Merge remote-tracking branch 'origin/6.x' into collaboration-addon-support

Author: jasonvarga

.gitignore

@@ -17,4 +17,5 @@ composer.lock
 .env
 bundle-stats.html
 .claude/settings.local.json
+polyscope.json
 storybook-static

.storybook/main.ts

@@ -25,6 +25,10 @@ const config: StorybookConfig = {
                 '@api': resolve(process.cwd(), 'resources/js/api.js'),
             };
         }
+        config.build = {
+            ...config.build,
+            reportCompressedSize: false,
+        };
         return config;
     },
 };

CHANGELOG.md

@@ -1,5 +1,87 @@
 # Release Notes
 
+## 6.12.0 (2026-04-08)
+
+### What's new
+- Add support for filtering conditions in Assets Tag [#13936](https://github.com/statamic/cms/issues/13936) by @jackmcdade
+
+### What's fixed
+- Add padding around 2FA QR code for dark mode scanning [#14460](https://github.com/statamic/cms/issues/14460) by @duncanmcclean
+- Fix form submissions with non-UTF-8 data crashing the CP listing [#14461](https://github.com/statamic/cms/issues/14461) by @duncanmcclean
+- Remove deprecated function calls [#14457](https://github.com/statamic/cms/issues/14457) by @justindantzer
+- Upgrade to Vite 8 [#14459](https://github.com/statamic/cms/issues/14459) by @jasonvarga
+- Nested fields should respect read-only state [#14351](https://github.com/statamic/cms/issues/14351) by @duncanmcclean
+
+
+
+## 6.11.0 (2026-04-07)
+
+### What's new
+- Add support for public properties to PathDataManager [#11697](https://github.com/statamic/cms/issues/11697) by @marcorieser
+- Add ability to filter submission exports [#14432](https://github.com/statamic/cms/issues/14432) by @jasonvarga
+- Add elevated session guards to AssignGroups and AssignRoles actions [#14450](https://github.com/statamic/cms/issues/14450) by @jasonvarga
+
+### What's fixed
+- Fix Stache index re-entrancy causing null URIs on cold stache [#14181](https://github.com/statamic/cms/issues/14181) by @o1y
+- Fix form submission types [#14430](https://github.com/statamic/cms/issues/14430) by @daun
+- Support decimal values in Range fieldtype [#13096](https://github.com/statamic/cms/issues/13096) by @hastinbe
+- Add `link` tag to allowed Antlers tags [#14438](https://github.com/statamic/cms/issues/14438) by @edalzell
+- Add `@default` support to Antlers content allowlists [#14440](https://github.com/statamic/cms/issues/14440) by @jasonvarga
+- Centralize SVG sanitization and sanitize CSS in style tags [#14442](https://github.com/statamic/cms/issues/14442) by @jasonvarga
+- Fix serializable_classes issues [#14443](https://github.com/statamic/cms/issues/14443) by @jasonvarga
+- Fix addon settings always showing as migratable [#14444](https://github.com/statamic/cms/issues/14444) by @duncanmcclean
+- Fix creating passkeys with JSON session serialization [#14448](https://github.com/statamic/cms/issues/14448) by @duncanmcclean
+- Stop auto-logging in users after password reset [#14454](https://github.com/statamic/cms/issues/14454) by @jasonvarga
+- Fix sync/desync on localizable nested fields [#14335](https://github.com/statamic/cms/issues/14335) by @duncanmcclean
+- French translations [#14431](https://github.com/statamic/cms/issues/14431) by @ebeauchamps
+- Bump defu from 6.1.4 to 6.1.6 [#14434](https://github.com/statamic/cms/issues/14434) by @dependabot
+- Bump vite from 7.1.12 to 7.3.2 [#14441](https://github.com/statamic/cms/issues/14441) by @dependabot
+
+
+
+## 6.10.0 (2026-04-02)
+
+### What's new
+- Default values can be computed [#14279](https://github.com/statamic/cms/issues/14279) by @edalzell
+- Ability to add to the filename replacements list [#14316](https://github.com/statamic/cms/issues/14316) by @edalzell
+
+### What's fixed
+- Harden OrderBys [#14421](https://github.com/statamic/cms/issues/14421) by @jasonvarga
+- Serialize nocache regions before storing in cache [#14422](https://github.com/statamic/cms/issues/14422) by @jasonvarga
+- Fix invalid HTML `lang` attribute [#14427](https://github.com/statamic/cms/issues/14427) by @duncanmcclean
+- Add serializable classes to allowlist [#14416](https://github.com/statamic/cms/issues/14416) by @duncanmcclean
+- Filter invalid UTF-8 locales from dictionary [#14426](https://github.com/statamic/cms/issues/14426) by @duncanmcclean
+- Fallback to option key in listings when label is missing [#14429](https://github.com/statamic/cms/issues/14429) by @duncanmcclean
+- Ensure moved/removed entries are statically invalidated [#14386](https://github.com/statamic/cms/issues/14386) by @ryanmitchell
+- Catch axios errors in blueprint builder [#14428](https://github.com/statamic/cms/issues/14428) by @duncanmcclean
+- Improve error handling when requiring starter kits [#14411](https://github.com/statamic/cms/issues/14411) by @duncanmcclean
+- Ensure empty addon settings get default blueprint values [#14384](https://github.com/statamic/cms/issues/14384) by @ryanmitchell
+- Bump lodash-es from 4.17.23 to 4.18.1 [#14425](https://github.com/statamic/cms/issues/14425) by @dependabot
+
+
+
+## 6.9.0 (2026-04-01)
+
+### What's new
+- Add a Text component [#14247](https://github.com/statamic/cms/issues/14247) by @jaygeorge
+- Emit `asset.saved` event from asset editor [#14392](https://github.com/statamic/cms/issues/14392) by @duncanmcclean
+
+### What's fixed
+- Fix collection whereStatus logic [#14380](https://github.com/statamic/cms/issues/14380) by @jackmcdade
+- Implement whereStatus() on search query builder [#14387](https://github.com/statamic/cms/issues/14387) by @ryanmitchell
+- Blueprint button order changes [#14365](https://github.com/statamic/cms/issues/14365) by @jaygeorge
+- Fix address bar overlapping bottom of content (typically on iOS) [#14399](https://github.com/statamic/cms/issues/14399) by @jaygeorge
+- Fix nested Bard toolbar focus issues [#14396](https://github.com/statamic/cms/issues/14396) by @jaygeorge
+- Fix nav section border radius [#14409](https://github.com/statamic/cms/issues/14409) by @jaygeorge
+- Fix conditional field borders [#14407](https://github.com/statamic/cms/issues/14407) by @thomasvantuycom
+- Fix collection listing dates from wrapping [#14415](https://github.com/statamic/cms/issues/14415) by @jaygeorge
+- Fix Parameters make method [#14418](https://github.com/statamic/cms/issues/14418) by @jasonvarga
+- Prevent npm packages from executing malicious code via `postinstall` [#14417](https://github.com/statamic/cms/issues/14417) by @duncanmcclean
+- French translations [#14393](https://github.com/statamic/cms/issues/14393) by @ebeauchamps
+- Bump brace-expansion from 2.0.2 to 2.0.3 [#14383](https://github.com/statamic/cms/issues/14383) by @dependabot
+
+
+
 ## 6.8.0 (2026-03-27)
 
 ### What's new

config/antlers.php

@@ -57,4 +57,25 @@
 
     ],
 
+    /*
+    |--------------------------------------------------------------------------
+    | User content allowlists
+    |--------------------------------------------------------------------------
+    |
+    | These control which tags and modifiers will be permitted in user-supplied
+    | Antlers (e.g. fields with `antlers: true`). Include the literal string
+    | `@default` in the array to merge Statamic's defaults with your own.
+    |
+    */
+
+    // 'allowedContentTags' => [
+    //     '@default',
+    //     'foo:*',
+    // ],
+
+    // 'allowedContentModifiers' => [
+    //     '@default',
+    //     'foo'
+    // ],
+
 ];

config/assets.php

@@ -207,6 +207,19 @@
 
     'additional_uploadable_extensions' => [],
 
+    /*
+    |--------------------------------------------------------------------------
+    | Additional Filename Character Replacements
+    |--------------------------------------------------------------------------
+    |
+    | When uploading files, certain characters in filenames will be replaced
+    | to ensure a safe filename. You may configure additional replacements.
+    | These are in addition to the native ones. They are not overridable.
+    |
+    */
+
+    'additional_filename_replacements' => [],
+
     /*
     |--------------------------------------------------------------------------
     | SVG Sanitization

lang/ar.json

@@ -99,6 +99,7 @@
     "Application Cache": "ذاكرة تخزين التطبيق",
     "Application cache cleared.": "تم مسح ذاكرة تخزين التطبيق.",
     "Apply": "تطبيق",
+    "Save All": "حفظ الكل",
     "Apply Link": "تطبيق الرابط",
     "Are you sure you want to delete this column?": "هل أنت متأكد أنك تريد حذف هذا العمود؟",
     "Are you sure you want to delete this entry?": "هل أنت متأكد أنك تريد حذف هذا الإدخال؟",

lang/az.json

@@ -99,6 +99,7 @@
     "Application Cache": "Tətbiqi Program Keşi",
     "Application cache cleared.": "Tətbiq Program keşi təmizləndi.",
     "Apply": "Tətbiq et",
+    "Save All": "Hamısını yadda saxla",
     "Apply Link": "Keçidi tətbiq et",
     "Are you sure you want to delete this column?": "Bu sütunu silmək istədiyinizə əminsinizmi?",
     "Are you sure you want to delete this entry?": "Bu girişi silmək istədiyinizə əminsinizmi?",

lang/cs.json

@@ -99,6 +99,7 @@
     "Application Cache": "Mezipaměť aplikace",
     "Application cache cleared.": "Mezipaměť aplikace vymazána.",
     "Apply": "Použít",
+    "Save All": "Uložit vše",
     "Apply Link": "Použít odkaz",
     "Are you sure you want to delete this column?": "Opravdu chcete smazat tento sloupec?",
     "Are you sure you want to delete this entry?": "Opravdu chcete smazat tento záznam?",

lang/da.json

@@ -99,6 +99,7 @@
     "Application Cache": "Applikationscache",
     "Application cache cleared.": "Applikationscache ryddet.",
     "Apply": "Anvende",
+    "Save All": "Gem alle",
     "Apply Link": "Anvend link",
     "Are you sure you want to delete this column?": "Er du sikker på, at du vil slette denne kolonne?",
     "Are you sure you want to delete this entry?": "Er du sikker på, at du vil slette denne?",

lang/de.json

@@ -109,6 +109,7 @@
     "Apply": "Übernehmen",
     "Apply & Close All": "Übernehmen & alle schließen",
     "Apply & Save": "Übernehmen & Speichern",
+    "Save All": "Alle speichern",
     "Apply Link": "Link übernehmen",
     "Apply Query Scopes": "Query-Scopes anwenden",
     "Archive": "Archiv",