Bump craftcms/cms from 5.9.18 to 5.10.10

[dependabot]

Bumps craftcms/cms from 5.9.18 to 5.10.10.

Release notes

Sourced from craftcms/cms's releases.

5.10.10

• Updated web-auth/webauthn-lib to 5.3. (#19226)
• Fixed an error that could occur when running CLI commands. (#19030)

5.10.9

• Added craft\services\Security::isRestrictedDir(). (#19179)
• craft\helpers\Image::imageSizeByStream() now supports WebP, AVIF, and HEIC/HEIF images. (#19189)
• craft\services\Sites::getGroupById() now has a $withTrashed argument.
• Fixed a bug where the site/siteId params weren’t being respected on eager-loaded localized queries. (#18588)
• Fixed a bug where it wasn’t possible to enter decimal values after tabbing into a Money field. (#19156)
• Fixed a bug where the search inputs on the Entry Types and Fields settings index pages were case-sensitive on PostgreSQL. (#19158)
• Fixed a bug where timepicker menus weren’t auto-scrolling to the selected time when opened. (#19142)
• Fixed an error that could occur when reassigning entries to a new author when deleting a user. (#19154)
• Fixed a bug where the “All entries” and “All users” sources weren’t available to be selected within Entries/Users field settings. (#19185)
• Fixed a bug where database backups weren’t using the --single-transaction flag on MariaDB. (#19191)
• Fixed a bug where element indexes could show multiple table columns for the same nested fields within Content Block fields. (#19197)
• Fixed a PHP error that could occur when merging canonical changes into a draft that contained nested elements. (#19187)
• Fixed an error that could occur when applying project config changes, if a site group was deleted. (#19076)
• Fixed an error that could occur when nested Matrix entries were copied. (#19195)
• Fixed a bug where project config YAML files could include component name comments with trailing whitespace. (#19198)
• Fixed a low-severity information disclosure vulnerability.
• Fixed a low-severity cache poisoning vulnerability.

5.10.8.1

• Fixed an error that occurred when saving an existing asset. (#19152)

5.10.8

• Fixed a bug where element thumbnails could have inconsistent rounded corners. (#19117)
• Fixed a bug where video file uploads could cause a timeout or exhaust the memory limit. (#19131)
• Fixed an error that occurred if a custom source had a condition rule that referenced a field instance that no longer existed. (#19132)
• Fixed a bug where the relation deletion blocker’s messages weren’t always properly capitalized. (#19133)
• Fixed a bug where the “Delete” button within element deletion blocker modals wasn’t getting translated properly. (#19134)
• Fixed a bug where the previewTokenDuration config setting was defaulting to 1 day, rather than to the defaultTokenDuration value. (#18550)
• Fixed a bug where nested elements weren’t showing validation errors. (#19147)
• Fixed a bug where error summaries weren’t properly linking to their corresponding fields’ error lists. (#19147)
• Fixed a low-severity XSS vulnerability.
• Fixed a high-severity authorization bypass vulnerability.

5.10.7

• Added craft\web\twig\AllowableInSandbox.
• Fixed a bug where craft\helpers\App::parseEnv() wasn’t resolving aliases for environment variables that referenced an alias (e.g. @root/storage/rebrand). (#19108)
• Fixed a bug where the “Parent” field on Structure entries’ edit pages wasn’t showing the parent entry if it didn’t exist for the same site being edited, causing the parent relationship to be lost on save. (#19110)
• Fixed a high-severity RCE vulnerability.

5.10.6

• Forward slashes in query strings are now encoded. (#19057)
• Added craft\controllers\EVENT_BEFORE_SAVE_IMAGE. (#19068)
• Added craft\events\SaveAssetImageEvent. (#19068)
• Added craft\web\Request::getPreviewParam().
• Updated Axios to 1.17.0. (#19053)

... (truncated)

Changelog

Sourced from craftcms/cms's changelog.

5.10.10 - 2026-07-08

• Updated web-auth/webauthn-lib to 5.3. (#19226)
• Fixed an error that could occur when running CLI commands. (#19030)

5.10.9 - 2026-07-03

• Added craft\services\Security::isRestrictedDir(). (#19179)
• craft\helpers\Image::imageSizeByStream() now supports WebP, AVIF, and HEIC/HEIF images. (#19189)
• craft\services\Sites::getGroupById() now has a $withTrashed argument.
• Fixed a bug where the site/siteId params weren’t being respected on eager-loaded localized queries. (#18588)
• Fixed a bug where it wasn’t possible to enter decimal values after tabbing into a Money field. (#19156)
• Fixed a bug where the search inputs on the Entry Types and Fields settings index pages were case-sensitive on PostgreSQL. (#19158)
• Fixed a bug where timepicker menus weren’t auto-scrolling to the selected time when opened. (#19142)
• Fixed an error that could occur when reassigning entries to a new author when deleting a user. (#19154)
• Fixed a bug where the “All entries” and “All users” sources weren’t available to be selected within Entries/Users field settings. (#19185)
• Fixed a bug where database backups weren’t using the --single-transaction flag on MariaDB. (#19191)
• Fixed a bug where element indexes could show multiple table columns for the same nested fields within Content Block fields. (#19197)
• Fixed a PHP error that could occur when merging canonical changes into a draft that contained nested elements. (#19187)
• Fixed an error that could occur when applying project config changes, if a site group was deleted. (#19076)
• Fixed an error that could occur when nested Matrix entries were copied. (#19195)
• Fixed a bug where project config YAML files could include component name comments with trailing whitespace. (#19198)
• Fixed a low-severity information disclosure vulnerability.
• Fixed a low-severity cache poisoning vulnerability.

5.10.8.1 - 2026-06-23

• Fixed an error that occurred when saving an existing asset. (#19152)

5.10.8 - 2026-06-23

• Fixed a bug where element thumbnails could have inconsistent rounded corners. (#19117)
• Fixed a bug where video file uploads could cause a timeout or exhaust the memory limit. (#19131)
• Fixed an error that occurred if a custom source had a condition rule that referenced a field instance that no longer existed. (#19132)
• Fixed a bug where the relation deletion blocker’s messages weren’t always properly capitalized. (#19133)
• Fixed a bug where the “Delete” button within element deletion blocker modals wasn’t getting translated properly. (#19134)
• Fixed a bug where the previewTokenDuration config setting was defaulting to 1 day, rather than to the defaultTokenDuration value. (#18550)
• Fixed a bug where nested elements weren’t showing validation errors. (#19147)
• Fixed a bug where error summaries weren’t properly linking to their corresponding fields’ error lists. (#19147)
• Fixed a high-severity XSS vulnerability.
• Fixed a high-severity authorization bypass vulnerability.

5.10.7 - 2026-06-17

• Added craft\web\twig\AllowableInSandbox.
• Fixed a bug where craft\helpers\App::parseEnv() wasn’t resolving aliases for environment variables that referenced an alias (e.g. @root/storage/rebrand). (#19108)
• Fixed a bug where the “Parent” field on Structure entries’ edit pages wasn’t showing the parent entry if it didn’t exist for the same site being edited, causing the parent relationship to be lost on save. (#19110)
• Fixed a high-severity RCE vulnerability.

5.10.6 - 2026-06-16

... (truncated)

Commits

• d4c5f81 Finish 5.10.10
• 1249ace Updated webauthn-lib to 5.3
• dc2a339 Fixed #19030
• 7640873 Finish 5.10.9
• b160605 Merge branch '5.x-internal' into 5.x
• 56cef4c Merge branch '4.x' of https://github.com/craftcms/cms into 5.x
• ae46e09 Finish 4.18.4
• 3a88a4d Fixed a cache poisoning vulnerability
• 8005d40 Merge branch '5.x' into 5.x-internal
• de915f6 Merge branch 'bugfix/project-config-name-comment-trailing-whitespace' into 5.x
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.