Country and Region Fieldtypes

Fixed

• RegionFieldtypeController and the countries_and_regions:regions tag split a comma-separated country list with no cap on how many entries it could contain and no format check before doing work. A single request with a very long comma list could force the server to loop once per entry, each iteration re-scanning the subdivision dataset — the 2.0.1 rate limiting only caps requests per minute, not the cost of any one request, so it didn't mitigate this. Added a shared ParsesCountryCodes trait (src/Traits/ParsesCountryCodes.php) that filters to well-formed ISO 3166-1 alpha-2 codes and caps the list to 10 entries before any lookup happens; both call sites now use it.
• The public countries_and_regions/{country}/regions web route and the CP countries/{country}/regions action routes shared a single rate-limit bucket keyed only by IP, so heavy front-end traffic could exhaust the budget and 429 CP editors behind the same IP/NAT. Split into two named limiters, kadegray_scarf.options.cp and kadegray_scarf.options.public, same 60/min-per-IP policy, registered independently.

Fixed

• statamic/cms was only ever declared under require-dev, never require, going all the way back to when it was constrained to ^3.3 — meaning Composer never actually enforced or advertised which Statamic version this addon supports for anyone installing it into their own site. Moved "statamic/cms": "^6.0" into require, so Composer now correctly refuses to install this addon into a pre-6 Statamic site instead of allowing a broken install.

Added

• Test coverage for the countries_and_regions Antlers tag (tests/Tags/CountriesAndRegionsTest.php), covering countries()/regions() directly plus one Antlers::parse() test proving the tag is actually registered and renders correctly through real Antlers parsing — previously untested.
• Test coverage in RegionFieldtypeControllerTest for the public countries_and_regions/{country}/regions web route (routes/web.php), verifying both its response shape and that the 2.0.1 rate limiting is actually wired up on this route specifically, not just the CP action-route equivalent.

Fixed

• CountryFieldtypeController/RegionFieldtypeController no longer mutate the process's global locale via putenv()/setlocale(). Both endpoints are public and unauthenticated, and since PHP-FPM/Octane workers are reused across requests, a single request previously left LC_ALL/LANGUAGE permanently changed for every unrelated request handled by that worker afterward. Both controllers now resolve locale-aware names through SymfonyTranslationDriver instead, matching the pattern already used by the countries_and_regions tag and the two fieldtype filters.

Added

• Rate limiting (60 requests/minute per IP) on the countries, {country}/regions, and countries_and_regions/{country}/regions endpoints, via a new kadegray_scarf.options named rate limiter registered in ServiceProvider.

Changed

• Ported the control panel frontend from Vue 2 / Laravel Mix (Statamic 3.x) to Vue 3 / Vite, using the @statamic/cms package and Combobox UI component, for compatibility with Statamic 6's rewritten control panel.
• ServiceProvider now registers CP assets via $vite instead of $scripts.

Added

• PHP unit test suite (tests/) covering each fieldtype's augment()/process()/defaultValue() behavior, config-driven branches (render_invalid_value, region_is_required), and the countries/regions HTTP endpoints, using Statamic's AddonTestCase.
• Playwright browser test suite (tests/browser/) driving a real control panel to verify each fieldtype renders, is interactive, and correctly implements countries_field/countries_manual linking, clearable, max_items, and placeholder.
• TESTING.md documenting how to run both suites.

Fixed

• region_in_country's augment() now actually honors region_is_required: when disabled, a country-only value augments to just the country name instead of being treated as invalid.

Added

• region_is_required config option on the region_in_country fieldtype. When disabled, selecting only a country (with no region yet chosen) is accepted as a valid value instead of requiring a full region code.

Fixed

• Renamed an internal regions ref to region in the region_in_country Vue component (it always held a single region, not a collection) and reworked its value-sync watchers, fixing cases where the country and region sub-fields could fall out of sync with the field's actual value.

Fixed

• region fieldtype: same ISO 3166-2 one-character subdivision code fix as 1.2.3, applied here too.