Release Notes
Stay up to date with the latest Statamic changes.
To see what's in development, check out the roadmap.
5.74.3 Security
July 8th, 2026
What's fixed
- Escape submitted values in automagic email #14959 by @jasonvarga
- Tighten front-end form upload validation #14958 by @jasonvarga
5.74.2
July 3rd, 2026
5.74.1 Security
July 1st, 2026
What's fixed
- Tighten up dynamic method resolution #14911 by @jasonvarga
- Fix nav authorization checks #14906 by @jasonvarga
- Fix user wizard authorization check #14905 by @jasonvarga
- Fix failing Guzzle tests #14897 by @jasonvarga
- Fix OAuth #14887 by @jasonvarga
5.74.0 Security
June 8th, 2026
What's fixed
- Drop support for Laravel 10/11 #14793 by @jasonvarga
- Fix permission for Live Preview #14791 by @jasonvarga
5.73.24 Security
June 2nd, 2026
What's fixed
- Escape formula characters in form submission CSV exports #14760 by @jasonvarga
- Harden remote URL validation #14761 by @jasonvarga
- Fix Bard/Link Blink cache type collision #14739 by @simonerd
5.73.23 Security
May 22nd, 2026
What's fixed
- Harden
DataCollectionsort value resolution #14693 by @duncanmcclean - Fix token path traversal #14700 by @duncanmcclean
- Authorize relationship fieldtype data #14718 by @jasonvarga
- Fix asset fieldtype icon #14720 by @jasonvarga
5.73.22 Security
May 11th, 2026
What's fixed
- Harden remote URL validation #14645 by @jasonvarga
5.73.21 Security
April 27th, 2026
What's fixed
- Always show success when using forgot password form #14539 by @jasonvarga
5.73.20 Security
April 13th, 2026
What's fixed
- Harden query value resolution #14476 by @duncanmcclean
- Harden OrderBys #14474 by @duncanmcclean
- Remove negative assertions from
TestCase#14458 by @duncanmcclean
5.73.19
April 7th, 2026
5.73.18
April 2nd, 2026
What's fixed
- Harden OrderBys #14421 by @jasonvarga
5.73.17
March 25th, 2026
What's fixed
- Fix term revisions error #14347 by @duncanmcclean
5.73.16 Security
March 24th, 2026
What's fixed
- Fix config through Antlers views #14328 by @jasonvarga
- Sanitize password reset form redirect value #14327 by @jasonvarga
- Restrict markdown preview endpoint #14326 by @jasonvarga
- Add authorization to revision routes #14301 by @duncanmcclean
- Add CSP header to svg route #14325 by @jasonvarga
- Relationship fieldtype authorization tweaks #14307 by @duncanmcclean
- Allow external redirects from Form::getSubmissionRedirect #14318 by @jasonvarga
- Handle more cases in external url detection #14312 by @jasonvarga
- Fix live preview token scope #14304 by @jasonvarga
- Fix PHP sanitization edge cases #14300 by @duncanmcclean
5.73.15
March 18th, 2026
What's fixed
- Harden password reset #14296 by @jasonvarga
- Add additional
URL::isExternalToApplication()tests #14288 by @duncanmcclean
5.73.14 Security
March 17th, 2026
What's fixed
- Prevent term creation via fieldtype without permission #14274 by @duncanmcclean
- Prevent path traversal in file dictionary #14272 by @duncanmcclean
- Sanitize SVGs on asset reupload #14270 by @jasonvarga