Release Notes

What's new

• Add duration column to asset browser #13331 by @daun
• Search instructions when searching sets #13727 by @duncanmcclean
• Add "mod+s" shortcut to save blueprint order #13729 by @heidkaemper
• Add "mod+s" shortcut to save collection order #13724 by @duncanmcclean

What's fixed

• Improve the text fieldtype icon and the number icons #13713 by @JayGeorge
• Fix error when searching assets via the Command Palette #13718 by @duncanmcclean
• Fix "Icons" code example for buttons in Storybook #13719 by @duncanmcclean
• Bump tar from 7.5.6 to 7.5.7 #13721 by @dependabot
• Fix Invalid ISO 8601 date time string error from Date Fieldtype #13701 by Copilot
• Fix missing Live Preview componentUpdated function #13733 by @o1y
• After creating the assets folder, it keeps the last folder name #13722 by @nopticon
• Floating toolbar pointer improvements #13712 by @JayGeorge
• Fix adding sets to replicators nested inside Grid/Group fields #13723 by @duncanmcclean
• Use ResolveValues to resolve values in EloquentQueryBuilder::pluck() #13726 by @duncanmcclean

Read First

Be sure to read the Upgrade Guide first as manual changes may be necessary. You can also read the Statamic 6 Launch Announcement blog post to learn about many of the new features in depth!

What's new

• A completely redesigned Control Panel
• UI Component library
• Control Panel themes
• Vue 3
• Inertia.js
• Tailwind 4
• Command Palette
• Elevated sessions
• Two-factor authentication
• Passkeys
• Antlers component tag syntax
• Smart view scaffolding
• Addon settings
• Better date and timezone support
• Replicator/Bard sets can have image previews
• Laravel Boost Guidelines
• Publish form overhaul
• Collapsible publish form sections
• Publish form site locale-aware text direction
• Background Static Cache re-caching
• Collection calendar view
• Live Preview hot-reload
• REST API Authentication
• Improved JS and addon workflow
• Vue Composition API support in Fieldtypes

What's changed

• Dropped support for Laravel 11 and PHP 8.2.
• There are a number of breaking changes. Consult the 6.0 upgrade guide.

What's fixed

• Allow ueberdosis/tiptap-php ^2.1.2 #15620 by @jasonvarga

What's fixed

• Harden asset authorization #15196 by @duncanmcclean
• Harden impersonation action #15562 by @jasonvarga
• Tighten SVG sanitization #15583 by @jasonvarga
• Harden remote URL validation #15584 by @jasonvarga
• Tighten class based validation rules #15585 by @jasonvarga
• Harden user file paths #15593 by @jasonvarga

What's fixed

• Hash URL in static caching lock key #15061 by @david-windsock
• Tighten get modifier #15138 by @jasonvarga
• Harden SVG sanitization #15137 by @jasonvarga
• Tighten Antlers variable path resolution #15154 by @jasonvarga

What's fixed

• Escape submitted values in automagic email #14959 by @jasonvarga
• Tighten front-end form upload validation #14958 by @jasonvarga

What's fixed

• Fix roles/groups select being empty for non-super users #14889 by @mynetx

What's fixed

• Tighten up dynamic method resolution #14911 by @jasonvarga
• Fix nav authorization checks #14906 by @jasonvarga
• Fix user wizard authorization check #14905 by @jasonvarga
• Fix failing Guzzle tests #14897 by @jasonvarga
• Fix OAuth #14887 by @jasonvarga

What's fixed

• Drop support for Laravel 10/11 #14793 by @jasonvarga
• Fix permission for Live Preview #14791 by @jasonvarga

What's fixed

• Escape formula characters in form submission CSV exports #14760 by @jasonvarga
• Harden remote URL validation #14761 by @jasonvarga
• Fix Bard/Link Blink cache type collision #14739 by @simonerd

What's fixed

• Harden DataCollection sort value resolution #14693 by @duncanmcclean
• Fix token path traversal #14700 by @duncanmcclean
• Authorize relationship fieldtype data #14718 by @jasonvarga
• Fix asset fieldtype icon #14720 by @jasonvarga

What's fixed

• Harden remote URL validation #14645 by @jasonvarga

What's fixed

• Always show success when using forgot password form #14539 by @jasonvarga

What's fixed

• Harden query value resolution #14476 by @duncanmcclean
• Harden OrderBys #14474 by @duncanmcclean
• Remove negative assertions from TestCase #14458 by @duncanmcclean

What's fixed

• Add link tag to allowed Antlers tags #14438 by @edalzell
• Add @default support to Antlers content allowlists #14440 by @jasonvarga
• Fix Stache index re-entrancy causing null URIs on cold stache #14181 by @o1y
• Fix form submission types #14430 by @daun