New Features
- Enhanced Thumbnail Editor: Crop Controls, Live Preview, and Dialog Improvements (#13016) (thanks katalysis)
- Add an option to exclude system pages from the Remove Old Page Versions task (thanks digitmaster)
Behavioral Improvements
- Bug: Completed tasks can remain shown as running (#418) (thanks digitmaster)
- The Home Folder is not pre-selected when uploading files from blocks (#12794) (thanks broreece)
- Add date_public to the Page API transformer (#13125) (thanks broreece)
- Fixed: File dialogs throw a fatal error instead of "Invalid file" when
fID is empty or non-numeric (#13152) (thanks janscarton)
- Better breadcrumb support in the Dashboard Express pages (thanks mlocati)
- Persist Dashboard panel visibility preference (#12994) (thanks digitmaster)
Dashboard panel now will stay closed for much longer if the user manually closes it.
- Express Entry List block: check the classes when reading its settings back (#13237) (thanks mlocati)
- Config Key for Help System (#11669) (thanks aembler)
Bug Fixes
- Legacy Form block throws an error on submit (#13129) (thanks mlocati)
- [Fix] PHP 8 error in Add Workflow dashboard page caused by incorrect View::element argument order (#13119) (thanks biplobice)
- When there was a PHP_EXTENSION_ERROR while uploading a file, we would show the wrong error message. This is now fixed. (thanks darkdi)
- Bug: Dashboard page favorite icon stays gray in dark mode (thanks digitmaster)
- Fixed bug in REST API where block was updated twice (thanks mlocati)
- Fixed bug where programmatically updating the Google Maps block through code could clear the API key (thanks mlocati)
- Bug fixes in the image block when saving links using the REST API (thanks mlocati)
- Fixed bug where installing Concrete via composer was impossible with security auditing enabled, due to upstream dependencies (thanks mlocati)
- concretecms/monolog-cascade not compatible with symfony/config v6.4.44 (#13219) (thanks mlocati)
- Fixed bug where conversation max file size for registered users was set incorrectly (thanks mlocati)
- Many bug fixes to the Content Import Format (thanks mlocati)
- Many bug fixes in the REST API (thanks mlocati)
- Express Entry Detail block: don't preset an entry mode that doesn't exist (#13187) (thanks mlocati)
- Express Entry List block: fill the edit dialog even when the entity has no attributes (#13188) (thanks mlocati)
- Fix duplicate composer schedule dialogs by cleaning up on close. (#13190) (thanks broreece)
- Clarify Waiting For Me notification menu label and fix dropdown positioning (#13192) (thanks broreece)
- Fixed bug where copying a calendar event associated to a page and deleting the new event would delete the page, orphaning the original calendar event's page relation (thanks eastagiletracker)
- Fix the URL returned after renaming an Express search preset (#13214) (thanks mlocati)
- Fix stale search index when page attributes are deleted. (#13226) (thanks broreece)
- Allow clearing the skin of a page (#13225) (thanks mlocati)
- Prevent duplicate File Manager folder submissions (#13189) (thanks digitmaster)
- Fix deleting all keys in Cache/Driver/RedisStashDriver (#12966) (thanks mlocati)
- Page List set to "Everywhere" on the homepage shows no results after upgrading to 9.5.4. (#13232)
Security Updates
- CVE-2026-106551 (8.6) @bp0lr
Developer
- Improvements to new ConcreteFetch JS fetch library (thanks mlocati)
- Lots of code cleanup (thanks mlocati)
- Packages that define tasks no longer need to explicitly register their task controllers with the task manager. (thanks mlocati)
- Re-implemented many formerly skipped tests (thanks mlocati)
- Update composer dependencies (#13239) (thanks mlocati)