Bump craftcms/cms from 5.4.4 to 5.8.22

[dependabot]

Bumps craftcms/cms from 5.4.4 to 5.8.22.

Release notes

Sourced from craftcms/cms's releases.

5.8.22

• Improved keyboard control for Money fields. (#18198, #18212)
• User queries now always return active, non-pending users first, unless otherwise specified by orderBy. (#18148)
• The utils/fix-field-layout-uids command now checks for duplicate top-level field layout UUIDs. (#18193)
• Fixed a bug where all plugin settings were being saved to the project config, rather than just posted settings. (craftcms/commerce#4006)
• Fixed a bug where custom selects could be positioned incorrectly after the window was resized. (#18179)
• Fixed an error that could occur when logging a deprecation warning, if the backtrace contained any non-UTF-8-encoded strings. (#18218)
• Fixed a bug where it wasn’t possible to view assets if they had exactly 50 subfolders alongside them. (#18213)
• Fixed a bug where Matrix fields’ Entry Types settings were partially interactive when admin changes were disallowed. (#18145)
• Fixed a bug where users could be unable to sign in if an inactive user account existed with the same email address. (#18148)
• Fixed a bug where Content Block fields could appear to be missing their content when viewing a revision. (#18149)
• Fixed a bug where Dropdown and Radio Button fields weren’t handling :empty:/:notempty: element query params properly for options with blank values. (#18156)
• Fixed a bug where chip icons were getting rounded. (#18163)
• Fixed a bug where object templates that included another template were missing variables. (#18165)
• Fixed a JavaScript error that could occur if two control panel animations were triggered simultaneously.
• Fixed a bug where it wasn’t possible to copy/paste nested entries within Matrix fields set to the inline-editable blocks view mode, for unpublished owner elements. (#18185)
• Fixed a bug where custom fields’ checkboxes weren’t getting removed from field layouts’ “Card Attributes” lists when removed from the layout.
• Fixed a bug where consecutive hyphens (-) within Link fields’ “Class Name” values were getting removed. (#18201)
• Fixed an error that could occur when saving a recursively-nested element. (#18164)
• Fixed a bug where element indexes could show muliple table columns for the same field/label/handle combinations. (#18209)
• Fixed a bug where element indexes’ “View” menus could list some custom fields under “Attributes”. (#18221)
• Fixed SSRF vulnerabilities. (GHSA-96pq-hxpw-rgh8, GHSA-m5r2-8p9x-hp5m, GHSA-8jr8-7hr4-vhfx)
• Fixed an XSS vulnerability. (GHSA-7pr4-wx9w-mqwr)
• Fixed a SQL injection vulnerability. (GHSA-2453-mppf-46cj)
• Fixed an XSS vulnerability. (GHSA-9f5h-mmq6-2x78)
• Fixed a permission escalation vulnerability. (GHSA-fxp3-g6gw-4r4v)
• Fixed an RCE vulnerability. (GHSA-7jx7-3846-m7w7)

5.8.21

• Improved the performance of saving nested elements on multi-site installs with a custom propagation method. (#18126)
• Fixed a bug where remove buttons within multi-select Selectize inputs weren’t working if the input wasn’t focusend and fully in view. (#18079)
• Fixed an error that could occur when executing a GraphQL mutation when the lazyGqlTypes config setting was enabled. (#18014)
• Fixed a PHP error that could occur when creating a username that began or ended with an @. (#18123)
• Fixed a bug where assets with disallowed file extensions could be stored in the system’s temp directory. (#18049)
• Fixed a bug where font icons weren’t hidden from screen readers. (#18078)
• Fixed a bug where relation fields weren’t handling :empty:/:notempty: element query params properly if the field had multiple instances within a field layout. (#18092)
• Fixed a bug where user preferences were being respected for users who formerly had access to the control panel.
• Fixed a bug where nested entries could be reordered when their owner element was resaved programmatically. (#18121)
• Fixed RCE vulnerabilities. (GHSA-255j-qw47-wjh5, GHSA-742x-x762-7383)
• Fixed an SSRF vulnerability. (GHSA-x27p-wfqw-hfcc)
• Fixed a DoS vulnerability. (GHSA-v64r-7wg9-23pr)
• Fixed an information disclosure vulnerability. (GHSA-53vf-c43h-j2x9)

5.8.20

• Plugin licenses are now assigned immediately when installed via the plugin/install command. (#17871)
• Improved drag-n-drop performance. (#18019)
• Fixed a bug where assets with disallowed file extensions could still be uploaded to the system’s temp directory. (#18015)
• Fixed an error that could occur when an array was passed to an asset query’s folderPath param. (#18056)
• Fixed a bug where the Live Preview drag bar wasn’t easily draggable when a nested slideout was open. (#17781)
• Fixed a bug where nested slideouts within Live Preview weren’t getting resized when the window was resized.

... (truncated)

Changelog

Sourced from craftcms/cms's changelog.

5.8.22 - 2026-01-09

• Improved keyboard control for Money fields. (#18198, #18212)
• User queries now always return active, non-pending users first, unless otherwise specified by orderBy. (#18148)
• The utils/fix-field-layout-uids command now checks for duplicate top-level field layout UUIDs. (#18193)
• Fixed a bug where all plugin settings were being saved to the project config, rather than just posted settings. (craftcms/commerce#4006)
• Fixed a bug where custom selects could be positioned incorrectly after the window was resized. (#18179)
• Fixed an error that could occur when logging a deprecation warning, if the backtrace contained any non-UTF-8-encoded strings. (#18218)
• Fixed a bug where it wasn’t possible to view assets if they had exactly 50 subfolders alongside them. (#18213) <<<<<<< HEAD
• Fixed a bug where Matrix fields’ Entry Types settings were partially interactive when admin changes were disallowed. (#18145)
• Fixed a bug where users could be unable to sign in if an inactive user account existed with the same email address. (#18148)
• Fixed a bug where Content Block fields could appear to be missing their content when viewing a revision. (#18149)
• Fixed a bug where Dropdown and Radio Button fields weren’t handling :empty:/:notempty: element query params properly for options with blank values. (#18156)
• Fixed a bug where chip icons were getting rounded. (#18163)
• Fixed a bug where object templates that included another template were missing variables. (#18165)
• Fixed a JavaScript error that could occur if two control panel animations were triggered simultaneously.
• Fixed a bug where it wasn’t possible to copy/paste nested entries within Matrix fields set to the inline-editable blocks view mode, for unpublished owner elements. (#18185)
• Fixed a bug where custom fields’ checkboxes weren’t getting removed from field layouts’ “Card Attributes” lists when removed from the layout.
• Fixed a bug where consecutive hyphens (-) within Link fields’ “Class Name” values were getting removed. (#18201)
• Fixed an error that could occur when saving a recursively-nested element. (#18164)
• Fixed a bug where element indexes could show muliple table columns for the same field/label/handle combinations. (#18209)
• Fixed a bug where element indexes’ “View” menus could list some custom fields under “Attributes”. (#18221)
• Fixed moderate-severity SSRF vulnerabilities. (GHSA-96pq-hxpw-rgh8, GHSA-m5r2-8p9x-hp5m, GHSA-8jr8-7hr4-vhfx)
• Fixed a low-severity XSS vulnerability. (GHSA-7pr4-wx9w-mqwr)
• Fixed a high-severity SQL injection vulnerability. (GHSA-2453-mppf-46cj)
• Fixed a low-severity XSS vulnerability. (GHSA-9f5h-mmq6-2x78)
• Fixed a high-severity permission escalation vulnerability. (GHSA-fxp3-g6gw-4r4v)
• Fixed a moderate-severity RCE vulnerability. (GHSA-7jx7-3846-m7w7)

5.8.21 - 2025-12-04

• Improved the performance of saving nested elements on multi-site installs with a custom propagation method. (#18126)
• Fixed a bug where remove buttons within multi-select Selectize inputs weren’t working if the input wasn’t focusend and fully in view. (#18079)
• Fixed an error that could occur when executing a GraphQL mutation when the lazyGqlTypes config setting was enabled. (#18014)
• Fixed a PHP error that could occur when creating a username that began or ended with an @. (#18123)
• Fixed a bug where assets with disallowed file extensions could be stored in the system’s temp directory. (#18049)
• Fixed a bug where font icons weren’t hidden from screen readers. (#18078)
• Fixed a bug where relation fields weren’t handling :empty:/:notempty: element query params properly if the field had multiple instances within a field layout. (#18092)
• Fixed a bug where user preferences were being respected for users who formerly had access to the control panel.
• Fixed a bug where nested entries could be reordered when their owner element was resaved programmatically. (#18121)
• Fixed RCE vulnerabilities. (GHSA-255j-qw47-wjh5, GHSA-742x-x762-7383)
• Fixed an SSRF vulnerability. (GHSA-x27p-wfqw-hfcc)
• Fixed a DoS vulnerability. (GHSA-v64r-7wg9-23pr)
• Fixed an information disclosure vulnerability. (GHSA-53vf-c43h-j2x9)

5.8.20 - 2025-11-18

• Plugin licenses are now assigned immediately when installed via the plugin/install command. (#17871)
• Improved drag-n-drop performance. (#18019)

... (truncated)

Commits

• 8e23a7a Finish 5.8.22
• 8271efb Merge branch '4.x' of https://github.com/craftcms/cms into 5.x
• fc46694 Finish 4.16.18
• 6f4d70f Merge pull request #18212 from craftcms/bugfix/cms-18198-money-focus
• 0c02cdd Release note
• d41fa13 Merge branch '5.x' into bugfix/cms-18198-money-focus
• f64a924 Remove logs
• aa944e8 Build
• 8559ea2 Update mask on blur too
• ae97c56 Merge branch '4.x' of https://github.com/craftcms/cms into 5.x
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Superseded by #3.