Bump craftcms/cms from 5.8.15 to 5.9.9

[dependabot]

Bumps craftcms/cms from 5.8.15 to 5.9.9.

Release notes

Sourced from craftcms/cms's releases.

5.9.9

[!WARNING]
Relational condition rules’ element ID templates are now rendered in a sandboxed Twig environment, when enableTwigSandbox is enabled.

• Added craft\helpers\ElementHelper::cleanseQueryCriteria().
• Fixed an error that could occur when editing an element with a Table field. (#18408)
• Fixed an error that occurred when editing a Table field with no default rows. (#18407)
• Fixed a high-severity RCE vulnerability. (GHSA-fp5j-j7j4-mcxc)
• Fixed a high-severity SQL injection vulnerability. (GHSA-g7j6-fmwx-7vp8)

5.9.8

• Element edit pages no longer redirect to their referral URL on save. (#18404)
• Fixed a bug where the Entries index page could trigger an infinite browser redirect loop. (#18400)
• Fixed a styling issue with slideouts within Live Preview. (#18383)

5.9.7

• Nested entries’ edit screens now have a “Field settings” action menu item.
• GraphQL API requests no longer get cache response headers; only no-cache headers, and only if the request had a X-Craft-Gql-Cache: no-cache header, or if the request contained any mutations. (#18348)
• Legacy entry index URLs now redirect content/<page-name>.
• The create() Twig function now allows craft\helpers\ classes to be created. (#18376)
• yii\base\Event is now allowed in its entirety within sandboxed Twig environments.
• Added craft\helpers\ElementHelper::elementRevisionsUrl().
• Fixed a bug where Dashboard columns weren’t getting refreshed when the window was resized. (#18389)
• Fixed a bug where craft\web\View::renderSandboxedObjectTemplate() and renderSandboxedString() weren’t properly sandboxing templates rendered from the control panel.
• Fixed a bug where element queries with draftOf set to false were omitting canonical elements that were duplicated for an owner draft.
• Fixed a bug where newly-created nested elements were being fully duplicated to other drafts, rather than just their ownership data.
• Fixed a bug where ancestor elements’ breadcrumbs weren’t getting hyperlinked. (#18375)
• Fixed a bug where craft\models\Volume::getSubpath() could return / instead of an empty string, if the subpath was set to an environment variable set to an empty string. (#18379)
• Fixed a bug where it wasn’t possible to set assets’ alt text via GraphQL mutations. (#18381)
• Fixed a bug where dragging a field from a field layout designer’s “Add” HUD, and then dropping it back on itself, would result in the field getting selected in a hidden state. (#18382)
• Fixed a bug where custom entry index pages were getting included in the global nav, even if they only contained sources that weren’t available to the current user. (#18391)
• Fixed an error that occurred when creating a new element on multi-site installs, if its field layout contained any generated fields. (#18393)
• Fixed a bug where pressing Return on a textarea when bulk-editing elements would submit the changes.
• Fixed a bug where it wasn’t possible to save an entry with a pre-selected author that is no longer allowed to author entries for the section. (#18397)
• Fixed a bug where the “View all revisions” button wasn’t working for nested entries. (#18398)
• Fixed a low-severity XSS vulnerability. (GHSA-fvwq-45qv-xvhv)
• Fixed a low-severity information disclosure vulnerability. (GHSA-vg3j-hpm9-8v5v)

5.9.6

• It’s now possible to set elements’ Thumbnail Source to a field nested within a Content Block field. (#18365)
• Elements within embedded element indexes are now hyperlinked by default. (#17080)
• Added craft\db\mysql\Schema::getRowFormat().
• Added craft\db\mysql\Schema::setRowFormat().
• Added craft\fieldlayoutelements\BaseField::getThumbOptions().
• Added craft\helpers\Cp::cardThumbOptions().
• Added craft\models\FieldLayout::getThumbHtmlForElement().
• Added craft\models\FieldLayout::hasThumbField().
• Deprecated craft\models\FieldLayout::getThumbField(). hasThumbField() or getThumbHtmlForElement() should be used instead.
• Fixed a bug where nested entries within Matrix fields weren’t showing their UI labels if they didn’t have titles.
• Fixed a bug where assets weren’t getting hyperlinked on the Assets index page in thumbnail view.

... (truncated)

Changelog

Sourced from craftcms/cms's changelog.

5.9.9 - 2026-02-11

[!WARNING]
Relational condition rules’ element ID templates are now rendered in a sandboxed Twig environment, when enableTwigSandbox is enabled.

• Added craft\helpers\ElementHelper::cleanseQueryCriteria().
• Fixed an error that could occur when editing an element with a Table field. (#18408)
• Fixed an error that occurred when editing a Table field with no default rows. (#18407)
• Fixed a high-severity RCE vulnerability. (GHSA-fp5j-j7j4-mcxc)
• Fixed a high-severity SQL injection vulnerability. (GHSA-g7j6-fmwx-7vp8)

5.9.8 - 2026-02-10

• Element edit pages no longer redirect to their referral URL on save. (#18404)
• Fixed a bug where the Entries index page could trigger an infinite browser redirect loop. (#18400)
• Fixed a styling issue with slideouts within Live Preview. (#18383)

5.9.7 - 2026-02-09

• Nested entries’ edit screens now have a “Field settings” action menu item.
• GraphQL API requests no longer get cache response headers; only no-cache headers, and only if the request had a X-Craft-Gql-Cache: no-cache header, or if the request contained any mutations. (#18348)
• Legacy entry index URLs now redirect content/<page-name>.
• The create() Twig function now allows craft\helpers\ classes to be created. (#18376)
• yii\base\Event is now allowed in its entirety within sandboxed Twig environments.
• Added craft\helpers\ElementHelper::elementRevisionsUrl().
• Fixed a bug where Dashboard columns weren’t getting refreshed when the window was resized. (#18389)
• Fixed a bug where craft\web\View::renderSandboxedObjectTemplate() and renderSandboxedString() weren’t properly sandboxing templates rendered from the control panel.
• Fixed a bug where element queries with draftOf set to false were omitting canonical elements that were duplicated for an owner draft.
• Fixed a bug where newly-created nested elements were being fully duplicated to other drafts, rather than just their ownership data.
• Fixed a bug where ancestor elements’ breadcrumbs weren’t getting hyperlinked. (#18375)
• Fixed a bug where craft\models\Volume::getSubpath() could return / instead of an empty string, if the subpath was set to an environment variable set to an empty string. (#18379)
• Fixed a bug where it wasn’t possible to set assets’ alt text via GraphQL mutations. (#18381)
• Fixed a bug where dragging a field from a field layout designer’s “Add” HUD, and then dropping it back on itself, would result in the field getting selected in a hidden state. (#18382)
• Fixed a bug where custom entry index pages were getting included in the global nav, even if they only contained sources that weren’t available to the current user. (#18391)
• Fixed an error that occurred when creating a new element on multi-site installs, if its field layout contained any generated fields. (#18393)
• Fixed a bug where pressing Return on a textarea when bulk-editing elements would submit the changes.
• Fixed a bug where it wasn’t possible to save an entry with a pre-selected author that is no longer allowed to author entries for the section. (#18397)
• Fixed a bug where the “View all revisions” button wasn’t working for nested entries. (#18398)
• Fixed a low-severity XSS vulnerability. (GHSA-fvwq-45qv-xvhv)
• Fixed a low-severity information disclosure vulnerability. (GHSA-vg3j-hpm9-8v5v)

5.9.6 - 2026-02-03

• It’s now possible to set elements’ Thumbnail Source to a field nested within a Content Block field. (#18365)
• Elements within embedded element indexes are now hyperlinked by default. (#17080)
• Added craft\db\mysql\Schema::getRowFormat().
• Added craft\db\mysql\Schema::setRowFormat().
• Added craft\fieldlayoutelements\BaseField::getThumbOptions().
• Added craft\helpers\Cp::cardThumbOptions().
• Added craft\models\FieldLayout::getThumbHtmlForElement().

... (truncated)

Commits

• 74eb5d3 Finish 5.9.9
• 070bfe7 Merge branch '4.x' of https://github.com/craftcms/cms into 5.x
• 5020fa5 Finish 4.17.4
• e1a3dd6 Fixed GHSA-g7j6-fmwx-7vp8
• 32a54bd Merge branch '4.x' of https://github.com/craftcms/cms into 5.x
• 79505a8 ElementHelper::cleanseQueryCriteria()
• e1c226e Allow passing helpers classes to create()
• 0915e0a Merge pull request #18409 from craftcms/bugfix/18407-table-field-no-default-rows
• 0f2ad2f Release note
• 2530ac2 Merge branch '5.x' into bugfix/18407-table-field-no-default-rows
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Superseded by #95.