Bump craftcms/cms from 4.0.0.1 to 4.13.8

[dependabot]

Bumps craftcms/cms from 4.0.0.1 to 4.13.8.

Release notes

Sourced from craftcms/cms's releases.

4.13.8

• Fixed a bug where asset edit page URLs contained spaces if the asset filename contained spaces. (#15236)
• Fixed a bug where custom fields were getting included in rendered field layout forms, even if their getInputHtml() method returned an empty string.
• Fixed a bug where the password input on the Set Password page wasn’t including the “Show” button.
• Fixed a SQL error that could occur if an element was saved with a title longer than 255 characters.
• Fixed a bug where some UI messages began with a lowercase letter in some languages. (#16354)
• Fixed an RCE vulnerability.

4.13.7

• Fixed a bug where elements’ getPrev() and getNext() methods could cause duplicate queries. (#16329)
• Fixed a bug where assets that were shorter than the preview thumb container weren’t getting vertically centered within it.
• Fixed a bug where it was possible to set a focal point on SVGs, even though focal points on SVGs aren’t supported. (#16258)
• Fixed a bug where ancestors, children, descendants, and parent eager-loading wasn’t working for previewed elements. (#16327)

4.13.6

• Fixed a bug where blank user group descriptions weren’t getting omitted from project config data. (#16272)
• Fixed a bug where pressing Return when a color text input within an editable table was focused was submitting the form rather than moving focus to the next row.
• Fixed a JavaScript error that occurred on the Plugins index page, if there were any missing plugins associated with the Craft CMS license and no plugins were Composer-installed yet.

4.13.5

• Fixed a bug where asset, category, and entry sources defined by the EVENT_REGISTER_SOURCES event didn’t have any custom fields available to them, unless the EVENT_REGISTER_FIELD_LAYOUTS event was also used to define the available field layouts for the event-defined source. (#16256)

4.13.4

• Reduced the likelihood of a deadlock error occurring when updating search indexes. (#15221)
• The PHP Info utility is no longer shown in environments where the phpinfo() function is disabled. (#16229)
• Fixed an error that could occur when duplicating an element with an Assets field that had a dynamic subpath. (#16214)
• Fixed a bug where renaming asset folders could move them to the webroot on Windows. (#16215)
• Fixed a bug where Matrix fields’ content tables weren’t getting renamed properly when applying project config changes. (#16227)
• Fixed a bug where utilities’ isSelectable() methods weren’t being respected.
• Fixed an exception that could be thrown when displaying entry indexes, if any EVENT_INIT or EVENT_DEFINE_BEHAVIORS entry event handlers were calling getSection() or getType() on the entry. (#16254)

4.13.3

• Element indexes now sort by ID by default, for sources that don’t define a default sort option.
• Fixed a bug where element indexes were sorting by the first sortable attribute alphabetically by default, rather than the first sortable attribute defined by the element type.
• Fixed a bug where bulk asset actions where shown as available when subfolders were selected, when they shouldn’t have. (#16151)
• Fixed a bug where craft\events\ApplyFieldSaveEvent::$field wasn’t being set consistently by craft\services\Fields::EVENT_BEFORE_APPLY_FIELD_SAVE. (#16156)
• Fixed a bug where the address field layout’s project config data wasn’t getting recreated when running project-config/rebuild. (#16189)

4.13.2

• Fixed an error that could occur if an invalid folder ID was passed to craft\services\Assets::deleteFoldersByIds(). (#16147)
• Fixed an RCE vulnerability.

4.13.1.1

• Fixed a PHP error. (#16142)

4.13.1

• Fixed a JavaScript error that could occur on element edit pages. (#16055)
• Fixed a Twig deprecation error. (#16107)
• Fixed a bug where craft\services\Structures::fillGapsInElements() wasn’t working properly if the elements weren’t passed in hierarchical order. (#16085)
• Fixed an RCE vulnerability.

... (truncated)

Changelog

Sourced from craftcms/cms's changelog.

4.13.8 - 2025-01-02

• Fixed a bug where asset edit page URLs contained spaces if the asset filename contained spaces. (#15236)
• Fixed a bug where custom fields were getting included in rendered field layout forms, even if their getInputHtml() method returned an empty string.
• Fixed a bug where the password input on the Set Password page wasn’t including the “Show” button.
• Fixed a SQL error that could occur if an element was saved with a title longer than 255 characters.
• Fixed a bug where some UI messages began with a lowercase letter in some languages. (#16354)
• Fixed an RCE vulnerability.

4.13.7 - 2024-12-17

• Fixed a bug where elements’ getPrev() and getNext() methods could cause duplicate queries. (#16329)
• Fixed a bug where assets that were shorter than the preview thumb container weren’t getting vertically centered within it.
• Fixed a bug where it was possible to set a focal point on SVGs, even though focal points on SVGs aren’t supported. (#16258)
• Fixed a bug where ancestors, children, descendants, and parent eager-loading wasn’t working for previewed elements. (#16327)

4.13.6 - 2024-12-10

• Fixed a bug where blank user group descriptions weren’t getting omitted from project config data. (#16272)
• Fixed a bug where pressing Return when a color text input within an editable table was focused was submitting the form rather than moving focus to the next row.
• Fixed a JavaScript error that occurred on the Plugins index page, if there were any missing plugins associated with the Craft CMS license and no plugins were Composer-installed yet.

4.13.5 - 2024-12-03

• Fixed a bug where asset, category, and entry sources defined by the EVENT_REGISTER_SOURCES event didn’t have any custom fields available to them, unless the EVENT_REGISTER_FIELD_LAYOUTS event was also used to define the available field layouts for the event-defined source. (#16256)

4.13.4 - 2024-12-02

• Reduced the likelihood of a deadlock error occurring when updating search indexes. (#15221)
• The PHP Info utility is no longer shown in environments where the phpinfo() function is disabled. (#16229)
• Fixed an error that could occur when duplicating an element with an Assets field that had a dynamic subpath. (#16214)
• Fixed a bug where renaming asset folders could move them to the webroot on Windows. (#16215)
• Fixed a bug where Matrix fields’ content tables weren’t getting renamed properly when applying project config changes. (#16227)
• Fixed a bug where utilities’ isSelectable() methods weren’t being respected.
• Fixed an exception that could be thrown when displaying entry indexes, if any EVENT_INIT or EVENT_DEFINE_BEHAVIORS entry event handlers were calling getSection() or getType() on the entry. (#16254)

4.13.3 - 2024-11-22

• Element indexes now sort by ID by default, for sources that don’t define a default sort option.
• Fixed a bug where element indexes were sorting by the first sortable attribute alphabetically by default, rather than the first sortable attribute defined by the element type.
• Fixed a bug where bulk asset actions where shown as available when subfolders were selected, when they shouldn’t have. (#16151)
• Fixed a bug where craft\events\ApplyFieldSaveEvent::$field wasn’t being set consistently by craft\services\Fields::EVENT_BEFORE_APPLY_FIELD_SAVE. (#16156)
• Fixed a bug where the address field layout’s project config data wasn’t getting recreated when running project-config/rebuild. (#16189)

4.13.2 - 2024-11-19 [CRITICAL]

• Fixed an error that could occur if an invalid folder ID was passed to craft\services\Assets::deleteFoldersByIds(). (#16147)
• Fixed an RCE vulnerability.

4.13.1.1 - 2024-11-18

... (truncated)

Commits

• 5a47f8a Finish 4.13.8
• df20e00 Merge pull request #16377 from craftcms/t9n/4.x
• 6cc0dcf New translations app.php (German, Switzerland)
• 516ec9a New translations app.php (German)
• 22f7c04 Merge pull request #16360 from craftcms/t9n/4.x
• 7c8f1bd Doh
• 5755af3 Capitalize the first letter of strings that start with {type} in German
• c815128 New translations app.php (German, Switzerland)
• 583fcbc Missing @deprecated
• eddcc95 Revert "Filter out field layouts for invalid element types"
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.