Bump craftcms/cms from 4.8.10 to 4.12.7

[dependabot]

Bumps craftcms/cms from 4.8.10 to 4.12.7.

Release notes

Sourced from craftcms/cms's releases.

4.12.7

• Fixed a privilege escalation vulnerability.

4.12.6.1

• Custom field condition rules are now ignored if they reference a field with an incompatible type. (#15850)

4.12.6

• The Plugin Store now displays plugin ratings and reviews. (#15860)
• An InvalidConfigException is now thrown if the defaultCountryCode config setting is set to an empty string. (#15812)
• Fixed an error that could occur when saving an element, if a Date field’s time zone input was focused.
• Fixed a bug where the time zones listed in Date fields weren’t labelled properly based on the selected date. (#15805)
• Fixed an error that could occur if a native element property was attempted to be eager-loaded. (#15822)
• Fixed errors that could occur if a custom source or field condition referenced a custom field whose type had changed. (#15850)
• Fixed a bug where disclosure menus weren’t sticking to their trigger element as it was scrolled, if it was within a slideout or other inline-scrollable container. (#15852)
• Fixed a bug where the default backup command for MySQL was exporting triggers twice. (#15854)
• Fixed a bug where Multi-select fields were saving the selected options in the user-selected order rather than the field-defined order. (#15857)
• Fixed a missing authorization vulnerability.

4.12.5

• Fixed a bug where entries’ deletedWithEntryType values in the entries table weren’t getting set back to null after being restored.
• Fixed a bug where it wasn’t possible to discard changes for related elements via slideouts, if they didn’t exist in the primary site. (#15798)
• Fixed an information disclosure vulnerability.

4.12.4.1

• Fixed a JavaScript error. (#15784)

4.12.4

• Auto-generated handles, slugs, etc. now update immediately when the source input is changed. (#15754)
• Fixed a bug where Table fields’ Default Values table could lose existing rows if they only consisted of Dropdown columns without configured options.
• Fixed a bug where custom fields’ required properties were always false. (#15752)
• Fixed a bug where craft\helpers\StringHelper::toHandle() was allowing non-alphanumeric/underscore characters through. (#15772)
• Fixed a bug where entries were getting auto-saved while dragging elements within element select inputs.
• Fixed a bug where the maxBackups config setting wasn’t working. (#15780)

4.12.3

• Fixed a data deletion bug that occurred during garbage collection on PostgreSQL. (#14891)
• Fixed a bug where image constraint labels weren’t translated within the Image Editor.
• Fixed a bug where image orientation labels weren’t getting translated for screen readers within the Image Editor.
• Fixed a PHP error. (#14635)

4.12.2

• Updated Twig to 3.14. (#15704)
• Fixed a bug where soft-deleted structures weren’t getting hard-deleted via garbage collection. (#15705)
• Fixed an RCE vulnerability.

4.12.1

• Added craft\services\Security::isSystemDir().
• Fixed a bug where craft\helpers\StringHelper::lines() was returning an array of Stringy\Stringy objects, rather than strings.
• Fixed styling issues with Template field layout UI elements’ selector labels.
• Fixed a validation error that could occur when saving a relational field, if the “Maintain hierarchy” setting had been enabled but was no longer applicable. (#15666)

... (truncated)

Changelog

Sourced from craftcms/cms's changelog.

4.12.7 - 2024-10-15

• Fixed a privilege escalation vulnerability.

4.12.6.1 - 2024-10-09

• Custom field condition rules are now ignored if they reference a field with an incompatible type. (#15850)

4.12.6 - 2024-10-08

• The Plugin Store now displays plugin ratings and reviews. (#15860)
• An InvalidConfigException is now thrown if the defaultCountryCode config setting is set to an empty string. (#15812)
• Fixed an error that could occur when saving an element, if a Date field’s time zone input was focused.
• Fixed a bug where the time zones listed in Date fields weren’t labelled properly based on the selected date. (#15805)
• Fixed an error that could occur if a native element property was attempted to be eager-loaded. (#15822)
• Fixed errors that could occur if a custom source or field condition referenced a custom field whose type had changed. (#15850)
• Fixed a bug where disclosure menus weren’t sticking to their trigger element as it was scrolled, if it was within a slideout or other inline-scrollable container. (#15852)
• Fixed a bug where the default backup command for MySQL was exporting triggers twice. (#15854)
• Fixed a bug where Multi-select fields were saving the selected options in the user-selected order rather than the field-defined order. (#15857)
• Fixed a missing authorization vulnerability.

4.12.5 - 2024-09-27

• Fixed a bug where entries’ deletedWithEntryType values in the entries table weren’t getting set back to null after being restored.
• Fixed a bug where it wasn’t possible to discard changes for related elements via slideouts, if they didn’t exist in the primary site. (#15798)
• Fixed an information disclosure vulnerability.

4.12.4.1 - 2024-09-24

• Fixed a JavaScript error. (#15784)

4.12.4 - 2024-09-23

• Auto-generated handles, slugs, etc. now update immediately when the source input is changed. (#15754)
• Fixed a bug where Table fields’ Default Values table could lose existing rows if they only consisted of Dropdown columns without configured options.
• Fixed a bug where custom fields’ required properties were always false. (#15752)
• Fixed a bug where craft\helpers\StringHelper::toHandle() was allowing non-alphanumeric/underscore characters through. (#15772)
• Fixed a bug where entries were getting auto-saved while dragging elements within element select inputs.
• Fixed a bug where the maxBackups config setting wasn’t working. (#15780)

4.12.3 - 2024-09-14

• Fixed a data deletion bug that occurred during garbage collection on PostgreSQL. (#14891)
• Fixed a bug where image constraint labels weren’t translated within the Image Editor.
• Fixed a bug where image orientation labels weren’t getting translated for screen readers within the Image Editor.
• Fixed a PHP error. (#14635)

4.12.2 - 2024-09-11

• Updated Twig to 3.14. (#15704)

... (truncated)

Commits

• 91eb1f4 Empty commit
• f4f7ba0 Empty commit
• 757ace8 Empty commit
• cdad4c1 Finish 4.12.7
• d5be48e Fixed a privilege escalation vulnerability
• f1a285b Inaccurate
• 516e2a1 Finish 4.12.6.1
• d21357c e8e67bfa5a598de49f67d59d3f1a8625b943b2fb part 2
• 511f3dd Merge pull request #15865 from craftcms/bugfix/ratings-typo
• e0f2968 build
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Superseded by #30.