6.3.0-beta1#

Overview#

A full list of module versions included in CMS Recipe 6.3.0-beta1 is provided below. We recommend referencing recipes in your dependencies, rather than individual modules, to simplify version tracking. See Recipes.

Included module versions
ModuleVersion
colymba/gridfield-bulk-editing-tools5.2.1
dnadesign/silverstripe-elemental6.2.3
dnadesign/silverstripe-elemental-userforms5.1.1
silverstripe/admin3.3.0-beta1
silverstripe/asset-admin3.3.0-beta1
silverstripe/assets3.3.0-beta1
silverstripe/campaign-admin3.3.0-beta1
silverstripe/cms6.3.0-beta1
silverstripe/config3.1.0
silverstripe/developer-docs6.3.0-beta1
silverstripe/dynamodb6.0.0
silverstripe/environmentcheck4.1.0
silverstripe/errorpage3.3.0-beta1
silverstripe/framework6.3.0-beta1
silverstripe/graphql6.1.1
silverstripe/gridfieldqueuedexport4.1.1
silverstripe/htmleditor-tinymce1.2.0-beta1
silverstripe/installer6.3.0-beta1
silverstripe/linkfield5.2.2
silverstripe/login-forms6.2.1
silverstripe/lumberjack4.1.1
silverstripe/mfa6.2.1
silverstripe/mimevalidator4.0.0
silverstripe/realme6.1.0-beta1
silverstripe/recipe-cms6.3.0-beta1
silverstripe/recipe-core6.3.0-beta1
silverstripe/recipe-kitchen-sink6.3.0-beta1
silverstripe/recipe-plugin2.1.0
silverstripe/reports6.3.0-beta1
silverstripe/segment-field4.1.1
silverstripe/session-manager3.1.3
silverstripe/sharedraftcontent4.2.1
silverstripe/siteconfig6.3.0-beta1
silverstripe/spamprotection5.0.1
silverstripe/startup-theme1.0.12
silverstripe/staticpublishqueue7.0.2
silverstripe/tagfield4.2.1
silverstripe/taxonomy4.2.0
silverstripe/template-engine1.0.1
silverstripe/textextraction5.0.1
silverstripe/totp-authenticator6.1.1
silverstripe/userforms7.1.3
silverstripe/vendor-plugin3.0.0
silverstripe/versioned3.3.0-beta1
silverstripe/versioned-admin3.3.0-beta1
symbiote/silverstripe-advancedworkflow7.2.3
symbiote/silverstripe-gridfieldextensions5.2.1
symbiote/silverstripe-queuedjobs6.2.0
tractorcow/silverstripe-fluent8.2.2

Security considerations#

The following fixes were previously released as patches for earlier release lines:

The root-cause fix for both remote code execution vulnerabilities lives in the template parser, which now emits single-quoted PHP string literals for <%t %> translation blocks so that variables and expressions are no longer interpolated.

The high severity fixes were released in patches for the CMS 5.4, 6.1, and 6.2 release lines. The medium severity fixes were released in patches for the CMS 6.2 release line. That difference follows our release policy: a release line in partial support only receives fixes for high and critical impact vulnerabilities, meaning those with a CVSS score of 7.0 or above, while a release line in full support receives fixes at any severity. The Silverstripe CMS security patches June 2026 blog post lists the same distribution.

Action may be required for media embeds#

The fix for CVE-2026-54720 now strips event-handler and other unsafe attributes from a non-sandboxed <iframe> returned by an oEmbed provider. If stripping an attribute breaks a legitimate embed, you can exempt a fully trusted provider's domain from sandboxing with the EmbedShortcodeProvider.domains_excluded_from_sandboxing configuration property:

yaml
# app/_config/embed.yml
SilverStripe\View\Shortcodes\EmbedShortcodeProvider:
  domains_excluded_from_sandboxing:
    - trusted-provider.com

The domain is matched by suffix, so the value above also matches subdomains such as embed.trusted-provider.com - and any other domain ending in the same string, including an unrelated nottrusted-provider.com. Give the full domain, so you don't match a domain you don't control.

Embeds from an excluded domain render exactly as the provider sends them, and are no longer wrapped in a sandboxed iframe, so only add domains you fully trust. See sandboxing oembed HTML for more about how sandboxing works.

Features and enhancements#

Image editing#

Content authors can now make simple composition changes to images without leaving the CMS: crop, rotate in 90 degree steps, flip horizontally or vertically, and resize.

In the "Files" section, click an image to open its detail view, then click the "Other actions" button - the three dots next to "Save" and "Publish" - and select "Edit image". The action only appears for raster images you have permission to edit.

Image editor

The editor is focused on image composition (where the subject sits in the frame) rather than retouching i.e. there are no brightness, colour, filter, or background removal controls.

Note the following behaviours:

  • The original file is replaced in place. Applying an edit writes the rendered result over the origin file. The record keeps its ID, folder, and filename, so everything already using that image picks up the edited pixels with nothing to repoint.
  • The original can be backed up first. A checkbox in the editor - ticked by default - copies the pre-edit bytes into a new draft file in the same folder before the replacement is written, named by the CMS's usual de-duplication, so beach.jpg is backed up as beach-v2.jpg. Untick it and the original bytes are gone for good.
  • The edit is saved as a draft. The published version of the file is untouched, so the live site keeps serving the pre-edit image until you publish it yourself.
  • Resizing keeps the aspect ratio. Type a width or a height and the other is derived. The output can only be made smaller than the cropped image, never larger.
  • Raster images only. SVG files are not editable through the image editor.

Being able to edit an image requires permission to edit the original - its bytes are modified - and permission to create files in the folder it lives in, for the backup copy.

Edited images are encoded in the same format as their source, at the same quality used for resampled images, or at a quality you configure for the editor alone.

Extension hooks are called either side of each write the editor makes, so you can alter the rendered image before it is saved - to add a watermark, for example - or react once it has been.

See image editor for the rest of the configuration options.

React class components converted to functional components#

Form field components in the CMS have been converted from React class components to functional components. This is part of an ongoing modernisation effort - functional components are simpler, have better tooling support, and align with current React best practices.

For most projects this change is invisible. However, if your project extends any of these components as an ES6 class (extends TextField), that pattern will no longer work because functional components cannot be subclassed.

To ease migration, the original class-based implementations are preserved as Legacy-prefixed copies in client/src/legacy/ReactComponents/. Only class components that were previously defined in the client/src/bundles/bundle.js file in silverstripe/admin, or were a parent class of an exported component, are available as legacy components. If your project subclasses a converted component, update the import to use the legacy version:

Before:

javascript
import TextField from 'components/TextField/TextField';

class MyCustomField extends TextField {
  // ...
}

After:

javascript
import LegacyTextField from 'legacy/ReactComponents/LegacyTextField';

class MyCustomField extends LegacyTextField {
  // ...
}

You will need the latest version of @silverstripe/webpack-config to use the legacy components, which includes an updated externals configuration to support the new import paths.

Note that these legacy class components are provided as a short-term migration aid and will be removed in CMS 7. Projects should plan to move away from class inheritance before then.

The new functional components provide exports (for example getInputProps(), handleChange(), and render()) that were previously provided via class inheritance. If you previously extended class components, migrate to functional components by composing the exported helpers in your own components.

Bug fixes#

This release includes a number of bug fixes to improve a broad range of areas. Check the change logs for full details of these fixes split by module. Thank you to the community members that helped contribute these fixes as part of the release!

SingleRecordAdmin permission generation#

Previously, SingleRecordAdmin subclasses did not generate CMS access permissions in the way that ModelAdmin subclasses did. This meant it was difficult to grant non-admin users access to custom SingleRecordAdmin sections through the CMS security permissions interface - they were only visible to users with administrator privileges without adding custom code.

We've now updated the permission generation system in LeftAndMain::providePermissions() to include both ModelAdmin and SingleRecordAdmin subclasses. Any custom SingleRecordAdmin implementation will now automatically generate a permission that allows you to control access via groups and roles, just as you would for ModelAdmin sections. By default these permission will be disabled for non-admin users, so you will need to explicitly grant access to the relevant user groups via the CMS.

If you have a custom SingleRecordAdmin that should not appear in the permissions interface, set the LeftAndMain.skip_permission_generation configuration property value to true:

php
namespace App\Admins;

class MySpecialAdmin extends SingleRecordAdmin
{
    private static bool $skip_permission_generation = true;
    // ...
}

Full commits list#

Reveal full list of commits

Security#

  • silverstripe/framework (6.2.0 -> 6.3.0-beta1)

  • silverstripe/cms (6.2.0 -> 6.3.0-beta1)

    • 2026-06-24 62f9912b Escape page titles in breadcrumbs for page list view (#3175) (Steve Boyd) - See cve-2026-54717

  • silverstripe/versioned (3.2.0 -> 3.3.0-beta1)

  • silverstripe/userforms (7.1.0 -> 7.1.3)

  • symbiote/silverstripe-advancedworkflow (7.2.0 -> 7.2.3)

Features and enhancements#

  • silverstripe/admin (3.2.0 -> 3.3.0-beta1)

    • 2026-02-23 c3721e68 Convert more admin components to functional (Steve Boyd)

  • silverstripe/asset-admin (3.2.0 -> 3.3.0-beta1)

    • 2026-07-31 3f2318cf Basic image editing (#1693) (Steve Boyd)

  • silverstripe/htmleditor-tinymce (1.1.0 -> 1.2.0-beta1)

    • 2026-02-23 ccb587c Convert TinyMceHtmlEditorField to functional component (Steve Boyd)

Bugfixes#

  • silverstripe/framework (6.2.0 -> 6.3.0-beta1)

    • 2026-08-11 30c45de4e deprecation warning in RequiredFieldsValidator when validating a field without name (#11982) (Florian Thoma)
    • 2026-06-24 7801ad0b4 Prevent RCE via translation default strings (#11994) (Steve Boyd)
    • 2026-06-23 3a41d5108 Correct hex escape pattern in i18nTextCollector (#11991) (Steve Boyd)
    • 2026-03-17 1d3692983 code example in doc block (#11976) (Stefan Eickhoff)

  • silverstripe/template-engine (1.0.0 -> 1.0.1)

    • 2026-06-24 e4f5f4e Prevent RCE via translation default strings (Steve Boyd)

  • silverstripe/admin (3.2.0 -> 3.3.0-beta1)

    • 2026-06-10 129a407b Strip Content-Type parameters before matching in Backend.js decode() (#2140) (Steve Boyd)
    • 2026-06-09 5ff3c732 Strip Content-Type parameters before matching in Backend.js decode() (Lukas Erni)
    • 2026-02-25 3ae49297 Add SingleRecordAdmin to permission management (Steve Boyd)

  • dnadesign/silverstripe-elemental (6.2.0 -> 6.2.3)

    • 2026-04-22 9c67638 Fixed element search in the add new menu (fixes #1428) (UndefinedOffset)
    • 2026-04-22 8ddc890 Fixed issue where custom icons would be broken in 6.2 of elemental (fixes #1424) (UndefinedOffset)

  • symbiote/silverstripe-gridfieldextensions (5.2.0 -> 5.2.1)

    • 2026-03-23 14a9628 Control which components are written on GridFieldEditableColumns::handleSave (Florian Thoma)

  • tractorcow/silverstripe-fluent (8.2.0 -> 8.2.2)

    • 2026-05-08 90f8478 Fix PHPCS issues (Loz Calver)

Api changes#

  • silverstripe/siteconfig (6.1.1 -> 6.3.0-beta1)
    • 2026-02-27 e2c3f231 Set config to skip permission generation (Steve Boyd)

Dependencies#

  • silverstripe/admin (3.2.0 -> 3.3.0-beta1)

    • 2026-08-27 b194dd32 Update JS dependencies (#2173) (github-actions[bot])
    • 2026-08-25 bd62ff9b Update JS dependencies (#2171) (github-actions[bot])

  • silverstripe/asset-admin (3.2.0 -> 3.3.0-beta1)

    • 2026-08-27 17fb978f Update JS dependencies (#1699) (github-actions[bot])
    • 2026-08-25 131e97ad Update JS dependencies (#1697) (github-actions[bot])

  • silverstripe/versioned-admin (3.2.0 -> 3.3.0-beta1)

    • 2026-08-27 4dcfa0c Update JS dependencies (#484) (github-actions[bot])
    • 2026-08-25 e008e8a Update JS dependencies (#482) (github-actions[bot])

  • silverstripe/cms (6.2.0 -> 6.3.0-beta1)

    • 2026-08-27 f85e5efb Update JS dependencies (#3185) (github-actions[bot])
    • 2026-08-25 d4ed2299 Update JS dependencies (#3183) (github-actions[bot])

  • silverstripe/reports (6.2.0 -> 6.3.0-beta1)

    • 2026-08-27 e05e8bf7 Update JS dependencies (#251) (github-actions[bot])
    • 2026-08-25 864b385f Update JS dependencies (#249) (github-actions[bot])

  • silverstripe/session-manager (3.1.1 -> 3.1.3)

    • 2026-08-25 85444f0 Update JS dependencies (#271) (github-actions[bot])
    • 2026-02-01 66b7a8f Update JS dependencies (github-actions)

  • silverstripe/login-forms (6.2.0 -> 6.2.1)

    • 2026-08-25 6898ddd Update JS dependencies (#253) (github-actions[bot])

  • silverstripe/htmleditor-tinymce (1.1.0 -> 1.2.0-beta1)

    • 2026-08-27 32d5629 Update JS dependencies (#60) (github-actions[bot])
    • 2026-08-25 04e0260 Update JS dependencies (#58) (github-actions[bot])

  • silverstripe/totp-authenticator (6.1.0 -> 6.1.1)

    • 2026-08-25 d35f9a6 Update JS dependencies (#226) (github-actions[bot])

  • silverstripe/mfa (6.2.0 -> 6.2.1)

    • 2026-08-25 fc6c323 Update JS dependencies (#647) (github-actions[bot])

  • silverstripe/gridfieldqueuedexport (4.1.0 -> 4.1.1)

    • 2026-08-25 5edec87 Update JS dependencies (#167) (github-actions[bot])

  • silverstripe/realme (6.0.3 -> 6.1.0-beta1)

    • 2026-02-01 8caa000 Update JS dependencies (github-actions)
    • 2026-02-01 7719e5b Update JS dependencies (github-actions)
    • 2025-08-20 1e97092 Update JS dependencies (Steve Boyd)

  • silverstripe/segment-field (4.1.0 -> 4.1.1)

    • 2026-08-25 2214c6b Update JS dependencies (#157) (github-actions[bot])

  • silverstripe/sharedraftcontent (4.2.0 -> 4.2.1)

    • 2026-08-25 9ec625d Update JS dependencies (#316) (github-actions[bot])

  • silverstripe/lumberjack (4.1.0 -> 4.1.1)

    • 2026-08-25 ed49078 Update JS dependencies (#222) (github-actions[bot])

  • silverstripe/tagfield (4.2.0 -> 4.2.1)

    • 2026-08-25 d9dd060 Update JS dependencies (#356) (github-actions[bot])

  • silverstripe/userforms (7.1.0 -> 7.1.3)

    • 2026-08-25 b2dca6a Update JS dependencies (#1452) (github-actions[bot])

  • dnadesign/silverstripe-elemental (6.2.0 -> 6.2.3)

    • 2026-08-25 9dac131 Update JS dependencies (#1439) (github-actions[bot])

  • symbiote/silverstripe-advancedworkflow (7.2.0 -> 7.2.3)

    • 2026-08-25 23c67ed Update JS dependencies (#635) (github-actions[bot])

  • colymba/gridfield-bulk-editing-tools (5.2.0 -> 5.2.1)

    • 2026-08-25 1a8351b Update JS dependencies (#368) (github-actions[bot])

  • tractorcow/silverstripe-fluent (8.2.0 -> 8.2.2)

    • 2026-08-25 51ebb38 Update JS dependencies (github-actions)

  • silverstripe/linkfield (5.2.0 -> 5.2.2)

    • 2026-08-25 9bb76a0 Update JS dependencies (#455) (github-actions[bot])

  • silverstripe/campaign-admin (3.2.0 -> 3.3.0-beta1)

    • 2026-08-27 a7485d3 Update JS dependencies (#406) (github-actions[bot])
    • 2026-08-25 cdfaef9 Update JS dependencies (#404) (github-actions[bot])

Documentation#

  • silverstripe/developer-docs (6.2.0 -> 6.3.0-beta1)
    • 2026-08-03 3b5a524c Create June 2026 security release entry for CMS 6.3 changelog (#894) (Steve Boyd)
    • 2026-07-31 9f7daf4c Align image editor docs with house tone (#896) (Bernard Hamlin)
    • 2026-07-31 0a437799 Basic image editing (#895) (Steve Boyd)
    • 2026-03-25 e28ba5a6 Document SingleRecordAdmin permission generation (Steve Boyd)
    • 2026-02-18 50aa01a6 Add changelog for legacy react components (Steve Boyd)

Translations#

  • silverstripe/assets (3.2.0 -> 3.3.0-beta1)

    • 2026-08-20 378e8e8 Update translations (#714) (Steve Boyd)

  • silverstripe/framework (6.2.0 -> 6.3.0-beta1)

    • 2026-08-20 d8325ec54 Update translations (#12009) (Steve Boyd)

  • silverstripe/admin (3.2.0 -> 3.3.0-beta1)

    • 2026-08-20 bbfaadb3 Update translations (#2167) (Steve Boyd)

  • silverstripe/asset-admin (3.2.0 -> 3.3.0-beta1)

    • 2026-08-20 b881de6d Update translations (#1695) (Steve Boyd)
    • 2026-08-14 5675d3c6 Update translations (#1694) (Steve Boyd)

  • silverstripe/versioned-admin (3.2.0 -> 3.3.0-beta1)

    • 2026-08-20 7997fdb Update translations (#480) (Bernard Hamlin)
    • 2026-08-19 a75e886 Update translations (Steve Boyd)

  • silverstripe/cms (6.2.0 -> 6.3.0-beta1)

    • 2026-08-20 9d60f454 Update translations (#3180) (Steve Boyd)

  • silverstripe/errorpage (3.1.0 -> 3.3.0-beta1)

    • 2026-08-20 698570f Update translations (#141) (Steve Boyd)

  • silverstripe/reports (6.2.0 -> 6.3.0-beta1)

    • 2026-08-20 a5138552 Update translations (#248) (Steve Boyd)

  • silverstripe/versioned (3.2.0 -> 3.3.0-beta1)

    • 2026-08-20 536b1f1 Update translations (#546) (Steve Boyd)

  • silverstripe/realme (6.0.3 -> 6.1.0-beta1)

    • 2025-05-18 9f5c9b7 Update translations (#185) (Guy Sartorelli)

  • silverstripe/spamprotection (5.0.0 -> 5.0.1)

    • 2026-08-20 f478d32 Update translations (#139) (Steve Boyd)

  • silverstripe/userforms (7.1.0 -> 7.1.3)

    • 2026-08-20 a97e4f6 Update translations (#1451) (Steve Boyd)

  • dnadesign/silverstripe-elemental (6.2.0 -> 6.2.3)

    • 2026-08-20 49a3fb6 Update translations (#1438) (Steve Boyd)

  • dnadesign/silverstripe-elemental-userforms (5.1.0 -> 5.1.1)

    • 2026-08-20 624e60d Update translations (#127) (Steve Boyd)

  • symbiote/silverstripe-advancedworkflow (7.2.0 -> 7.2.3)

    • 2026-08-20 8f1339b Update translations (#634) (Steve Boyd)

  • silverstripe/linkfield (5.2.0 -> 5.2.2)

    • 2026-08-20 f804880 Update translations (#454) (Steve Boyd)

  • silverstripe/campaign-admin (3.2.0 -> 3.3.0-beta1)

    • 2026-08-20 9ad4eae Update translations (#402) (Steve Boyd)

Other changes#

  • tractorcow/silverstripe-fluent (8.2.0 -> 8.2.2)
    • 2026-04-21 c891bae Update RecordLocale.php (Lars Prakken)