Verbb

Changelog

4.0.6 2026-11-01

Added

  • Add “All Form Fields”, “All Non Empty Fields”, “All Visible Fields” and formatted Group and Repeater summaries to integration field mappings for text fields. Freshdesk ticket descriptions receive them as HTML. (#3078 (opens new window))
  • Add IntegrationField::$acceptsHtml for integration fields that render HTML content. (#3078 (opens new window))
  • Add instructions explaining the Redirect Source options in form behaviour settings.
  • Add field warning for URL settings in the control panel, when the URL starts with a reference.

Changed

  • Allow reference-supplied external redirect URLs, leaving the choice of destination source to the editor.
  • Update the minimum Tiptap requirement to 1.0.6.

Fixed

  • Fixed an information disclosure vulnerability. (#3074 (opens new window))
  • Fixed a moderate-severity cross-site scripting vulnerability. (GHSA-544h-97wp-pvhx)
  • Fix rich-text Multi-Line Text answers displaying as HTML source when referenced in email notifications.
  • Fix rich-text editor registration running more than once when Craft’s buildId setting is configured.
  • Fix garbage collection failing when pruning Formie submissions, sent notifications or uploaded assets. (#3075 (opens new window))
  • Fix form group permissions not applying to email notification Advanced and Templates tabs, the New Submission form list, the Recent Form Submissions widget, and sent notification sources, actions and resending.
  • Fix the cursor jumping to the end when typing around variable tags.
  • Fix browser requests failing when Craft uses a custom action trigger, including token refresh after AJAX submissions. (#3068 (opens new window))
  • Fix file upload reference checks causing MySQL sort-memory errors for large submissions. (#3069 (opens new window))
  • Fix upload manager file order and move button states becoming inconsistent after reordering files. (#3070 (opens new window))
  • Fix searchable dropdown placeholders not appearing until a form field is focused. (#3072 (opens new window))
  • Fix client-rendered forms failing to load when Date fields contain dropdown controls, including AM/PM controls. (#3073 (opens new window))
  • Fix Date pickers displaying calendar labels in English on non-English sites. (#3076 (opens new window))
  • Fix required advanced Date pickers being skipped by client-side validation. (#3077 (opens new window))
  • Fix Date fields showing Required settings that were reset on save. Set Required on the Date's sub-fields instead. (#3077 (opens new window))
  • Fix invisible hCaptcha challenges timing out before they could be completed, requiring a second submit click. (#3067 (opens new window))
  • Fix Agree fields not being selectable in integration field mappings. (#3066 (opens new window))
  • Fix the Opt-In Field setting for integrations not being able to be cleared. (#3066 (opens new window))
  • Fix large HubSpot portals failing to load or refresh integration settings due to the metadata storage limit.
  • Fix optional field selections, including Match Field and integration field references, not being able to be cleared.
  • Fix country defaults for Phone, Address Country and Google address autocomplete not being able to be cleared.
  • Fix Phone country dropdowns selecting the first allowed country when the default is None, and not restoring None when forms reset. (#3071 (opens new window))
  • Fix optional option-source parameters not being able to be cleared, and provider defaults restoring explicitly empty values.
  • Fix Form Default positions not being retained for Address and Name instructions, and Content, HTML, Recipients, Quiz and Survey labels.
  • Fix deleted page client events returning on forms upgraded from legacy event settings.
  • Fix clearing custom required error messages reverting to their previous value. (#3065 (opens new window))
  • Fix populating Entries and other element fields with a single element ID.
  • Fix forms on path-based sites receiving refreshed submission tokens for the wrong site. (#3064 (opens new window))
  • Fix Microsoft Dynamics 365 requests failing with a provider origin override error. (#3063 (opens new window))
  • Fix theme attributes not being applied to AJAX success and error messages. (#3061 (opens new window))
  • Fix nested alert roles in form error messages that could cause duplicate screen reader announcements. (#3062 (opens new window))
  • Fix AJAX submissions showing the form error message when Error Message Position is set to None.
  • Fix Opayo re-tokenizing cards and requesting unnecessary merchant sessions after completing a 3D Secure challenge. (#3048 (opens new window))
  • Fix importing Formie 3 forms with a null redirect target. (#3060 (opens new window))
  • Fix variable pickers not showing for redirect URL settings.

Removed

  • Remove the completionRedirectAllowedOrigins configuration setting.

4.0.5 2026-10-28

Added

  • Add a Maximum Displayed Options setting for searchable dropdowns, defaulting to 100 while searching all options. (#3059 (opens new window))
  • Add configurable Dropdown placeholders across all option sources, enabled for new fields while preserving existing options and defaults. (#3058 (opens new window))
  • Add Form layout, Alphabetical, and Custom field ordering for reports and exports, preserving existing custom orders. (#3054 (opens new window))
  • Add report subcolumn support for parent fields, including Name and Address, with Single Column, Separate Columns, and Both display options for automatic reports. (#3055 (opens new window))
  • Add a dedicated field value projection and event for reports, with readable combined values and independent field formatting. (#3055 (opens new window))
  • Add save-time validation for completion redirect URLs, with guidance for external origins that are not allowed. (#3038 (opens new window))

Changed

  • Retain compact condition selectors with Plugin Kit’s xxs size.
  • Update the minimum Auth requirement to 2.0.56.

Fixed

  • Fix render-time theme overrides being ignored for fields on sites with form translations. (#3057 (opens new window))
  • Fix forms with Question CAPTCHA failing to render when strict Twig variables are enabled, and correct the answer input name for submission. (#3056 (opens new window))
  • Fix form imports not reporting missing update permission when the existing form is hidden from the control panel index.
  • Fix conditional Payment fields initializing widgets more than once, including duplicate Opayo Drop-in sessions and unhandled mount errors. (#3048 (opens new window))
  • Fix dragging inside a nested field’s editor moving its parent Group or Repeater field. (#3049 (opens new window))
  • Fix retired Duplicate, Honeypot, and JavaScript CAPTCHAs appearing as unavailable after upgrading, remove their obsolete form bindings, and preserve third-party CAPTCHA bindings that reuse those handles. (#3047 (opens new window))
  • Fix required dropdowns enhanced with third-party libraries such as Choices.js failing validation when options are selected, and preserve custom required messages. (#3046 (opens new window))
  • Fix new fields failing to save after upgrading to Formie 4 on PostgreSQL. (#3045 (opens new window))
  • Fix submission index sorting ignoring the selected direction when switching between Submission and Date Created. (#3044 (opens new window))
  • Fix report field columns and exports using alphabetical order instead of the form layout when including all fields. (#3054 (opens new window))
  • Fix integration provider options appearing as custom values after upgrading or as “Don’t Include” after selection. (#3042 (opens new window))
  • Fix integrations failing for whole Name and other container field mappings, and migrate legacy Phone sub-field mappings on previously upgraded forms. (#3052 (opens new window))
  • Include the destination field and safe field reference in integration mapping errors, while continuing to fail the integration when a mapping cannot be resolved. (#3052 (opens new window))
  • Fix Freshdesk ticket payloads with and without attachments, including errors resolving field mappings and uploaded files. (#3051 (opens new window))
  • Fix integration failures before sending blocking retries, and allow unresolved provider operations to be confirmed individually in Delivery Diagnostics. (#3051 (opens new window))
  • Fix queued notifications being incorrectly rejected as stale when site translations are applied, and provide clearer rejection messages and directions to delivery diagnostics. (#3040 (opens new window))
  • Fix translated notification content losing formatting and custom TipTap nodes when emails are sent. (#3040 (opens new window))
  • Fix the Condition dropdown showing no options when configuring conditional email notification recipients. (#3053 (opens new window))
  • Fix matching recipient conditions returning no email addresses, and preserve older recipient rules when editing notifications. (#3053 (opens new window))
  • Fix email field summaries including opted-out fields inside Group and Repeater fields. (#3043 (opens new window))
  • Fix text-based fields inside Group fields not displaying their default values. (#3039 (opens new window))
  • Fix custom validation messages not saving or being used for fields inside Group and Repeater fields. (#3041 (opens new window))
  • Fix Checkboxes fields not enforcing option limits or using custom option limit error messages in the browser. (#3037 (opens new window))

4.0.4 2026-10-22

Added

  • Add allowedPrivateIntegrationHosts configuration for integrations connecting to trusted private networks. (#3034 (opens new window))
  • Add a Kebab Case text transform for reference tokens, including File Upload subpaths and filenames.
  • Add temporary Salesforce diagnostics for API requests, field filtering, cached settings and editor mappings.

Changed

  • Updated Markdown-it to 14.3.3 and the frontend build toolchain to Vite 8.3.4.

Fixed

  • Fix plugin initialization failing on Craft versions before 5.10, preserving user submission deletion, reassignment and restoration. (#3035 (opens new window))
  • Fix integration metadata being altered or discarded by diagnostic redaction, including refreshed Salesforce fields disappearing.
  • Fix ordinary integration settings being mistaken for credentials in diagnostic logs.
  • Fixed variable tags not showing their configured transform name or default-value indicator.
  • Fix page-reload submissions stalling when the submit delay is zero.
  • Fix mounted form lifecycle events omitting the form instance, including submission, page navigation, token refresh and teardown hooks. (#3032 (opens new window))
  • Fix form builder tab navigation adding browser history entries, so Back returns to the previous page. (#3029 (opens new window))
  • Fix form Appearance position dropdowns appearing empty when registration hooks filter or key their options. (#3017 (opens new window))
  • Fix File Upload subfolder and filename variable pickers including the field being edited, including unnamed fields.
  • Fix duplicate Upload Location validation errors and an unusably narrow subfolder editor. Only show the subfolder editor after selecting a location, with simpler instructions.
  • Fix built-in variables hiding available transforms in the variable picker.
  • Clarify upgrade guidance for settings that resolve references instead of Twig, including upload paths and filenames, supported transforms, and settings that retain Twig support.
  • Fix Date sub-field labels and settings reverting after saving the form builder. (#3026 (opens new window))
  • Fix Address country defaults and builder previews when option values use full country names. (#3036 (opens new window))
  • Fix nested fields remaining hidden when a conditional Group or Repeater is revealed after continuing a multi-page form. (#3031 (opens new window))
  • Fix Agree fields reverting their Label Position from Form Default to Hidden after saving. (#3030 (opens new window))
  • Fix field variables in notification subjects appearing literally in PDF attachment filenames. (#3025 (opens new window))
  • Fix Hidden fields missing from notification email address variable pickers.
  • Fix forms created on secondary sites using the primary site as their source and failing when saving their first field. (#3024 (opens new window))
  • Fix editing Name field labels on secondary sites failing when Use Multiple Name Fields is disabled. (#3024 (opens new window))
  • Fix custom hidden field defaults leaving reference tokens unresolved when rendering a new form. (#3027 (opens new window))
  • Fix dropdown optgroup labels being replaced with true and their optgroup setting being lost in the form builder. (#3028 (opens new window))

4.0.3 2026-10-20

Added

  • Add a dedicated Spam Protection area with grouped navigation in Craft’s standard sidebar, matching page and panel headings, standard header Save buttons, separate provider and spam-rule permissions, and independent provider saves.
  • Add sanitised installation, permissions and integration diagnostics to support bundles, with guidance to send requests from the affected environment.
  • Add Salesforce token-request logging with the endpoint and grant type, excluding OAuth credentials.

Changed

  • Clarify user permission labels, order spam rules before CAPTCHA and spam filtering services, remove permission info tooltips, align permission nesting with Formie’s navigation while retaining a single Select All control, limit settings permissions to production-accessible tools, and migrate legacy grants to preserve production access.
  • Store CAPTCHA, spam filtering and spam-rule settings locally on each installation. Existing values are preserved during upgrade; these settings are no longer deployed through project config.
  • Clarify project and instance settings for integrations, stencils, spam protection and captcha providers, including deployment and editing permissions.
  • Remove the informational Widget Mode field from Cloudflare Turnstile settings.

Fixed

  • Fix “Scroll To Top” having no effect after successful AJAX submissions. (#3023 (opens new window))
  • Fix production settings navigation hiding permitted read-only pages and scheduled reports exposing unavailable editing controls.
  • Fix form import, report export and scheduled report permissions depending on unrelated management permissions.
  • Fix upgrading from Formie 2 failing on Date fields before form statuses have been migrated.
  • Fix upgrading from Formie 2 failing on Payment fields before integration scopes have been migrated.
  • Fix later migrations failing after an interrupted field-table rename, and report when missing field definitions require restoring a backup.
  • Fix an error when upgrading from Formie 3 with an empty or invalid default date. (#3022 (opens new window))
  • Fix the Settings page redirecting repeatedly when admin changes are disabled.
  • Fix legacy Honeypot settings preventing forms from being created or saved, including from stencils.
  • Fix project config sync overwriting or removing instance-level integrations, stencils and spam protection settings.
  • Fix notification and submission properties rendering empty or being blocked by the Twig sandbox in PDF attachment filenames. (#3018 (opens new window))
  • Fix the Defaults settings page failing to load when custom field positions use non-sequential keys. (#3017 (opens new window))
  • Fix Date fields using Calendar (Simple) rendering text inputs instead of native date and time pickers. (#3014 (opens new window))
  • Fix reCAPTCHA v3 failing when its script is already loaded without the configured site key.
  • Fix reCAPTCHA v3 inline badges rendering outside the form. (#3016 (opens new window))
  • Fix slow submission and sent notification indexes in the control panel on sites with many forms.
  • Fix encryption warning icons appearing on a separate line from their text.
  • Fix custom rendering documentation using removed methods and omitting validation markup and spam-protection inputs.

4.0.2 2026-10-17

Changed

  • Update the minimum Auth requirement to 2.0.55.
  • Update the minimum Tiptap requirement to 1.0.5.

Fixed

  • Fix JSON report exports failing to download in the control panel.
  • Fix reports ignoring the option to display choice labels instead of values.
  • Fix disabled or missing payment providers allowing payment forms to complete.
  • Fix card details and temporary payment credentials being included in saved submissions and integration payloads.
  • Fix Bpoint payment fields not rendering their card inputs.
  • Fix Eway and Bpoint payment summaries missing from the submission editor.
  • Fix summary fields remaining blank after AJAX page navigation.
  • Fix summary fields repeatedly retrying failed requests.
  • Fix multi-row Likert answers not saving when editing submissions in the control panel.
  • Fix rank selectors missing labels in the submission editor.
  • Fix passwords containing only 0 not being stored correctly.
  • Fix cleared number fields restoring their default value when submissions are saved or loaded.
  • Fix hidden query prefills replacing submitted values after native form validation errors.
  • Fix editing submissions in the control panel replacing captured hidden values with the current administrator, date or IP address.
  • Fix text counters and phone countries not returning to their initial values when forms reset.
  • Fix rich-text validation errors failing to focus and describe the editable control.
  • Fix text, name, dropdown, email, phone, number and hidden field labels not identifying their inputs in the submission editor.
  • Fix text minimum limits using the maximum limit's unit in the submission editor.
  • Fix static table fields allowing rows to be added or removed in the submission editor.
  • Fix custom radio answers missing from the submission editor.
  • Fix checkbox toggles sharing option labels and being included in submission values and validation.
  • Fix required table fields incorrectly requiring every cell to have a value.
  • Fix Pardot form handlers rejecting submissions with existing single-select mappings such as country.value, while retaining plain field names and separate multi-select values.
  • Fix calculations using another calculation with a number prefix or suffix returning incorrect results.
  • Fix spam submissions configured to show success failing to display completion messages or redirect.
  • Fix fresh forms retaining an earlier submission’s spam-protection timer.
  • Fix form schedules accepting an end date before their start date.
  • Fix save-and-resume links losing the form page after saving a resumed submission.
  • Fix forms freezing when live validation and disabling the submit button until valid are both enabled.
  • Fix file upload names failing to refresh after navigating between form pages.
  • Fix duplicate validation errors for disallowed file uploads.
  • Fix users with create-only submission permissions being unable to save new submissions in the control panel.
  • Fix Salesforce Client Credentials connections using generic login endpoints instead of their saved instance domain, and clarify the My Domain requirement.
  • Fix reCAPTCHA initialization when another reCAPTCHA SDK is already present on the page.
  • Fix AWeber OAuth provider resolution on case-sensitive filesystems.
  • Fix missing class references affecting CAPTCHA language detection, integrations, GraphQL, element conditions, submission editing, and plugin migrations. (#3012 (opens new window))
  • Fix Events integration date mappings failing and preserve mapped timezones.
  • Fix oversized payment webhooks failing instead of returning HTTP 413, and stencil permission failures returning the wrong error.
  • Fix unnecessary predefined option and submission status deprecation errors with the debug toolbar enabled.
  • Fix IP submission throttling using an incorrect time window on sites with a non-UTC timezone. (#3013 (opens new window))
  • Fix SuiteCRM Contact fields not loading for field mapping with the V8 API. (#3010 (opens new window))
  • Fix SuiteCRM Contact mappings being omitted from record payloads after a full integration refresh. (#3011 (opens new window))

4.0.1 2026-10-16

Added

  • Add the formie:unload-warning:collect-exclusions browser event for integrations to exclude automatically updated transport fields from unsaved-changes checks. (#3008 (opens new window))

Changed

  • Update the minimum Auth requirement to 2.0.53.

Fixed

  • Fix saving upgraded Date fields resetting their child-field identities and settings.
  • Fix Date year dropdowns losing their available years and rejecting valid submissions after upgrading.
  • Fix Date migrations overriding explicitly configured future year ranges.
  • Fix empty legacy Phone values displaying serialized country metadata after upgrading to Formie 4.
  • Fix upgrades clearing integration connection state and cached field metadata required by existing mappings.
  • Fix integration lists rendering as an empty pane instead of configured integrations or the empty-state message.
  • Fix integration type icons appearing oversized or stretched in integration lists.
  • Fix Zendesk tickets being rejected when the mapped requester name is blank.
  • Fix submission status color migrations failing when legacy status event handlers are registered.
  • Fix an error when upgrading multi-site installs from Formie 3 to Formie 4. (#3007 (opens new window))
  • Fix unnecessary EVENT_MODIFY_HTML_TAG deprecation warnings when rendering forms with the debug toolbar enabled. (#3009 (opens new window))
  • Fix CAPTCHA token updates triggering an unsaved-changes warning on untouched forms. (#3008 (opens new window))
  • Fix initial conditional field visibility triggering an unsaved-changes warning after native submissions.
  • Fix edits made immediately after a form loads being treated as saved.
  • Fix CAPTCHA widgets and callbacks remaining active after failed setup or removal.
  • Fix CAPTCHA widgets with a numeric zero handle failing to validate or reset.

4.0.0 2026-10-16

{warning} Before upgrading to Formie 4, review the Upgrading from v3 guide for breaking changes and required migration steps.

Added

  • Add a Formie 3 to Formie 4 migration path for existing Craft 5 projects.
  • Add direct Formie 2 to Formie 4 migration support, allowing Craft 4 projects to move to Craft 5 without upgrading through Formie 3 first.
  • Add Formie 4 Compatibility Mode, enabled by default, to bridge selected Formie 3 class aliases, event owners, custom field schema methods, field config keys, theme config keys, and legacy front-end event listeners during upgrades.
  • Add first-party framework-agnostic, browser, React, Vue, and Web Components packages for server-rendered and client-rendered forms, with REST and GraphQL transports.
  • Add headless GraphQL payment support: structured Payment field input types, payment follow-up fields on submitFormieClientForm, and BYO provider documentation. (#1375 (opens new window))
  • Add GraphQL Json siblings for stored rich-text content alongside existing Html fields (#865 (opens new window)): submitActionMessageJson, errorMessageJson, instructionsJson, descriptionJson, and contentJson.
  • Add generic saveSubmission GraphQL mutation for handle-based submission saves (#1007 (opens new window)).
  • Add developer extension APIs for schema-driven integration and notification settings, submission workflow stages and tasks, field value projections, slot tags, client modules, and programmatic form and submission factories.
  • Add Form Statuses to label form lifecycle states in the control panel (active, draft, archived), with form builder assignment, index status menu filtering, bulk actions, and project config support. Rename existing submission workflow labels to Submission Statuses, with backward-compatible class aliases. (#1471 (opens new window))
  • Dispatch integrations on control panel submission saves when the re-run policy includes Control panel save, including bulk status changes and other direct element saves. CP submission edit saves continue to use the submission workflow without double-triggering. (Discussion #2253 (opens new window))
  • Add a staged submission workflow service (SubmissionWorkflow) with preflight, validate, screen, persist, dispatch, and finalize stages.
  • Add database-backed temporary submission state, incomplete submission state, saved drafts, and resume-token handling.
  • Add multi-site support with automatic site availability via Form Group site policy, per-site content translation via sparse site overrides, portable stencil translations, and per-site required-field overrides. (#2308 (opens new window), #84 (opens new window), #2724 (opens new window), #2968 (opens new window), #2982 (opens new window))
  • Add a dedicated optional field-content encryption key, an Encryption settings page, key generation and status commands, resumable re-encryption, previous-key recovery, and read-only handling for unavailable encrypted values.
  • Add siteHandle request parameter support for headless form load and submit endpoints (#2286 (opens new window)).
  • Add Cleanup service, ./craft formie/gc/run, and ./craft formie/cron/run console commands for scheduled cleanup and retention. formie/cron/run also runs due scheduled reports, with --only, --skip-gc, and --skip-reports for finer scheduling control.
  • Add Reports control panel section for saved analytical views over submissions: filters, summary counts, charts, column configuration, and on-demand export (CSV, Excel, JSON, XML, text) with configurable filename tokens. (#647 (opens new window))
  • Add Scheduled Reports to email a summary and export attachment from a saved report on daily or weekly schedules, with configurable file type, optional email template, recipients, and user group delivery. (#692 (opens new window), #2184 (opens new window))
  • Add Report Async Export Row Threshold setting (Settings → Submissions) to queue large report exports in the background (default 1000 rows). (#2259 (opens new window))
  • Add Quiz field to forms for scored questionnaires (#605 (opens new window)). Each question supports radio buttons, checkboxes, or a dropdown; mark correct answers on static options, enable optional Weighted score for per-option points, and add Answer explanation rich text for incorrect responses. Form Behaviour → Quiz Scoring settings control pass percentage, retake restrictions (by logged-in user or IP address), and whether Ajax/client submit responses include a quizResult payload after a successful final-page submit. Scores persist in formie_submission_quiz_results for complete, non-spam submissions.
  • Add Survey field to forms with selectable presentation types: radio buttons, checkboxes, dropdown, Likert scale (#798 (opens new window)), Rating star scale (#2282 (opens new window)), and Rank drag-and-drop ordering (#605 (opens new window)). Likert supports single- and multi-row layouts, optional Weighted score on static columns, and built-in predefined scale defaults. Rank fields preserve submitted order on validation re-render.
  • Add a Results tab to the form builder when a form includes Quiz or Survey fields (#605 (opens new window)). View per-question response counts and option breakdowns, rank-weighted preference charts, Likert scoring averages when weighted scoring is enabled, and a quiz summary (attempts, average score, pass rate, pass threshold) for scored quizzes.
  • Add Checkout Mode setting to the Opayo payment integration, with Own Form (default) and Drop-in Checkout options. Drop-in Checkout renders card fields inside an Opayo-hosted iframe via sagepayCheckout, which can reduce PCI scope compared to own-form tokenisation, while reusing the existing server-side session key, transaction, and 3DS callback flow.
  • Add registered Custom Provider option sources for Dropdown, Radio, Checkboxes, and Recipients fields. Modules can register lightweight OptionSourceProviderInterface classes via OptionSources::EVENT_REGISTER_OPTION_SOURCE_PROVIDERS for local Craft data without building a full integration. See Custom option source providers. (#1421 (opens new window))
  • Add dynamic Brevo list assignment via field mapping. Map a form field to the Brevo List integration field to subscribe contacts to a submission-specific list, with fallback to the form’s configured list. (#2849 (opens new window))
  • Add Merge Multi-Option Fields setting to the Pipedrive integration. When updating an existing person (matched by email), mapped multi-option field values such as labels can be appended to existing values instead of replacing them.
  • Add a persisted metadata JSON column on submissions for submit-time request context (referrer, user agent, tracking cookies) and developer-defined custom data via form.setSubmissionMetadata(). Reference tokens such as {metadata:custom.campaignId} and {metadata:request.referrer} are supported in notifications, integrations, and PDFs. (#1379 (opens new window))
  • Add top-level Integrations control panel navigation for managing CRM, email marketing, element, and other payload integrations outside Settings.
  • Add site-scoped integrations that can be created and edited on production environments (allowAdminChanges = false). Existing integrations remain project-scoped and deploy via project config.
  • Add When integrations re-run settings (Integrations → Settings) with per-integration policies: once on submit (default), also when submission is edited, or custom trigger events. Integration conditions still apply. (#1429 (opens new window), #1724 (opens new window), #2591 (opens new window), #1970 (opens new window))
  • Add Use Submission User as Author to Entry element integrations, assigning the collected submission user as the entry author when Collect User is enabled on the form. (#1363 (opens new window))
  • HubSpot Map to Form integrations now resolve custom object objectTypeId values when submitting to HubSpot forms, including portal-specific custom objects (Enterprise). Refresh HubSpot forms after creating custom objects. (#2649 (opens new window))
  • Add Enable Conditions to form integration settings, allowing integrations to be triggered only when submission field and status rules match. (#447 (opens new window))
  • Add Integration Dispatch form settings (Integrations → Settings) to run payload integrations sequentially, choose immediate vs queued execution per integration, control notification timing relative to integrations, and expose dispatch results via {dispatch:handle:property} variables (for example {dispatch:user:url}). Dispatch variables appear in variable pickers when integration dispatch is enabled. (#2635 (opens new window), #1152 (opens new window), #2810 (opens new window))
  • Add durable integration and notification delivery history with encrypted diagnostics, safe retries, reconciliation tools, and support-download controls.
  • Add configurable Integration API Error Handling for Mailchimp and Campaign Monitor, classifying rate-limited and rejected payloads separately from operational failures. (#2172 (opens new window), #1990 (opens new window))
  • Add Integrations::EVENT_AFTER_TRIGGER_INTEGRATION_FAILED for handling integration failures outside the queue, and Send Email Alert for Failed Integration settings mirroring failed notification alerts. (Discussion #2579 (opens new window))
  • Add integration option sources, allowing integrations to opt in and expose selectable remote option lists to Dropdown, Radio and Checkboxes fields. (#512 (opens new window))
  • Add Mailchimp option sources for Interest Categories and Tags, using cached integration form settings and manual refresh actions from the field settings UI. (#512 (opens new window))
  • Add CRM integration option sources for HubSpot (forms and CRM properties), Salesforce, Zoho, and Microsoft Dynamics 365 picklists. (#512 (opens new window))
  • Add Salesforce Client Credentials authentication with configurable My Domain support. (#2961 (opens new window))
  • Add an event-based Microsoft Dynamics 365 entity registry for custom entities without requiring a custom integration subclass. (#2995 (opens new window))
  • Add repeater sub-field reference support with explicit row scope (first, last, index, all, count, custom row expressions) for variable tokens, notifications, conditions, and integrations. Repeater nested fields now appear once in the variable picker, with row targeting configured in the variable settings popover. (#1728 (opens new window), #1255 (opens new window), #2099 (opens new window), #1888 (opens new window), #2338 (opens new window))
  • Add console commands to inspect unresolved payments, reconcile gateway status, record verified outcomes and resume submission processing.
  • Add Stripe subscription Payment Limit field settings to cancel subscriptions automatically after a fixed or dynamic number of payments using Stripe subscription schedules. (#2123 (opens new window))
  • Add Stripe subscription Setup Fee field settings to charge a one-time fee on the first subscription invoice using Stripe invoice items. (#1767 (opens new window))
  • Migrate GoCardless payments from deprecated Redirect Flows to Billing Request Flows, including mandate fulfilment, one-off payment creation, and billing request webhooks. (#2552 (opens new window))
  • Add GoCardless recurring subscription support via Direct Debit mandate authorisation and GoCardless subscription creation after billing request fulfilment. (#2552 (opens new window))
  • Add Display Type settings to File Upload fields: File Input (Simple) keeps the native browser input and uploads files on form submit; Upload Manager (Advanced) adds a drag-and-drop zone with async staged uploads, progress, remove, and reorder controls via Formie’s upload endpoints. Existing forms default to File Input (Simple). (#133 (opens new window), #2385 (opens new window), Discussion #1692 (opens new window))
  • Add per-field Asset Data Retention settings to File Upload fields, allowing uploaded assets to be deleted after a configured duration while the submission record is kept. (#1715 (opens new window))
  • Add unique-value, match-field, text-limit, number-limit, email-format, blocked-domain, options-limit, and file-upload validation message overrides on supported field types. (#1475 (opens new window))
  • Add existing and synced fields to Group fields from the form builder, so reusable field definitions can be placed inside independent group wrappers with namespaced handles. (#2069 (opens new window))
  • Add form group policies for allowed submission statuses, optional per-group field palettes, and new-form default profiles (stencil, templates, form defaults). Group policies inherit from global settings; allowed submission statuses are enforced at the group level. (#2717 (opens new window), #2209 (opens new window), #863 (opens new window))
  • Add optional per-form reCAPTCHA Action and Minimum Score settings for score-based modes, inheriting global Spam Protection defaults when left blank. (#2167 (opens new window), #2804 (opens new window))
  • Add Settings → Synced Fields as a read-only audit page listing shared field definitions and the forms they appear on, with a View usage link from synced fields in the form builder. (#2377 (opens new window))
  • Add a configurable field palette for the form builder, with drag-and-drop group and field organisation, per-field enable/disable, and optional palette label overrides. Replaces the legacy Disabled Field Types settings checkboxes. (#2209 (opens new window))
  • Add synced-field support for stencils, preserving shared definition links when creating new forms from a stencil. (#1677 (opens new window), #1734 (opens new window))
  • Add stencil scopes so developers can ship starter forms in project config while content editors can create and manage their own stencils in the control panel. (#2814 (opens new window))
  • Add Form Groups for control panel organisation. (#1039 (opens new window), #662 (opens new window))
  • Add a dedicated Settings → Defaults control panel page for form, field, and notification defaults. (#863 (opens new window))
  • Show field handles in the form builder when the Craft user preference Show field handles in edit forms is enabled (admin users only), with a copy-to-clipboard control on hover. (#2279 (opens new window))
  • Show an Encrypted padlock badge on fields in the form builder when Enable Content Encryption is turned on. (#2332 (opens new window))
  • Add an optional Other choice for Radio fields, with a configurable label and free-text input on the front-end. (#1875 (opens new window))
  • Add password validation settings to the Password field: minimum length, and requirements for uppercase, lowercase, and special characters. (#1880 (opens new window))
  • Add a Unique User Email setting to Email Address fields, to reject email addresses already associated with a Craft user account. (#1151 (opens new window))
  • Add global Allowed domains email rules under Settings → Spam Protection → Email Rules. Allowlisted domains or full email addresses skip global blocked-domain and free-provider checks only; other spam screening still applies. (#2335 (opens new window))
  • Add craft.formie.ref() and craft.formie.refField() for building variable-picker-compatible reference tokens from Twig when overriding settings such as submitActionMessage. See Reference tokens. (#2838 (opens new window))
  • Add Lock Field Settings and Editor Note on the field editor Advanced tab to help content authors protect important field configuration. Locking dims field settings until Unlock is clicked for the session; notes appear in the field editor banner. (#1189 (opens new window))
  • Add Field Error Announcement plugin setting (Settings → Forms) to control how front-end validation and submit errors are announced to screen readers (polite, assertive, or off). Live validation while typing always uses polite announcements. (#2505 (opens new window))
  • Add scoped Submission Limits per form: cap all submissions for a form (closes the form when reached), submissions per IP address, or submissions per logged-in user, over configurable periods. Discussion #1939 (opens new window)
  • Add a Template default value source for Hidden fields using sandboxed Craft object templates. Resolved server-side on render and submit; posted values are ignored. Custom Value behaviour is unchanged. (#2605 (opens new window))
  • Add rich text editing for field Instructions, including Craft entry links with target="_blank", configurable via rich-text.json under fields.instructions. Legacy plain-text and markdown instructions are normalized automatically without migration. (#724 (opens new window))
  • Add Craft-style attribute maps and merge helpers for setFieldSettings() field overrides, including mergeInputAttributes and mergeContainerAttributes. (#2510 (opens new window))
  • Add a Note builder field for form-builder guidance with Tip, Warning, Info, and Error styles. (#2498 (opens new window))
  • Add a Rich Text cosmetic field for WYSIWYG content in the form builder, configurable via rich-text.json under fields.content. (#1028 (opens new window), #1709 (opens new window), Discussion #2070 (opens new window), Discussion #772 (opens new window))
  • Add a syntax-highlighted HTML code editor for HTML cosmetic fields in the form builder, with project config via html.json. (#2181 (opens new window))
  • Add a Custom Field form-builder field backed by opt-in Craft field adapters. (#2208 (opens new window))
  • Add Google Maps field support to Custom Field fields. (#625 (opens new window))
  • Add Maps field support to Custom Field fields. (#626 (opens new window))
  • Add Craft Link field support to Custom Field fields, covering URL, email, phone and SMS link values. (#718 (opens new window))
  • Add dynamic Option Source settings for Dropdown, Radio and Checkboxes, allowing options to be populated from predefined option sets and other structured sources. (#2684 (opens new window))
  • Add a Use Searchable Dropdown setting for Dropdown fields, element relation fields when Display type is Dropdown, and Recipients when shown as a dropdown. The front end loads Formie’s combobox browser module so users can filter predefined options. (#960 (opens new window))
  • Add support for changing compatible field types in the form builder, initially limited to simple string-like fields such as Single-Line Text and Email Address. Existing submissions are not rewritten. (Discussion #2110 (opens new window))
  • Add Settings → Fields → Field Builder policy settings for Allow Multi-Select Dropdowns and Allow Phone Country Selector. When disabled, the corresponding field settings are hidden in the form builder and forced off on existing fields. (Discussion #2484 (opens new window), Discussion #2485 (opens new window))
  • Add Date Range collection to Date/Time fields when Display Type is Calendar (Advanced), using Flatpickr range mode to collect a start and end date/time. (#2011 (opens new window))
  • Add calendar date validation for Date/Time Text Inputs and Dropdowns, rejecting impossible dates (for example February 31), enforcing configured Min Date / Max Date settings on those display types, and surfacing validation errors on the offending sub-field. (#1458 (opens new window))
  • Add smart State / Province behaviour for Address fields, with Text or Dropdown when available input modes, country-dependent subdivision loading, dynamic labels (State, Province, Prefecture, and so on), optional hiding when unused, searchable dropdowns, and datalist suggestions for text fallback. (#1416 (opens new window))
  • Add table column reference support for Calculations fields with explicit row scope (first, last, index, all, count, custom row expressions). Table columns now appear in the Calculations variable picker, with row targeting configured in the variable settings popover. (#1284 (opens new window))
  • Add failed notification alert recipients by Craft user group and additional email addresses. (#2226 (opens new window))
  • Add per-rule validation message overrides via a Validation form builder tab and the validationMessages field setting, with legacy errorMessage values migrated to validationMessages.required. (#1269 (opens new window))
  • Track and display who created and last updated a form in the form builder Settings tab footer and as optional forms index columns. (Discussion #2342 (opens new window))
  • Add an Autocomplete setting to single-line and multi-line text fields in the form builder Settings tab, with a searchable list of HTML autocomplete tokens. (Discussion #2764 (opens new window))
  • Document using {env:FORMIE_*} environment variable tokens in notification recipient fields. (#2676 (opens new window))
  • Add a page setting to place the submit button at the end of the last field row. (#2542 (opens new window))
  • Add control panel submission field condition behaviour with plugin and per-form settings to follow, collapse, or ignore front-end field and page conditions when editing submissions. (#2435 (opens new window))
  • Add a default country setting for Google Places address auto-complete fields. (#2721 (opens new window))
  • Add a configurable maximum email attachment size, and validate notification attach assets in the form builder. (#2697 (opens new window))
  • Add group-scoped form and submission permissions using stable form group handles, with optional per-form dedicated permissions via a new Use Dedicated Permissions form setting. (#1426 (opens new window), #1356 (opens new window), #2489 (opens new window), Discussion #1696 (opens new window))
  • Add built-in submission guards (honeypot, minimum submit time, replay protection) via a RunSubmissionGuardsTask screen-stage workflow task and Settings → Spam Protection controls.
  • Add suspicious text detection, maximum links screening, global submission throttling, and per-IP submission throttling under Settings → Spam Protection. (#1332 (opens new window), #1154 (opens new window), #1099 (opens new window))
  • Add Theme setting for Friendly Captcha (light/dark/auto). (#2907 (opens new window))
  • Add extensible TipTap nodes, marks, toolbar controls, and constrained TextStyle definitions across Formie editing, previews, and PHP rendering, including opt-in font family, font size, text/background color, line height, and Small caps controls.
  • Add csrfInput render option to control Craft CSRF hidden input output (true default, false to omit, or an options array such as { async: true } for statically cached pages). (#2121 (opens new window))
  • Add Enable Multi-Page Forms plugin setting to disable multi-page forms in the form builder. When disabled, authors cannot add pages and existing multi-page forms cannot be saved until reduced to a single page. (#2483 (opens new window))
  • Add a Last Edited By column to submission sources, tracking the Craft user who last saved a submission in the control panel. (#1403 (opens new window))
  • Add allowedSubmitMethods plugin setting to restrict form submission methods to Ajax only, page reload only, or both (#1751 (opens new window)).
  • Redesign page Client Events with a dedicated Tracking tab, support for multiple named events per page, variable picker values, and server-resolved clientEvents payloads in Ajax submit responses (#888 (opens new window)).
  • Add submission PDF downloads from the control panel and via craft.formie.generateSubmissionPdf() / craft.formie.getSubmissionPdfDownloadUrl() (#1213 (opens new window), Discussion #1273 (opens new window)).
  • Add custom variable sources via Variables::EVENT_REGISTER_VARIABLES, exposing registered tokens in the variable picker and resolving them server-side when references are parsed. (#898 (opens new window))
  • Add an includeFlatpickrCss plugin setting to disable Formie’s bundled Flatpickr stylesheet when your project already provides its own. (#2341 (opens new window))
  • Add conditional submission status rules in the form builder Settings → Submissions tab, evaluated on the front end during submission processing. (#508 (opens new window))
  • Add conditional redirect rules under Behaviour → After Submit, with an optional Enable Redirect Rules toggle that overrides the default submit action when conditions match. (#830 (opens new window))
  • Add a stock Form Preview slide-out in the form builder, rendering the current form with Formie’s default templates, CSS, and JavaScript. (#370 (opens new window))
  • Add submission UID to the control panel submission sidebar and as an optional submissions index column. (#2404 (opens new window))
  • Add an opt-in setting to disable the submit button until the current page passes validation. (#1514 (opens new window))
  • Add Ajax-safe tab link state theme keys tabLinkCurrent and tabLinkInactive, with aliases for pageTabLinkActive, pageTabLinkInactive, and pageInactive (#1279 (opens new window)).

Changed

  • Require Craft CMS 5 and PHP 8.2+.
  • Rebuild the form builder around React, schema-driven settings, and shared Plugin Kit components.
  • Replace the legacy bundled front-end theme/runtime with package-based browser and framework runtimes for server-rendered and client-rendered forms.
  • Route controller, managed client, GraphQL, draft, payment, notification, and integration processing through the staged submission workflow.
  • Move integration settings to PHP-defined schemas and front-end integration, captcha, address, payment, and field behavior to client modules.
  • Replace the Dropdown, Radio and Checkboxes option-table Disabled column with a row-menu Visible / Hidden / Disabled availability control (#1816 (opens new window)). Hidden removes an option from the front-end form while preserving stored submission values and labels; Disabled renders the option with HTML disabled so it stays visible but cannot be selected. Legacy disabled: true option rows are treated as hidden. Non-default states are indicated in the options table with row background tints.
  • Rework multi-site propagation and translation to use each form’s source site (where it was created) instead of Craft’s global primary site. “Same language” and “Same site group” propagation modes now filter from the source site. Forms store a persisted sourceSiteId. (#84 (opens new window))
  • Stop routing user-authored form content (labels, placeholders, messages, options) through the formie translation category. Form copy is output from the database after site overrides are merged; formie.php is for Formie-owned UI strings only (#2907 (opens new window)).
  • Replace text-limit counter {startTag}{num}{endTag} translation strings with Craft plural syntax and wire translated counter copy on the front end. (#2526 (opens new window))
  • Stream CSV/text report exports row-by-row to disk for memory-safe large datasets (#2497 (opens new window)).
  • Use stable field references and normalized field values across notifications, calculations, conditions, integrations, GraphQL, exports, and historical submission content.
  • Update phone number values sent to integrations to use E164 format instead of international formatting. (Discussion #2731 (opens new window))
  • Improve integration queue job descriptions and debug output with form context (formId, formHandle, formTitle). (#2172 (opens new window))
  • OAuth integration redirect URIs now default to a Craft action URL instead of a site URL. Add an optional OAuth Redirect URI Override plugin setting. (#1333 (opens new window))
  • Store incomplete submissions and pending uploads in database-backed, tokenized records with expiry, capability checks, garbage collection, and idempotent payment replay handling.
  • Replace self-referential synced fields with shared definitions and per-form placements, and update stencils to use snapshot semantics and stable field-reference remapping.
  • Improve Submission Limits form settings UX (Apply Limit To, consolidated messaging) and clarify the distinction from global Submission Throttling abuse controls. Add Submission Limits author documentation. Discussion #1939 (opens new window)
  • Improve HTML and Rich Text cosmetic field builder previews and control panel submission views to show rendered output instead of raw source where appropriate. (#2182 (opens new window))
  • Move Agree field checked/unchecked display labels to the Settings tab and clarify that submissions store a boolean; use getFieldValueAsString() for Yes/No-style output. (#2288 (opens new window))
  • Replace custom static-cache refresh snippets with built-in token refresh behavior and tighten anonymous route, CORS, file-upload, callback, and webhook handling.
  • Freeform 4/5 plugin migrations now process submissions in batches (default 100) to avoid memory exhaustion on large forms. Use php craft formie/migrate/freeform4 (or freeform5) with --batch-size, --submission-offset, --submission-limit, --submissions-only, and --skip-submissions for large migrations. (#2513 (opens new window))
  • Improve default theme color contrast for WCAG 2.2 AA — darker error text, muted helper text, and border-only control styling with split border tokens (#2475 (opens new window)).

Fixed

  • Fixed rate-limit bypass, CSRF, XSS, information disclosure, payment verification, XML injection, submission permission, and redirect URL vulnerabilities.
  • Fix file-upload security checks for MIME types, extensions, active content, and filename normalization.
  • Fix plugin uninstall via project-config/apply failing when Formie stencil project config is removed after the formie_stencils table has already been dropped. (#1710 (opens new window))
  • Fix plugin migrations failing on production when allowAdminChanges is disabled because migrations attempted to write plugin settings to project config. (#2615 (opens new window))
  • Fix captcha provider credentials saved in the control panel being wiped when project config syncs on deploy. Site-scoped captcha settings are now preserved across deployments. (#2407 (opens new window))
  • Fix Salesforce integrations failing after Craft 5 / Formie 3 upgrades when OAuth tokens were migrated without instance_url, by falling back to stored integration settings and backfilling token values. (#2492 (opens new window))
  • Fix Stripe payments failing with “Invalid email address” when Payment Receipt is enabled but the mapped receipt email resolves empty (for example legacy {field.email} tokens or User Email while logged out). (#2262 (opens new window))
  • Fix payment amount parsing for locale-formatted dynamic values (for example 1,234.56, 1.750,00, and £750.00) on both the server and in the browser payment modules. (#2334 (opens new window))
  • Fix payment follow-up states (such as 3D Secure authentication) showing as red validation errors. Action-required and pending payment responses now render as neutral form notices, and Ajax submit payloads include paymentStatus, paymentMessage, paymentAction, and paymentDecision metadata. (#2660 (opens new window))
  • Fix external redirect payments (for example Mollie) leaving users on the status polling page when payment fails. Failed payments now redirect back to the original form URL with a flash error message. (#2502 (opens new window))
  • Fix Stripe and other payment follow-up submits re-validating one-time captcha tokens (for example reCAPTCHA v2 checkbox and hCaptcha), which caused duplicate-token spam failures on the second Ajax POST. Incomplete continuation submits now skip captcha screening, matching replay-token behaviour. (#2465 (opens new window))
  • Fix Opayo, Stripe, Paddle, and GoCardless payment integrations not resolving Billing Details field mappings from the form builder static table, so Name and Address fields are included in payment payloads again. (#2617 (opens new window))
  • Fix OAuth integrations reporting a successful connection when their access token was not persisted. (#2961 (opens new window))
  • Fix Zoho picklist mappings sending option metadata IDs instead of their API values. (#2959 (opens new window))
  • Fix User element integration silently skipping group assignment when a configured group UID no longer resolves. (#2909 (opens new window))
  • Fix Group nested field values being ignored in submission title format tokens and Element/integration field mappings when the picker stored a child field reference. (#2922 (opens new window))
  • Fix queued integrations losing submit-time context (referrer, IP address, HubSpot/Pardot tracking cookies) by persisting request metadata on the submission at submit time and hydrating integration context from it in queue workers. (#1379 (opens new window))
  • Fix Salesforce integration refresh failing when an enabled object such as Opportunity or Case is unavailable in the connected org. (#1551 (opens new window))
  • Fix Marketo OAuth connect failing when an empty scope parameter is sent with the client-credentials grant, and normalize API domains that include a trailing /rest segment. (#2718 (opens new window))
  • Fix Mailchimp integrations not exposing or formatting Address merge fields, which prevented mapping Formie Address fields to Mailchimp audiences that require ADDRESS data. (#2387 (opens new window))
  • Improve Pardot integration errors when an account does not support API v4 (legacy Pardot Classic). (#2642 (opens new window))
  • Fix Upload Manager returning “Invalid file upload field” when a File Upload field is nested under a Group (and related nested content-key paths), and writing staged asset ids under the correct nested input names. (#2948 (opens new window))
  • Fix Recent Submissions widget breaking the control panel because WidgetsVendorAsset published from a src/ path that is not shipped in the package (#2939 (opens new window)).
  • Fix required File Upload fields using Upload Manager never passing client-side validation after a successful upload. (#2924 (opens new window))
  • Fix phone country dropdown flags not appearing on Craft Cloud. Flag sprites are inlined in the front-end bundle instead of loading from relative CSS asset paths. (#2529 (opens new window))
  • Fix file upload assets being deleted when trashing a submission with File Uploads → Delete files enabled, so restored submissions keep their uploaded files. (#1258 (opens new window))
  • Skip notification email attachments when the asset file cannot be read, instead of failing the entire send. (#2626 (opens new window))
  • Fix file upload validation allowing extensions such as .jfif that Craft cannot save as assets. (#2716 (opens new window))
  • Fix File Upload fields failing on submit when no upload location is set, by requiring the setting in the form builder and falling back to the plugin default volume when configured. (#2597 (opens new window))
  • Fix Ajax and multi-page File Upload fields losing their uploaded-file summary after step navigation or when editing existing submissions. (#2742 (opens new window), #1856 (opens new window), #1910 (opens new window))
  • Fix File Upload fields inside Repeater or Group fields not initializing upload persistence for nested inputs. (#1448 (opens new window))
  • Fix ActiveCampaign Email marketing contact payloads sending blank unmapped properties (now array_filter’d like the CRM path). (#2934 (opens new window))
  • Fix status-change notifications never sending: the trigger compared Submission::getStatus() as a status model, but it returns the handle string. (#2931 (opens new window))
  • Fix control panel submission saves running visitor page-flow and new-submission semantics on editExisting requests, which blocked status-change notifications, flipped completed submissions to incomplete, and overwrote the selected status. (#2932 (opens new window))
  • Fix form import with Update existing form not removing notifications deleted before export. Empty notifications arrays in the import payload now replace the form’s notifications instead of being ignored. (#1941 (opens new window))
  • Fix notification email preview and send failing when both From Name and From Email are set. (#2698 (opens new window))
  • Fix Recipients fields preserving the selected option label when multiple recipient options send to the same email address, using encrypted row identity tokens while keeping recipient emails private in front-end markup. (#2382 (opens new window))
  • Fix option field values appearing empty in notification “All Form Fields” summaries when options were overridden via Twig setFieldSettings(), by applying persisted submission snapshots when loading forms for email/export and falling back to stored option values when labels cannot be resolved. (#2350 (opens new window))
  • Sanitize notification queue job debug data to valid UTF-8 before re-serializing failed jobs, preventing queue rows from becoming unreadable when submission content contains invalid byte sequences. (#2344 (opens new window))
  • Improve notification mailer failure logging when Craft returns no transport error message, including CLI/queue context to help diagnose cron-only send failures. (#2610 (opens new window))
  • Validate literal email addresses in notification recipient settings so invalid addresses are caught when saving notifications. (#2712 (opens new window))
  • Fix email notification preview failing when a recipient setting references a non-email field. (#2537 (opens new window))
  • Fix final submit validating only the current page when a later page is conditionally hidden — isLastPage() / isFirstPage() now accept the submission so they skip unreachable pages the same way as getNextPage(). (#2927 (opens new window))
  • Fix page (and other form-builder) conditions showing an empty Value dropdown for Submission Status by always supplying status select options. (#2925 (opens new window))
  • Fix CP submission edit (Follow field conditions) always hiding pages whose conditions use {submission:*} tokens — the client now evaluates those from a submission snapshot instead of treating them as missing fields. (#2925 (opens new window))
  • Fix headless/Ajax validation error messages using the wrong locale by applying the target site language at submission time (#1545 (opens new window)).
  • Apply spam behaviour (success/message) without attempting to persist discarded spam submissions when Save spam submissions is disabled, avoiding failed saves under bot load. (#2818 (opens new window))
  • Fix page-reload single-line and multi-line text limit validation rerenders so field error styling, form-level error messages, and scroll/focus behaviour match ajax submissions. (#1997 (opens new window))
  • Fix Address and other fixed-parent sub-field settings being unavailable in the form builder by restoring on-demand field type config loading for nested sub-field types. (#1416 (opens new window))
  • Fix submission status filters in the control panel returning no results when submissions were saved without a persisted statusId, and resolve status queries by display name as well as handle. (#2687 (opens new window))
  • Fix form usage counts and the form builder Usage tab omitting entries on disabled Craft sites. (#2612 (opens new window))
  • Fix the form builder Usage tab not listing elements that reference a form on non-primary sites, including when Craft stores a relation without a specific sourceSiteId. (#2695 (opens new window))
  • Fix dropdown field options not saving in the form builder when no default option is selected. (#2795 (opens new window))
  • Fix replacing a deleted field with a new field using the same handle requiring a two-step save in the form builder. (#1854 (opens new window))
  • Fix missing page-list validation indicators in the form builder when a form has no pages. (#2786 (opens new window))
  • Keep field error live regions mounted without reserving empty layout space, honour the configured announcement priority, and associate definition-driven errors with their controls. (#2954 (opens new window))
  • Fix required Multi-line Text fields with Rich Text enabled being skipped by client-side validation — the backing <textarea> lives in a display: none wrapper, so visibility is now judged from the rich-text editor host instead. (#2947 (opens new window))
  • Fix field validation errors relying on aria-errormessage alone — also merge the error message id into aria-describedby (keeping any instruction ids) so assistive tech with weak aria-errormessage support still announces the error. (#2946 (opens new window))
  • Fix element-field variable tokens with a property selector resolving empty (e.g. {field:<ref>:title}). Unindexed selectors now resolve against related elements and join multi-value results. (#2930 (opens new window))
  • Fix rich text toolbars always showing only Bold/Italic — pass buttons / linkOptions to pk-tiptap-editor instead of the obsolete *Attr prop names so configured buttons reach the element. (#2929 (opens new window))
  • Fix submitting a filled Date/Time field throwing Undefined property: DateFieldValue::$date during validation when resolving nested date/time paths (including Date fields inside Group/Repeater). (#2923 (opens new window))
  • Fix date dropdown fields rejecting year-only values with “Year cannot be blank” when other date parts are disabled. Partial date parts are stored via DateFieldValue without requiring a full calendar date. (#2261 (opens new window))
  • Fix Google Maps API script conflicts when Address field autocomplete and the Google Maps Craft plugin are used on the same page. Formie reuses an existing window.google instance instead of injecting a second Maps script. (#2041 (opens new window))
  • Fix Phone field country selector labels not respecting the field’s Country Language setting. (#2042 (opens new window))
  • Fix required asterisk indicator not appearing on Agree fields when the field label is hidden and consent copy is shown on the checkbox label. (#2333 (opens new window))
  • Fix Summary field Ajax refreshes ignoring custom themeConfig classes by round-tripping render-time theme config through the summary HTML endpoint (#1721 (opens new window)).
  • Skip client-side validation for fields disabled by conditional logic, and disable conditionally hidden submit buttons so Enter no longer triggers hidden submit/next actions. (#2727 (opens new window), #1136 (opens new window), Discussion #1628 (opens new window))
  • Bound spam keyword scanning and spam log payloads so very large field values cannot stall PHP workers during spam handling. (#2065 (opens new window))
  • Fix Signature fields intermittently showing a misleading “browser does not support” message on multi-page forms, conditional fields, and late layout by retrying canvas sizing, watching visibility changes, and showing accurate status copy when initialization fails. (#2708 (opens new window))
  • Fix Dropdown, Radio and Checkboxes Disabled option availability not outputting HTML disabled on the front-end form. (#1816 (opens new window))
  • Prompt for confirmation when closing a field settings overlay with Escape (or backdrop/header close) only when the field has unsaved changes. Untouched new fields close immediately. (#2219 (opens new window))
  • Fix checkbox fields saving their default option values when explicitly unchecked on submit. (#2457 (opens new window))
  • Fix the Dutch translation mapping Auto to Automatisch, which incorrectly changed checkbox labels and values meaning “car”. (#2636 (opens new window))
  • Generate translatable date picker placeholders from the configured date and time formats when no custom placeholder is set. (#2464 (opens new window))
  • Initialise captcha placeholders immediately when multipage forms change page via tabs or Ajax Next, so Friendly Captcha and other providers mount on the visible page before submit. (#1893 (opens new window))
  • Tear down Cloudflare Turnstile widgets with remove() during remounts and apply CSP nonces to dynamically loaded captcha scripts where available, reducing console noise on strict CSP hosts. (#2535 (opens new window))
  • Wait for reCAPTCHA Enterprise readiness before executing score/policy challenges on multipage navigation. (#2224 (opens new window))
  • Fix redirect Entry selections on the Behaviour tab (and stencils) never persisting because save read submitActionEntryId instead of the posted submitActionEntry list. (#2926 (opens new window))
  • Fix rich-text links to internal pages opening in a new tab including rel="noopener noreferrer nofollow". Internal links now omit the attribute; external links keep it. (#2604 (opens new window))
  • Fix submit button conditions not applying on the front end. (#2568 (opens new window))

Deprecated

  • Deprecate legacy form render IDs, asset helpers, render options, runtime-named classes and JavaScript translation hooks in favor of the new render IDs, formAssets() / frontendAssets() helpers, client/frontend naming, and package-based runtimes.
  • Deprecate legacy HTML tag APIs in favor of slot tag APIs.
  • Deprecate JSON, variable, email, and legacy key field-value APIs in favor of array, reference, and reference-block APIs.
  • Deprecate legacy custom field schema, preview, and input-template APIs in favor of defineFormBuilder*Schema(), defineFormBuilderPreviewSchema(), and getInputTemplatePath().
  • Deprecate legacy integration settings, front-end variables, payment processing, and submission dispatch helpers in favor of schema settings, client modules, and workflow services.
  • Deprecate legacy Formie DOM and validator events, GraphQL client-event setting names, refresh-token parameters, theme config keys, and schema config keys.
  • Deprecate the PredefinedOptions service and namespace in favor of OptionSources and the verbb\formie\options\predefined namespace.

Removed

  • Remove the legacy CustomElement submission model, FieldLegacy trait, Formie 3 field inputHtml() fallback, and expired field name helpers.
  • Remove the old JavaScript form bus, built-in front-end bundle assumptions, and getFrontEndJsVariables() integration API.
  • Remove the Duplicate, JavaScript, and Honeypot captcha integrations and the Algolia address provider.
  • Remove file, Redis, Memcached, and session-backed submission progression; Formie 4 uses database-backed state and no longer exposes submissionStateMode or submissionStore.
  • Remove enableGatsbyCompatibility and direct templateHtml usage from the primary GraphQL rendering path.
  • Require GraphQL submission mutations to pass the applicable submission guards and a bootstrap requestToken for headless transports.