Merge branch '5.9' into 6.x

# Conflicts:
#	CHANGELOG-WIP.md
#	composer.json
#	composer.lock
#	src/Field/Matrix.php
#	src/config/app.php
#	src/controllers/FieldsController.php
#	src/controllers/UpdaterController.php
#	src/migrations/Install.php
#	src/services/Entries.php
#	src/services/Gc.php
#	yii2-adapter/legacy/elements/User.php
#	yii2-adapter/legacy/helpers/StringHelper.php
#	yii2-adapter/legacy/services/Search.php
#	yii2-adapter/legacy/web/BaseSpreadsheetResponseFormatter.php
#	yii2-adapter/legacy/web/CsvResponseFormatter.php
#	yii2-adapter/legacy/web/XlsxResponseFormatter.php
#	yii2-adapter/legacy/web/YamlResponseFormatter.php
#	yii2-adapter/tests-laravel/Legacy/helpers/StringHelperTest.php

Author: riasvdv

CHANGELOG.md

@@ -2,10 +2,28 @@
 
 ## Unreleased
 
+- Fixed a bug where Matrix fields’ Entry Types settings were partially interactive when admin changes were disallowed. ([#18145](https://github.com/craftcms/cms/pull/18145))
+- Fixed a bug where users could be unable to sign in if an inactive user account existed with the same email address. ([#18148](https://github.com/craftcms/cms/issues/18148))
+- Fixed a bug where Content Block fields could appear to be missing their content when viewing a revision. ([#18149](https://github.com/craftcms/cms/issues/18149))
+- Fixed a bug where Dropdown and Radio Button fields weren’t handling `:empty:`/`:notempty:` element query params properly for options with blank values. ([#18156](https://github.com/craftcms/cms/issues/18156))
+- Fixed a bug where chip icons were getting rounded. ([#18163](https://github.com/craftcms/cms/pull/18163))
+- Fixed a bug where object templates that included another template were missing variables. ([#18165](https://github.com/craftcms/cms/issues/18165))
+
+## 5.8.21 - 2025-12-04
+
+- Improved the performance of saving nested elements on multi-site installs with a custom propagation method. ([#18126](https://github.com/craftcms/cms/issues/18126))
 - Fixed a bug where remove buttons within multi-select Selectize inputs weren’t working if the input wasn’t focusend and fully in view. ([#18079](https://github.com/craftcms/cms/issues/18079))
 - Fixed an error that could occur when executing a GraphQL mutation when the `lazyGqlTypes` config setting was enabled. ([#18014](https://github.com/craftcms/cms/issues/18014))
+- Fixed a PHP error that could occur when creating a username that began or ended with an `@`. ([#18123](https://github.com/craftcms/cms/pull/18123))
+- Fixed a bug where assets with disallowed file extensions could be stored in the system’s temp directory. ([#18049](https://github.com/craftcms/cms/pull/18049))
 - Fixed a bug where font icons weren’t hidden from screen readers. ([#18078](https://github.com/craftcms/cms/pull/18078))
 - Fixed a bug where relation fields weren’t handling `:empty:`/`:notempty:` element query params properly if the field had multiple instances within a field layout. ([#18092](https://github.com/craftcms/cms/pull/18092))
+- Fixed a bug where user preferences were being respected for users who formerly had access to the control panel.
+- Fixed a bug where nested entries could be reordered when their owner element was resaved programmatically. ([#18121](https://github.com/craftcms/cms/pull/18121))
+- Fixed RCE vulnerabilities. (GHSA-255j-qw47-wjh5, GHSA-742x-x762-7383)
+- Fixed an SSRF vulnerability. (GHSA-x27p-wfqw-hfcc)
+- Fixed a DoS vulnerability. (GHSA-v64r-7wg9-23pr)
+- Fixed an information disclosure vulnerability. (GHSA-53vf-c43h-j2x9)
 
 ## 5.8.20 - 2025-11-18
 

composer.json

@@ -50,6 +50,7 @@
     "league/uri": "^7.0",
     "moneyphp/money": "^4.0",
     "phpdocumentor/reflection-docblock": "^5.3",
+    "phpoffice/phpspreadsheet": "^5.3",
     "pixelandtonic/imagine": "~1.3.3.1",
     "pragmarx/google2fa": "^8.0",
     "pragmarx/recovery": "^0.2.1",