v3.93.0

v3.93.0 (2026-11-04)

⚠️ Contains vital security updates. We encourage updating as soon as possible.

🚀 Features

• add auth.passwordHashIterations for environments that limit PBKDF2 (3.x) (#19074) (488f183)

🐛 Bug Fixes

• enforce block child read access in queries (21bdbbf)
• restrict blocks to each field's configured types (cfa60ea)
• enforce pasteURL restrictions on remote URL uploads (9071e58)
• apply xml response policy to xsl content (50d25f2)
• constrain global view redirects to available tenants (63a3a69)
• preserve shared localized draft changes (3.x backport of #17367) (#17394) (49b3c0b)
• resolve config labels before interpolating them into strings (#19209) (9c37160)
• prevent error in sendEmail due to empty from recepient (#18189) (aaea87b)
• delete the browser upload when a processed client upload replaces it for upload-thing storage (#19012) (8995c00)
• drizzle: lazily load drizzle kit tooling (3.x) (#17660) (d89c7c8)
• next: clamp description param on og endpoint (a56cc64)
• richtext-lexical: escape stored values in HTML converters (bed603f)
• ui: translate document drawer labels (3.x) (#19154) (b4e131c)
• ui: prevent duplicate autosaves from virtual field updates (#19096) (ef1bb73)
• ui: translate the collection label in the create new card button (3.x) (#19116) (04ec212)

⚙️ CI

• skip content api tests for audit deps PRs (3.x) (#19300) (59c52a7)
• port audit-dependencies action to 3.x (#19118) (8bbd52e)

🤝 Contributors

• Patrik (@PatrikKozak)
• Jarrod Flesch (@JarrodMFlesch)
• Sasha (@r1tsuu)
• Alessio Gravili (@AlessioGr)
• Elliot DeNolf (@denolfe)
• German Jablonski (@GermanJablo)
• Jessica Rynkar (@JessRynkar)
• Nate Lentz (@nathanlentz)
• Jake Fletcher (@jacobsfletch)