Update craftcms/cms requirement from ^3.1.0 to ^5.10.6

[dependabot]

Updates the requirements on craftcms/cms to permit the latest version.

Release notes

Sourced from craftcms/cms's releases.

5.10.6

• Forward slashes in query strings are now encoded. (#19057)
• Added craft\controllers\EVENT_BEFORE_SAVE_IMAGE. (#19068)
• Added craft\events\SaveAssetImageEvent. (#19068)
• Added craft\web\Request::getPreviewParam().
• Updated Axios to 1.17.0. (#19053)
• Fixed a bug where no-cache and X-Robots-Tag: none headers weren’t always being sent for requests with x-craft-preview or x-craft-live-preview query string params. (#19060)
• Fixed a bug where the “Delete” element edit page action wasn’t working properly when editing a provisional draft.
• Fixed a bug where craft\helpers\App::parseEnv() wasn’t returning boolean values for environment variable names that resolved to true/false values. (#19029)
• Fixed a bug where the submit button within Live Preview was labelled “Submit” rather than “Save”. (#19056)
• Fixed a bug where the selected site wasn’t being remembered after saving an element. (#19054)
• Fixed a bug where transformed SVG images could have two sets of width and height attributes. (#1902w7)
• Fixed an infinite recursion bug. (#19063)
• Fixed a JavaScript error that could occur if there was an error rendering an element condition rule’s Twig template.
• Fixed a bug where relational fields’ element selector modals weren’t showing any results if they were configured to only relate to elements in a specific site, and the author didn’t have permission to access that site. (#19078)
• Fixed a bug where element cards were showing preview values for conditionally-hidden fields. (#19064)
• Fixed a bug where some bulk element actions could exhaust the memory limit on large selections. (#19070)
• Fixed a SQL error that could occur when uploading an asset, if it contained non-UTF-8 alt text in its metadata. (#19069)
• Fixed an error that could occur when editing an entry if a soft-deleted user had recently edited the same entry. (#19081)
• Fixed a PHP error that occurred when setting general config settings via config/general.console.php or config/general.web.php. (#19083)
• Fixed a bug where address cards would show “0, 0” for Longitude/Latitude values when neither field had been populated. (#19093)
• Fixed a bug where field conditions within Matrix blocks weren’t always working when editing the owner element in a slideout. (#19084)
• Fixed a bug where verification code inputs weren’t always getting autofilled by password managers. (#19094)
• Fixed a bug where the “Use defaults” button in element index view menus wasn’t being shown automatically after a column header was pressed on. (#19101)
• Fixed a styling issue.
• Fixed high-severity RCE vulnerabilities.
• Fixed a high-severity information disclosure vulnerability.
• Fixed a moderate-severity authorization bypass vulnerability.
• Fixed a low-severity information disclosure vulnerability.
• Fixed a low-severity potential path traversal vulnerability.

Changelog

Sourced from craftcms/cms's changelog.

5.10.6 - 2026-06-16

• Forward slashes in query strings are now encoded. (#19057)
• Added craft\controllers\EVENT_BEFORE_SAVE_IMAGE. (#19068)
• Added craft\events\SaveAssetImageEvent. (#19068)
• Added craft\web\Request::getPreviewParam().
• Updated Axios to 1.17.0. (#19053)
• Fixed a bug where no-cache and X-Robots-Tag: none headers weren’t always being sent for requests with x-craft-preview or x-craft-live-preview query string params. (#19060)
• Fixed a bug where the “Delete” element edit page action wasn’t working properly when editing a provisional draft.
• Fixed a bug where craft\helpers\App::parseEnv() wasn’t returning boolean values for environment variable names that resolved to true/false values. (#19029)
• Fixed a bug where the submit button within Live Preview was labelled “Submit” rather than “Save”. (#19056)
• Fixed a bug where the selected site wasn’t being remembered after saving an element. (#19054)
• Fixed a bug where transformed SVG images could have two sets of width and height attributes. (#1902w7)
• Fixed an infinite recursion bug. (#19063)
• Fixed a JavaScript error that could occur if there was an error rendering an element condition rule’s Twig template.
• Fixed a bug where relational fields’ element selector modals weren’t showing any results if they were configured to only relate to elements in a specific site, and the author didn’t have permission to access that site. (#19078)
• Fixed a bug where element cards were showing preview values for conditionally-hidden fields. (#19064)
• Fixed a bug where some bulk element actions could exhaust the memory limit on large selections. (#19070)
• Fixed a SQL error that could occur when uploading an asset, if it contained non-UTF-8 alt text in its metadata. (#19069)
• Fixed an error that could occur when editing an entry if a soft-deleted user had recently edited the same entry. (#19081)
• Fixed a PHP error that occurred when setting general config settings via config/general.console.php or config/general.web.php. (#19083)
• Fixed a bug where address cards would show “0, 0” for Longitude/Latitude values when neither field had been populated. (#19093)
• Fixed a bug where field conditions within Matrix blocks weren’t always working when editing the owner element in a slideout. (#19084)
• Fixed a bug where verification code inputs weren’t always getting autofilled by password managers. (#19094)
• Fixed a bug where the “Use defaults” button in element index view menus wasn’t being shown automatically after a column header was pressed on. (#19101)
• Fixed a styling issue.
• Fixed high-severity RCE vulnerabilities.
• Fixed a high-severity information disclosure vulnerability.
• Fixed a moderate-severity authorization bypass vulnerability.
• Fixed a low-severity information disclosure vulnerability.
• Fixed a low-severity potential path traversal vulnerability.

5.10.5 - 2026-06-02

• Added craft\base\ElementInterface::afterAssignedId().
• Fixed an error that occurred when executing the users/remove-2fa command non-interactively, if --method wasn’t provided. (#18724)
• Fixed a bug where Link fields weren’t getting updated when the “Replace relations” element deletion option was chosen. (#18992)
• Fixed a bug where it wasn’t always possible to select new categories or entries in relation fields. (#18976)
• Fixed a bug where Checkboxes and Multi-select fields weren’t handling :empty:/:notempty: params properly. (#18988, #19019)
• Fixed a bug where entries with {id} in their Default Title Format weren’t always getting created with the correct generated title. (#18991)
• Fixed an infinite recursion bug that could occur when rendering sandboxed Twig templates. (#19004)
• Fixed a styling issue. (#19010)
• Fixed a moderate-severity authorization bypass vulnerability.
• Fixed a low-severity object injection vulnerability.

5.10.4.1 - 2026-05-28

• Fixed a bug where an empty @storage/runtime directory could be created within the webroot. (#18986)

5.10.4 - 2026-05-27

... (truncated)

Commits

• 5c05570 Finish 5.10.6
• f9cb033 Merge branch '4.x' of https://github.com/craftcms/cms into 5.x
• 5e93cdc Merge branch '5.x-internal' into 5.x
• c7ea105 Finish 4.18.2
• e2188e9 Merge branch '4.x-internal' into 4.x
• 3b8b2d8 Fixed #19101
• 2c57c31 Merge pull request #19098 from craftcms/otp-autocomplete
• 9cb2e2a Release note
• f03d04d Add one-time-code autocomplete to TOTP form
• 03f4577 Fixed #19084
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #13.