v5.17.7

Added

• Added a saved-form purge event for TTL and session-limit cleanup, including headless drafts, with deleted record identifiers and cleanup reason for custom integrations.

Changed

• Clarified reCAPTCHA setup instructions and integration help text to distinguish Google Cloud keys using legacy verification from native Enterprise API support.

Fixed

• Fixed Freeform GraphQL interface resolution when a GraphQL type prefix is configured.
• Fixed GraphQL schemas including submission types for forms outside the schema's submission permissions.
• Fixed stale GraphQL form-read permissions after switching schemas.
• Fixed GraphQL mutation arguments using another form's fields when rebuilding a schema with cached submission types.
• Fixed unnecessary field metadata processing slowing down GraphQL requests, including queries that do not use Freeform.
• Fixed searchable Dropdown and Multi-Select fields appearing twice in the form builder Preview.
• Fixed duplicate searchable-select arrows in daisyUI 5 sample formatting templates.
• Fixed searchable field heights in Bootstrap 5 templates and missing or low-contrast search hints in floating-label and dark templates.

Security

• Fixed a submission read-permission bypass that could allow control panel users to access submissions from unauthorized forms, including through element indexes and exports. Credit to kta1kri for reporting.
• Updated dependencies to address credential disclosure and denial-of-service vulnerabilities.