4.0.3

Added

• Add a dedicated Spam Protection area with grouped navigation in Craft’s standard sidebar, matching page and panel headings, standard header Save buttons, separate provider and spam-rule permissions, and independent provider saves.
• Add sanitised installation, permissions and integration diagnostics to support bundles, with guidance to send requests from the affected environment.
• Add Salesforce token-request logging with the endpoint and grant type, excluding OAuth credentials.

Changed

• Clarify user permission labels, order spam rules before CAPTCHA and spam filtering services, remove permission info tooltips, align permission nesting with Formie’s navigation while retaining a single Select All control, limit settings permissions to production-accessible tools, and migrate legacy grants to preserve production access.
• Store CAPTCHA, spam filtering and spam-rule settings locally on each installation. Existing values are preserved during upgrade; these settings are no longer deployed through project config.
• Clarify project and instance settings for integrations, stencils, spam protection and captcha providers, including deployment and editing permissions.
• Remove the informational Widget Mode field from Cloudflare Turnstile settings.

Fixed

• Fix “Scroll To Top” having no effect after successful AJAX submissions. (#3023)
• Fix production settings navigation hiding permitted read-only pages and scheduled reports exposing unavailable editing controls.
• Fix form import, report export and scheduled report permissions depending on unrelated management permissions.
• Fix upgrading from Formie 2 failing on Date fields before form statuses have been migrated.
• Fix upgrading from Formie 2 failing on Payment fields before integration scopes have been migrated.
• Fix later migrations failing after an interrupted field-table rename, and report when missing field definitions require restoring a backup.
• Fix an error when upgrading from Formie 3 with an empty or invalid default date. (#3022)
• Fix the Settings page redirecting repeatedly when admin changes are disabled.
• Fix legacy Honeypot settings preventing forms from being created or saved, including from stencils.
• Fix project config sync overwriting or removing instance-level integrations, stencils and spam protection settings.
• Fix notification and submission properties rendering empty or being blocked by the Twig sandbox in PDF attachment filenames. (#3018)
• Fix the Defaults settings page failing to load when custom field positions use non-sequential keys. (#3017)
• Fix Date fields using Calendar (Simple) rendering text inputs instead of native date and time pickers. (#3014)
• Fix reCAPTCHA v3 failing when its script is already loaded without the configured site key.
• Fix reCAPTCHA v3 inline badges rendering outside the form. (#3016)
• Fix slow submission and sent notification indexes in the control panel on sites with many forms.
• Fix encryption warning icons appearing on a separate line from their text.
• Fix custom rendering documentation using removed methods and omitting validation markup and spam-protection inputs.