Releases: WordPress/secure-custom-fields
6.5.7
Release Date 28 Aug 2025
Features
- Flexible Content layouts can now be renamed in the post editor, giving content editors better clarity when managing layouts.
- Flexible Content layouts can now be disabled, preventing them from rendering on the frontend without needing to delete their data.
- Flexible Content layouts can now be collapsed and expanded in bulk for faster content editing.
- Editing a Flexible Content layout now highlights the layout being edited, making it easier to identify.
- The Date and Date Time Picker fields can now be configured to default to the current date.
- Custom Icon Picker tabs now work correctly when used inside an ACF Block.
- Duplicating a Field Group no longer causes a fatal error when using Russian translations.
- ACF classes no longer use dynamic class properties, improving compatibility with PHP 8.2+.
- Field group metabox collapse and expand buttons are no longer misaligned in the post editor.
- HTML is now escaped from field validation errors and tooltips.
- Added a new source parameter to the /wp/v2/types REST API endpoint that allows filtering post types by their origin: core (WordPress built-in), scf (for SCF managed types), or other for the rest of CPTs.
Security
– Unsafe HTML in field group labels is now correctly escaped for conditionally loaded field groups, resolving a JS execution vulnerability in the classic editor.
– HTML is now escaped from field group labels when output in the ACF admin.
– Bidirectional and Conditional Logic Select2 elements no longer render HTML in field labels or post titles.
– The acf.escHtml function now uses the third party DOMPurify library to ensure all unsafe HTML is removed. A new esc_html_dompurify_config JS filter can be used to modify the default behaviour.
– Post titles are now correctly escaped whenever they are output by ACF code. Thanks to Shogo Kumamaru of LAC Co., Ltd. for the responsible disclosure.
– An admin notice is now displayed when version 3 of the Select2 library is used, as it has now been deprecated in favor of version 4.
6.5.6
Warning
Release discarded due to SVN errors.
6.5.5
6.5.4
6.5.4
Release Date 30 Jul 2025
Revert from 6.5.2.
6.5.2
Release Date 30 Jul 2025
Features
- Connect block attributes with custom fields via UI.
- Remove the word 'New' from default
add-new*label values.
6.5.1
6.5.0
Enhancements & Features
- Added Command Palette support.
- Added editor preview to acf-field source.
- Added an endpoint to retrieve the custom fields of a post type.
- Added nav menu as field type.
- Added compatibility with Woo HPOS for order fields and subscriptions. ( Ported from ACF )
- Create new options when editing a fields value on Selector. ( Ported from ACF )
- The “Escaped HTML” warning notice is now disabled by default. ( Ported from ACF )
- Added new
acf/fields/icon_picker/{tab_name}/iconsfilter ( Ported from ACF )
Bug Fixes
- Update initialization of the acfL10n object to ensure it's available globally.
- SCF Blocks are now forced into preview mode when editing a synced pattern. ( Ported from ACF )
- SCF no longer causes an infinite loop in bbPress when editing replies. ( Ported from ACF )
- Changing a field type no longer enables the “Allow Access to Value in Editor UI” setting. ( Ported from ACF )
- Blocks registered via acf_register_block_type() with a
parentvalue ofnullno longer fail to register. ( Ported from ACF ) - Fix AJAX repeater pagination. ( Ported from ACF )
- Paginated Repeater fields no longer save duplicate values when saving to a WooCommerce Order with HPOS disabled ( Ported from ACF )
Testing
- Added an initial batch of e2e tests.
6.4.2
- Uses a more stable function to validate an URL on field admin. (#106) by @cbravobernal
- Revert text domain change for the shortcode attr filter. (#101) by @pkevan
- Correct the release date in the changelog for 6.4.1 (#75) by @YanMetelitsa
Full Changelog: 6.4.1...6.4.2
6.4.1
What's Changed
- License and readme updates by @kraftbj in #2
- Update tested to version to 6.7 by @kraftbj in #4
- Update text domain and add WPCS for i18n by @kraftbj in #10
- Move the main plugin file by @kraftbj in #11
- Update language files by @kraftbj in #12
- Fixes old json in acf-json folder not showing in Sync available by @cyberwani in #30
New Contributors
- @cbravobernal made their first contribution in #28
- @cyberwani made their first contribution in #30
Full Changelog: 6.4.0-beta1...6.4.1
6.4.1-beta7
What's Changed
- Build Tools: Add NVM file and wp-env dev tools by @cbravobernal in #28
- Fixes old json in acf-json folder not showing in Sync available by @cyberwani in #30
- Docs: Add initial docs and tooling for import into developer.wordpress.org by @kraftbj in #35
- Add basic PHPUnit testing setup by @kraftbj in #29
- Tools: Add pre-release scripting by @kraftbj in #42
New Contributors
- @cbravobernal made their first contribution in #28
- @cyberwani made their first contribution in #30
Full Changelog: 6.4.1-beta6...6.4.1-beta7
6.4.1-beta6
What's Changed
- Resolve issue with option pages no longer displaying by @kraftbj in #25
- Resolve missing function from clone field by @kraftbj in #26
Full Changelog: 6.4.1-beta5...6.4.1-beta6