CiviCRM Release Notes

Thanks to the hard work of CiviCRM’s incredible community of contributors, CiviCRM version 6.16.0 is now ready to download.

This is a regular monthly release that includes new features and bug fixes. Details are available in the monthly release notes.

Your are encouraged to upgrade now for the most stable, secure CiviCRM experience:

Download CiviCRM

Users of the CiviCRM Extended Security Releases (ESR) do not need to upgrade. The current version of ESR is CiviCRM 6.10.x (supported until 5 August 2026).

Support CiviCRM

Support CiviCRM

CiviCRM is community driven and is sustained through code contributions and generous financial support.

We are committed to keeping CiviCRM free and open, forever. We depend on your support to help make that happen. Please consider supporting CiviCRM today.

Big thanks to all our partners, members, ESR subscribers and contributors who give regularly to support CiviCRM for everyone.

Credits

AGH Strategies - Alice Frumin; Agileware Pty Ltd - Justin Freeman; Artful Robot - Rich Lott; ASMAC (American Society of Music Arrangers and Composers) - Jeff Kellem; Australian Greens - John Twyman; BrightMinded Ltd - Bradley Taylor; Business & Code - Alain Benbassat; Christian Wach; Circle Interactive - Pradeep Nayak; CiviCoop - Jaap Jansma; CiviCRM - Coleman Watts, Tim Otten, Benjamin W; CiviDesk - Nicolas Ganivet; civiservice.de - Detlev Sieber, Tobias Voigt; davemoreton; Colored Cow - Tarun Joshi; CompuCo - Muhammad Shahrukh; Coop SymbioTIC - Mathieu Lutfy, Samuel Vanhove; CSES (Chelmsford Science and Engineering Society) - Adam Wood; Dave D; Freeform Solutions - Herb van den Dool; Fuzion - Luke Stewart; iXiam - Vangelis Pantazis; JMA Consulting - Edsel Lopez, Joe Murray, Seamus Lee, Celine Nicolas, Yifei Zhou; Joinery - Allen Shaw; Megaphone Technology Consulting - Jon Goldberg; MJW Consulting - Matthew Wire; Nicol Wistreich; Outlandish - Rasmus Winter; reubengrussell; Richard Baugh; Skvare - Mark Hanna, Sunil Pawar; Squiffle Consulting - Aidan Saunders; Stiftung Pfadfinden - Andreas Lietz; sushant-cividesk; Tadpole Collective - Kevin Cristiano; Wikimedia Foundation - Eileen McNaughton; Wildsight - Lars Sander-Green

New Extensions

• Case Roles - The CiviCRM Case Roles extension replaces the default CiviCRM Roles on a case.
• CiviCRM Datalayer - A CiviCRM extension that pushes GA4-compatible dataLayer events at every step of Contribution Pages and Event Registration forms, enabling Google Analytics 4 (GA4) e-commerce tracking via Google Tag Manager (GTM).
• MiscMinkTests - You wouldn't install this on a real site. It's just a collection of unit tests. But feel free to make a PR to add another test since these run regularly and once in a while catch something.
• Reimbursement - This extension helps to manage reimbursements. Reimbursements usually occur while working with applications for funding programs.
• CiviGantt - An extension that draws Gantt charts for CiviCase and CiviGrant.
• HelloAsso Webform CiviCRM - This Drupal module improves HelloAsso payments initiated by Webform CiviCRM.
• BulkSelect - Bulk Select is a CiviCRM extension that adds Select all and Select none actions to specific custom fields on contact edit screens.

View all latest extensions

Filed under Release announcements

There has been a security release for CiviCRM. Upgrades are available for:

• CiviCRM v6.15.3 (download, release notes)
• CiviCRM v6.10 ESR (info, download, release notes)

These upgrades address the following security issues:

• CIVI-SA-2026-18: Stored XSS in Job Name
• CIVI-SA-2026-19: Stored XSS in Grant Type
• CIVI-SA-2026-20: Stored XSS in Website URL
• CIVI-SA-2026-21: Stored XSS in Event Template Title
• CIVI-SA-2026-22: Stored XSS in Membership Type frontend title
• CIVI-SA-2026-23: Stored XSS in Price Field label
• CIVI-SA-2026-24: RCE via File API
• CIVI-SA-2026-25: Stored XSS in Tag Name
• CIVI-SA-2026-26: Unauthorized access to Files via APIv3
• CIVI-SA-2026-27: Stored XSS in Participant Status
• CIVI-SA-2026-28: Escalation via Extension Download API
• CIVI-SA-2026-29: Multiple Stored XSS in Mailings
• CIVI-SA-2026-30: Stored XSS in File Attachments
• CIVI-SA-2026-31: SQLI in GroupContact Create APIv3
• CIVI-SA-2026-32: Stored XSS in Profile Help
• CIVI-SA-2026-33: SQLI in OrderBy Parameters
• CIVI-SA-2026-34: SQLI in Financial Batch AJAX

Learn more about subscribing to Extended Security Releases (ESR).

Support CiviCRM

We are committed to keeping CiviCRM free and open, forever. We depend on your support to help make that happen.

• Make a donation or contribute to a Make it happen campaign.
• If your organization wants to support our work, please become a member today.
• If you are a CiviCRM service provider, please become a partner.

CiviCRM is community driven and is sustained through contributions, good vibes, solidarity, and financial support from its community. Help CiviCRM do a world of good.

Filed under Release announcements, Security Releases.

Thanks to the hard work of CiviCRM’s incredible community of contributors, CiviCRM version 6.15.0 is now ready to download.

This is a regular monthly release that includes new features and bug fixes. Details are available in the monthly release notes.

Your are encouraged to upgrade now for the most stable, secure, CiviCRM experience:

Download CiviCRM

Users of the CiviCRM Extended Security Releases (ESR) do not need to upgrade. The current version of ESR is CiviCRM 6.10.x (supported until 5 August 2026).

Support CiviCRM

Support CiviCRM

CiviCRM is community driven and is sustained through code contributions and generous financial support.

We are committed to keeping CiviCRM free and open, forever. We depend on your support to help make that happen. Please consider supporting CiviCRM today.

Big thanks to all our partners, members, ESR subscribers and contributors who give regularly to support CiviCRM for everyone.

Credits

AGH Strategies - Alice Frumin, Chris Garaffa; Agileware Pty Ltd - Justin Freeman; Antoine; ASMAC (American Society of Music Arrangers and Composers) - Jeff Kellem; Australian Greens - Andrew Cormick-Dockery; Blackfly Solutions - Alan Dixon; Brent Roose; Christian Wach; Circle Interactive - Pradeep Nayak; Civicopilot - Andy Burns; CiviCRM - Coleman Watts, Benjamin W, Tim Otten; Civiservice.de GmbH - Torben Bertram; Colored Cow - Tarun Joshi; CompuCo - Muhammad Shahrukh; Coop SymbioTIC - Mathieu Lutfy, Samuel Vanhove, Shane Bill; CSES (Chelmsford Science and Engineering Society) - Adam Wood; Dave D; Erawat Chamanont; Fuzion - Luke Stewart; Ingenieurbüro Dr. Maarten Becker - Maarten Becker; iXiam - Vangelis Pantazis; JMA Consulting - Seamus Lee; Joinery - Allen Shaw; Jon Griffin; Lemniscus - Noah Miller; lukasfelixkraft; Marvin Müller; Megaphone Technology Consulting - Jon Goldberg; MJW Consulting - Matthew Wire; Mosier Consulting - Justin Mosier; Nicol Wistreich; Passionate Bytes Solutions - Paul Bütof; Richard Baugh; Robin Bowes; Skvare - Mark Hanna; Squiffle Consulting - Aidan Saunders; Stiftung Pfadfinden - Andreas Lietz; SYSTOPIA - Daniel Hahn; Tadpole Collective - Kevin Cristiano; Wikimedia Foundation - Eileen McNaughton, Elliott Eggleston; Wildsight - Lars Sander-Green

New Extensions

• Custom Invoice Numbers and Offers - Adds functionality for custom invoice number cycles in a user chosen format and a new contribution type 'offers' with it's own number cycle, menu structure and custom displays.
• Nice Change Log - Enhances the contact Change Log tab. Shows what changed inline (no need to open each row) with client-side filters for action and component.
• Standalone Password Expire - This extension provides password expire functionality to CiviCRM standalone.
• Postmark Bounce Handler - The Postmark bounce handler CiviCRM extension helps track email bounces by listening for webhooks from the Postmark mail server and adding a contact activity indicating that the email bounced.
• E-Signature - Adds an input type of "Signature" to file fields in FormBuilder.
• SearchKit Cards - This extension adds a card display type for SearchKit, which allows you to create a responsive card grid from your SearchKit search results.
• GDPRX - This extension aims to be a toolkit to help you comply with the GDPR.

View all latest extensions

Thanks to the hard work of CiviCRM’s incredible community of contributors, CiviCRM version 6.13.0 is now ready to download. This is a regular monthly release that includes new features and bug fixes. Details are available in the monthly release notes.

Your are encouraged to upgrade now for the most stable, secure, CiviCRM experience:

Download CiviCRM

Users of the CiviCRM Extended Security Releases (ESR) do not need to upgrade. The current version of ESR is CiviCRM 6.10.x (supported until 5 August 2026).

Support CiviCRM

Support CiviCRM

CiviCRM is community driven and is sustained through code contributions and generous financial support.

We are committed to keeping CiviCRM free and open, forever. We depend on your support to help make that happen. Please consider supporting CiviCRM today.

Big thanks to all our partners, members, ESR subscribers and contributors who give regularly to support CiviCRM for everyone.

Credits

AGH Strategies - Alice Frumin; alexandreSymbiotic; Andy Burns; Benjamin W; CiviCRM - Coleman Watts, Tim Otten; CompuCo - Muhammad Shahrukh; Coop SymbioTIC - Mathieu Lutfy, Shane Bill; Dave D; Francesc Bassas i Bullich; JMA Consulting - Monish Deb, Seamus Lee; Joinery - Allen Shaw; Megaphone Technology Consulting - Jon Goldberg; MJW Consulting - Matthew Wire; Mosier Consulting - Justin Mosier; Nicol Wistreich; Progressive Technology Project - Jamie McClelland; Richard Baugh; Squiffle Consulting - Aidan Saunders; Third Sector Design - Kurund Jalmi; Wikimedia Foundation - Eileen McNaughton; Wildsight - Lars Sander-Green; Youth Apostles Institute - John Volk; Agileware - Justin Freeman; All In Appli.com - Guillaume Sorel; Artful Robot - Rich Lott; backofficeteam; Christian Wach; civiservice.de; CSES (Chelmsford Science and Engineering Society) - Adam Wood; Giant Rabbit - Eli Lisseck; JMA Consulting - Joe Murray; Jonny Toomey; Korlon - Stuart Gaston; Tadpole Collective - Kevin Cristiano; Third Sector Design - William Mortada

New Extensions

• Paypal - Adds Paypal Complete Payments support for FormBuilder.
• IdealPostcodes - Turns CiviCRM "Street Address" field into modal based all-in-one address lookup field. A modern UK address autocomplete for CiviCRM forms using the Ideal Postcodes Address Finder AP.
• Optimized Batcher for CiviSepa - Optimized batching functionality for CiviSepa. When pressing update recurring, an alternative method of creating pending contributions used.

View all latest extensions

Filed under Release announcements

There has been a security release for CiviCRM. Upgrades are available for:

• CiviCRM v6.12.1 (download, release notes)
• CiviCRM v6.10 ESR (info, download, release notes)

Update 2026-03-24: 6.12.2 has been released to fix a few bugs:

• CiviCRM v6.12.2 (download, release notes)
• CiviCRM v6.10 ESR (info, download, release notes)

There is still one known bug with Price Set labels being incorrectly escaped.

These upgrades address the following security issues:

• CIVI-PSA-2026-01: Quickform Widgets
• CIVI-SA-2026-01: File API: Remote Code Execution
• CIVI-SA-2026-02: Standalone: Session Fixation
• CIVI-SA-2026-03: Standalone: Extraneous Staff Permission
• CIVI-SA-2026-04: Accounting Batches (XSS)
• CIVI-SA-2026-05: APIv3 Explorer (XSS)
• CIVI-SA-2026-06: Contact Notes (XSS)
• CIVI-SA-2026-07: Contact Summary (XSS)
• CIVI-SA-2026-08: Custom Data Settings (XSS)
• CIVI-SA-2026-09: Dropdown Options (XSS)
• CIVI-SA-2026-10: Group Descriptions (XSS)
• CIVI-SA-2026-11: Message Templates (XSS)
• CIVI-SA-2026-12: PDF Formats (XSS)
• CIVI-SA-2026-13: Riverlea Settings (XSS)
• CIVI-SA-2026-14: Scheduled Jobs (XSS)
• CIVI-SA-2026-15: Unvalidated Script in Search-Display
• CIVI-SA-2026-16: Path Traversal in Contact Importer
• CIVI-SA-2026-17: Advanced Search with Custom Data

Learn more about subscribing to Extended Security Releases (ESR).

Support CiviCRM

We are committed to keeping CiviCRM free and open, forever. We depend on your support to help make that happen.

• Make a donation or contribute to a Make it happen campaign.
• If your organization wants to support our work, please become a member today.
• If you are a CiviCRM service provider, please become a partner.

CiviCRM is community driven and is sustained through contributions, good vibes, solidarity, and financial support from its community. Help CiviCRM do a world of good.

Filed under Extended Security Release, Release announcements, Security Releases

Thanks to the hard work of CiviCRM’s incredible community of contributors, CiviCRM version 6.12.0 is now ready to download. This is a regular monthly release that includes new features and bug fixes. Details are available in the monthly release notes.

Your are encouraged to upgrade now for the most stable, secure, CiviCRM experience:

Download CiviCRM

Users of the CiviCRM Extended Security Releases (ESR) do not need to upgrade. The current version of ESR is CiviCRM 6.10.x (supported until 5 August 2026).

Support CiviCRM

CiviCRM is community driven and is sustained through code contributions and generous financial support.

We are committed to keeping CiviCRM free and open, forever. We depend on your support to help make that happen. Please consider supporting CiviCRM today.

Big thanks to all our partners, members, ESR subscribers and contributors who give regularly to support CiviCRM for everyone.

Smarty5 is now the one and only

After 3 years working towards replacing the Smarty2 template engine, CiviCRM 6.12 has finished the process, leaving Smarty5 as the only supported version. This was a requirement for supporting recent PHP versions. It also provides many security and performance benefits.

If you previously customized your civicrm.settings.php file to force an older version of Smarty, you must make sure that all your extensions and message-templates work with Smarty5. Failing to do so will result in a fatal PHP error (or a "white screen of death"). See docs for: Switching Smarty.

Credits

AGH Strategies - Alice Frumin; Artful Robot - Rich Lott; Benjamin W; Christian Wach; CiviCRM - Coleman Watts, Tim Otten; Coop SymbioTIC - Shane Bill; CSES (Chelmsford Science and Engineering Society) - Adam Wood; Dave D; Francesc Bassas i Bullich; JMA Consulting - Monish Deb, Seamus Lee; Megaphone Technology Consulting - Jon Goldberg; MJW Consulting - Matthew Wire; NIAB - Stuart; Nicol Wistreich; PERORA SRL - Samuele Masetto; Richard Baugh; Squiffle Consulting - Aidan Saunders; Systopia - Dominic Tubach; Tadpole Collective - Kevin Cristiano; Wikimedia Foundation - Eileen McNaughton; Wildsight - Lars Sander-Green. Circle Interactive - Angela Jackson; Coop SymbioTIC - Mathieu Lutfy; Fuzion - Luke Stewart; JMA Consulting - Celine Nicolas; Progressive Technology Project - Jamie McClelland; Sjoerd Langkemper; Skvare - Mark Hanna; Third Sector Design - William Mortada.

New Extensions

• Auto Logout for Standalone - Automatically logs a use out after an inactive period (on CiviCRM Standalone).
• Document Preview - Provides the ability to preview PDF documents and images without actually downloading them. It can be useful to preview files without having to leave CiviCRM and/or potentially prevent people from download confidential documents.
• PayFast integration for the Omnipay Multi Processor Payment extension
• Large CSV Export from SearchKit - Provides a SearchKit Task (i.e. in the Actions drop-down) to export the results to a CSV file. The export is prepared in the background and a notification email is sent when it is ready. Useful for very large exports.
• Missed Recurring Payments - Recurring contributions occasionally go missing — a payment processor fails silently, a webhook is dropped, or a charge is refunded without a matching CiviCRM record. Over time these gaps accumulate and contact giving histories become inaccurate.

View all latest extensions

Filed under Release announcements

Thanks to the hard work of CiviCRM’s incredible community of contributors, CiviCRM version 6.11.0 is now ready to download. This is a regular monthly release that includes new features and bug fixes. Details are available in the monthly release notes.

Your are encouraged to upgrade now for the most stable, secure CiviCRM experience:

Download CiviCRM

Users of the CiviCRM Extended Security Releases (ESR) do not need to upgrade. The current version of ESR is CiviCRM 6.10.x (supported until 5 August 2026).

Support CiviCRM

CiviCRM is community driven and is sustained through code contributions and generous financial support.

We are committed to keeping CiviCRM free and open, forever. We depend on your support to help make that happen. Please consider supporting CiviCRM today.

Big thanks to all our partners, members, ESR subscribers and contributors who give regularly to support CiviCRM for everyone.

Credits

AGH Strategies - Alice Frumin; Artful Robot - Rich Lott; Benjamin W; Ben van Klinken; CiviCRM - Coleman Watts, Joshua Gowans; Tim Otten; CompuCo - Muhammad Shahrukh; Coop SymbioTIC - Mathieu Lutfy, Samuel Vanhove, Shane Bill; CSES (Chelmsford Science and Engineering Society) - Adam Wood; Dave D; dbw2bit; Calvin Theological Seminary - Dan Wells; Fuzion - Luke Stewart; Gokhalemethod - Sadashiv; JMA Consulting - Monish Deb, Seamus Lee; Megaphone Technology Consulting - Jon Goldberg; MJW Consulting - Matthew Wire; Nicol Wistreich; Outlandish - Rasmus Winter; Richard Baugh; Skvare - Sunil Pawar; Stiftung Pfadfinden - Andreas Lietz; Squiffle Consulting - Aidan Saunders; Wikimedia Foundation - Eileen McNaughton; All In Appli.com - Guillaume Sorel; CompuCorp - Jamie Novick; Francesc Bassas i Bullich; Paul Van Leemput; Skvare - Mark Hanna; Tadpole Collective - Kevin Cristiano; Wildsight - Lars Sander-Green.

New Extensions

• Membership Renewal - Adds additional functionality for renewal of memberships
• MapIt UK - Integration for MapIt UK, maps data against UK postcodes held in the CiviCRM address fields.
• Book Meeting - Book a meeting (or reserve something online), with optional CiviBooking integration.
• Grant Prefill - Enables pre-filling of grants on a Formbuilder form.
• Formbuilder Redirect - allows you to redirect to other Forms or Contribution Pages in the same way as using secret links/checksums.

View all latest extensions

Filed under Release announcements

Thanks to the hard work of CiviCRM’s incredible community of contributors, CiviCRM version 6.10.0 is now ready to download. This is a regular monthly release that includes new features and bug fixes. Details are available in the monthly release notes.

Your are encouraged to upgrade now for the most stable, secure, CiviCRM experience:

Download CiviCRM

Users of the CiviCRM Extended Security Releases (ESR) need to upgrade. The current version of ESR is also CiviCRM 6.10.x.

Support CiviCRM

Support CiviCRM

CiviCRM is community driven and is sustained through code contributions and generous financial support.

We are committed to keeping CiviCRM free and open, forever. We depend on your support to help make that happen. Please consider supporting CiviCRM today.

Big thanks to all our partners, members, ESR subscribers and contributors who give regularly to support CiviCRM for everyone.

USPS address standardization

USPS address standardization

Users of the USPS address standardization service must take one of the following actions as the old integration will otherwise stop working on 25 January 2026:

• Upgrade to CiviCRM 6.10, then re-enter the new credentials for the USPS Addresses v3 REST API ("consumer key" and "consumer secret") under Administer > Localization > Address Settings.
• If you cannot upgrade, please disable the USPS integration before 25 January 2026 to avoid possible data loss.

For more information, see: dev/core#6256 and PR#34066. With thanks to Sunil Pawar from Skvare for implementing this change before the deadline and Dave D for getting it merged.

USPS is a service from the United-States Postal Service that helps standardize addresses. If you do not use this service, no action is required. If you are not sure if you use the service, go to Administer > Localization > Address Settings.

Credits

AGH Strategies - Alice Frumin; Benjamin W; Business & Code - Alain Benbassat; CiviCoop - Jaap Jansma; CiviCRM - Coleman Watts, Tim Otten; CompuCo - Muhammad Shahrukh; Coop SymbioTIC - Mathieu Lutfy, Shane Bill; CSES (Chelmsford Science and Engineering Society) - Adam Wood; Dave D; Fuzion - Luke Stewart; Jens Schuppe; JMA Consulting - Monish Deb, Seamus Lee; Joinery - Allen Shaw; Megaphone Technology Consulting - Jon Goldberg; MJW Consulting - Matthew Wire; Nicol Wistreich; Outlandish - Rasmus Winter; Progressive Technology Project - Jamie McClelland; Richard Baugh; Skvare - Mark Hanna, Sunil Pawar; Stiftung Pfadfinden - Andreas Lietz; Third Sector Design - William Mortada; Wikimedia Foundation - Eileen McNaughton; Wildsight - Lars Sander-Green; All In Appli.com - Guillaume Sorel; Artful Robot - Rich Lott; ASMAC (American Society of Music Arrangers and Composers) - Jeff Kellem; CiviCoop - Jaap Jansma; civiservice.de - Gerhard Weber, Martin Correll; Coop SymbioTIC - Samuel Vanhove; Francesc Bassas i Bullich; JMA Consulting - Joe Murray; Lemniscus - Noah Miller; Sjoerd Langkemper; Squiffle Consulting - Aidan Saunders; Tadpole Collective - Kevin Cristiano; 5Knoten - Peter Klausing

New Extensions

• OAuth Outgoing Mail - Use OAuth for authenticating for outgoing mail (smtp). For example send e-mails with Office 365 e-mail address.
• PayPal PayflowPro - provides an integration with PayPal's Payflow Pro service. It supports one time and recurring payments from CiviCRM.
• External Message Processor - Receive messages from external sources and process them within CiviCRM (either as an API or a form processor).
• mobilemessage - MobileMessage.com.au and CiviCRM integration allows delivering single and mass short message service (SMS) messages through its Mobile Message Gateway to mobile phone users.

View all latest extensions

Filed under Release announcements

Thanks to the hard work of CiviCRM’s incredible community of contributors, CiviCRM version 6.9.0 is now ready to download. This is a regular monthly release that includes new features and bug fixes. Details are available in the monthly release notes.

Your are encouraged to upgrade now for the most stable, secure, CiviCRM experience:

Download CiviCRM

Users of the CiviCRM Extended Security Releases (ESR) do not need to upgrade. The current version of ESR is CiviCRM 6.4.x.

Support CiviCRM

Support CiviCRM

CiviCRM is community driven and is sustained through code contributions and generous financial support.

We are committed to keeping CiviCRM free and open, forever. We depend on your support to help make that happen. Please consider supporting CiviCRM today.

Big thanks to all our partners, members, ESR subscribers and contributors who give regularly to support CiviCRM for everyone.

Credits

AGH Strategies - Alice Frumin; Agileware Pty Ltd - Iris, Justin Freeman; akwizgran; ALL IN APPLI - Guillaume Sorel; Artful Robot - Rich Lott; BrightMinded Ltd - Bradley Taylor; Christian Wach; Christina; Circle Interactive - Dave Jenkins, Rhiannon Davies; CiviCoop - Jaap Jansma, Erik Hommel; CiviCRM - Coleman Watts, Tim Otten, Benjamin W; civiservice.de - Gerhard Weber; CompuCo - Muhammad Shahrukh; Coop SymbioTIC - Mathieu Lutfy, Samuel Vanhove, Shane Bill; cs-bennwas; CSES (Chelmsford Science and Engineering Society) - Adam Wood; Dave D; DevApp - David Cativo; Duncan Stanley White; Freeform Solutions - Herb van den Dool; Fuzion - Jitendra Purohit, Luke Stewart; Giant Rabbit - Nathan Freestone; Greenpeace Central and Eastern Europe - Patrick Figel; INOEDE Consulting - Nadaillac; JacquesVanH; JMA Consulting - Seamus Lee; Joinery - Allen Shaw; Lemniscus - Noah Miller; Makoa - Usha F. Matisson; Megaphone Technology Consulting - Jon Goldberg; MJW Consulting - Matthew Wire; Mosier Consulting - Justin Mosier; Nicol Wistreich; OrtmannTeam GmbH - Andreas Lietz; Progressive Technology Project - Jamie McClelland; Progressive Technology Project - Jamie McClelland; Richard Baugh; Skvare - Sunil Pawar; Sarah Farrell-Graham; Squiffle Consulting - Aidan Saunders; Tadpole Collective - Kevin Cristiano; Wikimedia Foundation - Eileen McNaughton; Wildsight - Lars Sander-Green

New Extensions

• Membership AJAX Permissions - This CiviCRM extension modifies the API permissions to allow it to be called with just the "Access AJAX API" permission instead of requiring the more restrictive default permissions.
• civiglific - Integrates Glific (https://glific.org) with CiviCRM to sync contact groups and send automated WhatsApp messages and receipts to contributors.
• Reply to Inbound Email - Makes it easier to reply to email, quote the original, etc.

View all latest extensions

Filed under Release announcements

Thanks to the hard work of CiviCRM’s incredible community of contributors, CiviCRM version 6.8.0 is now ready to download. This is a regular monthly release that includes new features and bug fixes. Details are available in the monthly release notes.

Your are encouraged to upgrade now for the most stable, secure CiviCRM experience:

Download CiviCRM

Users of the CiviCRM Extended Security Releases (ESR) do not need to upgrade. The current version of ESR is CiviCRM 6.4.x.

Support CiviCRM

CiviCRM is community driven and is sustained through code contributions and generous financial support.

We are committed to keeping CiviCRM free and open, forever. We depend on your support to help make that happen. Please consider supporting CiviCRM today.

Big thanks to all our partners, members, ESR subscribers and contributors who give regularly to support CiviCRM for everyone.

Credits

AGH Strategies - Alice Frumin, Chris Garaffa; Agileware Pty Ltd - Iris; ALL IN APPLI - Guillaume Sorel; Artful Robot - Rich Lott; BrightMinded Ltd - Bradley Taylor; Christina; CiviCoop - Jaap Jansma; CiviCRM - Coleman Watts, Tim Otten, Benjamin W; civiservice.de - Martin Correll; CompuCo - Muhammad Shahrukh; Coop SymbioTIC - Mathieu Lutfy, Samuel Vanhove, Shane Bill; CSES (Chelmsford Science and Engineering Society) - Adam Wood; Dave D; Duncan Stanley White; Freeform Solutions - Herb van den Dool; Fuzion - Luke Stewart; JMA Consulting - Monish Deb, Seamus Lee; Joinery - Allen Shaw; Megaphone Technology Consulting - Jon Goldberg; MJW Consulting - Matthew Wire; Nicol Wistreich; Parlamentwatch e.V. - Philipp Michael; Progressive Technology Project - Jamie McClelland; Richard van Oosterhout; Skvare - Sachin Doijad; Squiffle Consulting - Aidan Saunders; Third Sector Design - Kurund Jalmi; Wikimedia Foundation - Eileen McNaughton; Wildsight - Lars Sander-Green

New Extensions

• Course Registrations - Provides extra features for handling course registrations that have multiple classes (ex: weekly classes for Autumn 2026), without creating repeating events.
• NZ AU Addressfinder - Integrates CiviCRM Address fields with https://addressfinder.com an address validation/lookup service focused on NZ and Australian addresses.
• Refund Request - Provides a workflow to request refunds.
• SearchKit Flexbox - Implements a search display using CSS flexbox.
• Divert Mail - Divert i.e. reroute all outbound CiviCRM email to a configured address for testing/staging environments. Supports override via civicrm.settings.php constant CIVICRM_DIVERT_EMAIL.
• Employer Sync - If you create employee relationships using the API, it can result in contacts having an employee relationship but an empty employer_id field.

View all latest extensions

Filed under Release announcements

Thanks to the hard work of CiviCRM’s incredible community of contributors, CiviCRM version 6.7.0 is now ready to download. This is a regular monthly release that includes new features and bug fixes. Details are available in the monthly release notes.

Your are encouraged to upgrade now for the most stable, secure CiviCRM experience:

Download CiviCRM

Users of the CiviCRM Extended Security Releases (ESR) do not need to upgrade. The current version of ESR is CiviCRM 6.4.x.

Support CiviCRM

Support CiviCRM

CiviCRM is community driven and is sustained through code contributions and generous financial support.

We are committed to keeping CiviCRM free and open, forever. We depend on your support to help make that happen. Please consider supporting CiviCRM today.

Big thanks to all our partners, members, ESR subscribers and contributors who give regularly to support CiviCRM for everyone.

Credits

AGH Strategies - Alice Frumin; ALL IN APPLI - Guillaume Sorel; Artful Robot - Rich Lott; Australian Greens - John Twyman; Circle Interactive - Dave Jenkins, Pradeep Nayak; CiviCRM - Coleman Watts, Tim Otten, Benjamin W; Coop SymbioTIC - Mathieu Lutfy, Samuel Vanhove, Shane Bill, mmyriam; CSES (Chelmsford Science and Engineering Society) - Adam Wood; Dave D; Freeform Solutions - Herb van den Dool; Guydn; JMA Consulting - Monish Deb, Seamus Lee, Joe Murray; Joinery - Allen Shaw; Lemniscus - Noah Miller; Megaphone Technology Consulting - Jon Goldberg; MJW Consulting - Matthew Wire; New York State Senate - Nate Frank; Nicol Wistreich; OPEN - dewy; Parlamentwatch e.V. - Philipp Michael; Progressive Technology Project - Jamie McClelland; Richard Baugh; Sjoerd Langkemper; Systopia - Dominic Tubach; Tadpole Collective - Kevin Cristiano; Third Sector Design - Kurund Jalmi, William Mortada; Wikimedia Foundation - Eileen McNaughton; Wildsight - Lars Sander-Green

New Extensions

• Helcim - A payment processor extension for the services at https://www.helcim.com/
• Protect Smart Groups - Simple extension to forbid adding contact statically on smart groups unless user has the permission "bypass smart group protection".
• Auto Updating Recurring Memberships - Ability to automatically update the Auto-renew Membership amounts when changing a Membership Type and/or updating a Membership.

View all latest extensions

Filed under Release announcements

Thanks to the hard work of CiviCRM’s incredible community of contributors, CiviCRM version 6.6.0 is now ready to download. This is a regular monthly release that includes new features and bug fixes. Details are available in the monthly release notes.

Your are encouraged to upgrade now for the most stable, secure CiviCRM experience:

Download CiviCRM

Users of the CiviCRM Extended Security Releases (ESR) need to upgrade. The current version of ESR is CiviCRM 6.4.x.

Support CiviCRM

Support CiviCRM

CiviCRM is community driven and is sustained through code contributions and generous financial support.

We are committed to keeping CiviCRM free and open, forever. We depend on your support to help make that happen. Please consider supporting CiviCRM today.

Big thanks to all our partners, members, ESR subscribers and contributors who give regularly to support CiviCRM for everyone.

Credits

AGH Strategies - Alice Frumin; Agileware Pty Ltd - Justin Freeman; ALL IN APPLI - Guillaume Sorel; Artful Robot - Rich Lott; Australian Greens - Andrew Cormick-Dockery; Babu - Francesc Bassas i Bullich; Brian Matemachani; BrightMinded Ltd - Bradley Taylor; Christian Wach; Circle Interactive - Pradeep Nayak; CiviCoop - Jaap Jansma; Civicopilot - Andy Burns; CiviCRM - Coleman Watts, Tim Otten, Benjamin W; Civil Justice, Inc. - Brienne K.; CompuCo - Muhammad Shahrukh; Coop SymbioTIC - Mathieu Lutfy; CSES (Chelmsford Science and Engineering Society) - Adam Wood; Dave D; DevApp - David Cativo; Fuzion - Luke Stewart; Guydn; JMA Consulting - Monish Deb, Seamus Lee; John Kingsnorth; Lemniscus - Noah Miller; Marvin Müller; Megaphone Technology Consulting - Jon Goldberg; MJW Consulting - Matthew Wire; Mosier Consulting - Justin Mosier; New York State Senate - Nate Harris; Nicol Wistreich; Non Profit Tech Advisor - Brian Flett; Peter-Reck; Progressive Technology Project - Jamie McClelland; Richard Baugh; Squiffle Consulting - Aidan Saunders; Systopia - Dominic Tubach; Tadpole Collective - Kevin Cristiano; tapashdatta; Third Sector Design - Kurund Jalmi, William Mortada; Wikimedia Foundation - Eileen McNaughton, Wenjun Fan; Wildsight - Lars Sander-Green

New Extensions

• Render Drupal - Developer-oriented extension that makes it possible to embed Drupal (10+) blocks or entities in a CiviCRM Smarty template file. Requires the Twig Tweak module.
• Exclusive Relationship - Disables relationships if a new relationship of the same type is added. For example, adding a second relationship of "Primary Contact" can disable existing relationships of the same type for that contact.
• Enhanced Job Manager - A modern, feature-rich interface for managing CiviCRM scheduled jobs with advanced filtering, bulk operations, and real-time status monitoring.

View all latest extensions

Filed under Release announcements

Thanks to the hard work of CiviCRM’s incredible community of contributors, CiviCRM version 6.5.0 is now ready to download. This is a regular monthly release that includes several security fixes. Your are strongly encouraged to upgrade now for the most stable, secure CiviCRM experience:

Download CiviCRM

Users of the CiviCRM Extended Security Releases (ESR) need to upgrade. The current version of ESR is also CiviCRM 6.4.x.

Support CiviCRM

CiviCRM is community driven and is sustained through code contributions and generous financial support.

We are committed to keeping CiviCRM free and open, forever. We depend on your support to help make that happen. Please consider supporting CiviCRM today.

Big thanks to all our partners, members, ESR subscribers and contributors who give regularly to support CiviCRM for everyone.

CiviCRM 6.5 Highlights

UX Improvements

• Households and organizations can now, errr, "die". That's to say that they can otherwise cease to exist just like individuals.
• If you're using RiverLea and want to use some custom CSS, there is now clearer instruction on how to do so.
• The "DB Error Unknown Error" has gotten some love and should now present more details about the nature of the error.
• You can now use your email address as a login for CiviCRM Standalone.

SearchKit

• Users can now set the "net amount" field to calculate on contribution import, allowing users to import the contribution total and have SearchKit calculate the net amount.

Drupal Integration

• RiverLea will now display a warning for D7 users (ahem) using the Bartik theme.

Bugs Squashed

We have a pretty long list of bug fixes that we’re not going to cover here but we’re already behind on getting these release notes out. We’ll try to include these in the future.

Read the full release notes

Credits

This release was developed and coordinated by the following amazing contributors:

AGH Strategies - Alice Frumin;
Agileware Pty Ltd - Justin Freeman;
Artful Robot - Rich Lott; Benjamin W;
BrightMinded Ltd - Bradley Taylor; Christian Wach; CiviCRM - Coleman Watts, Tim Otten; CiviDesk - Nicolas Ganivet;
Coop SymbioTIC - Mathieu Lutfy, Samuel Vanhove, Shane Bill; Daniel Strum; Dave D;Ezodesign - Jeremy Proffitt; Francesc Bassas i Bullich;
Fuzion - Luke Stewart; Guydn; Humanists UK - Andrew West;
iXiam - Albert Vall-Llovera; Jens Schuppe;
JMA Consulting - Monish Deb, Seamus Lee, Rafe Murray; Lemniscus - Noah Miller; Megaphone Technology Consulting - Jon Goldberg;
MJW Consulting - Matthew Wire; Mosier Consulting - Justin Mosier; New York State Senate - Nate Harris; Nicol Wistreich; Richard Baugh; Savion Lee;
Skvare - Mark Hanna, Sunil Pawar;
Squiffle Consulting - Aidan Saunders; Systopia - Dominic Tubach;
Tadpole Collective - Kevin Cristiano; Wikimedia Foundation - Eileen McNaughton, Wenjun Fan; Wildsight - Lars Sander-Green

New Extensions

• Event Checkin - An extension to provide check-in links and QR codes to CiviCRM event participants, so they can check in with the event's front desk, or even automatically.
• Event Invitation - This extension allows you to invite contacts in CiviCRM to an event and provides a simple feedback form where contacts can choose whether they can attend or not.
• Spouse Salutations - Updates a spouse's greetings (email, postal, addressee) if necessary when a contact is updated.
• Anonymous Tracking - Collect important mailing statistics, such as open and click-through rates, without compromising individual user privacy by decoupling tracking events from specific contacts.
• SearchKit Calendar - adds a calendar view as a display option for SearchKit searches.

View all latest extensions

There has been a security release for CiviCRM. Upgrades are available for:

• CiviCRM v6.4.1 (download, release notes)
• CiviCRM v6.5.0 (download, release notes)
• CiviCRM v5.81.4 ESR (info, download, release notes)

These upgrades address the following security issue:

• CIVI-SA-2025-01: Insufficient Permission Denial
• CIVI-SA-2025-02: Contact Images (CSRF)
• CIVI-SA-2025-03: Dialog Title (XSS)
• CIVI-SA-2025-04: Arbitrary File Move
• CIVI-SA-2025-05: Embedded Searches
• CIVI-SA-2025-06: Weak CSRF Key

Looking to use Extended Security Releases (ESR) in the future? Starting this month, version 6.4 will be new ESR.

Support CiviCRM

We are committed to keeping CiviCRM free and open, forever. We depend on your support to help make that happen.

• Make a donation or contribute to a Make it happen campaign.
• If your organization wants to support our work, please become a member today.
• If you are a CiviCRM service provider, please become a partner.

CiviCRM is community driven and is sustained through contributions, good vibes, solidarity, and financial support from its community. Help CiviCRM do a world of good.

Thanks to the hard work of CiviCRM’s incredible community of contributors, CiviCRM version 6.4.0 is now ready to download. This is a regular monthly release. Upgrade now for the most stable CiviCRM experience:

Users of the CiviCRM Extended Security Releases (ESR) need to upgrade. The current version of ESR is also CiviCRM 6.4.x.

Support CiviCRM

CiviCRM is community driven and is sustained through code contributions and generous financial support.

We are committed to keeping CiviCRM free and open, forever. We depend on your support to help make that happen. Please consider supporting CiviCRM today.

Big thanks to all our partners, members, ESR subscribers and contributors who give regularly to support CiviCRM for everyone.

CiviCRM 6.4 Highlights

UX Improvements

• Users can now filter by “Group Type” in the Manage Group screen, allowing you to filter for groups that are Access Control, Mailing List or even custom group types.
• Links to “My Import Batches” and “All Import Batches” are now visible on the batch import screen, allowing users easy access to import batches.
• There’s a new version of the “Find Activities” search and a “Reports Listing”, both powered by SearchKit, available in the SearchUI extension.
• There is now a SearchKit version of “Administer Badge Layout” page as well as for the “Membership Status Rules” for sites using AdminUI extension

SearchKit

• Users can now select “contains one of” (or not), making it possible to select multiple values.
• Users can now choose between using Mosaico or a Traditional mailing when sending mail through SearchKit.

WordPress Integration

• There is a new setting which allows sites to determine whether or not to authenticate users automatically when they initially create their accounts.

Bugs Squashed

We have a pretty long list of bug fixes that we’re not going to cover here but we’re already behind on getting these release notes out. We’ll try to include these in the future.

Read the full release notes

Credits

This release was developed and coordinated by the following amazing contributors:

AGH Strategies - Alice Frumin; Artful Robot - Rich Lott; Australian Greens - Andrew Cormick-Dockery; BrightMinded Ltd - Bradley Taylor; Christian Wach; CiviCRM - Coleman Watts, Tim Otten; Benjamin W; Compuco - Shahrukh Sayyed; Coop SymbioTIC - Mathieu Lutfy, Samuel Vanhove, mmyriam; Christian Wach; Dave D; Evita Wagner; Francesc Bassas i Bullich; Freeform Solutions - Herb van den Dool; Fuzion - Luke Stewart; iXiam - Rubén Pineda; JMA Consulting - Monish Deb, Seamus Lee, Joe Murray; John Kingsnorth; Lemniscus - Noah Miller; Makoa - Usha F. Matisson; Megaphone Technology Consulting - Jon Goldberg; MJW Consulting - Matthew Wire; NIAB - Stuart; Nicol Wistreich; OPEN - dewy; PERORA SRL - Samuele Masetto; RaulJMCD; Reflexive Communications - Sandor Semsey; Richard Baugh; Squiffle Consulting - Aidan Saunders; Systopia - Lena Jukna; Tadpole Collective - Kevin Cristiano; Third Sector Design - William Mortada; Wikimedia Foundation - Eileen McNaughton, Elliott Eggleston; Wildsight - Lars Sander-Green

New Extensions

• Stripe Form Processor Integration - Integration of Stripe Checkout payment processor with the Form Processor extension.
• Trigger-Based Logging Size Reducer - Helps keep trigger-based logs from eating too much disk space. Includes a scheduled job to delete older entries and a simple UI to choose some tables to exclude from logging.
• Address Lookup - Lookup and correct addresses using Vlaams Basisregister Adressen (Flamish Address Database), BPost the Belgium Post Address lookup service, and the Openstreet Maps Nominatim.
• CiviSEPA Payment Processor - Provides payment processor for the existing CiviSEPA extension.

View all latest extensions

Filed under Release announcements