Pods Foundation Release Notes

This is a major security hardening release covering multiple areas of the plugin. We recommend updating as soon as possible.

Additional releases with these security fixes have been backported to each major version of Pods from Pods 2.7 and above.

Security

Further restrictions on error handling and fallbacks. (Nhien Pham @nhienit - GalaxyOne, @thevietronin - GalaxyOne, @sc0ttkclark)

General hardening improvements to how data queries are built and validated. (HaoNH @haoit, @onebitious, @sc0ttkclark)

Additional restrictions on how certain values are processed when displayed. (@sc0ttkclark)

Improved safety when handling previously stored data. (@sc0ttkclark)

Removed a legacy request-handling path that is no longer needed. (HaoNH @haoit, @sc0ttkclark)

Tightened access requirements for certain background requests. (HaoNH @haoit, @sc0ttkclark)

Improved consistency and enforcement of access and validation checks. (Youness HFA from AGBS Pentest Team @YounesHfa, HaoNH @haoit, @onebitious, @sc0ttkclark)

Hardening improvements to file and media handling. (@sc0ttkclark)

Additional safeguards for file and template handling. (@sc0ttkclark)

Improved handling of displayed content. (@sc0ttkclark)

Added extra verification for admin forms and actions. (@sc0ttkclark)

Additional validation for imported content. (@sc0ttkclark)

Improved handling of content based on user permissions. (@sc0ttkclark)

Updated bundled third-party JavaScript dependencies. (@sc0ttkclark)

Added a filter to optionally restrict access to the REST API documentation endpoint, which remains public by default. (@sc0ttkclark)

Additional automated test coverage for the changes in this release. (@sc0ttkclark)

This is a major security hardening release covering multiple areas of the plugin. We recommend updating as soon as possible.

Additional releases with these security fixes have been backported to each major version of Pods from Pods 2.7 and above.

Security

• Further restrictions on error handling and fallbacks. (Nhien Pham @nhienit - GalaxyOne, @thevietronin - GalaxyOne, @sc0ttkclark)
• General hardening improvements to how data queries are built and validated. (HaoNH @haoit, @onebitious, @sc0ttkclark)
• Additional restrictions on how certain values are processed when displayed. (@sc0ttkclark)
• Improved safety when handling previously stored data. (@sc0ttkclark)
• Removed a legacy request-handling path that is no longer needed. (HaoNH @haoit, @sc0ttkclark)
• Tightened access requirements for certain background requests. (HaoNH @haoit, @sc0ttkclark)
• Improved consistency and enforcement of access and validation checks. (Youness HFA from AGBS Pentest Team @YounesHfa, HaoNH @haoit, @onebitious, @sc0ttkclark)
• Hardening improvements to file and media handling. (@sc0ttkclark)
• Additional safeguards for file and template handling. (@sc0ttkclark)
• Improved handling of displayed content. (@sc0ttkclark)
• Added extra verification for admin forms and actions. (@sc0ttkclark)
• Additional validation for imported content. (@sc0ttkclark)
• Improved handling of content based on user permissions. (@sc0ttkclark)

Security

This is a major security hardening release covering multiple areas of the plugin. We recommend updating as soon as possible.

Additional releases with these security fixes have been backported to each major version of Pods from Pods 2.7 and above.

• Security: Further restrictions on error handling and fallbacks. (Nhien Pham @nhienit - GalaxyOne, @thevietronin - GalaxyOne, @sc0ttkclark)
• Security: General hardening improvements to how data queries are built and validated. (HaoNH @haoit, @onebitious, @sc0ttkclark)
• Security: Additional restrictions on how certain values are processed when displayed. (@sc0ttkclark)
• Security: Improved safety when handling previously stored data. (@sc0ttkclark)
• Security: Removed a legacy request-handling path that is no longer needed. (HaoNH @haoit, @sc0ttkclark)
• Security: Tightened access requirements for certain background requests. (HaoNH @haoit, @sc0ttkclark)
• Security: Improved consistency and enforcement of access and validation checks. (Youness HFA from AGBS Pentest Team @YounesHfa, HaoNH @haoit, @onebitious, @sc0ttkclark)
• Security: Hardening improvements to file and media handling. (@sc0ttkclark)
• Security: Additional safeguards for file and template handling. (@sc0ttkclark)
• Security: Improved handling of displayed content. (@sc0ttkclark)
• Security: Added extra verification for admin forms and actions. (@sc0ttkclark)
• Security: Additional validation for imported content. (@sc0ttkclark)
• Security: Improved handling of content based on user permissions. (@sc0ttkclark)

This is a major security hardening release covering multiple areas of the plugin. We recommend updating as soon as possible.

Additional releases with these security fixes have been backported to each major version of Pods from Pods 2.7 and above.

Security

Further restrictions on error handling and fallbacks. (Nhien Pham @nhienit - GalaxyOne, @thevietronin - GalaxyOne, @sc0ttkclark)

General hardening improvements to how data queries are built and validated. (HaoNH @haoit, @onebitious, @sc0ttkclark)

Additional restrictions on how certain values are processed when displayed. (@sc0ttkclark)

Improved safety when handling previously stored data. (@sc0ttkclark)

Removed a legacy request-handling path that is no longer needed. (HaoNH @haoit, @sc0ttkclark)

Tightened access requirements for certain background requests. (HaoNH @haoit, @sc0ttkclark)

Improved consistency and enforcement of access and validation checks. (Youness HFA from AGBS Pentest Team @YounesHfa, HaoNH @haoit, @onebitious, @sc0ttkclark)

Hardening improvements to file and media handling. (@sc0ttkclark)

Additional safeguards for file and template handling. (@sc0ttkclark)

Improved handling of displayed content. (@sc0ttkclark)

Added extra verification for admin forms and actions. (@sc0ttkclark)

Additional validation for imported content. (@sc0ttkclark)

Improved handling of content based on user permissions. (@sc0ttkclark)

This is a major security hardening release covering multiple areas of the plugin. We recommend updating as soon as possible.

Additional releases with these security fixes have been backported to each major version of Pods from Pods 2.7 and above.

Security

Further restrictions on error handling and fallbacks. (Nhien Pham @nhienit - GalaxyOne, @thevietronin - GalaxyOne, @sc0ttkclark)

General hardening improvements to how data queries are built and validated. (HaoNH @haoit, @onebitious, @sc0ttkclark)

Additional restrictions on how certain values are processed when displayed. (@sc0ttkclark)

Improved safety when handling previously stored data. (@sc0ttkclark)

Removed a legacy request-handling path that is no longer needed. (HaoNH @haoit, @sc0ttkclark)

Tightened access requirements for certain background requests. (HaoNH @haoit, @sc0ttkclark)

Improved consistency and enforcement of access and validation checks. (Youness HFA from AGBS Pentest Team @YounesHfa, HaoNH @haoit, @onebitious, @sc0ttkclark)

Hardening improvements to file and media handling. (@sc0ttkclark)

Additional safeguards for file and template handling. (@sc0ttkclark)

Improved handling of displayed content. (@sc0ttkclark)

Added extra verification for admin forms and actions. (@sc0ttkclark)

Additional validation for imported content. (@sc0ttkclark)

Improved handling of content based on user permissions. (@sc0ttkclark)

This is a major security hardening release covering multiple areas of the plugin. We recommend updating as soon as possible.

Additional releases with these security fixes have been backported to each major version of Pods from Pods 2.7 and above.

Security

Further restrictions on error handling and fallbacks. (Nhien Pham @nhienit - GalaxyOne, @thevietronin - GalaxyOne, @sc0ttkclark)

General hardening improvements to how data queries are built and validated. (HaoNH @haoit, @onebitious, @sc0ttkclark)

Additional restrictions on how certain values are processed when displayed. (@sc0ttkclark)

Improved safety when handling previously stored data. (@sc0ttkclark)

Removed a legacy request-handling path that is no longer needed. (HaoNH @haoit, @sc0ttkclark)

Tightened access requirements for certain background requests. (HaoNH @haoit, @sc0ttkclark)

Improved consistency and enforcement of access and validation checks. (Youness HFA from AGBS Pentest Team @YounesHfa, HaoNH @haoit, @onebitious, @sc0ttkclark)

Hardening improvements to file and media handling. (@sc0ttkclark)

Additional safeguards for file and template handling. (@sc0ttkclark)

Improved handling of displayed content. (@sc0ttkclark)

Added extra verification for admin forms and actions. (@sc0ttkclark)

Additional validation for imported content. (@sc0ttkclark)

Improved handling of content based on user permissions. (@sc0ttkclark)

• Feature: Reuse the same UI that Repeatable Fields use for the Relationship fields using "List View" list items. The UI is now consistent and Pods 3.4 will include the same UI treatment for the File fields. (@sc0ttkclark)

• Fixed: Resolve issue with reordering repeatable fields and prevent rendering incorrectly when typing in the field which causes focus to be lost. #7498 #7499 (@pdclark, @sc0ttkclark)

• Fixed: Resolve problems with reordering Relationship fields using "List View" list items. (@sc0ttkclark)

• Fixed: Resolve issue with Migrate PHP component not placing magic tags on the correct separate new line of the file header. (@sc0ttkclark)

• Fixed: Prevent conflicts with ACF/SCF when ACF compatibility functions are enabled.

Release Notes

• Minimum Requirements Notice: Pods 3.4 coming in 2026 will require new minimum versions of WordPress 6.8+, PHP 8.0+, and MySQL 5.7+

• Feature: Added support for showing fields as "Read Only" in forms when a user does not have edit access to them while allowing admins to continue editing them. You can find this under the Edit Field modal in Advanced > Visibility > UI Access. (@sc0ttkclark)

• Enhancement: When detecting malformed shortcodes broken by < or > characters within the where clause, Pods now shows a helpful notice with workaround instructions instead of just breaking. #7451 #7482 (@sc0ttkclark)

• Enhancement: New replacements within Pods shortcodes clauses for replacing LESS_THAN, LESS_THAN_OR_EQUAL, GREATER_THAN, and GREATER_THAN_OR_EQUAL with their corresponding <, <=, >, and >= characters to work around broken WP shortcodes. This is also available in the [if] Pods template shortcode compare attribute. #7451 #7482 (@sc0ttkclark)

• Enhancement: New option for conditional logic that will allow saving conditional field values even when the field is hidden. #7475 #7484 (@faisalahammad, @sc0ttkclark)

• Enhancement: New setting at Pods Settings > Performance that allows you to "Limit autocomplete search results in Relationship fields" to specify larger numbers if needed. #7454 (@sc0ttkclark)

• Enhancement: PodsUI > Implement pods_ui_after_heading hook for additional UI customizations. (@sc0ttkclark)

• Enhancement: PodsUI > Move restricted() checks before callbacks to prevent additional unnecessary calls when user doesn't have access. (@sc0ttkclark)

• Enhancement: Add pods_v_bool that uses pods_is_truthy to enforce boolean values on variables from various sources. (@sc0ttkclark)

• Enhancement: Add Manage link to the Navigate section of the Pods content admin forms. (@sc0ttkclark)

• Enhancement: Underlying code support for multiple condition checks for Conditional Logic. (@sc0ttkclark)

• Tweak: Remove trim from pods_is_truthy and pods_is_falsey functions. (@sc0ttkclark)

• Tweak: In the Edit Field modal, under the Advanced > Visibility section -- the Restrict Access and UI Access are now separate checkbox groups. (@sc0ttkclark)

• Tweak: Pods now follows WP Admin Theme color schemes more closely using dynamic CSS color references to the scheme colors. (@sc0ttkclark)

• Fixed: Shortcode unit test issue resolved. #7472 #7473 (@devlamconstructie, @sc0ttkclark)

• Fixed: Loading a form with WYSIWYG React Quill used as Repeatable fields now loads without breaking the editor. #7465 #7487 (@faisalahammad, @sc0ttkclark)

• Fixed: Resolved reordering of values for Repeatable Date/Time, Currency, and Number fields. #7471 #7486 (@faisalahammad, @sc0ttkclark)

• Fixed: Resolve sync associated taxonomy with relationship issues when not using bidirectional relationship field. #7477 #7485 (@faisalahammad, @sc0ttkclark)

• Fixed: Resolved reordering of values in List View relationship fields. (@sc0ttkclark)

• Fixed: Allow empty values in email fields when field is not required. #7476 #7483 (@faisalahammad, @sc0ttkclark)

• Fixed: esc_html_e usage when not used for translating in PodsUI. #7462 (@DAnn2012)

• Fixed: The default storage type for Settings is set to option when creating as it should have been. (@sc0ttkclark)

• Fixed: When using repeatable fields on a Pod that uses Table-based storage, a notice now shows explaining that it's not an available feature. (@sc0ttkclark)

• Fixed: Better support when values are sent as WP_Error and now show appropriate errors in save_pod_item validation handling. (@sc0ttkclark)

• Fixed: Resolve heredoc issue with Migrate PHP component. (@sc0ttkclark)

• Fixed: WordPress 7.0 compatibility issues fixed. (@sc0ttkclark)

• Fixed: Conditional logic now works properly for Boolean Group sub fields (used in Edit Field modal and other Pods Admin areas). (@sc0ttkclark)

• Extensive cleanup to resolve important WP Plugin Checker results, PHPCS, and PHPStan issues across the codebase. (@sc0ttkclark)

• Extensible testing upgrades to PHPUnit 10+ and wp-browser 4. (@sc0ttkclark, @lucetume)

• New hourly verification of the Pods PLC DID and FAIR metadata. (@johnbillion)

Release notes

• Tweak: Support referencing ID for PodsMeta::groups_get(). (@sc0ttkclark)

• Tweak: Update edit capability used for settings Pods so it can be displayed on the edit pod screen correctly. (@sc0ttkclark)

• Fixed: Resolve issues with TinyMCE and Quill editors not loading when used as repeatable fields or conditional logic. #7448 #7438 #7430 (@multisme, @altermulti, @sc0ttkclark, @ztackett11)

• Fixed: Resolve PHP fatal errors for undefined constant \Pods\Whatsit\Store::PLACEHOLDER in some edge case circumstances. #7445 (@sc0ttkclark, @Hue-SPetrovic)

• Fixed: Resolve PHP 8.4 deprecation warnings with DI52 usage. #7448 (@sc0ttkclark, @doehry)

• Fixed: Resolve warnings when using --args with WP-CLI commands. #7452 (@sc0ttkclark, @KhaledSakr)

• Fixed: Resolve handling of decimals when auto-formatting to prevent removing zero number values and expand decimal handling for more cases. Improve logic matching (except dashes) for PHP vs JS. (@sc0ttkclark)

• Fixed: Resolve field assigment issue in pods_config_merge_data() to reference the correct field. (@sc0ttkclark)

Release notes

Tweak

• Updated Swagger docs for Pods REST API endpoints. (@sc0ttkclark)
• pods_error() handles any Exception object including those extending the base Exception class. This allows for more refined error handling in Pods code. (@sc0ttkclark)
• PodsAPI now allows for passing in Pods related objects to be passed into various save/load methods without breaking those objects. (@sc0ttkclark)
• Allow setting new group when duplicating a field. (@sc0ttkclark)
• Added Jest testing coverage for more areas of the DFV code and updated to support the React Testing Library. #7427 (@sc0ttkclark)

Fixed

• Block Editor saves no longer trigger full saves when an autosave is sent and Pods form validation passes. (@sc0ttkclark)
• Ensure Pods cache flushes when changing settings to prevent issues with Pods Blocks configs not showing fields conditionally linked to those settings. #7429 (@sc0ttkclark)
• When duplicating a pod, group, or field it will now add a space between the label and the copy number. (@sc0ttkclark)
• Typos corrected across the codebase. #7434 (@szepeviktor, @sc0ttkclark)
• PHP deprecated warnings resolved in Pods REST API and DI52 usage. #7401 #7437 (@BrookeDot, @sc0ttkclark)
• Saving Pods settings will now properly flush the Pods cache to ensure that the new settings are applied immediately to all areas that may be cached based on those settings. (@sc0ttkclark)
• Added a "doing it wrong" notice and debug log line for when a non-string gets sent to Pods::do_magic_tags() to prevent PHP warnings. (@sc0ttkclark)
• Better caching around the pods_can_use_dynamic_feature_sql_clauses() setting usage to prevent additional DB calls. (@sc0ttkclark)
• Resolve issues when saving featured image based on the first value of a file field so it only saves files with the image type. #7433 (@sc0ttkclark)
• Add support for Value_Field in pods_config_for_field() to ensure bidirectional relationships work as expected for saving on both sides. #7435 (@sc0ttkclark)
• Prevent erroneous ? and # characters in website formatting. (@sc0ttkclark)