Bump craftcms/cms from 3.7.39 to 4.16.17

[dependabot]

Bumps craftcms/cms from 3.7.39 to 4.16.17.

Release notes

Sourced from craftcms/cms's releases.

4.16.17

• Fixed a bug where remove buttons within multi-select Selectize inputs weren’t working if the input wasn’t focusend and fully in view. (#18079)
• Fixed an error that could occur when executing a GraphQL mutation when the lazyGqlTypes config setting was enabled. (#18014)
• Fixed a PHP error that could occur when creating a username that began or ended with an @. (#18123)
• Fixed a bug where assets with disallowed file extensions could be stored in the system’s temp directory. (#18049)
• Fixed RCE vulnerabilities. (GHSA-255j-qw47-wjh5, GHSA-742x-x762-7383)
• Fixed an SSRF vulnerability. (GHSA-x27p-wfqw-hfcc)
• Fixed a DoS vulnerability. (GHSA-v64r-7wg9-23pr)
• Fixed an information disclosure vulnerability. (GHSA-53vf-c43h-j2x9)

4.16.16

• Fixed a bug where assets with disallowed file extensions could still be uploaded to the system’s temp directory. (#18015)
• Fixed an error that could occur when an array was passed to an asset query’s folderPath param. (#18056)

4.16.15

• Reverted an element query performance optimization for MySQL 9. (#16401)
• Updated Axios to 1.12.2. (#17988)
• Fixed a bug where plugin license keys were getting generated for environments that didn’t allow admin changes, which could result in an error that prevented the Plugin Store from loading. (#17942)
• Fixed a bug where new plugin license keys weren’t getting saved to .env if the environment variable didn’t exist yet. (#17942)
• Fixed a bug where pressing Return within an editable table within a slideout would submit the slideout.
• Fixed an error that could occur when retrieving an array/hash value in Twig, if the fetched key wasn’t an integer or string.
• Fixed a bug where it wasn’t possible to clear out a volume’s “Transform Filesystem” setting. (#17953)

4.16.14

• new is now a reserved filesystem handle.
• Fixed an error that could occur when running the utils/fix-field-layout-uids command. (#17848)
• Fixed a bug where the EVENT_DEFINE_EXTRA_FIELDS event wasn’t getting triggered for elements. (#17866)
• Fixed a bug where craft\services\Assets::EVENT_AFTER_REPLACE_ASSET events weren’t getting triggered when replacing an asset file via GraphQL. (#17005)
• Fixed a bug where sections’ preview targets weren’t getting stored in the project config properly. (#17919)

4.16.13

• Fixed a bug where entries’ and categories’ descendants’ URIs weren’t always getting updated after a parent’s URI changed. (#17804)
• Fixed a bug where addresses weren’t saving firstName, lastName, and fullName values properly. (#17807)

4.16.12

• When searching for elements, partial matches within titles are now scored higher than exact matches in other fields. (#17739)
• Fixed a bug where volumes’ filesystem settings weren’t respecting static translations of filesystem names. (#17749)
• Fixed an error that could occur when applying project config changes. (#15357)
• Fixed a bug where pressing the “Use defaults” button within element indexes’ View menus wasn’t removing the sort query string parameter, so the selected sort option could revert back if the window was reloaded. (#17761)
• Updated the bundled composer.phar to 2.7.7. (#17796)

4.16.11

• Improved the performance of element queries. (#16401)
• Updated svg-sanitizer to 0.22. (#17738)

4.16.10

• Fixed a bug where the folderPath asset query param required a trailing slash. (craftcms/html-field#18)
• Fixed PHP deprecation errors.

4.16.9.1

... (truncated)

Changelog

Sourced from craftcms/cms's changelog.

4.16.17 - 2025-12-04

• Fixed a bug where remove buttons within multi-select Selectize inputs weren’t working if the input wasn’t focusend and fully in view. (#18079)
• Fixed an error that could occur when executing a GraphQL mutation when the lazyGqlTypes config setting was enabled. (#18014)
• Fixed a PHP error that could occur when creating a username that began or ended with an @. (#18123)
• Fixed a bug where assets with disallowed file extensions could be stored in the system’s temp directory. (#18049)
• Fixed RCE vulnerabilities. (GHSA-255j-qw47-wjh5, GHSA-742x-x762-7383)
• Fixed an SSRF vulnerability. (GHSA-x27p-wfqw-hfcc)
• Fixed a DoS vulnerability. (GHSA-v64r-7wg9-23pr)
• Fixed an information disclosure vulnerability. (GHSA-53vf-c43h-j2x9)

4.16.16 - 2025-11-18

• Fixed a bug where assets with disallowed file extensions could still be uploaded to the system’s temp directory. (#18015)
• Fixed an error that could occur when an array was passed to an asset query’s folderPath param. (#18056)

4.16.15 - 2025-10-28

• Reverted an element query performance optimization for MySQL 9. (#16401)
• Updated Axios to 1.12.2. (#17988)
• Fixed a bug where plugin license keys were getting generated for environments that didn’t allow admin changes, which could result in an error that prevented the Plugin Store from loading. (#17942)
• Fixed a bug where new plugin license keys weren’t getting saved to .env if the environment variable didn’t exist yet. (#17942)
• Fixed a bug where pressing Return within an editable table within a slideout would submit the slideout.
• Fixed an error that could occur when retrieving an array/hash value in Twig, if the fetched key wasn’t an integer or string.
• Fixed a bug where it wasn’t possible to clear out a volume’s “Transform Filesystem” setting. (#17953)

4.16.14 - 2025-10-06

• new is now a reserved filesystem handle.
• Fixed an error that could occur when running the utils/fix-field-layout-uids command. (#17848)
• Fixed a bug where the EVENT_DEFINE_EXTRA_FIELDS event wasn’t getting triggered for elements. (#17866)
• Fixed a bug where craft\services\Assets::EVENT_AFTER_REPLACE_ASSET events weren’t getting triggered when replacing an asset file via GraphQL. (#17005)
• Fixed a bug where sections’ preview targets weren’t getting stored in the project config properly. (#17919)

4.16.13 - 2025-09-05

• Fixed a bug where entries’ and categories’ descendants’ URIs weren’t always getting updated after a parent’s URI changed. (#17804)
• Fixed a bug where addresses weren’t saving firstName, lastName, and fullName values properly. (#17807)

4.16.12 - 2025-08-29

• When searching for elements, partial matches within titles are now scored higher than exact matches in other fields. (#17739)
• Fixed a bug where volumes’ filesystem settings weren’t respecting static translations of filesystem names. (#17749)
• Fixed an error that could occur when applying project config changes. (#15357)
• Fixed a bug where pressing the “Use defaults” button within element indexes’ View menus wasn’t removing the sort query string parameter, so the selected sort option could revert back if the window was reloaded. (#17761)
• Updated the bundled composer.phar to 2.7.7. (#17796)

4.16.11 - 2025-08-13

• Improved the performance of element queries. (#16401)

... (truncated)

Commits

• b5f17cd Finish 4.16.17
• 20db16e Merge commit from fork
• 4bcb0db Fixed GHSA-53vf-c43h-j2x9
• f83d4e0 Merge commit from fork
• 1718011 Fixed GHAS-v64r-7wg9-23pr
• 31f90a1 Merge commit from fork
• 013db63 Fix GHSA-x27p-wfqw-hfcc
• a77ec7b Merge commit from fork
• d82680f Fixed GHSA-742x-x762-7383
• ec43c49 Fixed GHSA-255j-qw47-wjh5
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.