+New feature #JD-123: Bar chart orientation switch (#5441) (SaraDimoska)
+New feature #JD-195: Re-design survey structure items (Adil Moumni Abdou)
-Fixed issue: [security] Updated vulnerable speadsheet Excel writer package, raised PHP minimum requirement to 8.2.27 (#5479) (Patrick Teichmann)
-Fixed issue: [security] Missing authorization in the REST API survey template and survey archive endpoints. Severity: Medium (CVSS 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). An authenticated user with no permissions on a survey could retrieve the rendered survey template and list the archived response and participant tables of any survey. Affects versions 6.5.11 and later. (#5527) (Carsten Schmitz)
-Fixed issue: Screen readers could not identify CAPTCHA images, and the save form's CAPTCHA label was linked to the wrong field (Carsten Schmitz)
-Fixed issue: Refreshing a survey test run after the survey preview of the editor was opened in another tab showed a PHP warning (Carsten Schmitz)
-Fixed issue: Quick-translation auto-translate lost HTML formatting such as line breaks, bold text and paragraphs (Carsten Schmitz)
-Fixed issue: Password help text ignores the requirements of the PasswordRequirement plugin (Carsten Schmitz)
-Fixed issue: Conditional display not working on Multiple Choice type (#5532) (Stefan K)
-Fixed issue: Administrators could still change data or start a web database update while the hosting system made a backup or ran the update from the command line (#5509) (Carsten Schmitz)
-Fixed issue: A11y improvements in user management delete and import user modals (LS-NEW-012 to LS-NEW-014) (#5476) (Anblik Audit Team)
-Fixed issue: A11y improvements in survey themes and label sets lists (LS-NEW-016 to LS-NEW-025) (#5477) (Anblik Audit Team)
-Fixed issue: A11y improvements in participant attributes modals (LS-NEW-028 to LS-NEW-037) (#5493) (Anblik Audit Team)
-Fixed issue: A11y improvements in participant attribute dropdown fields (LS-NEW-039 to LS-NEW-041) (#5494) (Anblik Audit Team)
-Fixed issue: A11y improvements in grid pager and action links (LS-NEW-026, LS-NEW-027) (#5492) (Anblik Audit Team)
-Fixed issue: A11y improvements in central participant summary and CSV import (LS-NEW-043 to LS-NEW-052) (#5495) (Anblik Audit Team)
-Fixed issue: A11y improvements in CPDB import summary and attributes list (LS-NEW-053 to LS-NEW-062) (#5496) (Anblik Audit Team)
-Fixed issue: A11y improvements in CPDB attributes filters and share panel (LS-NEW-063 to LS-NEW-072) (#5506) (Anblik Audit Team)
-Fixed issue: A11y LS-NEW-002 to LS-NEW-009: modals in user management (#5475) (Anblik Audit Team)
-Fixed issue #JD-216: File upload mandatory question does not block saving after deleting uploaded files (#5484) (haythem chibani)
-Fixed issue #JD-203: Save other option checked without text (#5469) (SaraDimoska)
-Fixed issue #CT-2046: Missing admin translations (#5517) (Rami S. Zaki)
-Fixed issue #AT-2326: A11y font color of survey nav menu items and buttons on theme-colored backgrounds now meets WCAG AA contrast in all fruity_twentythree theme colors (#5505) (Tim Willig)
-Fixed issue #AT-2323: Broken image select question type attributes (#5434) (Tim Willig)
-Fixed issue #AT-2280: Theme options - images were showing old versions of the LimeSurvey logo (#5512) (Tim Willig)
-Fixed issue #AT-2270: Set minimum version for composer (#5479) (Patrick Teichmann)
-Fixed issue #AT-2159: Fix React warning - Connect(Droppable) uses deprecated defaultProps on memo component (#5413) (Rami S. Zaki)
-Fixed issue #AT-2059: Empty placeholder list in the editor + some placeholders not displayed in subquestions and answer options (#5436) (Tim Willig)
-Fixed issue #20843: [security] Authorization bypass vulnerability in survey participant table restore. Severity: High (CVSS 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). An authenticated user allowed to create participants in their own survey could copy the participant list of any other survey, including the access codes, into their own survey and use those codes to answer the other survey. Affects versions 6.16.0 and later. Reported by: korosuke587. (#5531) (Carsten Schmitz)
-Fixed issue #20842: Survey logic overview no longer showed the array filter equations of the answer options of list questions (Carsten Schmitz)
-Fixed issue #20841: Reorder questions/question groups showed the question code twice and the group ID in front of the group name (Carsten Schmitz)
-Fixed issue #20839: Fruity TwentyThree offered no setting to hide the language switcher and hiding it with custom CSS left an empty '...' menu (Carsten Schmitz)
-Fixed issue #20838: Stop survey page in the classic editor wrongly warned that all participant information will be lost on deactivation although the participant list is archived and can be restored (Carsten Schmitz)
-Fixed issue #20836: Dual scale array cells referenced by their field name (Q123_S456#) were reported as undefined variable plus unsupported syntax, for example after importing a LimeSurvey 3 survey with SGQA references in question texts (Carsten Schmitz)
-Fixed issue #20834: Condition designer showed the 'customized condition' note for questions with the default condition 1 instead of 'This question is always shown' (Carsten Schmitz)
-Fixed issue #20832: The 'Activate' button in the survey list opened the general settings instead of the survey activation dialog (Carsten Schmitz)
-Fixed issue #20831: [security] Stored cross-site scripting (XSS) vulnerability in user management. Severity: Medium (CVSS 6.1, AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N). An attacker with the permission to create or edit user groups could give a user group a name containing HTML that ran as script in the browser of any administrator, including superadministrators, opening the user management page. Affects versions 4.0.0 to 7.9.1 (Carsten Schmitz)
-Fixed issue #20831: [security] Stored XSS vulnerability via user group names in user management (#5530) (Carsten Schmitz)
-Fixed issue #20824: The basic toolbar of the classic HTML editor had no way to set headings (Carsten Schmitz)
-Fixed issue #20823: [security] Server-side request forgery (SSRF) and missing authorization vulnerability in the REST survey template endpoint. Severity: Medium (CVSS 5.0, AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N). An authenticated REST API user without any survey permission could make the server fetch the survey preview path from any port of an allowed host, such as an internal service on localhost, and read the response, and could also list the response archives of any survey. Affects versions 6.5.11 to 6.17.19 and 7.0.0 to 7.9.1. Reported by: c1k0xx. (#5529) (Carsten Schmitz)
-Fixed issue #20821: [security] Insecure randomness vulnerability in the generation of participant access codes, password reset links and uploaded file names. Severity: Medium (CVSS 4.2, AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N). An attacker who knows a valid participant access code could work out other access codes generated together with it and answer the survey as those participants; password reset keys and uploaded file names were predictable in the same way. Affects all versions up to 7.9.1. Reported by: leediay153. (#5528) (Carsten Schmitz)
-Fixed issue #20819: Array (Numbers) and Array (Text) answers were missing in the queXML PDF response export (Carsten Schmitz)
-Fixed issue #20817: On small screens the slider value tooltip covered the start of the subquestion text (Carsten Schmitz)
-Fixed issue #20816: In the fruity_twentythree theme, a dropdown question set to the width of the longest entry stayed as narrow as "Please choose..." (Carsten Schmitz)
-Fixed issue #20815: In the new editor, a date/time question could not be set to a time-only or other custom date/time format (Carsten Schmitz)
-Fixed issue #20783: With debug mode on, uploading a forbidden file type in the file manager showed a server error instead of the error message (Carsten Schmitz)
-Fixed issue #19378: Answers were lost and a "Response data not found" error was shown when a survey was taken in a browser session that had previewed it while it was still inactive (Carsten Schmitz)
-Fixed issue #18746: The create survey button in the top bar was announced as "plus" by screen readers and showed no tooltip (Carsten Schmitz)
-Fixed issue #18377: "No answer" was still shown for soft mandatory Array, Array (10 point choice), Array dual scale and 5 point choice questions (Carsten Schmitz)
-Fixed issue #18014: In the question editor, long subquestion and answer option lists were shown in a scroll box and the label set and Quick add buttons were only reachable at its end (Carsten Schmitz)
-Fixed issue #17686: In the question editor the subquestion and answer option lists showed only a few rows and long subquestion relevance equations could not be read (Carsten Schmitz)
#Updated translation: Slovenian by translations_bot
#Updated translation: Portuguese (Brazil) by rafaelmaia, translations_bot, xastrefernando
#Updated translation: Polish by elissa, translations_bot
#Updated translation: Polish (Informal) by elissa
#Updated translation: Japanese by d_inoue, nomoto, translations_bot
#Updated translation: German by c_schmitz, translations_bot
#Updated translation: German (Informal) by c_schmitz, translations_bot
#Updated translation: French (France) by c_schmitz, DenisChenu, translations_bot
#Updated translation: Dutch by c_schmitz, Han, translations_bot
#Updated translation: Dutch (Informal) by c_schmitz, Han, translations_bot
#Updated translation: Catalan by qualitatuvic, translations_bot