[6.x] Port settings/sites to inertia

.github/workflows/facades.yml

@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
@@ -57,17 +57,22 @@ jobs:
           php -f vendor/bin/facade.php -- \
             CraftCms\\Cms\\Support\\Facades\\Announcements \
             CraftCms\\Cms\\Support\\Facades\\Deprecator \
+            CraftCms\\Cms\\Support\\Facades\\Entries \
             CraftCms\\Cms\\Support\\Facades\\EntryTypes \
             CraftCms\\Cms\\Support\\Facades\\Fields \
             CraftCms\\Cms\\Support\\Facades\\I18N \
             CraftCms\\Cms\\Support\\Facades\\ProjectConfig \
             CraftCms\\Cms\\Support\\Facades\\Sections \
+            CraftCms\\Cms\\Support\\Facades\\SiteGroups \
+            CraftCms\\Cms\\Support\\Facades\\Sites \
             CraftCms\\Cms\\Support\\Facades\\Structures \
             CraftCms\\Cms\\Support\\Facades\\Updates \
-            CraftCms\\Cms\\Support\\Facades\\UserGroups
+            CraftCms\\Cms\\Support\\Facades\\UserGroups \
+            CraftCms\\Cms\\Support\\Facades\\UserPermissions \
+            CraftCms\\Cms\\Support\\Facades\\Users
 
       - name: Commit facade docblocks
-        uses: stefanzweifel/git-auto-commit-action@v5
+        uses: stefanzweifel/git-auto-commit-action@v7
         with:
           commit_message: Update facade docblocks
           file_pattern: src/

CHANGELOG.md

@@ -2,12 +2,21 @@
 
 ## Unreleased
 
+- User queries now always return active, non-pending users first, unless otherwise specified by `orderBy`. ([#18148](https://github.com/craftcms/cms/issues/18148))
+- The `utils/fix-field-layout-uids` command now checks for duplicate top-level field layout UUIDs. ([#18193](https://github.com/craftcms/cms/pull/18193))
+- Fixed a bug where all plugin settings were being saved to the project config, rather than just posted settings. ([craftcms/commerce#4006](https://github.com/craftcms/commerce/issues/4006))
+- Fixed a bug where custom selects could be positioned incorrectly after the window was resized. ([#18179](https://github.com/craftcms/cms/issues/18179))
 - Fixed a bug where Matrix fields’ Entry Types settings were partially interactive when admin changes were disallowed. ([#18145](https://github.com/craftcms/cms/pull/18145))
 - Fixed a bug where users could be unable to sign in if an inactive user account existed with the same email address. ([#18148](https://github.com/craftcms/cms/issues/18148))
 - Fixed a bug where Content Block fields could appear to be missing their content when viewing a revision. ([#18149](https://github.com/craftcms/cms/issues/18149))
 - Fixed a bug where Dropdown and Radio Button fields weren’t handling `:empty:`/`:notempty:` element query params properly for options with blank values. ([#18156](https://github.com/craftcms/cms/issues/18156))
 - Fixed a bug where chip icons were getting rounded. ([#18163](https://github.com/craftcms/cms/pull/18163))
 - Fixed a bug where object templates that included another template were missing variables. ([#18165](https://github.com/craftcms/cms/issues/18165))
+- Fixed a JavaScript error that could occur if two control panel animations were triggered simultaneously.
+- Fixed a bug where it wasn’t possible to copy/paste nested entries within Matrix fields set to the inline-editable blocks view mode, for unpublished owner elements. ([#18185](https://github.com/craftcms/cms/pull/18185))
+- Fixed a bug where custom fields’ checkboxes weren’t getting removed from field layouts’ “Card Attributes” lists when removed from the layout.
+- Fixed an SSRF vulnerability. (GHSA-96pq-hxpw-rgh8)
+- Fixed an XSS vulnerability. (GHSA-7pr4-wx9w-mqwr)
 
 ## 5.8.21 - 2025-12-04
 
@@ -20,10 +29,10 @@
 - Fixed a bug where relation fields weren’t handling `:empty:`/`:notempty:` element query params properly if the field had multiple instances within a field layout. ([#18092](https://github.com/craftcms/cms/pull/18092))
 - Fixed a bug where user preferences were being respected for users who formerly had access to the control panel.
 - Fixed a bug where nested entries could be reordered when their owner element was resaved programmatically. ([#18121](https://github.com/craftcms/cms/pull/18121))
-- Fixed RCE vulnerabilities. (GHSA-255j-qw47-wjh5, GHSA-742x-x762-7383)
-- Fixed an SSRF vulnerability. (GHSA-x27p-wfqw-hfcc)
-- Fixed a DoS vulnerability. (GHSA-v64r-7wg9-23pr)
-- Fixed an information disclosure vulnerability. (GHSA-53vf-c43h-j2x9)
+- Fixed RCE vulnerabilities. ([GHSA-255j-qw47-wjh5](https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5), [GHSA-742x-x762-7383](https://github.com/craftcms/cms/security/advisories/GHSA-742x-x762-7383))
+- Fixed an SSRF vulnerability. ([GHSA-x27p-wfqw-hfcc](https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc))
+- Fixed a DoS vulnerability. ([GHSA-v64r-7wg9-23pr](https://github.com/craftcms/cms/security/advisories/GHSA-v64r-7wg9-23pr))
+- Fixed an information disclosure vulnerability. ([GHSA-53vf-c43h-j2x9](https://github.com/craftcms/cms/security/advisories/GHSA-53vf-c43h-j2x9))
 
 ## 5.8.20 - 2025-11-18
 

CONTRIBUTING.md

@@ -67,6 +67,55 @@ If you want to help improve Craft’s translations, [sign up to be a translator]
 
 If you would like to work on a new core feature or improvement, first create a [GitHub issue](https://github.com/craftcms/cms/issues) for it if there’s not one already. As much as we appreciate community contributions, we are pretty selective about which sorts of features should make it into Craft itself rather than a plugin, so don’t take it the wrong way if we advise you to pursue the idea as a plugin instead.
 
+## Control Panel Front End
+
+In order to work on the control panel front end, we recommend opening two terminal windows.
+
+1. Run `npm run dev` in one window to start the Vite development server.
+2. Run `npm run dev:cp` in the other window to start the Vite process for the `@craftcms/cp` package.
+
+With both processes running, you'll be able to work on most aspects of the control panel. 
+
+If getting into the weeds is your thing, more detail on these pieces is provided below. 
+
+### Control Panel Assets
+
+The assets specific to the control panel live in the `resources` folder. Those are built using a fairly typical Vite setup. To develop assets for the control panel, there are two commands:
+```shell
+# Run the Vite development server
+npm run dev
+
+# Build assets for production
+npm run build
+```
+
+### `@craftcms/cp` package
+
+The control panel is largely backed by web components that live in the `@craftcms/cp` package within the `packages/craftcms-cp` directory. Like other packages, it has its own build process that can be run independently of the control panel.
+```shell
+# Run the build in watch mode. Assets will be rebuilt on every change
+npm run dev:cp
+
+# Run the build for production
+npm run build:cp
+```
+
+In practice, you rarely work on one without the other, so we recommend having two terminal panes open. One running the main control panel assets build and another building the web components.
+
+### Legacy Bundles
+
+> [!NOTE]  
+> Updating the legacy bundles should be a rare occurrence. Avoid when possible.
+
+All the styles and scripts used to support the control panel up until Craft 5 live in the [yii2-adapter](https://github.com/craftcms/yii2-adapter) package. That package has its own NPM dependencies and build process, but because it's common to have that package symlinked into your Craft 6 project, you're able to run the build scripts via the `build:bundles` command.
+```sh
+# Build assets for production
+npm run build:bundles
+
+# Run dev server to develop a specific package
+npm run dev:bundles -- -- --config-name=cp
+```
+
 ## Pull Requests
 
 Pull requests should clearly describe the problem and solution. Include the relevant issue number if there is one. If the pull request fixes a bug, it should include a new test case that demonstrates the issue, if possible.

package.json

@@ -10,13 +10,13 @@
     "prebuild": "npm run fix-prettier",
     "build": "vite build",
     "dev": "vite",
-    "build:bundles": "cd yii2-adapter && npm run build",
-    "dev:bundles": "cd yii2-adapter && npm run dev",
-    "serve:bundles": "cd yii2-adapter && npm run serve",
-    "dev:cp": "npm run dev -w @craftcms/cp",
-    "build:cp": "npm run build -w @craftcms/cp",
-    "test:cp": "npm run test -w @craftcms/cp",
-    "storybook:cp": "npm run storybook -w @craftcms/cp",
+    "build:bundles": "cd ./yii2-adapter && npm run build",
+    "dev:bundles": "cd ./yii2-adapter && npm run dev",
+    "serve:bundles": "cd ./yii2-adapter && npm run serve",
+    "dev:cp": "cd ./packages/craftcms-cp && npm run dev",
+    "build:cp": "cd ./packages/craftcms-cp && npm run build",
+    "test:cp": "cd ./packages/craftcms-cp && npm run test",
+    "storybook:cp": "cd ./packages/craftcms-cp && npm run storybook",
     "build:all": "npm run build:bundles && npm run build:cp && npm run build"
   },
   "workspaces": [
@@ -53,6 +53,7 @@
   "dependencies": {
     "@craftcms/cp": "file:packages/craftcms-cp",
     "@inertiajs/vue3": "^2.2.7",
+    "@tanstack/vue-table": "^8.21.3",
     "@vueuse/core": "^14.0.0",
     "axios": "^1.13.2",
     "laravel-vite-plugin": "^2.0.1",

packages/craftcms-cp/src/components/action-item/action-item.ts

@@ -1,8 +1,8 @@
 import {html, LitElement, nothing} from 'lit';
 import {property} from 'lit/decorators.js';
 import styles from './action-item.styles.js';
-import {Variant, type VariantKey} from '@/types';
-import variantsStyles from '@/styles/variants.styles';
+import {Variant, type VariantKey} from '@src/types';
+import variantsStyles from '@src/styles/variants.styles';
 
 /**
  * @summary Either a link or button typically used in a menu.
@@ -12,7 +12,7 @@ export default class CraftActionItem extends LitElement {
   @property() icon: string | null = null;
   @property() href: string | null = null;
   @property({type: Boolean}) disabled: boolean = false;
-  @property() variant: VariantKey = Variant.Default;
+  @property({reflect: true}) variant: VariantKey = Variant.Default;
 
   renderBody() {
     return html`

packages/craftcms-cp/src/components/action-menu/action-menu.ts

@@ -1,7 +1,7 @@
 import {css, html, LitElement} from 'lit';
 import {OverlayMixin, withDropdownConfig} from '@lion/ui/overlays.js';
 import {queryAssignedElements} from 'lit/decorators.js';
-import type CraftActionItem from '@/components/action-item/action-item';
+import type CraftActionItem from '@src/components/action-item/action-item';
 import {uuid} from '@lion/ui/core.js';
 
 /**
@@ -13,6 +13,8 @@ import {uuid} from '@lion/ui/core.js';
 export default class CraftActionMenu extends OverlayMixin(LitElement) {
   static override styles = css`
     ::slotted([slot='content']) {
+      font-size: var(--c-text-base);
+      font-weight: 400;
       display: grid;
       gap: var(--c-spacing-xs);
       border: 1px solid var(--c-color-neutral-border-subtle);

packages/craftcms-cp/src/components/button/button.styles.ts

@@ -11,7 +11,7 @@ export default css`
     align-items: center;
     border-radius: var(--c-button-radius, var(--c-radius-sm));
     color: var(--c-button-fg, inherit);
-    padding-inline: var(--c-button-spacing-inline, var(--c-spacing-lg));
+    padding-inline: var(--c-button-spacing-inline, var(--c-spacing-md));
     padding-block: 0;
     width: auto;
     min-height: var(--c-button-height, var(--c-size-control-md));
@@ -46,6 +46,7 @@ export default css`
     padding-inline: var(--c-spacing-sm);
     min-width: var(--c-size-control-sm);
     min-height: var(--c-size-control-sm);
+    font-size: 0.9em;
 
     craft-icon {
       font-size: 0.8em;

packages/craftcms-cp/src/components/callout/callout.stories.ts

@@ -3,7 +3,7 @@ import type {Meta, StoryObj} from '@storybook/web-components-vite';
 import {html} from 'lit';
 
 import './callout.js';
-import {Variant, Appearance} from '@/types';
+import {Appearance, Variant} from '@src/types';
 
 const variants = Object.values(Variant);
 const appearances = Object.values(Appearance);

packages/craftcms-cp/src/components/callout/callout.ts

@@ -7,8 +7,8 @@ import {
   type AppearanceKey,
   Variant,
   type VariantKey,
-} from '@/types/index.js';
-import variantsStyles from '@/styles/variants.styles';
+} from '@src/types/index.js';
+import variantsStyles from '@src/styles/variants.styles.js';
 
 export default class CraftCallout extends LitElement {
   static override styles: CSSResultGroup = [variantsStyles, styles];

packages/craftcms-cp/src/components/indicator/indicator.stories.ts

@@ -3,7 +3,7 @@ import type {Meta, StoryObj} from '@storybook/web-components-vite';
 import {html} from 'lit';
 
 import './indicator.js';
-import {Variant} from '@/types';
+import {Variant} from '@src/types';
 
 // More on how to set up stories at: https://storybook.js.org/docs/writing-stories
 const meta = {

packages/craftcms-cp/src/components/indicator/indicator.ts

@@ -1,9 +1,8 @@
-import {LitElement, html, css} from 'lit';
+import {css, html, LitElement} from 'lit';
 import {property} from 'lit/decorators.js';
-import {Variant, type VariantKey} from '@/types';
+import {Variant, type VariantKey} from '@src/types';
 import {classMap} from 'lit/directives/class-map.js';
-import variantsStyles from '@/styles/variants.styles';
-import CraftCombobox from '@/components/combobox/combobox';
+import variantsStyles from '@src/styles/variants.styles';
 
 export default class CraftIndicator extends LitElement {
   static override styles = [

packages/craftcms-cp/src/components/input-file/input-file.ts

@@ -1,5 +1,5 @@
 import {LionInputFile} from '@lion/ui/input-file.js';
-import {inputStyles} from '@/styles/form.styles';
+import {inputStyles} from '@src/styles/form.styles';
 import styles from './input-file.styles.js';
 import CraftSelectedFileList from './selected-file-list.js';
 import {html} from 'lit';

packages/craftcms-cp/src/components/input/input.ts

@@ -1,5 +1,5 @@
 import {LionInput} from '@lion/ui/input.js';
-import {inputStyles} from '@/styles/form.styles';
+import {inputStyles} from '@src/styles/form.styles';
 import styles from './input.styles.js';
 import {property} from 'lit/decorators.js';
 

packages/craftcms-cp/src/components/nav-item/nav-item.styles.ts

@@ -4,16 +4,21 @@ export default css`
   .nav-item {
     display: grid;
     gap: var(--c-spacing-md);
-    grid-template-columns: calc(24rem / 16) 1fr auto;
+    grid-template-columns: 1fr auto;
     align-items: center;
     text-decoration: none;
     color: inherit;
-    padding-inline: var(--c-spacing-sm);
+    padding-inline: var(--c-spacing-md);
     padding-block: var(--c-spacing-sm);
     border-radius: var(--c-radius-md);
     position: relative;
   }
 
+  .nav-item--prefixed {
+    padding-inline: var(--c-spacing-sm);
+    grid-template-columns: calc(24rem / 16) 1fr auto;
+  }
+
   :host([active]) .nav-item {
     &:before {
       content: '';