Craft CMS 5.9: Matrix Overhaul, XLSX Export, and Sandboxed Twig Rendering
Craft CMS 5.9 is out, with a substantial set of improvements to the control panel, content authoring, and security. If you manage Craft sites or build on the platform, there is plenty here worth knowing about.
Custom Entry Index Pages
Entry sources can now be split into multiple index pages, each with its own name and icon. For sites with large editorial teams or complex content structures, this means cleaner navigation rather than a single flat list of every entry type crammed into one view.
Matrix Field Improvements
Three improvements landed for Matrix fields in this release:
- Grouped add buttons - Matrix fields with multiple entry type groups now show a separate button per group rather than a single dropdown containing everything. Much easier to navigate on complex blocks.
- Bulk actions - Both Cards and Blocks views now support selecting multiple nested entries and running Duplicate or Delete on all of them at once.
- Better Content Block support - Fields nested inside Content Block fields can now be surfaced in element cards and index table views.
New Export Options
Element index pages now support exporting to XLSX and YAML in addition to the existing formats. For client handoffs or data migrations, XLSX in particular is a meaningful practical addition - most clients are far more comfortable with a spreadsheet than a JSON dump.
Sandboxed Twig Rendering for System Messages
This is the security highlight of the release. System messages - things like password reset emails and notification templates - can now be rendered in a sandboxed Twig environment. The sandbox limits what Twig tags, filters, and functions are available, meaning that if a malicious template were somehow introduced (via a compromised admin account or a plugin vulnerability), the damage it could cause is significantly constrained.
For anyone who has followed the history of Twig Server-Side Template Injection vulnerabilities across CMS platforms - including the vCard plugin RCE we covered previously - this is a meaningful defensive addition at the framework level.
Element-Based Editability Conditions
Field layout tabs and individual custom fields can now be conditionally made editable or read-only based on the element being edited. This gives developers finer-grained control over what authors can and cannot change in the control panel, without needing to reach for custom plugins.
Composer Caret Operator
A small but useful developer improvement: when Craft makes automated changes to composer.json (for example when installing or updating plugins), it now writes version constraints using the caret operator (^1.2.3) rather than exact version pins. This makes running composer update across a Craft project considerably more predictable.
Full release notes are on GitHub. Update via composer update craftcms/cms.
