Joomla 5 Update Package - Version 5.4.4

[20260301] Hardened ACL checks in com_ajax.

[20260302] Fixed an SQL injection vulnerability in the com_content articles web service endpoint.

[20260303] Fixed an XSS vulnerability in the com_associations comparison view.

[20260304] Fixed XSS vulnerabilities in various article title outputs.

[20260305] Fixed an arbitrary file deletion vulnerability in com_joomlaupdate.

[20260306] Fixed improper access checks in web service endpoints.

#46866 — Updated the deployment version information.

#46857 — Reduced exclusions in phpstan-baseline.neon.

#46811 — Fixed date highlighting in the front-end calendar.

#46905 — Updated the browserlist:update script.

#46889 — Fixed TinyMCE initialization in Firefox Developer Edition.

#46719 — Fixed the content data-transitions attribute being inherited from the first allowed item.

#46835 — Updated the Pull Request template to link related issues automatically.

#46910 — Fixed calendar display for right-to-left languages.

#46917 — Added the artificial intelligence policy to the Pull Request template.

#46906 — Updated Browserlist data.

#46881 — Added publishing status checks when retrieving banner items.

#46929 — Exposed the update filename during the automatic update preparation step.

#47235 — Removed a duplicate empty line from README.md.

#47226 — Fixed the selected checkmark background in Choices.js fields.

#47253 — Added a workflow for automatically marking conflicting Pull Requests.

#47265 — Disabled the blank GitHub issue template.

#47286 — Fixed a comment typo in merge-conflicts.yml.

#47258 — Updated the deleted files and folders list in script.php for the Joomla 5.4.4 release.

#47293 — Added new Joomla versions to CONTRIBUTING.md.

#47268 — Fixed flashing icons in the administrator sidebar.

#47218 — Fixed duplicate article counts caused by many-to-many relationships in mod_tags_popular.

#47263 — Fixed conditional Read More link output in mod_articles.

#47244 — Fixed padding in Choices.js selection fields.

#47321 — Updated NPM development dependencies to fix nine security vulnerabilities.

#47217 — Fixed Scheduled Tasks stopping when one task becomes stuck.

#47336 — Added a check to verify that the schema path specified in the manifest exists.

#47352 — Selector filters are now reset when SearchTools filters are cleared.

#46933 — Fixed undefined array key warnings in workflow permissions.

#47274 — Fixed the Joomla version being omitted from nightly build notifications.

#47390 — Nightly build commands now use the DRONE_BRANCH variable instead of MINORVERSION.

#47397 — Corrected quotation mark escaping in nightly build notifications.

#47399 — Fixed nightly build notifications by using single quotes and string concatenation.

#47376 — Fixed MailHelper::isEmailAddress() throwing an exception for forbidden characters.

#47388 — The Versions button is now hidden when com_contenthistory is disabled.

#47406 — Updated the indirect flatted NPM dependency to fix a high-severity security vulnerability.

#47251 — Fixed relative asset paths on the Cassiopeia error page.

#47411 — Updated the GitHub feature request issue template.

#47422 — Updated GitHub Actions and dropped Node.js 20.

#47427 — The media edit button is now disabled when no media action plugins are enabled.

Joomla 5.4.4 is a security and bugfix release.

Installing Joomla 5.4.4 as soon as possible is strongly recommended.

Joomla 5.4.4 was released together with Joomla 6.0.4.

Creating a website backup and checking the compatibility of installed extensions and templates is recommended before updating.

When upgrading from a version earlier than Joomla 4.4, update to Joomla 4.4 first and then upgrade to Joomla 5.