# CiviCRM 6.17.0

Released August 5, 2026;

- **[Synopsis](#synopsis)**
- **[Features](#features)**
- **[Bugs resolved](#bugs)**
- **[Miscellany](#misc)**
- **[Credits](#credits)**


## <a name="synopsis"></a>Synopsis

| *Does this version...?*                                         |         |
|:--------------------------------------------------------------- |:-------:|
| **Fix security vulnerabilities?**                               | **yes** |
| **Change the database schema?**                                 | **yes** |
| **Alter the API?**                                              | **yes** |
| Require attention to configuration options?                     |   no    |
| **Fix problems installing or upgrading to a previous version?** | **yes** |
| **Introduce features?**                                         | **yes** |
| **Fix bugs?**                                                   | **yes** |

## <a name="security"></a>Security advisories

* **[CIVI-SA-2026-35](https://civicrm.org/advisory/civi-sa-2026-35-permission-bypass-apiv4): _APIv4_: Permission Bypass in APIv4 (security/core#286)**
* **[CIVI-SA-2026-36](https://civicrm.org/advisory/civi-sa-2026-36-information-discolsure-apiv4): _APIv4_: Information discolsure in APIv4 (security/core#290)**

## <a name="features"></a>Features

### Core CiviCRM

- **SearchKit - ability to export links
  ([dev/core#6511](https://lab.civicrm.org/dev/core/-/work_items/6511):
  [35831](https://github.com/civicrm/civicrm-core/pull/35831))**

  Formats hyperlinks in xls/pdf/ods downloads.

- **SearchKit - Add option to hide table header in search displays
  ([36005](https://github.com/civicrm/civicrm-core/pull/36005))**

  Adds an option to SearchKit Display settings to hide the table header.

- **Add implicit FK field for primary membership's contact ID in SearchKit
  ([35146](https://github.com/civicrm/civicrm-core/pull/35146))**

  Improves Searchkit by adding a foriegn key for primary membership contact id.

- **SearchKit - Enable totals in header as well as footer
  ([35855](https://github.com/civicrm/civicrm-core/pull/35855))**

  Adds a setting to show the total in SearchKit headers.

- **SearchKit - Selectable money format
  ([35833](https://github.com/civicrm/civicrm-core/pull/35833))**

  Makes it so one can select the money format to use in SearchKit.

- **SearchKit - Improve admin UX for picking subsearch displays
  ([36002](https://github.com/civicrm/civicrm-core/pull/36002))**

  Improves SearchKit admin user experience when picking subsearch displays.

- **Add civi.afform.sort.submit event
  ([35726](https://github.com/civicrm/civicrm-core/pull/35726))**

  Adds an Event to control (override) order civi.afform.submit.

- **Afform - add async Validate action
  ([34006](https://github.com/civicrm/civicrm-core/pull/34006))**

  Makes it so server side Afform validation can be run asynchronously without
  submitting.

- **Add subsearches to the list of editable searches from Afforms
  ([35865](https://github.com/civicrm/civicrm-core/pull/35865))**

  Makes it easier to find subsearches in the list of editable searches from
  Afforms.

- **Afform - Add static caching to Behaviors API
  ([36114](https://github.com/civicrm/civicrm-core/pull/36114))**

  Afform performance improvement.

- **FormBuilder - support using :name suffixed fields in af-field
  ([35915](https://github.com/civicrm/civicrm-core/pull/35915))**

  Allows using :name suffixed fields for pseudoconstant fields in FormBuilder,
  which improves portability.

- **FormBuilder - Reorganize tabs to add "Packaged Forms"
  ([36113](https://github.com/civicrm/civicrm-core/pull/36113))**

  Improves FormBuilder and SearchKit tabs to be consistent with each other.
  Replaces seldom-used "System Forms" tab with "Packaged Forms". Adds a filter
  to the other tabs to make it possible to still view packaged forms there if
  desired.

- **Add Afform::validate definition to Afform API4
  ([35992](https://github.com/civicrm/civicrm-core/pull/35992))**

  Adds in Afform::validate  definition so IDE etc. can find it.

- **File custom fields in multiple record custom field groups do not display
  properly in tab+table
  ([dev/core#6600](https://lab.civicrm.org/dev/core/-/work_items/6600):
  [36045](https://github.com/civicrm/civicrm-core/pull/36045))**

- **Riverlea Theme Editor - better support for packaged streams
  ([35872](https://github.com/civicrm/civicrm-core/pull/35872))**

  Improves support for packaged Riverlea streams.

- **Riverlea theme editor - wider preview pane
  ([35870](https://github.com/civicrm/civicrm-core/pull/35870))**

  Improves the Riverlea theme editor preview pane by making it wider.

- **Introduces theme mode change based on user control
  ([35430](https://github.com/civicrm/civicrm-core/pull/35430))**

  Adds a small toggle control to the backend menubar. The control stores the
  selected mode in a cookie, and Riverlea uses that cookie to override the
  backend dark-mode setting for the current user.

- **River - revised dashboard css adjustments: adjusts box-shadow,
  swaps to semantic variables, new variable for colour
  ([35956](https://github.com/civicrm/civicrm-core/pull/35956) and
  [35880](https://github.com/civicrm/civicrm-core/pull/35880))**

  Assorted Riverlea css improvements.

- **Allow user role permissions (permissions that imply a logged in user must
  have a certain CMS role) to be shown in search kit admin interface and used as
  part of conditional checks
  ([35890](https://github.com/civicrm/civicrm-core/pull/35890))**

  Adds user role permissions to the Searchkit admin interface.

- **add FTS index support to EFv2; add new contact_name index to civicrm_contact
  ([35792](https://github.com/civicrm/civicrm-core/pull/35792) and
  [35861](https://github.com/civicrm/civicrm-core/pull/35861))**

  Adds the schema level plumbing for FULLTEXT indices and adds a single new
  contact_name index to the civicrm_contact table.

- **FormBuilder - Convert admin listing to use SearchKit
  ([35821](https://github.com/civicrm/civicrm-core/pull/35821))**

  Converts FormBuilder listing screen to use FormBuilder+SearchKit; improves
  loading time and flexibility.

- **Add full primary address to all example contacts
  ([35922](https://github.com/civicrm/civicrm-core/pull/35922))**

  Improves example data.

- **Allow Redis caching via UNIX socket
  ([35884](https://github.com/civicrm/civicrm-core/pull/35884))**

  Implements Redis caching via the CIVICRM_DB_CACHE_HOST constant

- **Add SMS batch action for event participants
  ([35297](https://github.com/civicrm/civicrm-core/pull/35297))**

  Add an action to batch text event participants.

- **QuickForm - Add autocompleteFilters
  ([36107](https://github.com/civicrm/civicrm-core/pull/36107))**

  Adds a new optional method to the class CRM_Core_Form for registering
  autocomplete filters. This overcomes the limitation of adding filters directly
  to $props['api'] where they will be ignored for security reasons if not part
  of the autocomplete's SELECT clause.

### CiviCase

- **CiviCase - Add default subject field to timeline/sequence activities
  ([35962](https://github.com/civicrm/civicrm-core/pull/35962))**

  Allows a default subject to be set for every activity in the case timeline.

### CiviContribute

- **allow to enter multiple soft credits for the same contact
  ([30847](https://github.com/civicrm/civicrm-core/pull/30847))**

  Allow multiple soft credits to be entered for the same contact and
  contribution.

- **Update Contribution duplicate check to give more information on duplicates
  ([36053](https://github.com/civicrm/civicrm-core/pull/36053))**

  Improves error messaging when a duplciate contribution is found.

## <a name="bugs"></a>Bugs resolved

### Core CiviCRM

- **Help links should go after the label, not after the field
  ([dev/core#4297](https://lab.civicrm.org/dev/core/-/work_items/4297):
  [36087](https://github.com/civicrm/civicrm-core/pull/36087),
  [36089](https://github.com/civicrm/civicrm-core/pull/36089),
  [36090](https://github.com/civicrm/civicrm-core/pull/36090),
  [36086](https://github.com/civicrm/civicrm-core/pull/36086),
  [36088](https://github.com/civicrm/civicrm-core/pull/36088) and
  [36093](https://github.com/civicrm/civicrm-core/pull/36093))**

- **OAuth Client: add url and realm (for keycloak)
  (Work towards
  [dev/core#6554](https://lab.civicrm.org/dev/core/-/work_items/6554):
  [35871](https://github.com/civicrm/civicrm-core/pull/35871) and
  [35886](https://github.com/civicrm/civicrm-core/pull/35886))**

  Work towards integraying with keycloak.

- **Users with "view all contacts" permission cannot view contact pages
  ([dev/core#6555](https://lab.civicrm.org/dev/core/-/work_items/6555):
  [35920](https://github.com/civicrm/civicrm-core/pull/35920))**

- **FormBuilder: required fields inside an optional repeat block prevent
  submitting the form with 0 instances
  ([dev/core#6608](https://lab.civicrm.org/dev/core/-/work_items/6608):
  [36162](https://github.com/civicrm/civicrm-core/pull/36162))**

- **Formbuilder Payments: Allow test mode payment on live contribution
  ([35817](https://github.com/civicrm/civicrm-core/pull/35817))**

  Allow test mode payments on live contributions with formbuilder payments.

- **FormBuilder: Select Form Entity for entity ref field doesn't have any
  options ([dev/core#6624](https://lab.civicrm.org/dev/core/-/work_items/6624):
  [36234](https://github.com/civicrm/civicrm-core/pull/36234))**

- **SearchKit default values are not being set when multiple is set to true
  ([dev/core#6627](https://lab.civicrm.org/dev/core/-/work_items/6627):
  [36231](https://github.com/civicrm/civicrm-core/pull/36231))**

- **Trigger rebuild fails in cases when SHOW TABLES query returns empty values.
  ([dev/core#6630](https://lab.civicrm.org/dev/core/-/work_items/6630):
  [36292](https://github.com/civicrm/civicrm-core/pull/36292))**

- **SearchKit - Don't needlessly refresh subsearches
  ([36000](https://github.com/civicrm/civicrm-core/pull/36000))**

- **Wysiwyg - Fix missing function param causing undefined variable error
  ([36253](https://github.com/civicrm/civicrm-core/pull/36253))**

- **FormBuilder - Fix cross-contamination of field config
  ([36135](https://github.com/civicrm/civicrm-core/pull/36135))**

- **Afform: submit silently does nothing when a required field follows a filled
  required Date field
  ([dev/core#6591](https://lab.civicrm.org/dev/core/-/work_items/6591):
  [36007](https://github.com/civicrm/civicrm-core/pull/36007))**

- **AdminUI - Add missing component checks to managed SavedSearches
  ([36080](https://github.com/civicrm/civicrm-core/pull/36080))**

- **RiverLea: `.odd` should take precedence over `.even-row`
  ([35873](https://github.com/civicrm/civicrm-core/pull/35873))**

- **Theme Editor - remove duplicate description input
  ([36076](https://github.com/civicrm/civicrm-core/pull/36076))**

- **EmailTask - Move token help text back to the token selector
  ([36099](https://github.com/civicrm/civicrm-core/pull/36099))**

- **ScheduleReminders - Move token help text back to the token selector
  ([36098](https://github.com/civicrm/civicrm-core/pull/36098))**

- **Allow for NULL values to be returned if in entity definition
  ([36075](https://github.com/civicrm/civicrm-core/pull/36075))**

- **Get default values for hidden fields
  ([35941](https://github.com/civicrm/civicrm-core/pull/35941))**

- **Add hasValue() for pre hook to check if a value is included without
  confusing null ([35924](https://github.com/civicrm/civicrm-core/pull/35924))**

- **Form addRadio: change default separator to avoid superfluous space
  ([36055](https://github.com/civicrm/civicrm-core/pull/36055))**

- **Address some undeclared properties
  ([36036](https://github.com/civicrm/civicrm-core/pull/36036))**

- **multisite cron should be domain-aware
  ([35868](https://github.com/civicrm/civicrm-core/pull/35868))**

- **PHP - Short array syntax
  ([36008](https://github.com/civicrm/civicrm-core/pull/36008))**

- **Move spaces into variables in triggers file
  ([35987](https://github.com/civicrm/civicrm-core/pull/35987))**

- **Use ts best-practices in upgrade message
  ([35970](https://github.com/civicrm/civicrm-core/pull/35970))**

- **CRM_Core_Menu - remove unused `navigation` fetch from civicrm_menu
  ([35943](https://github.com/civicrm/civicrm-core/pull/35943))**

- **Switch accesskeys css to a class
  ([35910](https://github.com/civicrm/civicrm-core/pull/35910))**

- **html_type must be small letters
  ([35876](https://github.com/civicrm/civicrm-core/pull/35876))**

- **Strip non-numeric characters for phone fields in quicksearch autocomplete
  ([35878](https://github.com/civicrm/civicrm-core/pull/35878))**

- **Don't overwrite SearchDisplay totals column aggregate selection when loading
  ([36192](https://github.com/civicrm/civicrm-core/pull/36192))**

- **fix implicit nullable in oauth-client
  ([35875](https://github.com/civicrm/civicrm-core/pull/35875))**

- **Fix notice and unnecessary nesting
  ([36035](https://github.com/civicrm/civicrm-core/pull/36035))**

- **table_name needs to be table_name
  ([36306](https://github.com/civicrm/civicrm-core/pull/36306))**

- **SearchKit - Ensure "Doesn't contain any" operator matches NULL
  ([35848](https://github.com/civicrm/civicrm-core/pull/35848))**

- **SearchKit - Fix undefined function call
  ([36256](https://github.com/civicrm/civicrm-core/pull/36256))**

- **SearchKit - Fix importing activities via batch import.
  ([36225](https://github.com/civicrm/civicrm-core/pull/36225))**

- **SearchKit - Fix potentially undefined index errors
  ([36223](https://github.com/civicrm/civicrm-core/pull/36223))**

- **SearchKit: Fix rendering in Safari
  ([36122](https://github.com/civicrm/civicrm-core/pull/36122))**

- **Smarty - Remove unused var
  ([36120](https://github.com/civicrm/civicrm-core/pull/36120))**

### CiviContribute

- **Set trxn date on payment create api call
  ([36195](https://github.com/civicrm/civicrm-core/pull/36195) and
  [36208](https://github.com/civicrm/civicrm-core/pull/36208))**

- **Add 'Accounts Payable Account is' account_relationship option value
  ([34249](https://github.com/civicrm/civicrm-core/pull/34249))**

  Adds 'Accounts Payable Account is' financial account relationship of
  liability type.

- **show title, not name, of payment processor on recurring contributions
  ([36054](https://github.com/civicrm/civicrm-core/pull/36054))**

- **Pass in invoiceID and contributionID from AdditionalPayment form
  ([35901](https://github.com/civicrm/civicrm-core/pull/35901))**

- **Order API: Remove
  ContributionRecur::Create from calculateContributionRecurValues()
  ([35993](https://github.com/civicrm/civicrm-core/pull/35993))**

- **Contribution Main: avoid intro_text markup if no intro text
  ([36108](https://github.com/civicrm/civicrm-core/pull/36108))**

- **Prevent error in disallowDuplicates if trxn_id or invoice_id is null
  ([36139](https://github.com/civicrm/civicrm-core/pull/36139))**

### CiviEvent

- **SearchKit: participant update activity subject creation fails if multiple
  roles are set
  ([dev/core#6515](https://lab.civicrm.org/dev/core/-/work_items/6515):
  [36062](https://github.com/civicrm/civicrm-core/pull/36062))**

- **Paid Event registration form without confirmation page causing multiple
  registrations and payments
  ([dev/core#6313](https://lab.civicrm.org/dev/core/-/work_items/6313):
  [36157](https://github.com/civicrm/civicrm-core/pull/36157))**

  Prevents duplicate submission for paid events too when there's no confirmation
  page

- **Stop assigning participant_status to event_online template
  ([36052](https://github.com/civicrm/civicrm-core/pull/36052))**

- **Fix example event to have from email (used in tests)
  ([35958](https://github.com/civicrm/civicrm-core/pull/35958))**

### Joomla Integration

- **Joomla 5 compatibility (Work towards
  [dev/joomla#54](https://lab.civicrm.org/dev/joomla/-/work_items/54):
  [35877](https://github.com/civicrm/civicrm-core/pull/35877))**

  Fixes JPluginHelper not found error in Joomla! 5 without
  compatibility plugin.

### Standalone Integration

- **Standalone: PHP notices in an extension crash standalone after a cache clear
  ([dev/core#6557](https://lab.civicrm.org/dev/core/-/work_items/6557):
  [35991](https://github.com/civicrm/civicrm-core/pull/35991))**

## <a name="misc"></a>Miscellany

- **Update comment block to show actual possible forms
  ([36037](https://github.com/civicrm/civicrm-core/pull/36037))**

- **(EXP) OAuth for Payment Processor Setup
  ([33707](https://github.com/civicrm/civicrm-core/pull/33707))**

- **Add `/port` and `/lintroll` command to PR commands workflow
  ([36009](https://github.com/civicrm/civicrm-core/pull/36009),
  [36014](https://github.com/civicrm/civicrm-core/pull/36014),
  [35960](https://github.com/civicrm/civicrm-core/pull/35960),
  [36018](https://github.com/civicrm/civicrm-core/pull/36018),
  [35955](https://github.com/civicrm/civicrm-core/pull/35955),
  [35882](https://github.com/civicrm/civicrm-core/pull/35882),
  [35954](https://github.com/civicrm/civicrm-core/pull/35954) and
  [35976](https://github.com/civicrm/civicrm-core/pull/35976))**

- **Sync DAO class annotations with entityType fields
  ([35883](https://github.com/civicrm/civicrm-core/pull/35883))**

- **make CRM_Core_Payment::getAllFields public
  ([35180](https://github.com/civicrm/civicrm-core/pull/35180))**

- **Remove deprecated CRM_Activity_BAO_Activity::sendEmail
  ([35957](https://github.com/civicrm/civicrm-core/pull/35957))**

- **Remove setting expiry date params twice
  ([36044](https://github.com/civicrm/civicrm-core/pull/36044))**

- **Update contributor-key.yml
  ([35885](https://github.com/civicrm/civicrm-core/pull/35885))**

- **Update guzzle to 7.15, psr7 to 2.13 guzzle promises to 2.5.1
  ([36276](https://github.com/civicrm/civicrm-core/pull/36276))**

- **Upgrade DomPDF to be 3.1.6
  ([36297](https://github.com/civicrm/civicrm-core/pull/36297))**

- **[REF] Use newer function to get custom fields
  ([35828](https://github.com/civicrm/civicrm-core/pull/35828))**

- **[REF] CRM_Core_Menu - remove unused `_menuCache` var
  ([35942](https://github.com/civicrm/civicrm-core/pull/35942))**

- **[REF] Create new methods to get Joomla user and current user
  ([35480](https://github.com/civicrm/civicrm-core/pull/35480))**

- **[REF] Fix missing field set legend and some missing labels on Edit Search
  kit screen ([30751](https://github.com/civicrm/civicrm-core/pull/30751))**

- **Refactor CRM_Core_BAO_Country to use Civi::$statics
  ([36068](https://github.com/civicrm/civicrm-core/pull/36068))**

- **(NFC) Fix components doc link
  ([36116](https://github.com/civicrm/civicrm-core/pull/36116))**

- **Remove calls to getLineItems from ChangeFeeSelectionTest
  ([35953](https://github.com/civicrm/civicrm-core/pull/35953))**

- **Deprecate getLineItems function & remove some test calls
  ([35950](https://github.com/civicrm/civicrm-core/pull/35950))**

- **ContactAclTest - Add test case for contact phone
  ([35854](https://github.com/civicrm/civicrm-core/pull/35854))**

- **Convert CRM_Event_Form_ParticipantFeeSelection test calls to use full form
  flow ([36038](https://github.com/civicrm/civicrm-core/pull/36038))**

- **MariaDB Test Failures
  ([dev/core#6609](https://lab.civicrm.org/dev/core/-/work_items/6609):
  [36073](https://github.com/civicrm/civicrm-core/pull/36073) and
  [36071](https://github.com/civicrm/civicrm-core/pull/36071))**

- **LoggingTest - Update checkLogTableCreated() to pass on MariaDB
  ([36124](https://github.com/civicrm/civicrm-core/pull/36124))**

- **Copy deprecated function to MailingTokens class
  ([35933](https://github.com/civicrm/civicrm-core/pull/35933))**

- **SearchKit - Fix SearchDownloadTest testDownloadCSV
  ([35853](https://github.com/civicrm/civicrm-core/pull/35853))**

- **SearchKit - Fix flaky SearchDownloadTest by using fuzzier match
  ([35852](https://github.com/civicrm/civicrm-core/pull/35852))**

## <a name="credits"></a>Credits

This release was developed by the following code authors:

AGH Strategies - Alice Frumin; Andy Burns; Benjamin W; Ben van Klinken;
Christian Wach; Circle Interactive - Pradeep Nayak; CiviCoop - Jaap Jansma;
CiviCRM - Coleman Watts, Tim Otten; Coop SymbioTIC - Mathieu Lutfy, Samuel
Vanhove; CSES (Chelmsford Science and Engineering Society) - Adam Wood;
Dave D; DevApp - David Cativo; ECOPLAN - Torben Bertram; Fuzion - Luke Stewart;
iXiam - Vangelis Pantazis; Jens Schuppe; JMA Consulting - Monish Deb, Seamus
Lee, Yifei Zhou; Megaphone Technology Consulting - Jon Goldberg; MJW
Consulting - Matthew Wire; Nicol Wistreich; Outlandish - Rasmus Winter;
PERORA SRL - Samuele Masetto; Richard Baugh; Wikimedia Foundation - Eileen
McNaughton; Wildsight - Lars Sander-Green; Jakub Fidler;
Joseph LeDuc; Progressive Technology Project - Jamie McClelland;

Most authors also reviewed code for this release; in addition, the following
reviewers contributed their comments:

All In Appli.com - Guillaume Sorel; Andrew Thompson; Artful Robot - Rich Lott;
civiservice.de - Martin Correll; Fuzion - Peter Davis; JMA Consulting - Edsel
Lopez, Joe Murray; Joinery - Allen Shaw; Korlon - Stuart Gaston; Ruza
Solutions - Rose