Security - Newly added fields now have to be explicitly set to allow access in the content editor (when using the ACF shortcode or Block Bindings) to increase the security around field permissions. See the release notes for more details
Security Fix - Field labels are now correctly escaped when rendered in the Field Group editor, to prevent a potential XSS issue. Thanks to Ryo Sotoyama of Mitsui Bussan Secure Directions, Inc. for the responsible disclosure
Fix - Validation and Block AJAX requests nonces will no longer be overridden by third party plugins
Fix - Detection of third party select2 libraries will now default to v4 rather than v3
Fix - Block previews will now display an error if the render template PHP file is not found
Security Fix - The ACF shortcode now prevents access to fields from different private posts by default. View the release notes for more information
Fix - Users without the edit_posts capability but with custom capabilities for a editing a custom post type, can now correctly load field groups loaded via conditional location rules
Fix - Block validation no longer validates a field’s sub fields on page load, only on edit. This resolves inconsistent validation errors on page load or when first adding a block
Fix - Deactivating an ACF PRO license will now remove the license key even if the server call fails
Fix - Field types returning objects no longer cause PHP warnings and errors when output via the_field, the_sub_field or the ACF shortcode, or when retrieved by a get_ function with the escape html parameter set
Fix - Server side errors during block rendering now gracefully displays an error to the editor
Security Fix - ACF now generates different nonces for each AJAX-enabled field, preventing subscribers or front-end form users from querying other field results
Security Fix - ACF now correctly verifies permissions for certain editor only actions, preventing subscribers performing those actions
Security Fix - Deprecated a legacy private internal field type (output) to prevent it being able to output unsafe HTML
Security Fix - Improved handling of some SQL filters and other internal functions to ensure output is always correctly escaped
Security Fix - ACF now includes blank index.php files in all folders to prevent directory listing of ACF plugin folders for incorrectly configured web servers