Memberz

Forms and directories are project config, so they can now only be changed by an admin, on an environment where allowAdminChanges is on — the "Manage forms and directories" permission (now "View forms and directories") opens the screens read-only. Change them in development and deploy them, as with Craft's own settings.

Security

• Directory search and filters matched on fields members had hidden. A member who set their city or company to private was still matched by a search or filter for it, so anybody could confirm the hidden value by querying for it — the card masked the value, but the result count had already answered. Search and filters now apply the same privacy verdict as the cards, before matching: a member is not matched on a field they hide from the viewer, and a field the site keeps from a viewer altogether (members-only, viewer signed out) cannot be searched or filtered by that viewer at all. Members still find themselves; admins are unrestricted.
• "Manage forms and directories" could save project config anywhere. Forms and directories — including raw HTML rows printed on the public registration form — could be saved by any user with that permission, on the live site too, where the next deploy undid it. Saving, deleting and reordering now need an admin where admin changes are allowed; everyone else sees the screens read-only, and the new-form and new-directory screens refuse.

Changed

• PHPStan and ECS configuration, and the findings they raised tidied.