Filament 5.7.6

Filament 5.7.6 shipped on August 5, 2026, a maintenance release that tightens up security around MFA codes, fixes a Markdown editor refresh quirk, and expands translation coverage. It's a small, safe update for anyone on the 5.7 line.

Security: MFA Code Caching Hardened

The headline fix touches the MFA flow. Previously, cached two-factor codes were keyed using a combination of the secret and the code; 5.7.6 now caches used MFA codes using a hash of the secret rather than the raw secret and code (PR #20335). That removes an unnecessary exposure of sensitive material in cache storage — a quiet but worthwhile hardening if you run Filament's built-in two-factor authentication.

Editor and Test Fixes

Two smaller fixes round out the release. The raw Markdown editor instance is now used when refreshing (PR #20320), preventing stale or re-instantiated editor state from causing issues in forms. And in the testing layer, per-key state paths are now derived correctly when unsetting missing array keys (PR #20318), which makes test assertions on partial array state behave as expected.

Translation Coverage

Filament 5.7.6 adds a full Tajik (tg) translation (PR #20303, first contribution from komyor09) and fills in missing Arabic translation files across the notifications and support packages (PR #20321). The rest of the diff is dependency bumps and CI workflow updates.

Upgrade Notes

There are no breaking changes in this release. Update your composer.json constraint to ^5.7.6 and run composer update filament/filament — or use the Filament updater command if you manage upgrades through the panel. The MFA caching change is backwards compatible, though it will re-validate codes after deploy as old cache entries are invalidated.