build(deps): bump getkirby/cms from 4.7.1 to 5.4.4

[dependabot]

Bumps getkirby/cms from 4.7.1 to 5.4.4.

Release notes

Sourced from getkirby/cms's releases.

5.4.4

[!NOTE] This release is part of our monthly security release series. Find out more about those releases and their background on our website: https://getkirby.com/buzz/security-update

🚨 Security

🛎️ Recommendation to secure your content salt and cookie key values

Kirby internally relies on the following values:

• The content.salt option is used to generate secure preview and media URLs that should not be guessable by external visitors.
• The Kirby\Http\Cookie::$key property, to sign (or authenticate) cookie values to prevent easy tampering with cookie values that have been set from the backend.

We recommend to set the content.salt and Kirby\Http\Cookie::$key values to long random strings for all of your sites.

We have updated the security guide with a section on this topic and added warnings to the Panel system view if Kirby detects the unchanged defaults.

Thanks to @​adrgs and Peter Levashov (@​petersevera) for their responsible disclosure and suggestion.

---

External Initialization of the Panel on reverse proxy setups with the Forwarded, X-Client-IP or X-Real-IP header

This vulnerability affects Kirby sites that have no configured user accounts and are running on publicly accessible servers behind a reverse proxy that sets the Forwarded: for=..., X-Client-IP, or X-Real-IP request header.

It was possible to install the Panel (= create the first admin user) in these setups even from remote IP addresses.

This vulnerability is of critical severity for affected sites.

Your site is not affected if any of the following apply:

• An admin account has already been configured
• The Panel and API are disabled
• The site is not running behind a reverse proxy
• The reverse proxy sets the X-Forwarded-For or Client-IP header instead of the affected ones.

Advisory Details:

• CVE ID: CVE-2026-54003
• Severity: critical (CVSS score 9.1)
• Advisory: GHSA-whxw-24jc-cwmv

Thanks to Peter Levashov (@​petersevera) for responsibly reporting the identified issue.

---

Cross-site scripting (XSS) from incomplete HTML/XML sanitization in Dom::sanitize()

This vulnerability affects Kirby sites and plugins that use the writer or list fields or that use $dom->sanitize(), Sane::sanitize(), Sane\Html::sanitize(), Sane\Svg::sanitize(), Sane\Xml::sanitize(), Sane::sanitizeFile() or $file->sanitizeContents() with untrusted input.

... (truncated)

Commits

• 3f96d3b Merge pull request #8200 from getkirby/release/5.4.4
• bf9597e i18n: Update translations
• 90efd8f build: Update JS dependencies
• f96bfc6 build: Update composer dependencies
• d8ef9a0 Merge branch 'develop-patch' into release/5.4.4
• 309e812 [v5] fix: Use proper generic for Item::$siblings (#8195)
• 818ce1b Merge pull request #8192 from getkirby/fix/8191-quote-block-nodes-prop
• 7ae48fc Merge pull request #8193 from getkirby/fix/7747-pagetree-preselect-undefined-ref
• e3e89e1 fix: Guard against undefined ref in PageTree::preselect
• 4d52145 fix: Pass nodes prop from blueprint to quote block writer inputs (#8191)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.