Date: 10/6/2026

fix(security): multiple security improvements around the code
feat(cart): option to not preselect billing plan for products with multiple plans
feat(admin): make critical upgrade notices prominent and non-dismissible
fix(security): trust X-Forwarded-For only from configured proxies
fix(security): constant-time compare for admin reset and HOTP codes
fix(security): mask payment plugin secrets in invoice log
fix(security): drop eval() field mappings from protect tables
fix(newsletter): restrict subscription to lists allowed for the user
fix(webhooks): count connection errors as delivery failures
fix(webhooks): don't block on cron lock
fix(php): improved PHP 8.5 compatibility
***Payments
    fix(stripe): prevent false rebill failures from webhook race
    fix(ccbill): use report date for rebills
***Plugins
    fix(joomla): multiple fixes

Date: 10/1/2026

fix(aff): keep commission failures from blocking payments
fix(auth): improve admin pages security
fix(core): restore safe PHP diagnostic logging
fix: prevent payout and refund total inflation
***Payments
    fix(ccbill): isolate datalink checkpoints
    fix(ccbill): reject untrusted callback sources
    fix(clickbank): prevent signature comparison bypass

Date: 9/16/2026

fix(signup): correct redirect url after login
fix(wordpress): support WordPress 7.1 SSO
feat(admin-users): ability to export admin url of uploaded files
fix(users): export array-valued custom fields
***Payments
    fix(ccbill): exclude cancellation from test request
    feat(ccbill): support scoped datalink requests
    fix(beanstream): update API endpoint
***Plugins
    feat(joomla): add Joomla 6 support

Date: 8/24/2026

fix(aff): ability to clear all conditions in commission rule
feat(report): Number of Paid Users by Date
***Payments
    feat(ccbill): sync DataLink cancellations
    fix(square-up): migrate to payments API
    feat(stripe): ability to set Statement Descriptor Suffix for card payments
***Plugins
    feat(invision): support Invision Community 5
    feat(schedule-access): support product duration

Date: 8/4/2026

feat(admin-ui): ability to filter email messages by type
fix(mail): generate unsubscribe link for the To recipient, not bcc
fix(webhooks): include items in invoice payloads
fix(admin-product): fixed end date reset to today
feat(signup): add placeholders to form bricks
fix(signup): account for paid product options
fix(auth): avoid throttling pending 2fa logins
fix(import): link imported access to invoice items
***Payments
    fix(ccbill): fall back to upgrade subaccount
    fix(gocardlesspro): treat 422 invalid_state on cancel as already cancelled
    fix(paypal): prevent duplicate recurring profiles
    feat(netvalve): add 3ds fallback mode

Date: 7/3/2026

fix(query): preserve select aliases in count queries
feat(pricing-table): ability to customize title of price variant
fix(regression): style of tabs in browse files dialogue
fix(regression): html editor changes not saved in forms editor
feat(saved-reports): ability to change order of reports
feat(user-consent): ability to force customer to scroll agreement up to the end before accept it
feat(saved-report): ability to edit saved report settings
admin: add invoice payment action block hook
perf: include -1 (product_category_id) to access cache on cache rebuild, got rid of OR in join condition (does not allow to use index)