Date: Oct/12/2026

fix(security): multiple security improvements around the code (CSRF protection, output escaping)
feat(security): accept CIDR ranges in trusted proxies
fix(security): verify TLS certificates on outgoing requests by default
fix(security): sign download links with site key and enforce expiry
fix(security): mask passwords and secrets in System Info
fix(security): don't save OAuth consent when user declines authorization
fix(auth): regenerate session id on login
fix(tax): validate tax rate input and parse comma-decimal rates
fix(oauth): enforce client secret and allowed grant types, apply 2FA to password grant
feat(upload): support WebP images
fix(oauth): add refresh_token grant to existing clients on upgrade
feat(setup): hide whether an account exists on lost password form for new installs
feat(upgrade): check PHP, extension and MySQL requirements before upgrade
fix(setup): multiple installation wizard fixes
fix(helpdesk): limit live update polling and back off after errors
fix(helpdesk): fix paste in mass reply
fix(aff): restore product category commission condition
fix(cancel-feedback): restore admin Stop Recurring
fix(grid): third-party grid actions confirmed with legacy _confirm=yes work again (deprecated, raises E_USER_DEPRECATED)
fix(admin): legacy stop-recurring URLs with invoice_id in query string work again (deprecated, raises E_USER_DEPRECATED)
fix(invoice-pdf): skip refunds for unsaved payments
fix(core): revert back logging to Db, make PHP diagnostic logging opt-in (const AM_PHP_ERROR_LOG)
fix(deps): upgrade composer and npm packages
fix(php): improved PHP 8.5 compatibility
***Payments
    fix(stripe): acknowledge resent charge webhooks without inserting
    fix(stripe): reject webhooks when signing secret is not configured
    fix(segpay): authenticate postbacks with a key in postback URL, warn admin if it is missing
    fix(ccbill): reject posts without subscription IDs
    fix(ideal): fix http request in WebRequest
    fix: stronger IPN validation for Razorpay, Coinbase Commerce, FastSpring Contextual, Digistore24, WarriorPlus, JVZoo, ClickBank, Gumroad
***Plugins
    fix(wordpress): set SSO cookies HttpOnly, security hardening
    fix(apple-login): validate token issuer, audience and expiry
    fix(google-login, paypal-login): require verified email to link existing account

Date: Oct/06/2026

fix(security): multiple security improvements around the code
feat(cart): option to not preselect billing plan for products with multiple plans
feat(admin): make critical upgrade notices prominent and non-dismissible
fix(security): trust X-Forwarded-For only from configured proxies
fix(security): constant-time compare for admin reset and HOTP codes
fix(security): mask payment plugin secrets in invoice log
fix(security): drop eval() field mappings from protect tables
fix(newsletter): restrict subscription to lists allowed for the user
fix(webhooks): count connection errors as delivery failures
fix(webhooks): don't block on cron lock
fix(php): improved PHP 8.5 compatibility
***Payments
    fix(stripe): prevent false rebill failures from webhook race
    fix(ccbill): use report date for rebills
***Plugins
    fix(joomla): multiple fixes

Date: Oct/01/2026

fix(aff): keep commission failures from blocking payments
fix(auth): improve admin pages security
fix(core): restore safe PHP diagnostic logging
fix: prevent payout and refund total inflation
***Payments
    fix(ccbill): isolate datalink checkpoints
    fix(ccbill): reject untrusted callback sources
    fix(clickbank): prevent signature comparison bypass

Date: Sep/16/2026

fix(signup): correct redirect url after login
fix(wordpress): support WordPress 7.1 SSO
feat(admin-users): ability to export admin url of uploaded files
fix(users): export array-valued custom fields
***Payments
    fix(ccbill): exclude cancellation from test request
    feat(ccbill): support scoped datalink requests
    fix(beanstream): update API endpoint
***Plugins
    feat(joomla): add Joomla 6 support

Date: Aug/24/2026

fix(aff): ability to clear all conditions in commission rule
feat(report): Number of Paid Users by Date
***Payments
    feat(ccbill): sync DataLink cancellations
    fix(square-up): migrate to payments API
    feat(stripe): ability to set Statement Descriptor Suffix for card payments
***Plugins
    feat(invision): support Invision Community 5
    feat(schedule-access): support product duration

Date: Aug/04/2026

feat(admin-ui): ability to filter email messages by type
fix(mail): generate unsubscribe link for the To recipient, not bcc
fix(webhooks): include items in invoice payloads
fix(admin-product): fixed end date reset to today
feat(signup): add placeholders to form bricks
fix(signup): account for paid product options
fix(auth): avoid throttling pending 2fa logins
fix(import): link imported access to invoice items
***Payments
    fix(ccbill): fall back to upgrade subaccount
    fix(gocardlesspro): treat 422 invalid_state on cancel as already cancelled
    fix(paypal): prevent duplicate recurring profiles
    feat(netvalve): add 3ds fallback mode