FOSSBilling Files

0.8.4

Installations that have not yet upgraded from older releases should treat 0.8.4 as the recommended security baseline. It is recommended to upgrade from earlier versions as soon as possible.

⚠️ Potentially Breaking Changes

• Admin permissions have been reworked from per-user permissions to a group-based model. Existing staff members are migrated to temporary groups on upgrade. Custom modules or themes that check permissions directly may need updating. (#3821, [#3885], [#3890])

🔐 Security

• Server manager credentials (passwords, API keys) are now masked in API responses and throughout the admin UI. (#3840)
• Extension configuration pages now require the manage_settings permission. Existing staff groups are backfilled with this permission to preserve prior behavior for upgrading installs. (#3856, [#3890])
• Stripe webhooks now require a webhook signing secret when webhook mode is enabled, and server manager input handling has been hardened. (#3962)

📈 Enhancements

• Stripe now supports recurring subscriptions via Setup Intents and webhooks, including handling of subscription lifecycle events and invoice payments. (#3455, [#3857])
• Client profile forms gain a country code selector and number formatter. (#3812)
• The knowledge base has been migrated to Doctrine with improved search, article listing alongside categories, view counts, and better canned response management. (#3808)
• Administrators and clients can now set a per-user timezone. Dates throughout the app and in email notifications respect the configured timezone. (#3895)
• Staff notification emails (new order, ticket, signup) can now be scoped to specific admin groups instead of always going to every staff member. (#3899)
• Administrators can edit their own ticket replies, with full revision history kept for auditability. (#3906)
• Custom client fields are now sorted alphabetically in forms, and the maximum has been raised from 10 to 20 fields. (#3909)
• PDF invoices can now be attached to invoice emails, so clients paying by bank transfer can view the invoice without logging in. (#3913)
• Invoice reminder intervals are now configurable — customize when reminders are sent before and after the due date. (#3914)
• Custom client IDs are now exposed in the API and admin UI. (#3922)
• A Discord community button has been added to the admin header. (#3865)
• Suspended client status badges now use a ribbon-style for better visual distinction. (#3936)
• Order creation now validates prices, preventing invalid or missing price data from reaching payment gateways. (#3952)
• Rate limit counters can now be viewed and reset from the admin panel via a new management UI and API. (#3953)
• Zero-price orders can now generate invoices for record-keeping purposes. (#3958)

🐛 Bug Fixes

• Fixed a MySQL 8.0.22+ REGEXP charset conflict that could cause database patches 67 and 74 to fail during upgrades. (#3822)
• Fixed ticket and knowledge base messages silently losing content when users typed angle brackets (e.g. <World>) — content is now sanitized with a Markdown-safe approach instead of an HTML sanitizer. (#3830)
• Fixed third-party registrar adapters not being loaded after installation due to Composer's optimized autoloader not discovering the files. (#3832)
• Outgoing HTTP requests from the update checker now include a User-Agent header, and the update path text in the admin UI has been corrected. (#3861)
• Twig render failures are now returned as proper 500 error pages instead of blank screens. (#3874)
• The Servicehosting admin template no longer errors when order actions are missing. (#3880)
• Renewal invoices now use the order's edited price instead of the product's base price. (#3893)
• DirectAdmin account deletion now recovers from false-negative API errors by verifying the account was actually removed before reporting failure. (#3894)
• Renewals are now skipped for invoice items that already have a pending payment, preventing duplicate charges. (#3905)
• Cron settings defaults now populate correctly on fresh installs. (#3911)
• Repeated PayPal subscr_signup IPNs no longer create duplicate subscription records. (#3927)
• The Product Promotions admin page no longer crashes for promo rows with NULL flags from legacy installs. (#3946)
• Domain orders paid with account credit during checkout no longer trigger a duplicate activation attempt. (#3948)
• Upgrading from 0.6.x no longer fails with an undefined method error in UpdatePatcher after the Extension module's Doctrine migration. (#3949)
• PayPal IPN callback handling has been refined for improved edge case reliability. (#3957)
• Several email and payment edge cases have been fixed, including uncancel emails, zero-credit payment handling, and DirectAdmin apostrophe entity decoding. (#3959)

📝 Changes

• Admin groups and permissions have been reworked into a Doctrine-backed group model with per-group permission sets. (#3821)
• The Email, Extension, and Support modules have been migrated to Doctrine ORM. (#3863, [#3879])
• Document fields (passport, driver's license, etc.) have been migrated to use the custom client fields system. (#3839)
• Frontend JavaScript has been migrated to TypeScript. The public API bundle continues to ship as compiled JavaScript. (#3950)

📦 Dependencies

• Update Twig to v3.28.0 (#3881)
• Update CKEditor 5 to v48.3.0 (#3872)
• Update Sentry SDK to v4.29.0 (#3864)
• Update Stripe PHP to v20.3.0 (#3835)
• Update PostCSS to v8.5.16 (#3862)
• Update Autoprefixer to v10.5.2 (#3841)
• Update Rector to v2.5.0 (#3814)
• Update actions/cache to v6 (#3831)
• Update docker/setup-compose-action to v2.3.0 (#3871)

Full Changelog: https://github.com/FOSSBilling/FOSSBilling/compare/0.8.3...0.8.4