Open Source Point of Sale Files

This release contains plenty of security fixes beside few bugfixes and improvements. We strongly advise to upgrade.

For docker users, updating docker-compose.yaml is required . There are two new env variables that need to be configured

• ALLOWED_HOSTNAMES=<domain> needs to be added to set the allowed domain for the website that is being served
• THROTTLE_KEY=<randomstring> needs to be configured for an existing installation.

For a regular install, the .env file will need to be adapted

• throttle.key will be added by the migration in case the .env is writable
• app.allowedHostnames needs to be configured once

What's Changed

• Fix writable folder permission check (#4270) by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4273
• Extended payment delete fix by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4274
• Upgrade github workflow (#3708) by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4280
• Fix migration 20250522000000 by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4284
• Upgade CI to 4.6.2 by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4298
• Allow empty tax category id (#4285) by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4288
• Fix for suspended sales (#4283) by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4303
• Fix reference to upload path permission check (#4270) by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4286
• Bump jspdf from 3.0.1 to 3.0.2 by @dependabot[bot] in https://github.com/opensourcepos/opensourcepos/pull/4309
• Add transactions to missing config keys migration. by @JustASideQuestNPC in https://github.com/opensourcepos/opensourcepos/pull/4318
• [Feature] Add logging to migrations by @JustASideQuestNPC in https://github.com/opensourcepos/opensourcepos/pull/4327
• Fix XSS in javascript notification by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4341
• Fix attachment cid by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4314
• Allow anonymous giftcard creation by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4278
• Fix config notification by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4343
• Fix creation of date attribute value (#4310) by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4344
• Escape return_policy in receipt + invoice by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4349
• Add show/hide cost price & profit feature - in reports [#4130] by @bhojkamal in https://github.com/opensourcepos/opensourcepos/pull/4350
• Fixing Disallowed Characters Issue by @dilushanka in https://github.com/opensourcepos/opensourcepos/pull/4355
• Fix multiple XSS vulnerabilities (#3965) by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4356
• Bump lodash from 4.17.21 to 4.17.23 by @dependabot[bot] in https://github.com/opensourcepos/opensourcepos/pull/4369
• Bump jspdf and jspdf-autotable by @dependabot[bot] in https://github.com/opensourcepos/opensourcepos/pull/4373
• Fix XSS vulnerabilities in invoices + receipts (#3965) by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4363
• Fix permission bypass in Reports submodule access control by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4389
• Use Content-Type application/json for AJAX responses by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4357
• Language Array Key Typo Fix by @lyimolucasl in https://github.com/opensourcepos/opensourcepos/pull/4371
• Fix employee language session by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4377
• Broken object level authorization fix by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4391
• Bump dompurify from 3.3.1 to 3.3.2 by @dependabot[bot] in https://github.com/opensourcepos/opensourcepos/pull/4402
• Fix incorrect argument types in migration round_number() methods by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4403
• CSV import unit tests by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4399
• Fix whitelist and validate invoice template types by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4393
• Fix second-order SQL injection in currency_symbol config by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4390
• fix(security): add row-level authorization to password change endpoints by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4401
• Fix item thumbnail spaces by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4398
• Fix report permissions by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4397
• Fix SQL injection in custom attribute search by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4410
• Fix stored XSS vulnerability in item descriptions by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4413
• Fix stored XSS vulnerabilities in employee permissions and customer data by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4412
• Fix: Preserve CHECKBOX attribute state when adding attributes (#4385) by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4396
• Fix payment type becoming null when editing sales with dot thousands separator locales by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4417
• Fix broken SQL injection fix - use havingLike() for HAVING clause by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4416
• Fix mass assignment vulnerability in bulk edit by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4414
• Sync language files (#3468) by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4418
• [Feature]: Auto-update issue templates with releases by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4423
• Update SECURITY.md with published security advisories by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4426
• Bump jspdf from 4.1.0 to 4.2.0 by @dependabot[bot] in https://github.com/opensourcepos/opensourcepos/pull/4383
• Add filter persistence for table views via URL query string by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4400
• Fix PHPUnit test configuration for database connectivity by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4430
• Fix IDOR vulnerability in password change by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4427
• Fix XSS vulnerability in tax invoice view by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4432
• Fix permission bypass in Sales.getManage() access control by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4428
• Update SECURITY.md with published security advisories by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4431
• Fix SQL injection in suggestions column configuration by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4421
• Fix PHPUnit environment variables not being set by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4434
• Fix DECIMAL attribute not respecting locale format by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4422
• Fix stored XSS vulnerability in Attribute Definitions by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4429
• Fix: Host Header Injection vulnerability by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4433
• [Security] Fix stored XSS in reCAPTCHA Site Key on login page by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4436
• Fix stored XSS via stock location name by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4435
• Fix Token_lib::render() for PHP 8.4 compatibility by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4419
• Fix: Add Debit Card filter to Daily Sales and Takings by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4440
• Fix Taxes Summary Report totals not matching row values by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4437
• Fix: Restrict employee selection in expenses and receivings forms by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4443
• Bump jspdf from 4.2.0 to 4.2.1 by @dependabot[bot] in https://github.com/opensourcepos/opensourcepos/pull/4446
• Bump picomatch from 2.3.1 to 2.3.2 by @dependabot[bot] in https://github.com/opensourcepos/opensourcepos/pull/4451
• fix: Clear sale session after completing sale by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4454
• Translate missing strings in multiple languages by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4453
• Convert Travis CI to GitHub Actions by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4409
• fix: Use file-based session until database is migrated by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4455
• Fix negative price/quantity/discount validation by @morimori-dev in https://github.com/opensourcepos/opensourcepos/pull/4450
• Fix/sendmail command injection by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4469
• refactor: simplify release workflow to version bump only by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4473
• fix: Remove unused router service call in tax_helper by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4479
• fix: Handle empty database on fresh install by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4467
• Fix: Improve allowedHostnames .env configuration and fail-fast in production by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4482
• [Feature]: Case-sensitive attribute updates and CSV Import attribute deletion capability by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4384
• Update to CodeIgniter 4.7.2 by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4485
• Bump lodash from 4.17.23 to 4.18.1 by @dependabot[bot] in https://github.com/opensourcepos/opensourcepos/pull/4462
• Bump dompurify from 3.3.2 to 3.4.0 by @dependabot[bot] in https://github.com/opensourcepos/opensourcepos/pull/4512
• fix: Propagate attribute definition failures in postSaveGeneral() by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4509
• fix: Escape dynamic output and fix CSS property in barcode_sheet.php by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4501
• Fix CRC currency reverting to EUR/LAK in locale config by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4511
• fix: Add missing $img_tag variable in Sales::getSendPdf() by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4515
• fix: Language dropdown defaults to Arabic after saving locale config by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4518
• fix: Scope orWhere clauses in Item::exists() and Item::get_item_id() to fix items performance regression by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4520
• feat: Update translations for multiple languages by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4498
• fix: Catch mysqli_sql_exception in DB fallback handlers for fresh Docker installs by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4525
• fix(home): cast logged-in person_id in strict auth checks for self pa… by @enricodelarosa in https://github.com/opensourcepos/opensourcepos/pull/4526
• Assignable Keyboard Shortcuts Updates by @WebShells in https://github.com/opensourcepos/opensourcepos/pull/4532
• chore: miscellaneous updates and improvements by @BudsieBuds in https://github.com/opensourcepos/opensourcepos/pull/4530
• chore(deps): bump minimatch from 3.1.2 to 3.1.5 by @dependabot[bot] in https://github.com/opensourcepos/opensourcepos/pull/4536
• chore: sync project files to match upstream templates by @BudsieBuds in https://github.com/opensourcepos/opensourcepos/pull/4537
• fix(ci): include hidden files in Docker build context by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4543
• feat: add ALLOWED_HOSTNAMES environment variable support for Docker/C… by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4544
• fix(docker): correct permissions and fix migration barcode_type error by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4546
• docs: Update SECURITY.md with disclosure process by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4549
• fix(security): Path traversal vulnerability in getPicThumb by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4545
• fix(security): SQL injection and path traversal vulnerabilities by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4539
• fix: Capture CSV import failures in save_tax_data and save_inventory_quantities by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4507
• fix: Validate attributeId > 0 in saveAttributeLink() by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4508
• feat: Add deployment workflow with approval gates by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4522
• Bugfixes to get Migration working on MySQL and MariaDB by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4551
• Bugfix: Sale search in register not handling trailing space properly by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4557
• fix: cast string returns to int in MY_Migration by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4560
• Add fallback for allowedHostnames environment variable by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4565
• Fix: Allow searching by Sale ID in Takings/Daily Sales view by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4569
• Add Guards to Database Migration by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4571
• fix: tax rate inputs blank with comma-decimal locales by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4555
• fix(security): Fix DOMPDF RCE and customer email sanitization by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4568
• Fix overly lenient date validation by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4574
• chore(deps): bump dompurify from 3.4.0 to 3.4.11 by @dependabot[bot] in https://github.com/opensourcepos/opensourcepos/pull/4578
• Bugfix: Fix problems with migration UI in login by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4589
• Forgotten commit from login migration branch by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4592
• Feature: Payment reference code by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4587
• bugfix(giftcard): correct return type and rename getGiftcardId method by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4600
• chore(deps): bump dompurify from 3.4.11 to 3.4.12 by @dependabot[bot] in https://github.com/opensourcepos/opensourcepos/pull/4602
• bugfix(reports): crash on detailed sales report when sale has multiple payments with reference codes by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4599
• Bugfix: normalize quote style in SQL GROUP_CONCAT expression by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4608
• chore(deps): upgrade dompdf from v2.0.8 to v3.1.6 by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4610
• chore(deps): bump brace-expansion by @dependabot[bot] in https://github.com/opensourcepos/opensourcepos/pull/4614
• chore(deps): add xlsx via SheetJS CDN and upgrade tableexport plugin by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4615
• chore(deps): bump lodash.template from 4.5.0 to 4.18.1 by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4616
• fix(login): skip auth validation on new install to allow migration by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4609
• fix: Wrap postSave() in single transaction for atomicity by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4506
• refactor: Replace var with let/const in JavaScript files by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4503
• fix: get_definition_by_name() returns single row instead of multi-dimensional array (#4452) by @jonathanchang31 in https://github.com/opensourcepos/opensourcepos/pull/4464
• fix(config): validate theme param to prevent XSS via invalid theme by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4620
• fix(sales): enforce server-side authorization for price changes by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4631
• fix(sales): escape quote number in email template to prevent XSS by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4625
• Bugfix: Correct Version Number Regex parsing of migration for logs by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4611
• fix(auth): validate gcaptcha before password to prevent bypass by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4618
• refactor: apply PSR-12 naming and return documentation to Attribute definition methods by @minutechreview in https://github.com/opensourcepos/opensourcepos/pull/4624
• fix(security): sanitize filenames and escape logo path in config by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4630
• fix: use db_connect() for item save transactions by @richardmilles in https://github.com/opensourcepos/opensourcepos/pull/4636
• fix(xss): remove redundant escaping that double-encoded item attribute values by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4628
• chore(deps): bump codeigniter4/framework from 4.7.2 to 4.7.4 by @dependabot[bot] in https://github.com/opensourcepos/opensourcepos/pull/4638
• chore(deps): bump dompurify from 3.4.12 to 3.4.13 by @dependabot[bot] in https://github.com/opensourcepos/opensourcepos/pull/4639
• Reject item CSV imports whose header row is missing required columns by @SAY-5 in https://github.com/opensourcepos/opensourcepos/pull/4597
• fix(items): validate item_number and skip receiving quantity default for temp items by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4621
• Feature: CodeIgniter Throttler by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4619
• Bugfix: Resolve Race Condition in Rewards and Gift Card Spending by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4640
• hotfix(auth): hash throttler keys to improve security by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4646
• fix(items): add explicit sentinel value for clearing supplier in bulk edit by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4617
• Codeigniter changes between 4.7.2 and 4.7.4 by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4650
• Hotfix: Fix CI3 database migration caused by regression by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4649
• fix(sales): gate per-record endpoints behind reports_sales grant by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4627
• Fix Regression caused by PSR compliance renaming that did not propagate. by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4659
• Feature admin account safeguards by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4657
• Ensure payload data is escaped to prevent XSS by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4664
• fix(sales): enforce reports_sales grant on search endpoint by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4673
• fix(reports, home): resolve double-URL-decoding bypass for method grants (#4660) by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4666
• Bugfix tax names by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4677
• bugfix(validation): tighten mailpath validation with strict path rule by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4684
• Bugfix input validation in giftcard by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4683
• fix: prevent duplicate items when editing imported rows by @richardmilles in https://github.com/opensourcepos/opensourcepos/pull/4634
• fix(barcode): resolve string interpolation issue in barcode display html by @VighneshNilajakar in https://github.com/opensourcepos/opensourcepos/pull/4692
• Bugfix: Gate Sales::getSearch behind reports_sales grant by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4675
• bugfix(sales): reject non-negative gift-card amount_tendered by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4674
• fix(sales): enforce authorization and status check on unsuspend by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4686
• fix(tests): resolve all phpunit failures — clean-DB suite green (#4626) by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4691
• fix(build): await all async gulp copy/exec calls to fix race condition breaking fresh-clone builds by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4698
• fix(validation): allow Windows sendmail paths in PLAIN_FILESYSTEM_PATH_STRICT rule by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4697
• fix(security): handle special characters in .env key values and improve insertion logic by @objecttothis in https://github.com/opensourcepos/opensourcepos/pull/4656
• fix(locale): validate language_code against known locales to block path traversal by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4704
• Fix GHSA-frx7-c5vv-m3mr: recompute cashup total server-side and force owner identity by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4706
• feat(security): add THROTTLE_KEY env-var fallback for throttle.key by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4707
• fix(i18n): translate remaining English labels in Swiss German Items.php by @minutechreview in https://github.com/opensourcepos/opensourcepos/pull/4701
• fix(ci): stop stamping app version onto master and branch Docker tags by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4709
• chore(deps): bump fflate from 0.8.2 to 0.8.3 by @dependabot[bot] in https://github.com/opensourcepos/opensourcepos/pull/4690
• fix(i18n): swap print_delay_autoreturn number/required messages in 5 locales by @minutechreview in https://github.com/opensourcepos/opensourcepos/pull/4699
• chore(release): unified git-cliff release workflow (changelog + tag + optional bump) by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4711
• Fix [REDACTED]: HTML-escape attribute dropdown option labels in items attributes view by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4715
• fix(release): keep package-lock.json version in sync on bump by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4718
• Fix [REDACTED]: strip all HTML tags from $.notify alert messages by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4716
• chore: strip security advisory IDs from code and changelog by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4720
• fix(security): report unwritable .env.lock, make throttle limits configurable by @jekkos in https://github.com/opensourcepos/opensourcepos/pull/4714
• chore(deps): bump dompurify from 3.4.13 to 3.4.16 by @dependabot[bot] in https://github.com/opensourcepos/opensourcepos/pull/4723

New Contributors

• @JustASideQuestNPC made their first contribution in https://github.com/opensourcepos/opensourcepos/pull/4318
• @lyimolucasl made their first contribution in https://github.com/opensourcepos/opensourcepos/pull/4371
• @morimori-dev made their first contribution in https://github.com/opensourcepos/opensourcepos/pull/4450
• @enricodelarosa made their first contribution in https://github.com/opensourcepos/opensourcepos/pull/4526
• @jonathanchang31 made their first contribution in https://github.com/opensourcepos/opensourcepos/pull/4464
• @minutechreview made their first contribution in https://github.com/opensourcepos/opensourcepos/pull/4624
• @richardmilles made their first contribution in https://github.com/opensourcepos/opensourcepos/pull/4636
• @SAY-5 made their first contribution in https://github.com/opensourcepos/opensourcepos/pull/4597
• @VighneshNilajakar made their first contribution in https://github.com/opensourcepos/opensourcepos/pull/4692

Full Changelog: https://github.com/opensourcepos/opensourcepos/compare/3.4.1...unstable