Core Laravel Package

This release fixes a URL generation regression introduced in v4.4.0 that affected Windows operating systems.

Fixed

• Resolved an issue where frontend page URL generation was broken on Windows OS

This release introduces new theme template features, a dedicated currency validation rule, and several bug fixes for form fields, cache handling, and dependency management.

Added

• Introduced a views/files template type for arbitrary nested theme templates wired into the Template Editor and Theme Manager.
• Added a dedicated currency validation rule that accepts numbers formatted with the default currency's decimal and thousand separators.
• Added a ComposerScripts post-autoload-dump hook that boots a minimal application and removes the cached addons path so it regenerates on the next run.

Fixed

• Fixed "Select All" / "Select None" links in checkbox list fields, which had been non-functional since the v4 rewrite; a delegated event handler now toggles checkboxes and fires change events so dependsOn bindings react correctly.
• Fixed the currency cache not being invalidated when a currency is saved or deleted, which previously caused newly created or edited currencies to not appear on the storefront until the app cache was manually cleared.
• Fixed the currency form field rejecting localized price input (e.g. values using a comma as a decimal separator) under the numeric validation rule; the field's hardcoded pattern attribute now also accepts the configured decimal sign.
• Fixed unescaped output being incorrectly blocked in TemplateSandbox for theme templates.
• Fixed the ColorPicker widget to normalize saved hex values, expanding 3-digit hex shorthand and rejecting invalid input; a linked text input is now shown alongside the color swatch and kept in sync.
• Fixed composer operations to exclude dev dependencies by adding --no-dev to the outdated command and --update-no-dev to require and remove commands.

Changed

• Replaced the SafeMailTemplateContent sandbox with SafeThemeTemplateContent across page, layout, partial, and content models; TemplateSandbox now scans actual PHP regions instead of blanket-blocking object calls, app()/resolve(), and static calls.

This release expands the template sandbox capabilities and fixes an issue with empty place suggestion titles for plain addresses.

Added

• Template sandbox now supports allowlisted object methods and extensible registries, giving greater flexibility when working with sandboxed templates

Fixed

• Empty place suggestion titles for plain addresses when using the Nominatim provider are now handled correctly

Changed

• Marketplace Composer authentication — Carte key is now sent via the TI-Rest-Key custom header instead of HTTP Basic auth, so platform headers are included on marketplace requests.

Upgrade note: After updating, retry an extension update via the admin updates so auth.json is regenerated without the old http-basic entry for composer.tastyigniter.com.

This release introduces a System Information health check dashboard and optional auto-refresh for the admin Lists widget, along with two bug fixes for improved security and reliability.

Added

• New System Information health check dashboard for monitoring system status
• Optional auto-refresh interval support for the admin Lists widget

Fixed

• Prevented potential SQL injection via unsortable column values in list sorting

This release delivers important security hardening for template sandboxing and file uploads, along with a bug fix for active tab state management in admin forms.

Fixed

• Active tab now resets to the default when opening a new or different record, preventing stale tab state from carrying over between records
• Hardened file upload handling to protect against path traversal and code injection attacks
• Blocked higher-order function bypass attempts in the Pagic template sandbox
• Blocked server-side template injection in mail and theme templates

Changed

• Simplified sandbox regex patterns and callback syntax in Pagic for cleaner, more maintainable code

Security

• Restricted [@php](https://github.com/php) Blade directive in layouts. Default layouts no longer permit raw [@php](https://github.com/php) blocks to prevent unsanitised input execution.
  • If you haven't customised the default layout: no action needed, the update applies automatically.
  • If you have customised the default layout: back up your current layout, delete the existing default layout (so the updated version can be regenerated), then reapply your customisations on top of the new default.
• Theme and mail layout editors now validate against raw PHP. If you need PHP in a theme or mail layout, edit the Blade files directly on disk — the in-app theme/mail editors will reject saves containing PHP code.

This release adds marketplace authentication improvements and licence warning detection, along with two bug fixes for priority handling and the updates endpoint URL.

Added

• Introduced carte licence warning detection with status alerts in the updates flow
• Added marketplace authentication support with a platform header and URL validation for Composer

Fixed

• Prevented the Sortable trait from overwriting an explicitly set priority of 0

License: Carte keys now bind to a single production installation URL for marketplace and Composer install/update; dev environments exempt.

This release introduces new middleware for guiding incomplete setups and improves file upload validation in the media manager.

Added

• Added a CheckInitialSetup middleware that redirects users to the setup flow when initial configuration is incomplete
• Added MIME type and extension-based validation for file uploads in the media manager

Fixed

• Restricted the CheckInitialSetup redirect logic to apply only to theme routes, preventing unintended redirects elsewhere

Changed

• Replaced getAllowedMimeTypes with extension-based validation for media file handling
• Added type hints and removed unused imports in the media manager for improved code clarity

This release includes improvements to Google Places session billing and language update filtering.

Added

• Language updates are now filtered to only apply when the version is a valid semantic version

Fixed

• Session token is now passed to Place Details requests to enable correct Google session billing

This release improves template handling by introducing a sandbox for sanitization, refining related editor behavior, and fixing a nullable type issue on the tag property.

Added

• Introduced a TemplateSandbox component to handle template sanitization

Fixed

• Improved theme template sanitization and cleanup logic when modifying files from the admin theme customiser
• Issue where media are being stored with the incorrect tag name

✨ New Features

Zero-decimal currency support — currencies without decimal places (e.g. JPY, KRW) now format correctly (#46, #47)

🐛 Bug Fixes

Fixed array slice error in the dashboard news widget (#48) HOME and COMPOSER_HOME are now set when spawning the composer process (#49) Checkbox list in admin forms now correctly submits an empty value (53947e91) Added custom error message for missing item.package (a8432a1c)

Fixed

• Prevented empty filter values from being applied in database queries

Added

• Added indexes to media_attachments, languages, countries, and currencies tables to improve query performance

Fixed

• Fixed issue where query filters were not being applied when option key exists
• Fixed package type references to resolve issues when updating extensions
• Various minor bug fixes and improvements

Changed

• Updated constructor type hints in ApplicationException class for better type safety
• Refactored query grammar usage and tidied relation constructors and tests
• Updated repository host from Satis to Composer for consistency
• Updated urlPolicy to enforce URL policy behavior

Added

• cache: Add CacheMaker trait with caching helper methods

Added

• dashboard: Add widget selection and selected widget fields to the new widgets form.

Changed

• model: Change isRelationPurgeable method visibility from protected to public.
• refactor: Update type hints for functions and variables across the codebase.
• refactor(onboarding): Move menus onboarding step into Cart extension and add mail completion check.

Fixed

• NominatimProvider: Update URL formatting in distance method for accuracy.
• Update schedule: Remove value from --check option on igniter:update command.

Minor bug fix

Added

• geolocation: Implement places autocomplete and coordinates retrieval in GoogleProvider and NominatimProvider.

Changed

• Update PHP requirement in composer.json from ^8.2 to ^8.3.

Fixed

• Fix issue where image is not displayed on mediafinder. (#34)
• Bring back console.schedule event to run registered schedule command.
• Theme: Simplify required extensions handling

Fixed

• deps: Add support for Laravel 12.
• Update references from Crowdin to Community Translation project.

Added

• mail: Add support for using mailer configuration file.

Fixed

• Fix status dropdown bug on the order page. (#30)

Added

• Enhance extension installation logic and update package handling.

Changed

• charts: Enhance dashboard chart options handling.

Fixed

• Issue where saving form with empty select dropdown adds selected options back
• HasRelationships: Reorder parameters to fix issue with saving MorphToMany relationships.
• Update version handling for extensions and themes in IgniterUtil.

Added

• logs: Add size check for log files before processing them.
• settings: Implement afterModelSave to update model attributes.

Fixed

• Fix "The path file/folder does not exist" issue when uploading to media manager.
• Replace save() with saveQuietly() in LogsStatusHistory model.
• Ensure extension is loaded only if the install path is a directory.
• Rename the index of columns and keys to fix "migration name too long" issue. (#25)
• Dropdown position fix. (#25)

Style

• Update icon styles and make category label bold in settings view.

Added

• Add support for permissions field when registering admin navigation menu
• Enhance MorphTo and other relationships with event firing.
• Replace with() method calls with withSerializedData() in MailHelper to better serialize mail data in queue jobs
• Add actionUrl and actionText properties to FlashBag messages for better handling of flash overlay messages.
• Update editor to only allow importing and exporting of translated strings for non-English languages.
• Add media directory creation to the installation process.

Changed

• Update v3 mail template codes to match v4 standards.

Fixed

• Potential errors when retrieving mail template sections.
• Ensure controller has makeView method before calling it in FlashException.
• Ensure parent path exists before checking for theme.php.
• Fix OpenStreetMap API 403 issue and bugs when coordinates are present. (#22)
• Fix GoogleProvider response stream consumed twice. (#20)

Release v4.0.9

Release v4.0.8

Release v4.0.7

Release v4.0.6

Release v4.0.5

Release v4.0.4

Release v4.0.3

Release v4.0.2

Release v4.0.1

Initial release