Every release

• New Credential Check plugin, on by default: every sign-up, sign-in and password change is checked against Have I Been Pwned.
• The password never leaves the server, only the first five characters of its hash.
• An address and a password that are both in known breaches are refused; either one alone gets a warning, and a sign-in with a leaked password shows a notice until the password changes.
• Email checks need a Have I Been Pwned API key under the plugin's settings.
• Site images now pick up Alpine's security fixes and no longer carry npm.

• Security update: Next.js 16.4.6 closes several remote code execution flaws in the image optimizer and cached functions, and sharp 0.35.5 patches its image libraries.
• Every install should take this release.
• Discord gets a fly-trap channel and a link spam ladder that share one offence ladder (timeouts, then a ban), clear the offender's recent messages and report it in the channel, plus a name filter that renames members to a neutral nickname, with a preview before any existing member is touched.
• Newsletter forms file signups onto their lists, per page when tagged, after quiet bot checks; bots are told they succeeded and a mistyped mail domain is named on the form.
• Marketing opens on Lists & contacts, filtered by status, list, source and search.

• Browse lists every plugin the hub sells, on any connected install.
• A plugin that ships as a package — Heat Maps, Forms Plus, SEO Toolkit — has its own card with its picture, price and trust tier, and installs straight from Browse; a paid one points at Subscriptions until the licence is held.
• Discord's rules screen is written with the join questions, and the verification panel can go up without its button, as a rules post.
• Publishing names a starting channel that @everyone cannot see, skips channels deleted in Discord, and says which field Discord refused.
• Poll buttons stay answered after a domain move, and closed or deleted polls lose their buttons.
• Discord tier roles can vote without a site account, and linking keeps the highest tier.
• IndexNow announces every language's address, as the sitemap lists them.

• Entries can be translated.
• An entry carries its words in each language the site publishes, edited from a Languages card on the entry form for the title and every text field, with anything left blank falling back to the primary language.
• A page in another language reads the translated title and fields everywhere they appear: the template, the tab title, loops and structured data.
• The MCP entries tool saves translations per language and field, and renaming an entry found by its id no longer moves it to a new address.
• A countdown's Days, Hours, Mins and Secs are settings of their own, so they can be translated like any other text.

• Covers 1.2.9 to 1.2.11.
• The Discord plugin has a Joining tab that writes Discord's own join questions: titles and answers per language, joined into one line with a flag in front of each language, roles and channels per answer, and pictures from the library uploaded as server emoji for the answers.
• A method switch picks between that and the bot's own gate.
• Rate limiting reads the caller from a trusted number of proxy hops, media and plugin routes answer 404 while a site is locked, form uploads check their bytes against their type and a size quota, and the script policy drops its blanket https: source.
• A locked site refuses visitors in the proxy, before any page renders.
• Pages have a URL per language and links can differ per language, and the header and footer follow the address after a client-side move, so the language switcher lands on the page you are on.
• Story chapter dots read each page's translated label.
• Hosted video streams with byte ranges, loops in a reel, crops to its frame and buffers before it plays.
• A reel slide can be a phone video or a picture, honours slide conditions and keeps pause on a single slide, and editors upload files up to 100 MB.
• Menu items can be dimmed and settings take a WhatsApp link.
• The pointer shows sliders and play state and follows the way an arrow control points, and a story settles the page before it turns.

• Fixes the 1.2.7 package, which did not build on connected installs. They kept running their current version throughout.
• Connected installs take everything listed under 1.2.7 with this release.

• Covers 1.2.6 and 1.2.7.
• An MCP Server plugin lets an MCP client read and build a site through one key-protected endpoint, with checked batch edits, undo and page checks.
• Lists can split one field point by point and sit in columns, which is how this page reads now.
• Marketplace tiles show each plugin's picture.
• Shop, product and collection pages carry a canonical, and every page has a share image: its own, or the site's card when it has none. Library SVGs go out as JPEG.
• The sitemap lists each address once, and the collection breadcrumb leads to the shop.
• Edge rails close above a closing ticker, scroll with the page past a pinned section, and match what runs beneath the header.
• Raised bands can carry a line pattern, and videos hold while they are off screen.
• Field conditions take type.field keys and tags such as listing.image.
• Carousels fade only the sides they can still scroll to, and autoplay rewinds and waits for the visitor.
• The pointer turns into a payment card over checkout buttons and a plus with a cart over add-to-cart buttons, and its link arrow points down over anything that opens downwards.
• Cursor changes restyle only the element under the pointer, not the whole page.
• Membership tier tiles can show the tier product's picture across the top.

• Covers 1.2.2 to 1.2.5.
• A Face-off element for head-to-heads, which plays in as it comes on screen, and single templates that can match on an entry's own fields.
• Edge rails under Styling → Layout: lines down both sides of the page, running over every section as well as the tab bars and tickers between them, with a Hide edge rails setting per page.
• A Video reel built from Reel slides: clips cut through black and keep playing, with a start and length per slide and the caption placed where you want it.
• A pointer setting — the browser's own, shapes, a reticle, or the shapes inside a ring that rests as a dot — and opt-in red-fill colours for red behind white text, which bands carry too.
• Menus gain submenu arrows and can hide unpublished items, date conditions for upcoming and passed dates, and dates that show their year outside the current one.
• Links inside tables take the rich text and long-form styling, the colour mode toggle turns its icon on hover with a switch to keep it still, and form step labels, active tab counts and the empty cart count read with more contrast.
• With no canonical URL in Settings, canonicals, og:url, JSON-LD, robots.txt, the sitemaps and feeds are built on the address the request reached the site on instead of localhost.

• Partner links render on your own domain as /go/name, so ad-block lists that hide links by the partner's address leave them alone, and every click is counted.
• Short links are managed under Affiliate Links, which can make one for every partner link already in your content.
• Campaign links use them too and are marked as sponsored.
• The Affiliate Links forms keep what you typed after an error.

• Light and dark colour modes with a toggle.
• Page types describe their entries to search engines and send them out in feeds: RSS with full text and pictures, topic feeds and a Google News sitemap.
• Entries can be scheduled; links to them show as text until they go live.
• Menus can browse a page type by one of its fields, marquees can run the latest entries, loops can show fewer items on small screens, and a close button hides bars.
• Redirects, partner-link markers and the site cursor are settings.
• Plugin pictures come from the hub once and are kept.
• Pages carry far less data.
• Servers install new releases themselves and keep the old version running if a build fails.

• First release, published from the admin.

Connect an install once from the Licensing plugin and it hears about every release on this page the moment it publishes.