Changelogs

Security

• Enforces the 254-character email limit and each field’s declared maxlength on the server.
• Rejects nested form values and encoded submission metadata above 60 KiB before hooks, storage, or notifications.
• Keeps uploaded file bytes outside that metadata ceiling; upload size remains controlled by the field and PHP limits.

Fixed

• Restores single and multiple multipart file uploads by normalizing PHP’s $_FILES data into the submission pipeline.
• Prevents invalid and spam submissions from moving files or persisting temporary upload paths.
• Fixes per-form rate-limit settings, hourly expiry, and AJAX error visibility.

See CHANGELOG.md for the full release history.