Changelog

• Added
• Streaming chat at POST /alpha-chat/v1/chat/stream (SSE). The widget streams tokens and falls back to JSON /chat if the host buffers the stream.
• Hybrid retrieval: FULLTEXT candidate cut, follow-up query rewrite, and a score boost for the current page’s chunks.
• Source cards now show at most three posts the reply actually used. Admin metadata still stores the full retrieved set.
• Mapped Thinking control (off / low / medium / high) for OpenAI, Grok, and DeepSeek. Default and all presets are low. xhigh/max are not sent.
• Voyage AI as an independent embedding provider (voyage-4-lite, voyage-4, voyage-4-large). Chat, embeddings, and moderation are now separate settings.
• alpha_chat_moderation_provider filter and a no-op moderator when no OpenAI key is set.
• xAI (Grok) and DeepSeek as chat-only providers, using the same Chat Completions client as OpenAI.
• PHP ModelCatalog as the admin source of truth. GET /settings now returns { settings, stats, catalog }.
• Settings secrets xai_api_key and deepseek_api_key.
• alpha_chat_model_catalog and alpha_chat_http_timeout filters.
• Changed
• OpenAI chat models are now GPT-5.6 Luna / Terra / Sol. New installs default to gpt-5.6-luna.
• Retired OpenAI IDs (gpt-5.4-mini, gpt-5.4, gpt-4.1) remap on settings read so the dropdown is never blank; the new ID is persisted on Save.
• Provider HTTP timeout raised from 30s to 60s.
• OpenAI is no longer required for embeddings or chat. Retrieval search only uses chunks from the active embedding model.
• Public /chat and /chat/stream require the alpha_chat_frontend nonce the widget already localizes.

• Fixed
• Fixed a fatal "Allowed memory size exhausted" error when updating the plugin. Updater::clearCache() runs on delete_site_transient_update_plugins and then deletes an update transient of its own, which fires the generic deleted_site_transient and deleted_option hooks; any listener that refreshes the plugin update cache in response re-entered the deletion hook, and the two recursed until PHP ran out of VM stack. clearCache(), injectUpdate(), and the remote fetch in metadata() now each hold a re-entry guard.
• Stopped Updater::metadata() from repeating the license-server request when the update transient filter re-enters before the first response is cached.
• Fixed the Redis object-cache drop-in reporting a successful delete for a key it never held. Core's WP_Object_Cache::delete() returns false in that case, and delete_site_transient() fires the generic deleted_site_transient hook only on a true result, so the unconditional answer re-dispatched that hook on every repeat deletion. This is what kept the update-cache recursion above from settling on sites where the drop-in is installed without a reachable Redis server.

• Added
• Added xCloud Public API site discovery, host-cache status and purge routing, independent Cloudflare Enterprise detection, explicit edge ownership, and requested 12-hour traffic reporting.
• Added safe enable-time profiles for Cloudflare, xCloud, static CDN rewriting, Redis, compatibility safeguards, Private Islands, and Fleet while preserving credentials, custom endpoints, and other non-empty provider values.
• Added feature-level EWWW Image Optimizer ownership for next-generation formats, Easy IO, lazy loading, and missing dimensions without disabling complementary upload compression.
• Changed
• Moved WebP and AVIF generation out of media-upload requests and split each source and registered image size into its own durable background job. Image work now runs ahead of cache preloads while keeping cache purges first.
• Added generic CDN and Cloudflare-specific no-store directives to private, commerce, feed, authenticated preview, and Private Islands responses.
• Fixed
• Prevented large multi-image uploads from spending the full PHP execution window generating every modern-format variant synchronously. Existing targets are skipped, duplicate physical sub-sizes are deduplicated, and queued jobs recheck ownership before writing.
• Prevented GT Performance and EWWW from generating, rewriting, lazy-loading, or dimensioning the same images when EWWW or Easy IO owns the corresponding feature.
• Blocked direct Cloudflare synchronization and duplicate purge routing while an enabled xCloud edge layer owns the cache, and failed closed when xCloud Enterprise exposes analytics but no token-authenticated purge mutation.

• Schema-rendered field IDs are now unique per form instance, so labels and descriptions stay correctly associated when multiple forms appear on one page.
• The MailerPress action defaults to double opt-in, preserves existing subscribers and suppressed contacts, and records form-level consent metadata. Confirmation is resent only when a pending or previously unsubscribed contact submits again.
• The legacy FluentCart-to-MailerPress bridge no longer creates subscribed contacts when its settings are empty.

• Contacts added as Pending now receive the configured confirmation email after list and tag assignment.
• Existing subscribed or suppressed contacts are not force-resubscribed.

Full changelog: https://core-forms.com/changelog/

• Your existing license key keeps working. Sites re-register themselves on the first admin page load after updating, so there is nothing to re-enter.
• If that automatic step cannot reach the server, the key is left untouched and a notice asks you to reactivate, rather than the license being cleared.
• License checks now retry once on a timeout or server error, so a brief network problem no longer marks an active license invalid.

• What's Changed
• Fixed
• Collapsible TOC rendered a double border on themes that style <details> as a card. The block drew its own hairline frame and summary divider around the <details> element, so themes with disclosure-card styling (such as Marketers Delight) showed two nested borders. The render template now adds an acf-toc--collapsible modifier class, and the block stylesheet drops its frame, summary divider, and duplicate content padding for that variant, letting the theme's disclosure card own the chrome. Non-collapsible TOCs are unchanged.
• Notes
• blocks/toc-block/block.json now declares "version", so the enqueued stylesheet URL busts CDN caches on plugin updates.
• Commits
• 2.10.2: fix collapsible TOC double border on themes with details cards (55a1f59)
• Stats
• Commits: 1
• Changes 9 files changed, 49 insertions(+), 12 deletions(-)
• Plugin Info
• Blocks included: 29
• Requires WordPress: 6.0+
• Requires PHP: 7.4+
• Requires: ACF Pro 6.0+ or Secure Custom Fields
• Installation
• Download acf-blocks-plugin-*.zip from the assets below
• Go to Plugins → Add New → Upload Plugin in WordPress admin
• Upload the zip file and activate

• What's Changed
• Fixed
• Filled buttons were unreadable in 2.10.0. The 2.10.0 conversion mapped several filled controls to --acfb-surface-3, a light neutral, while leaving their text inverted white — so they rendered as pale text on a pale fill. Affected: the Product Box primary and Amazon buttons and its discount badge, the Product List primary button and rank chip, and the Coupon Code copy button.
• Filled controls now use --acfb-button, which the theme guarantees pairs with --acfb-button-text. Measured 5.44:1 in both light and dark.
• The Product Box Amazon button is now a readable neutral secondary (dark text on a light fill, 13.4–14.4:1) rather than a second full-strength fill, so the card keeps one primary action. Its hover no longer darkens toward the brand colour underneath dark text.
• Notes
• Added a regression test rejecting any filled control whose background is a --acfb-surface-* token while its paired text is --acfb-on-primary.
• Commits
• 2.10.1: fix unreadable filled buttons from the token conversion (79879cf)
• Stats
• Commits: 1
• Changes 11 files changed, 63 insertions(+), 12 deletions(-)
• Plugin Info
• Blocks included: 29
• Requires WordPress: 6.0+
• Requires PHP: 7.4+
• Requires: ACF Pro 6.0+ or Secure Custom Fields
• Installation
• Download acf-blocks-plugin-*.zip from the assets below
• Go to Plugins → Add New → Upload Plugin in WordPress admin
• Upload the zip file and activate

• What's Changed
• Added
• Design token bridge (assets/css/tokens.css). Every block now styles through --acfb-* tokens that resolve to Marketers Delight theme tokens when MD is active and to neutral literals otherwise. Dark mode follows the theme's own toggle with no per-block rules.
• Build-time asset minification (tools/build-assets.php). Writes a .min sibling for every CSS and JS file; the enqueue layer serves it, SCRIPT_DEBUG serves the source, and a missing artifact falls back to the source rather than 404ing. composer build regenerates, composer generated (and CI) verifies freshness.
• Keyboard support for the Tabs block: arrow keys, Home/End, and a roving tabindex, per the ARIA tabs pattern.
• Changed
• Tabs redesigned as a minimal segmented control. Tab buttons no longer carry wp-element-button, which had rendered every tab as a filled CTA button. Pills, underline and boxed variants retained.
• Tabs behaviour moved out of an inline <script> into tabs.js, registered as the block's viewScript.
• 797 hardcoded colours across the block stylesheets reduced to 89, all of which are deliberate (social brand colours, code-editor syntax themes, video letterboxing).
• 54 hand-rolled [data-theme] override rules removed; the token layer handles both schemes.
• Fixed
• Video block rendered on the front end but not in the block editor. The player is absolutely positioned, so the wrapper's padding-bottom was the block's only source of height — if the stylesheet did not reach the editor the block collapsed to 0px and vanished. The aspect ratio is now carried inline, so the box survives with no CSS at all.
• Pros & Cons is now dark-mode capable. It previously hardcoded dark text on light pink and green tints, which was unreadable on a dark background.
• Semantic status labels (changelog, pricing) sat at 4.0–4.2:1 against their own tint, under the WCAG AA floor. They are now mixed toward the text colour.
• Button fills used --color-primary, which MD lightens for dark mode, dropping white button text to 3.3:1. They now use --color-button, which MD keeps stable and guarantees pairs with --color-button-text.
• Removed the rounded-container-plus-thick-coloured-rail treatment from the opinion box, video caption, compact URL preview and Pros & Cons.
• Notes
• Total shipped CSS dropped from ~291 KB to ~257 KB: deleting the dark-mode override rules more than pays for the token layer.
• Every measured text/background pair passes WCAG AA in both light and dark (19 pairs across 14 block palettes, worst 5.44:1).
• Commits
• Correct 2.10.0 changelog date to release day (5fd652d)
• 2.10.0: MD design tokens, minified assets, Tabs redesign (842f9da)
• Stats
• Commits: 2
• Changes 91 files changed, 2655 insertions(+), 322 deletions(-)
• Plugin Info
• Blocks included: 29
• Requires WordPress: 6.0+
• Requires PHP: 7.4+
• Requires: ACF Pro 6.0+ or Secure Custom Fields
• Installation
• Download acf-blocks-plugin-*.zip from the assets below
• Go to Plugins → Add New → Upload Plugin in WordPress admin
• Upload the zip file and activate

• Choose the global default, always load forms.css, or always skip it for each form.
• Keep the form-editor preview aligned with the frontend’s resolved Skeleton CSS and form-theme settings.
• Preserve existing form behavior until a per-form override is selected.

• What's Changed
• Added WordPress 7 Abilities API operations for module status, privacy-safe diagnostics, assumption scans, content-integrity checks, redirect import previews, redirect creation, task creation, module toggles, and opt-in AI explanations.
• Added DataViews and DataForm workspaces for Redirect Manager, its bounded 404 activity, and Task Manager with searchable, sortable, filterable tables and modern creation forms while retaining the classic interfaces as fallbacks.
• Added Command Palette actions for opening Functionalities screens and running an Assumption Detection scan.
• Added Explicitly opt-in AI explanations powered by the WordPress AI Client. Only a finding submitted by an administrator is sent to the configured provider.
• Improved SVG Icon block upgraded to Block API v3 with WordPress Core Icon source support, two-way Core Icon transforms, pattern-override-ready content attributes, block bindings, and an Icon Callout pattern.
• Fixed Content Integrity now uses the current wp.editor plugin-sidebar components on WordPress 7 while retaining the legacy fallback.
• Fixed Custom font declarations are emitted with their preloads so first-paint typography does not shift when async theme styles arrive.
• Changed Minimum WordPress version is now 6.3 so the SVG Icon block can use Block API v3 consistently. WordPress 7-only integrations remain feature-detected.
• Commits
• Add WordPress 7 integrations for 1.5.0 (1abacd5)
• Fix custom font layout shifts (87d507f)

• Added
• Added URL-specific and site-wide regeneration controls to CSS Reports. URL regeneration invalidates every delivery-mode report for that page, purges its origin and connected edge cache entries, and warms it immediately. Site-wide regeneration advances the settings generation, marks existing reports stale, purges the full page cache, and uses the normal preload queue.
• Extended stylesheet exclusions to match WordPress inline style IDs as well as external URLs, and added automatic server-side pruning exclusions for active FluentCart, Easy Digital Downloads, and WooCommerce application styles.
• Fixed
• Preserved hexadecimal CSS escapes such as \\e800 and \\f0e1 through parsing and HTML serialization. Inline used CSS no longer turns icon-font glyphs or other escaped content values into literal numeric entities.
• Preserved the original cascade order when collecting external and inline styles, ignored noscript fallbacks, treated asynchronous media="print" loaders that promote themselves to all correctly, and parsed each stylesheet independently so one parser-hostile source cannot alter following stylesheets.
• Kept custom-property definition blocks as dependencies, expanded supported dynamic pseudo-classes and state attributes, and expanded trained compound selectors into reusable ID and class fragments so runtime states remain protected when selector order differs.
• Made authenticated used-CSS previews bypass page and edge storage while still executing the production optimization pipeline.