A collection's version can follow its changelog, and addresses with spaces or other encoded characters work again.
Read full notes4 changes
AddedA collection's version can follow a changelog. Collections → a collection → Current version now offers No version, Type a version (as before), or From a changelog: the current version of the changelog you pick, which updates with each new release, so docs never show an old version again. The changelog linked to the collection is listed first, each with its current version. A doc's own version still wins; if the changelog is removed or has no releases yet, the typed version shows.
FixedChangelog sources with spaces in the file name stopped syncing. Saving a changelog removed the percent-encoding from its addresses, so .../blob/main/Commerce%20Bridge%20for%20Hoster.txt was stored as .../CommerceBridgeforHoster.txt and the sync got a 404. "Check source" still worked, because it never saved. Addresses now keep their encoding, and a file address is no longer encoded twice when it is fetched from GitHub, GitLab, Bitbucket, Gitea or Forgejo (%20 became %2520). A changelog saved with the broken address needs its address entered again once.
Fixed The same encoding loss affected a collection's Product page, Community and Source code links and a doc's Old addresses, which are now kept as entered.
FixedDocs with non-Latin or other encoded characters in their address redirected to themselves. The check that sends a doc to its one canonical address read the requested address without its encoded characters, so it never matched and the page looped. It now compares the address as requested.
FixedA new connected site could vanish. About 1 in 300 new connected sites got an id made only of digits, which WordPress stored as a number, so Core Support never listed the site and its contact form, portal and docs answered "not connected". Site ids now always contain a letter. Sites created before stay as they are.
Choose whether your theme's styles and scripts load on docs pages.
Read full notes4 changes
AddedYour theme on docs pages. Settings → Header and footer has a new card that names the active theme, and its parent when it is a child theme, and says when Core Support recognizes it (built-in rules that also cover its add-on plugins and generated CSS). Two switches, both off by default, load the theme's styles or its scripts on docs pages:
AddedStyles: the theme's stylesheets, theme.json global styles and Additional CSS load, so its fonts and colors reach the docs.
AddedScripts: the theme's scripts load and run.
Added Either way, the theme's header, footer and other page markup stay out: from the theme's head and footer code, only the chosen style or script tags come through. Changelog and portal pages still load only Core Support's files.
Docs pages leave other plugins' video players alone.
Read full notes3 changes
FixedCore Support restyled video players inside docs. A player from another plugin, such as TruePlayer, Presto, Plyr or Video.js, got Core Support's text-field look on its volume and seek sliders (border, padding, white background, 36px height), Core Support's fonts and focus outline on its buttons, and doc styles on its links, menus, posters and video. A forced auto height and 16:9 ratio could also resize its video or embedded YouTube frame. Docs pages now skip any element that holds media together with player controls, so the player looks as it does on any other page. Ordinary doc content keeps its styles.
FixedSliders and file pickers never get text-field styles. Range, file, submit, button, reset and image inputs are left as their own plugin or the browser draws them, on every Core Support page.
Addedcsp-not-prose class. Add it to any block in a doc (Advanced → Additional CSS class) to keep Core Support's doc typography off that block and everything inside it.
Changelogs sync from private GitLab, Bitbucket, Gitea and Forgejo repositories, and every settings section links its guide.
Read full notes5 changes
AddedTokens for GitLab, Bitbucket, Gitea and Forgejo. Settings → Changelogs has a token for each service beside GitHub's, and an address for a self-hosted GitLab or Gitea/Forgejo server. A changelog can sync from a repository, a folder or file in one, or its releases on any of them. Each token is sent only to its own service. Bitbucket has no releases, so it reads changelog files only.
AddedExact token permissions in Settings. Each token field names what the token needs: Contents: Read-only on GitHub, the read_api scope on GitLab, Repositories: Read on Bitbucket, read:repository on Gitea and Forgejo.
AddedA question mark beside each settings section opens its guide on gauravtiwari.org in a new tab, and a tooltip names the guide. It is on Settings, Connections, Connected sites, Integrations, Chat, Diagnostics and License. The core_support_docs_url filter points the links elsewhere, or hides them when it returns an empty string.
FixedA GitHub token without file access read as "needs an access token". A fine-grained token that can see a repository but was not given Contents now gets "The GitHub token can see the repository but not its files", with the setting to change. Other services name the permission their token needs.
FixedA later "not found" hid a refused token. When the first changelog file was refused and the next names were not found, the sync reported the last 404. It now reports the refusal. A 404 with a token says the token may not cover the repository.
The agent inbox follows the support portal's header and footer.
Read full notes1 change
FixedThe inbox ignored Settings → Header and footer. The agent workspace always showed the logo, the brand name and "Core Support / By Gatilab" in its footer, whatever the support portal pages were set to. It now uses the Support portal pages settings: the logo, the site name (hidden from view but still read out when switched off), the label beside it, and the footer text, credit and links. The version badge and the agent links stay.
Chat keeps private docs private, a Support Manager role, privacy tools for tickets, an opt-in clean uninstall, and clearer wording across the help desk.
Read full notes14 changes
SecurityChat no longer learns content meant for some readers only. Password-protected posts and docs in collections set to "Signed-in visitors" were learned like any other post, so Chat could quote them to anyone. Chat now never learns them, forgets a collection's docs the moment it is closed to signed-in visitors, and learns them again when it is opened. On update, everything restricted that Chat had learned is forgotten once.
AddedSupport Manager role. Support Agent now works tickets, incoming mail, Chat conversations and docs. Support Manager does all of that plus Settings, Connections, Connected sites, Integrations and Diagnostics. Updating moves existing Support Agents to Support Manager, so nobody loses access; new agents get tickets only.
AddedTickets in WordPress's privacy tools. Tools → Export Personal Data includes every ticket opened with the address, with its public conversation, and email received from it. Tools → Erase Personal Data removes the customer's name, address, subjects, own messages, attachments and original emails, and keeps the team's replies.
AddedSettings → Data: delete everything on uninstall. Off by default. When on, deleting Core Support from the Plugins screen removes its tables, settings, docs, changelogs, collections, private attachment files, roles and scheduled tasks on that site, and gives back the homepage if the support page held it. Files in an R2, S3 or Bunny bucket stay there.
AddedConversation titles can use no model. The Conversation titles menu has "No model: first words of the question".
Added A warning on Core Support screens when attachment storage needs attention, since new files go to the database until it is fixed.
FixedSaving Chat settings switched model-written conversation titles off. The setting had no field, so every save turned it off. It now follows the Conversation titles menu.
FixedThe core_support_chat_rate_limit filter did nothing. Every Chat limit now goes through it: chat_session, chat_ip, chat_global and contact_ip, and a limit of 0 turns a bucket off.
FixedChat introduced itself with an empty name when its own brand name was blank. It now uses the help desk brand, which falls back to the site title.
FixedChat with no key for its answer model showed its button and then failed every question. The button now stays hidden until the provider has a key, and the warning on the Chat screen says so.
FixedThe learning card counted posts with nothing to learn. A published post with no text of its own, such as a docs section that only groups its docs, can never be learned, yet it counted as published, so Docs read 172 of 202 on a site with 30 such sections. These posts are now recorded when Chat finds nothing to learn in them and left out of the card's counts, the Knowledge tab's Published column and the "Learn all now" summary; the card says how many are not counted. A post that gains text is learned and counted again. On upgrade, published posts that were checked but never learned are checked once more by the 30-minute check.
Fixed The hourly limit on new tickets and replies said "Hourly demo limit reached". It now says "You have reached the hourly limit" and can be translated.
Fixed Delivery activity said "Handed to WordPress mail" even when Emailit, Resend, Brevo or SendGrid sent the email. It now names the mail service in use.
Fixed The Logo help text described the old fallback, and the connected-site portal switch asked for WordPress mail when any mail delivery except Capture only works.
FixedThe Cloudflare relay Worker never delivered a message. On Cloudflare, the bundled tools/mail-relay Worker failed every delivery before sending it: it asked fetch for redirect: 'error', which Workers rejects, and called the global fetch as a method of its dependencies, which Workers refuses as an illegal invocation. Each email was retried three times and then forwarded to the fallback address, or rejected without one, so no relayed mail became a ticket. The Worker now fetches with redirect: 'manual' (a redirect still counts as a failed delivery and is not retried) and calls fetch directly. Redeploy the Worker from this version; nothing changes in WordPress or in the signature format.
Docs on your other websites, share buttons, plugin assets on docs pages, badges in any colour, and the current version in every changelog passage Chat learns.
Read full notes6 changes
AddedDocs on a connected website. Core Support → Connected sites → a website → Docs on this website shows the docs collections ticked for it on that site, from one script tag that works on static sites and site builders. The docs open in a frame that grows with its content and keeps search, navigation, videos and code blocks working. Only the ticked collections appear there: search, the docs home and the navigation leave the others out, and any other collection sends the reader back to the docs home. Only that site's addresses may frame them. Collections that need sign-in cannot be shown. Embedded pages are not indexed, so the docs site keeps its search ranking. Each collection also has its own start address, for a product's own site.
AddedShare buttons on docs and changelogs (Settings → Header and footer → Sharing): X, LinkedIn, Facebook, Bluesky, Threads, Reddit, WhatsApp, email and copy link, as plain links to each network's share page with no scripts from them. Off until you tick networks.
AddedBadges in any colour. A badge's colour can be your own: a hex code (#7c3aed), an rgb(), hsl() or oklch() value, or a CSS variable from your theme (var(--brand)), mixed so it reads in light and dark mode. The badges editor now lists the built-in badges (New, Improved, Fixed, Removed, Deprecated, Security, Breaking) first, to recolour them or add words, with a colour picker for your own colours.
ChangedDocs pages leave out only your theme. Every plugin's and block's styles and scripts now load on docs pages, so video players (TruePlayer, Presto and the like), Code Block Pro and analytics work. What goes is the theme's: files in the theme's folder, handles named after it, and rules for popular themes and their pro add-ons (Astra, GeneratePress, Kadence, Blocksy, OceanWP, Neve, Hello Elementor, Divi, Avada, Bricks, Storefront, Flatsome and more, and Marketers Delight); WordPress's theme layer (theme.json global styles, classic theme styles, Additional CSS); and code the theme hooks into the page head and footer. Block plugins whose names start like a theme's, such as GenerateBlocks and Kadence Blocks, stay. Settings → Header and footer → Other plugins on docs pages lists plugin handles to leave out as well, and the core_support_theme_handle_prefixes filter adjusts the theme rules; on docs pages the core_support_standalone_handles filter keeps a theme handle that would otherwise go. Changelog and portal pages still load only Core Support's styles and scripts.
Changed Code blocks that bring their own highlighting and copy button (Code Block Pro and the like) keep their look on docs pages and get no second copy button.
Fixed"What is the current version?" still answered with an old release on a changelog with many releases. On gauravtiwari.org, "what is the current Stackless version?" found the 1.0.4 release passage, not the passage naming 1.5.1, and Chat answered 1.0.4. Every passage of a changelog now starts with "{Product} changelog (current version X, released D)", so whichever release search finds, the current version comes with it. Learned changelogs are marked once on upgrade and learned again by the next 30-minute check.
Security: Webhook credentials stay on the server. Public forms submit a signed reference to current saved settings; private, removed, and changed configurations are rejected. Webhook requests require HTTPS and never follow redirects.
Read full notes19 changes
Security Webhook credentials stay on the server. Public forms submit a signed reference to current saved settings; private, removed, and changed configurations are rejected. Webhook requests require HTTPS and never follow redirects.
Security URL Preview checks image dimensions through bounded safe HTTP requests. Image localization rejects SVGs and invalid cached images and removes failed new imports.
Security Star Rating ignores untrusted proxy headers by default. PHP_CodeSniffer is updated to 3.13.6, fixing the development dependency advisory.
Security Structured data safely encodes script examples in TOC, Product Review, and Star Rating fields. URL Preview imports require permission to edit their parent post.
Fixed WordPress base/contrast palette colors take precedence over operating-system fallbacks, keeping light themes readable on a dark OS and dark theme palettes readable on a light OS. Explicit theme color variables retain priority.
Fixed Featured URL Preview secondary actions keep their outline background and readable hover state, and card borders stay inside their declared width.
Fixed Changelog date-picker values use their registered display format instead of showing raw eight-digit storage values.
Fixed Background image updates preserve concurrent editor saves and queue additions. Migration mutations coordinate their workers, preserve exact verified restore points, retain failed restores for retry, and honor cancellation.
Fixed Migration parsing preserves comment examples inside JSON; recovery preserves escaped text, and Settings/cron load the same recovery helpers as WP-CLI.
Fixed Field compatibility resolves registered keys and recursively normalizes nested and flattened groups/repeaters. Changelog descriptions/types and marketing rows survive; half-star feature ratings keep their decimals.
Fixed Compare preserves legacy feature lists per row. A secondary-only CTA and a zero pricing amount render correctly. Missing-manifest discovery registers field groups.
Fixed Checklist state is scoped to its page and block, and interaction/progress work when browser storage is unavailable.
Fixed Email forms retain hidden fields and custom field attributes. Multiple webhook authentication headers remain separate.
Fixed TOC links, heading anchors, active-state tracking, and schema use the same rendered heading inventory, including HTML and reusable content, without overwriting custom anchors.
Fixed Gallery's lightbox setting opens an accessible dialog with keyboard support and focus restoration. URL Preview imports select the imported image in the originating field.
Fixed Failed remote license deactivation preserves local credentials and reports the error.
Fixed Changed block scripts receive the plugin's cache version even when block metadata carries an older version. Malformed numeric ratings cannot allocate unbounded star markup, and editor repeater reconstruction follows actual stored rows.
Upgrade notes Purge cached webhook form pages and rotate authentication credentials used with earlier versions, which included those values in public HTML. New signed form references do not expire with a page cache.
Upgrade notes Existing localized SVG files are not deleted automatically; review previously imported SVGs before continuing to serve them. Safe background content updates require an InnoDB posts table and defer when another integration owns a database transaction.
The Scheduled coupons switch is on by default wherever Extra Enhancements is enabled.
Read full notes5 changes
New Scheduled coupons
FluentCart refuses a coupon still marked Scheduled at checkout and only switches it to Active when someone opens its Coupons list, so a sale could open with its code refused.
With the new Extra Enhancements switch on, the coupon is checked against its own dates the first time a buyer enters it after the start date, saved as Active and applied.
Before the start date nothing is saved and FluentCart's own message still shows. A scheduled coupon past its end date is saved as Expired.
Turn it off under GT Extensions → Extra Enhancements → Scheduled coupons.
Fixes a fatal error at the end of pages that show the Query Monitor panel. Query Monitor asks for the address of scripts and stylesheets that have none, and GT Performance's version-hiding filter failed on that empty address instead of passing it through.
Read full notes1 change
Fixes a fatal error at the end of pages that show the Query Monitor panel. Query Monitor asks for the address of scripts and stylesheets that have none, and GT Performance's version-hiding filter failed on that empty address instead of passing it through.
