Fixed apps failing to register with the WebSocket server when the platform's web address points to a local or private network (for example a .test domain or a LAN hostname), which made connections and events fail with an "app not found" error
Fixed a rejected app configuration not appearing in the logs; it is now recorded along with the server's reason
Updated the documentation with the correct log file name, the exact error to look for when an app is rejected, and which platform addresses may point to a local or private network
New security headers and a Content-Security-Policy now protect the whole app, including the dashboard and admin panel, which previously shipped with none
Fixed sign-in, registration and password reset doing nothing at all when the spam-protection check could not be reached
Fixed an admin viewing a customer's account being able to change that customer's email address
Fixed an admin viewing a customer's account being able to cancel that customer's subscription
Fixed being unable to switch off a plugin that was active but no longer configured
Fixed the admin Cronjobs page showing the wrong schedule for the demo cleanup task
Updated bundled third-party components to clear known security advisories
New WebSocket server binaries for Linux (Intel and ARM) and macOS, rebuilt for this release
Updated the WebSocket server's build toolchain to a patched version, clearing known security issues affecting previous builds
Fixed regenerating an app's credentials not revoking the old key, which kept accepting new connections until the server was restarted
Fixed the Pusher-compatible API accepting reserved event names, which let forged presence and error events reach subscribers
Updated the Pusher-compatible API to count one message per channel, matching the rest of the product — a message sent to several channels previously counted as one
Improved webhook security so a webhook address can no longer be redirected to a private internal server
Improved social sign-in to refuse providers that return no email address
Updated a bundled encryption library to a patched version
Fixed lifetime plans failing to save on MySQL databases
Fixed referral credit that could be spent twice, or used up without the subscription being activated
Fixed YooKassa renewals that could charge a customer twice
Fixed the daily message allowance resetting after a product update, handing out a second day of messages
Fixed the message allowance going negative and granting free messages
Fixed missing webhook failure alerts and duplicate delivery records on installations that run a queue worker
Fixed the installer discarding the admin name and password when reusing an existing account
Fixed re-adding a previously removed server failing to receive its app settings
Fixed account deletion leaving daily usage records behind
Improved the admin overview to show when server statistics cover only part of the fleet
Updated the documentation site with around 90 corrections, including a server setup example that could take the Apps dashboard offline
Fixed plan limits not being applied to live connections — an app left blank on connections, channels or message size ran with no limit at all instead of inheriting its plan's ceiling
Fixed plan changes not taking effect — after a downgrade the previous, higher limits stayed active indefinitely; upgrades, downgrades and cancellations now apply right away
Fixed customers with a cancelled or missing subscription running without limits; they now fall back to the default plan
Fixed the pause/activate toggle failing with a validation error on apps whose saved limits sat above their plan
Fixed the app details page showing a message-size limit the server no longer enforced — app pages now show the limit actually in force
Fixed errors from scheduled tasks and background jobs never reaching error reporting
Fixed form errors on the app and plan screens being hidden behind a generic message instead of appearing on the field
Added a scheduled task that reapplies app limits to your WebSocket servers, also runnable on demand from the admin area
Improved limit display — unlimited allowances now read "Unlimited" instead of showing nothing
Removed the "Events today" quota, which was measured against a different counter
Fixed the updater starting an update it could not finish — it now checks every file it needs to write before taking your site down, and stops with a clear list of what to fix instead of failing halfway through
Fixed a rare case where a failed update could restore an older database over a live site
Updated the Upgrade Guide with the file-ownership steps behind most failed updates
Improved the WebSocket server with refreshed dependencies
Fixed a failed update leaving stray files behind — a rollback now fully restores the previous version instead of a mix of old and new files
Improved the updater to work on restrictive hosting (such as cPanel/shared hosting): it now shows a clear message when a file can't be written, and safely rejects malformed update packages
Updated the bundled WebSocket server binaries to the latest dependency versions
Fixed software updates that could fail or get stuck when the live dashboard connection was briefly unavailable — updates now finish reliably and report a clear status if something goes wrong
Fixed the admin dashboard's live updates not reconnecting after a server node was re-activated
Fixed an internal system name that could still appear in page source after you rebrand the product
Fixed App settings: the "client events" and "webhooks" toggles now show clearly when your plan does not include them, instead of silently failing on save
Fixed App dashboard: live connection and channel counters now reflect real activity instead of always showing zero
Fixed Admin → Settings: branding upload, branding remove, and the "send test email" button now work as expected
Fixed Admin → Servers: deleting a server now shows the actual reason if it can't be removed, and the dialog stays open until the action succeeds
Improved subscription upgrades: changes to event-log access take effect immediately
Improved security of the webhook callbacks between the dashboard and the WebSocket server (replay protection and stricter URL validation)