Zender - WhatsApp and SMS Messaging Platform and use Android as SMS Gateways (SaaS) v3.10.0

Zender - WhatsApp and SMS Messaging Platform and use Android as SMS Gateways (SaaS) Changelog

Updating your languages

This release adds new text. If you already have a language installed, your own copy is never overwritten by an update, so the new phrases will show as raw keys until you refresh it.

Download the latest files from https://github.com/titansys/zender-languages and re-upload them under Administration → Languages.

Customised a language? Do not overwrite it. That repository's "changes" folder lists exactly the keys each version adds — take the file for this version and add just those lines to your own translation.

Changelog v3.10.0

Before you update

• Updated the minimum PHP version to 8.4.1. Check your server before updating — on anything older, every page will return an error, including the dashboard
• Added a required Exchange Rate API key for anyone using USD Conversion on a payment gateway. Without it checkout is now refused rather than charging the wrong amount; set it under Admin → Overview → System
• Updated the WhatsApp server to require a secret you choose yourself. It ships with a blank one and refuses to start until you set it, replacing the shared default that earlier versions used
• Removed the Titan Echo cron job; delete that line from your crontab
• Renamed the Payments folder in the download to Plugins

New

• New in-house AI: conversations now go straight from your site to OpenAI, Anthropic, Gemini, DeepSeek or Grok using your own key, instead of passing through our servers. Chat history is stored in your own database, and failures are logged instead of silently returning nothing
• New realtime notifications powered by Pusher, or any compatible server you host yourself. Set it up under Admin → Overview → System
• New Android SMS gateway app, ready to install from Gateway/prebuilt/ and with full source under Gateway/src/. Devices now pair by scanning a QR code that expires after ten minutes and works only once
• New complete offline documentation in Documentation/, replacing the link to an online help centre
• Added full Go source for the WhatsApp server under WhatsApp/src/, with binaries pre-built for Linux x86-64, Linux ARM64 and macOS (Apple Silicon) in WhatsApp/prebuilt/. Windows is not pre-built; build it from source
• Improved the built-in API reference so it works offline and on any install, instead of failing when it could not reach our licence server

Security

• Fixed a flaw that let a crafted file upload run code on your server
• Fixed a flaw that could expose your database credentials over the web
• Fixed a flaw that let a crafted plugin archive write or delete files outside its own folder
• Removed a third-party script that every dashboard page loaded from an outside server, replacing it with a copy served from your own site
• Updated bundled libraries to clear 18 published security advisories
• Fixed payment handling so a repeated notification from a provider can no longer credit the same order twice, and so the amount paid is checked against the amount owed before anything is credited (PayPal and Mollie)

Fixed

• Fixed missing translations showing as raw keys such as and_dash_pg_pay_line45; anything not yet translated now falls back to English

• Fixed checkout selling a package for nothing when a currency conversion failed

• Fixed campaigns ignoring your unsubscribe list for manually typed numbers

• Fixed flows bound to one device firing for every device

• Fixed typed video, audio and document links being discarded in the flow builder

• Fixed a paused flow never resuming, which left that contact permanently excluded from flows and auto-replies

• Fixed WhatsApp Servers being reachable only by the main administrator, however you had set up roles

• Fixed the mobile-number check, which had never actually filtered anything

• Improved WhatsApp handling for the LID era; direct messages and groups are resolved to phone-number identities before reaching the platform

• Update package for existing installations is under "Updates/v3.9.8-fix-102525 to v3.10.0/"