v3.62.0

3.62.0 (2026-06-30)

New Features

• cabinet: add /branding/footer-enabled GET+PATCH endpoint (#3011) (fee15cb)
• per-method payment description override (white-label) (#3014) (500259e)
• pre-warm logo file_id at startup to kill broadcast re-upload (b93db73)
• subscription: reuse expired trial of same tariff on paid purchase (bot/guest) (ac9268b), closes #3004
• surface 2.8.0 service.api_token_created/deleted webhook events (499dfb8)
• surface payment decline reason in the admin panel (#3015) (c378431)
• update Remnawave API integration for panel 2.8.0 (db39b69)

Bug Fixes

• bound MonitoringService notification sends with a per-send timeout (9046bee)
• cabinet: reuse expired trial of same tariff on purchase instead of duplicating (#3004) (c95aec0)
• carry subscription_id through tariff renewal callbacks (#3012) (348491e)
• clarify balance-related notification texts (autopay hint + INSUFFICIENT_BALANCE) (#3013) (baf6782)
• email: build From header with formataddr to avoid duplicated address (e66c526)
• handle 2.8.0 user.expiration webhook event (7ce455f)
• read webhook envelope meta from data['_meta'] in user.expiration (1e1a309)
• resolve the correct subscription in tariff-switch flows (#3012) (08c08dd)
• respect RESET_DEVICES_ON_RENEWAL in Remnawave user sync (#3006) (#3008) (0f608a7)
• security: block stored XSS via ticket media (HTML/SVG served inline) (0cbf624)
• security: harden admin logo serving against SVG script execution (2e512fc)
• show Lava payment methods in the bot when enabled (#3016) (591b154)
• stop multi-tariff HWID device limit bleeding across tariffs (7463ec0)
• sync used traffic from nested userTraffic in user.modified webhook (7fd397e)

Refactoring

• close low-pri 2.8.0 follow-ups (trafficLimitBytes coerce, api-token name) (dc4eaad)
• harden HWID byApp aggregation (2.8.0) + test coverage (a82614c)

Documentation

• document the _resolve_subscription footgun + add guard tests (#3012) (1db6924)