Bookingistic v2.5.0

Bookingistic 2.5.0 makes booking race-safe, hardens the payment and calendar token flows, and fixes the payments status endpoint.

Highlights

Race-safe booking. Concurrent submissions for the same staff member are serialized with a row lock, and the availability re-check runs inside the transaction — preventing double-booking under simultaneous submits (InnoDB; silently degrades to check-then-insert on MyISAM).
Fixed: /payments/status now accepts the signed link's t parameter (previously it only read token, so plugin-issued links always returned 410 Gone).
Security: pay-now links expire after 90 days. The token embeds its expiry under an HMAC; previously a leaked pay link stayed valid forever.
Security: Google Calendar OAuth tokens are encrypted at rest (authenticated secretbox keyed from the site salt). Existing tokens migrate transparently on the next save.
Dev: standalone test suite under tests/ — run php tests/run-all.php, no WordPress install required. Covers payment token expiry, crypto round-trip and deposit math.

No manual migration is required; existing OAuth tokens re-encrypt transparently.
Compatibility: WordPress 6.4+, PHP 8.0+.

File	What it is
`bookingistic-2.5.0.zip`	The WordPress plugin. Upload it under Plugins → Add New → Upload Plugin.
`SHA256SUMS.txt`	Checksums for every file.

Verify with sha256sum -c SHA256SUMS.txt after download.