The Crocoblock release. Seven Jet plugins that kept their daily work behind
their own screens now have it in Minn: JetEngine's meta boxes, options pages and
post types where Minn already puts that kind of thing, JetBooking and
JetAppointments in the Bookings inbox, and Custom Content Types, JetReviews,
JetThemeCore parts, JetSearch and JetSmartFilters each over the plugin's own
tables and code. One membership key pasted on the Licenses tab covers the whole
pack.
Long jobs stopped holding the page. Backups and exports from five engines run in
the background behind a progress pill in the top bar that survives a reload and
has a Stop, and every backup row can now be downloaded through a door WordPress
already has. Design's Styles tab grew from a row of swatches into the place a
site's look is actually edited, with a specimen that follows what you type, a
contrast check and a history of who changed what. And a security pass over
v0.37.0 found one thing that was plainly broken and a set of gates that were not
asking the right question; both are put right here.
Added
- JetEngine fields, options pages and post types come into Minn. Sites built on JetEngine keep their structure in three places, and all three now show up where Minn already puts that kind of thing. Meta boxes appear as a Custom fields panel in the editor, with text, numbers, selects, checkbox sets, switches, colors, dates, images, galleries and rich text edited in place and saved the way JetEngine saves them (repeaters, post pickers, maps and glossary-fed options are counted and link out). Options pages sit under Site options as tabs, each honoring its own capability and storage setting, with a partial save leaving the other fields untouched. Post types and taxonomies JetEngine created are attributed to it on the Structure page, editable there with their meta fields, admin columns and advanced settings preserved, and JetEngine is offered as a place to store new definitions.
- JetBooking and JetAppointments join Bookings. Crocoblock's two booking plugins keep their bookings in their own tables behind their own screens, so nothing of theirs showed in Minn. Both now sit in the Bookings inbox beside Amelia, LatePoint and Bookly: upcoming, pending, today and canceled views, search by guest, item, service or provider, and each booking opening as its own page with the guest, the booked rental or service, the provider, nights or time slot, phone and comments where the form collected them. Mark completed, cancel and delete go through each plugin's own code, so JetBooking's workflows, WooCommerce order sync and status emails fire, JetAppointments' notifications and excluded-dates bookkeeping run, and a JetBooking vendor account sees only its own bookings. Calendars, units, pricing, schedules and the booking forms stay in the Jet plugins, one click away.
- The rest of the Jet pack. Five more Crocoblock plugins get their daily screens in Minn, each over the plugin's own tables and code. JetEngine Custom Content Types appear as a Content types surface with a view per type: the type's own fields as columns and forms, published and draft tabs, search, add, edit, publish or draft, and delete, with access decided by the type's own capability. JetReviews gets a Reviews inbox: pending and approved tabs, a detail with the reviewer, message and per-field ratings, and approve, unapprove or delete singly or in bulk, done the way its own screen does so item ratings stay in sync. JetThemeCore theme parts join the Templates surface next to Elementor and Bricks, with type tabs, the canvas, a plain-language conditions summary, add, rename, trash and Edit. JetSearch's suggestions become a Tools surface: what visitors search, ordered by weight, with add, edit, delete and the plugin's own duplicate merge. JetSmartFilters joins that same Tools item as a Filters view when both are active, and stands alone when only it is, with the indexer on the status card and a Reindex that runs in the background and reports the row count when it finishes. The Content switcher no longer lists JetThemeCore parts, JetEngine listing items or JetMenu mega-menu items beside real writing types.
- Crocoblock joins Licenses with paste-to-activate. One Crocoblock membership key licenses every Jet plugin on a site (JetEngine, JetElements, JetSmartFilters, JetBooking and the rest of the pack), so Licenses shows it as one row: the membership kind, lifetime or the renewal date, and how many of the installed Jet plugins it covers, naming any it does not. Paste the key and Minn activates it through the Jet Dashboard code the plugins already ship, re-verifies against Crocoblock on demand, and removes this site from the license when you deactivate. A refused key stores nothing, and a key activated for a different address (a cloned or migrated site) reads as invalid with the reason instead of looking fine.
- Backups and exports run in the background, behind a progress pill. Starting a backup or an export used to hold the page for as long as it took. All-in-One WP Migration's Export site (with toggles to skip media, plugins, themes, spam comments or revisions), UpdraftPlus and WPvivid's Back up now (everything or database only), BackWPup's Run job now (with a job picker when there is more than one) and Duplicator's Build a package (with a name and a database-only toggle) all start from their Backups status card and run as background jobs. A pill in the top bar shows the live percentage on every page, clicking it opens a small window with the current step, a progress bar and a Stop button, the job survives a reload, and the archive list refreshes when the run ends. Each one rides the plugin's own engine and reads the plugin's own job data, so what Minn shows is what the plugin's own screen would show, and Stop goes through the plugin's own abort. This is a general mechanism: any plugin's long-running action can now report progress the same way through one extra key on its status card.
- Every backup row can be downloaded, from the ⋯ menu or a right-click. UpdraftPlus sets (the whole set, or just the database), WPvivid sets kept on this server, BackWPup archives, Duplicator archives and their installers, and All-in-One WP Migration exports all carry a Download action now. Files stream through a nonce-checked door WordPress already has (admin-post) straight from the plugin's own backup folder, so nothing needs to be web-readable and a link cannot be shared around. A set made of several files shows a short page with one link per file. UpdraftPlus rows also gain Delete set (this server's copy only; remote copies stay).
- Design → Styles shows the current look and its history. A Current look card sits above the style cards: the palette, body and heading fonts, text sizes, content and wide widths, background and shadow presets your visitors get right now, each row opening Minn's own editor at that section (only Shadows, which Minn does not edit, links out to the Site Editor and says so), and a Customized list that says in plain words what was changed from the theme ("H1 font → Quattrocento", "Background color → #f0efee"). Reset to theme defaults clears every customization with an Undo. History lists every saved version of the site's styles, who saved it, when, and what changed from the version before, with Restore on each and Undo after a restore. Edit look turns the card into a short form for the everyday changes: background, text, link, heading, button and caption colors from the palette or a hex value, body and heading font, body text size and line height, page padding, block spacing, content and wide widths. Empty fields keep the theme's value, a cleared field goes back to the theme, invalid values are refused with the reason, and Save has an Undo. Every heading level from H1 to H6 gets its own font and size. Each style card's menu offers Use its colors only and Use its type only, so one variation's palette can go with another's fonts, and the Default card resets just the colors or just the type to the theme. A Contrast row grades text, links and headings against the background and button text against the button background by the WCAG AA ratio. A specimen at the top of the card renders a heading, a paragraph with a link and a button with the site's own stylesheet, real fonts included, and follows edits as they are typed. Each customization names who made it and when, History labels saves that match a style variation as Applied, and the card's ⋯ menu copies the look as a theme.json-shaped document or pastes one from another site, with an Undo. Everything reads and writes the same global-styles record the Site Editor uses, through its own route, so its validation and permissions apply.
- Independent Analytics fills the Stats page. Sites running Independent Analytics (free or Pro) now get the range-wide breakdowns the Stats page was built for: top pages, referrers by their grouped names (Google, ChatGPT, Reddit) with direct traffic left out, countries with their continent, cities with their country, device types and browsers, and on Independent Analytics Pro the UTM campaigns and tracked link clicks its paid tabs record. Visitor counts now match the plugin's own dashboard (a returning visitor counts once per range, not once per session), and the Overview day drill-down uses the same friendly referrer names.
- Independent Analytics Pro joins Licenses with paste-to-activate. The first Freemius-sold plugin with the full loop: paste the key on Extensions → Licenses, and Minn activates it through the Freemius code the plugin already ships, shows the plan's expiry (or lifetime) and activation count, re-verifies against Freemius on demand, and releases the license from this site when you deactivate. A refused key stores nothing. Every other Freemius-sold plugin still reads its license state generically; the same three helpers now make wiring another one a few lines.
- Forms cards chart the last two weeks. Every forms status card (Fluent Forms, Ninja Forms, Forminator, Flamingo, Everest Forms, SureForms, WPForms, Elementor, Formidable and CFDB7) now draws entries per day for the last fourteen days, with spam marked as its own series where the plugin tracks it, so a form that went quiet or a spam wave shows at a glance. Each chart buckets on the site's own days whichever clock the plugin stores its timestamps in.
- Bookings cards show the fortnight ahead. Amelia, LatePoint, Bookly, JetBooking and JetAppointments each draw a Next 14 days chart under the status rows: how many appointments or check-ins are booked on each day, with the ones still pending marked, so a busy Thursday is visible before it arrives. Each chart respects the same staff, agent or vendor scope as the card above it.
- Formidable and CFDB7 open with a status card. The two forms providers that still dropped you straight into the list now match their siblings: Formidable shows submitted entries with a seven-day count and the number of forms, CFDB7 shows unread entries against the total and its forms, and each card links to the plugin's own entries screen. Gravity Forms stays the one deliberate exception, since its depth lives in the entry workflow itself.
- Activity Log (Aryo) shows where each change came from. Activity Log 2.14 started recording whether an event came from the browser, the REST API, WP-CLI, WP-Cron, XML-RPC or the Abilities API, and which Application Password signed the request. Minn's Activity Log surface now carries that as a Source column and a Source filter beside the action tabs, with the password's name on the row and in the detail, so "was that a person or an integration" is one click. The column and filter appear once the plugin's own database update has run; until then the list looks as it did.
- Disable Comments joins the Spam page. Sites that close comments with Disable Comments now see a card for it beside the spam filters: how many comment, trackback and REST comment attempts it has turned away since it started counting, read from the plugin's own counter, with a link to its settings.
Improved
- Row dialogs read like cards. Opening a row that has no purpose-built detail (a backup archive, a filter, a suggestion) used to print the raw record: the encoded id as the title, field keys as labels, a URL spelled out across the dialog. The row's own name now leads with the surface underneath, labels read as words, links are links, timestamps show how long ago with the full date beside, and long values wrap instead of widening the dialog.
- The sidebar's Commerce and Tools groups have an order. Commerce leads with the store's daily four (Orders, Products, Customers, Coupons) and lists the add-on kinds after them by name, so Bookings, Gift cards and Subscriptions read the same on every site whatever mix it runs. Tools reads in three bands: what shapes the site (Templates, Field Groups, Site Options, Snippets), what routes visitors and mail through it (Search, Redirects, Email), then what keeps it running (Activity Log, Backups, Migrate, Performance, Diagnostics); a surface Minn does not know lands between the second and third bands. Gift cards also stop sharing the Products icon.
- Error reporting is always put back after the Breakdance workaround. A
fatal, or a request that legitimately used it, could leave deprecation
notices switched off for the rest of that request. - Two more descriptor routes are checked before the app is pointed at
them: a status card's route and a collection's import route. - The updater is pickier about where an update may come from. It now names
the published release rather than the repository, which is a meaningful
difference on GitHub. - Copying a post no longer builds objects out of stored values. Duplicating
a post decodes what plugins saved on it, and that decode no longer constructs
anything.
Fixed
- JetEngine content type rows are read without building anything out of what
they hold. A row in a custom content type can be created by a form on the
public side of the site, and Minn decoded the values stored in one in a way
that could construct whatever a stored value named. Opening the list now only
ever produces plain values, which is how JetEngine's own code reads the same
rows. - Two Jet screens ask the Jet plugins who may open them. Theme parts and
smart filters were open to anyone who can write a post, on the strength of a
check inside each plugin that only ever runs behind a stricter one. Both now
ask for what Crocoblock's own screens ask for, so an editor or a contributor
no longer reaches either. A smart filter carries the query a listing runs on,
so this is the difference between someone being able to stop the site's
filtering working and not. - Bricks settings stay with the administrators. Builder access is granted to
editors on plenty of sites, and it is a license to design pages rather than to
change what the theme does everywhere. These settings include maintenance
mode, which decides whether the public site is reachable at all, so they ask
for the same administrator Bricks itself asks for. Templates still go through
Bricks' own permissions, which is where those apply. - WP Migrate backups download through Minn's own door. They now stream
through the same nonce-checked door as every other backup provider, which asks
for the capability WP Migrate itself asks for, rather than linking out to the
plugin's own handler. - Gift card messages stay with the administrators. A message is written by
one customer to another, and WooCommerce Gift Cards shows it only to a site
administrator. Minn was showing it to any shop manager, having taken the same
care over the card codes beside it. - Two ways of inserting a block now park what they insert. Everything a
plugin or a pattern puts into the editor arrives inert and is woken up on
save, so nothing in stored markup can run while it is being placed. Most
paths already did this. Inserting from the slash menu or the block browser
did not. - Reads now ask what writes were already asking. WP Job Manager and the SEO
panel both check with the plugin whether you may change a field, and neither
asked whether you may see it. On a site that narrows who can view job
listings, an applicant's email address and the salary were readable by
someone the plugin's own API would have hidden them from. Squirrly was the
one SEO plugin of seven Minn never asked at all. - A booking list is never shown unscoped. LatePoint restricts what an agent
sees by location and service as well as by agent. If Minn could not get an
answer out of LatePoint, it showed everything; now it shows nothing, which is
what the other booking plugins already did. - Your own appearance and language settings need an account that can use
Minn. The routes that write them by user id accepted a subscriber writing to
their own account, which the same settings on your own profile did not. - Smaller repairs. BackWPup archives are checked against the real backup
folder before being sent, and its Download button only appears for people
allowed to use it. Redirects added through Minn are stored exactly as the
redirect plugin stores them, so a source with encoded characters matches.
Design library images stop matching an unrelated picture whose filename merely
contains the one being looked for. Gift card and spam provider settings only
accept the switches the provider offered. And the Weight column in Search
suggestions is finally a number. - Maintenance mode holds back the admin's own back door. The front end and
the REST API were covered; admin-ajax was not, so any plugin with a handler
that answers logged-out visitors kept serving the site's real content while
the holding page was up. That is the staging-before-launch case the feature
exists for. - Two Overview numbers stop counting work their reader cannot see. The
Products card showed the whole catalogue's draft count to marketplace
vendors, and the activity chart counted unapproved comments, spam and
WooCommerce order notes that the list behind it correctly hides. - The SEO panel disappears from content types you switched it off for.
Turning an SEO plugin's controls off for a content type hides them from
wp-admin for everybody; Minn kept offering the fields and accepting values. - An update is no longer checked against a hash that cannot be right. When
GitHub could not be reached the updater compared the download against the
manifest copy inside the plugin, which names a hash for the release it is
part of and therefore cannot be that release's own. A perfectly good package
was refused, blaming the download. It now says the check could not be made. - The server's directory layout stays out of form entry rows. A file-upload
answer carries the file's path on disk beside its address, and Everest Forms
and Ninja Forms printed both. - Pasting a license key the site would ignore is refused. Where a key is
pinned in wp-config it wins over anything stored, so activating a different
one spent a paid activation at the vendor for a key this site would never
use, and then reported success. This now covers every plugin Minn can
activate that reads such a constant, ACF PRO, Gravity Perks and Gravity
SMTP among them (Gravity SMTP honors two). - Deleting a CleanTalk spam account acts on the account you confirmed, not
one named in the request body. - The Elementor submissions screen goes when the license does. Elementor
builds that feature only under license; without one its own screen and
clean-up job disappear while the recorded entries stay in the database, and
Minn kept serving them. - The editor panels are back. Every panel disappeared in v0.37.0. ACF,
ACPT, Meta Box, Pods, SEO, The Events Calendar, WP Job Manager and Seriously
Simple Podcasting all left the editor sidebar at once, and nothing explained
why. A check added that release to stop a plugin pointing the app at another
site was reading a panel's address with the rules meant for a simpler kind of
address, and every panel failed it. Panels work again, and the check is now
stricter about the thing it was written to catch. - The database pages describe this install and no other, on every kind of
site. The rule that decides which tables belong here was rewritten in
v0.36.0, which fixed one kind of hosting and broke another. On hosting that
puts several sites in one database, a neighbour's tables could be listed and
read, their user accounts among them. The rule now covers both shapes, and
the System page's database card reads through the same one. - A stored link is held to the same schemes as every other link in the app.
An address typed into an ACPT link field was saved exactly as written, so an
address that runs code instead of going somewhere was stored and later
printed into the page. It is refused now, and refusing it leaves the address
that was already there alone. - A picture no longer disappears when somebody else saves the post. Fields
holding an image nobody but its owner may see were being emptied by an
ordinary save from someone else, because refusing an image and clearing one
were the same answer. Clearing a field still clears it; a refusal now leaves
the picture where it is. - Reading a linked post or person back asks the same question as choosing
one. The pickers that offer posts and accounts withhold other people's
unfinished work; reading a saved choice back did not, so a title and its
status could be recovered by writing an id in by hand. Both directions agree
now. - Retyping or moving a code snippet is treated as writing code. Changing
what a Header Footer Code Manager snippet is, or where it runs, could put
saved code somewhere the person changing it was not allowed to put code. - Two routes now ask which thing, not just what kind of thing. Sending a
password reset asked whether you may edit an account, which everyone may do
to their own, and regenerating thumbnails asked only whether you may use the
tool and not which picture. - The setup route no longer answers questions about what is installed. It
told an unknown plugin apart from one somebody may not configure, which let
any signed-in account learn which plugins are here and which are unconfigured.