v2026.4.9

Release v2026.4.9

This release changes the database. Back up the site before updating; the upgrade runs from the panel and every step can be run again safely.

🎨 Visual Page Editor

• Component panel: hovering a block opens a card that says what it does, the HTML it writes and its English name; grid items and Bootstrap components carry a small drawing. Search also knows English and HTML names: "link", "button", "a" or "div" find Link, Button and Div, and Turkish words typed without accents are found too.
• Links inside text: the links in a paragraph or heading can be edited (address, target, classes, rel) under "Links in the text", split out into their own element right after the text, or unlinked. A paragraph made only of links (a row of buttons) turns into separate link elements with "Split into elements", and HTML import does the same. The Layers panel lists these links under their paragraph.
• Loop areas can be dropped into a div, section or list (ul, ol, tbody), not only above or below them; dragging a loop area onto one of its own children is no longer highlighted as a target.
• Form List widget: the default layout puts the records side by side as cards (three on wide screens, two on medium); changing the column width applies to every record.
• Faster editing: designs built with their own CSS (Bootstrap 6 and other large frameworks) no longer slow the canvas; on large pages element toolbars are built only when needed; Save and Publish write only the pages that changed.
• Fixes: elements dropped above or below an item inside a widget land where they are shown; bindings to hyphenated form fields (for example publish-date) show their value; details/summary blocks (FAQ lists) and Bootstrap 6 nav-overflow menus behave on the canvas as on the page.

🧩 Installation

• The installer now installs the store templates (Online Store, Boutique, Bookshop): they could be picked at the design step, but the installation stopped with "Template not found".
• Sites installed at the same time on one MySQL server no longer stop each other: an installation locks only its own database.

🌐 Multilingual Sites

• The Browser AI (Gemini Nano) engine falls back to the browser's translation model for languages the model does not write, such as Turkish.
• "Update translations" no longer times out on large sites: shared parts (header, footer, menus) are scanned once, and long scans run in steps with progress on screen.
• Search engines: a page in another language now stores the answer it gives search engines, and sitemap.xml and hreflang both follow it; a noindex language page is no longer listed as an alternate. A machine translation that comes back identical to its source (a name or abbreviation such as SEO) no longer keeps the whole page out of search engines.
• Language RSS feeds link to the pages in that language and declare their language.
• "Approve all" in Translations also appears when only suspicious machine translations are left, and offers to approve those as well.

🔎 SEO & Sharing

• sitemap.xml reads as a numbered list in the browser, with dates, priorities and language versions; search engines read it as before. The home page is listed once, at the site root.
• Product, category and blog post pages built in the visual editor have their own canonical address, title, description and share image (from the product or category SEO fields, or its name and description), and are listed in sitemap.xml.
• Template blog forms come with RSS roles (Title, Description, Media), so posts take their own title and description and the blog list offers an RSS feed; the update gives these roles to existing template blog forms that have none.

⚙️ Control Panel

• Help for every screen: a "?" button in the header opens the screen's documentation on pinegrap.com in a new tab, in the panel's language; list screens open the section of the selected filter. The account menu's Help row and F1 do the same, and the Site Settings dialog has its own help for the open category.
• Fix: "Delete All Notifications" now removes Workspace notifications (mentions, task assignments, channel invitations), which could not be deleted one by one either; notifications addressed to someone else are left alone.

v2026.4.8

Release v2026.4.8

This release changes the database. Back up the site before updating; the upgrade runs from the panel and every step can be run again safely.

🎨 Visual Page Editor

• Three new design templates: Playground, Bookshop and Boutique join Hello Pinegrap and Online Store. Every built-in template now ships a Help Centre with site-wide search, account, staff and blog pages with its own sample posts, an inbox, a language switcher and a shared account bar. "Choose from Template" is wider, with shorter cards.
• Search sections: Any element can be marked as a search section, with extra topics that do not appear on the page. A site search hit opens the page at that section, highlights the searched words and opens a closed accordion answer or details block. Sections are listed in the page's structured data (WebPage → hasPart).
• AI summary on blog posts: buttons that open ChatGPT, Claude, Perplexity or Google AI with the post's address, and an on-device summary through the browser's built-in AI (desktop Chrome and Edge 138+). Nothing is sent to a server.
• Turn a design into a template (Settings › Design), copy or move a page to another design, and pick the design when adding a page.
• Page tabs can be reordered and grouped like browser tab groups.
• Live preview: while the preview window is open, edits to content, style, theme, CSS and JS show up in it.
• Animations button: page animations are paused on the canvas by default and can be played from the canvas toolbar. Heavy-animation pages no longer slow the editor, and scrolling the canvas no longer re-measures every element.
• Shared components can contain other shared components and system widgets; loops are refused.
• Account Security widget: Google connection, remembered devices and two-step verification for members.
• Theme picker: five new looks (Editorial, Technical, Organic, Luxury, Glass) and five new colour palettes. Theme switchers no longer leave their own code in the page.
• Custom-framework designs: the Options panel shows only settings that write style directly; Bootstrap-only options and theme variables are hidden. Bootstrap icons are edited as icons in every design.
• Fixes: the canvas of custom-framework designs and Bootstrap 5 columns now match the live page; object position, icon size and background gradient stay in sync with the style attribute; form messages appear next to their own form when a page carries several widgets; list widgets render their repeated card as on the page; Form List / Form Item pages provide RSS again; Ctrl+wheel zooms the editor, not the browser; a home page sent to the recycle bin stops being the home page; the language switcher menu no longer opens off-screen on phones; template products are linked to every shipping zone.
• Security: deleting a design is checked against the user's role on the server.

🧾 ERP (Pre-accounting)

• Quotes: copy a quote, customer signature on screen or tablet, expiry notifications, an "Open quotes" box on the dashboard, filter by account, audit trail and webhooks for quote events; an invoice made from a quote links back to it, and a quote whose invoice is cancelled can be invoiced again.
• Faster forms: searchable account lists and a quick "new account" dialog on invoices, quotes, delivery notes, payments and cheques; copy an issued, cancelled or draft invoice.
• Accountant package link opens in a dialog with a QR code.
• One toolbar order on every ERP register; due dates and supplier invoice numbers are kept when a form is reloaded; accounts with the same name can be told apart; the export screen works on servers without GLOB_BRACE.

💬 Workspace

• Threads, scheduled messages, approval requests, read receipts and channel templates.
• Tasks: time tracking with a timer, a time-spent card per channel, a draft invoice from billable time (with ERP), task dependencies and a channel board view.
• Calc and tables: groups, hidden and blank rows, named values shared within a message or note, IF / IFERROR / AND / OR / NOT and more functions, ready-made templates, and a formula menu in tables.
• Notes: undo and redo, saved versions, and My Notes in the Workspace menu.
• Automations are built as workflows (When → Only if → Do → Afterwards) with new triggers ("Someone joins", "Something happens on the site") and a "send people their tasks by email" action; record watching for orders, products and contacts.
• Sharing: share a channel by link (read or read-write), QR codes for guest links, one search box everywhere (Ctrl+K).
• Assistants: Pinegrap AI or Claude can change many records at once; bulk delete stays off until allowed in Workspace Settings. Pinegrap AI uses the subscription key from Settings › General, no separate licence key.

🌐 Multilingual Sites

• New translation engine "Browser AI (Gemini Nano)", running in Chrome on the editor's own computer; newly added languages start with the free browser translator.
• "Clear translations" in the Translations menu; removing a language also removes its translations.
• Fixes: the software's own texts no longer enter translation in languages without a language file; "Update translations" no longer times out on sites with thousands of texts.

🔐 Sign-in, Accounts & Security

• Two-step sign-in with an authenticator app and recovery codes; it can be required from a chosen role upward (Settings › Security). Signing in with Google does not skip it. Secrets are stored encrypted with the site's encryption key.
• Cookie consent for visitor pages: a small notice in the visitor's language; analytics, visitor statistics and sales tracking wait for consent. Settings › SEO › Cookie Consent.

📧 Email

• Password reset, order, form and comment emails go through a mail queue when the scheduled job runs; Settings › Jobs › Mail queue lists pending, sent and dropped mail.
• Campaigns retry failed recipients instead of counting them as sent, and commercial campaigns carry List-Unsubscribe headers.

💾 Backups

• One zip archive per week, a retention setting, and an optional remote copy to FTP / FTPS or S3-compatible storage after each automatic backup. Backup Manager lists the archives.

⚙️ Panel, Software & Database

• Repair Software (Settings › Jobs) downloads the current package of the site's channel and restores the product files; database upgrade steps can be run again from the same screen. The Download Assistant no longer repairs.
• Tables still on MyISAM move to InnoDB; a new Database Engine screen and a System Status row show what is left. The Performance Log records queries per request.
• Scheduled jobs run with their own locks; uncaught errors and fatal PHP errors go to the software's error log.
• Panel: a fuller dashboard greeting, a tidier Orders entry, full-width toolbars on contacts and submitted forms, QR codes for short links, and edit, view and print screens that stop early when the record is missing.

🔌 External API

• Device sign-in for roles that require two-step verification, ERP quote signatures, Workspace threads, scheduled messages, read receipts, note versions, task time entries and dependencies. The OpenAPI document gives DELETE /webhooks/{id} its real 204 response.

v2026.4.7

Release v2026.4.7

🎨 Visual Page Editor

• Draft pages: New pages — a new tab, a page copy, template or imported pages, a new design's first page — start as drafts. A draft has two buttons: Save keeps it as a draft, Publish puts it on the site. Drafts live in a private Drafts folder: visitors cannot open them, and they stay out of the sitemap and site search. A published page can be taken back to draft from its tab menu, the menu next to Publish or Page Settings; a whole design can be unpublished and republished at once, and the home page always stays published.
• Publishing state at a glance: The designs list shows each design as Published, Draft or Partly published, with one-click unpublish / publish (refused while someone has the design open). Draft pages are marked in the file manager.
• Language Switcher Button: A Bootstrap dropdown in the component palette that lists the site's languages and opens the same page in the chosen one; style, outline, size, name or code, icon and alignment are set in the Options panel.
• Fixes: Selecting an element or toggling layers no longer marks the page unsaved; Ctrl+S on the canvas reaches the editor instead of the browser's save dialog (Save on drafts, Publish on published pages); unsaved changes to a widget or shared component survive switching tabs, so template widgets no longer come back empty; removing a font style line in the Attributes panel no longer deletes the first attribute; the "Online Store" template has its own thumbnail, and its "Go to cart" link opens the template's own cart page (1.0.1).

🌍 Multilingual Sites

• Form records in translation: Form list and form item widgets can include their records (for example a blog post's title, summary and body) in the Translations screen and translate them on language pages.
• Translation in the editor for more people: The Translation section of the Options panel is open to site managers and to users who may edit the page's content; text they cannot edit elsewhere is shown read-only, because a text has one translation everywhere.
• Interface texts: For languages without a language file, the software's own wording (comment buttons, labels, messages) can be translated in a new group of the Translations screen.
• Fixes: Catalog "View / Expand" buttons and the page's comment label are translated; placeholder text such as "Lorem ipsum" stays out of translation.
• Security: The text search of the Translations screen and of GET /translations/strings?search= now escapes the searched text.

🌐 External API

• POST /translations/refresh re-reads page texts and reports how many await translation per language; POST /translations/status reviews, machine-translates or resets translations (with all for "approve all").
• Glossary endpoints: GET / POST /translations/glossary.
• GET /translations/strings filters by catalog or forms and returns where each text is used, with the previous wording and its translation when the text changed.
• The OpenAPI document now includes the core object definitions, field descriptions, list item types and limits, defaults and 400 / 409 / 503 responses, and passes OpenAPI validators (Postman and Swagger accept it).

🛡️ Built-in Firewall & Bot Control

Every Pinegrap site ships with its own web application firewall — nothing to install:

• Signature scanning for SQL injection, XSS, path traversal, remote code execution and protocol abuse; global, sign-in / checkout and API rate limits; concurrent-request caps and automatic temporary bans; IPv6-aware (/64) allow and block lists.
• Search-engine crawlers are verified by reverse and forward DNS, AI assistants against their published IP ranges; scrapers, AI training crawlers and attack tools can be turned away.
• Starts in monitor mode so you can review the log before blocking, and fails open — a firewall error never takes the site down.

🧭 Panel

• Ctrl+S no longer saves the account menu's profile prompt instead of the screen's own form.

⚙️ Upgrade notes

• This release includes a database schema step (Drafts folder and draft page records); run the upgrade from the panel after updating.

Full Changelog: v2026.4.6...v2026.4.7

v2026.4.6

Release v2026.4.6

🌍 Multilingual Sites

• Language directories: Pages built in the visual editor are served in other languages from a virtual directory — /about-us becomes /en/about-us with the same design and translated text. Nothing is copied; files, images and CSS/JS keep a single address.
• Translations screen: Pages with their coverage, source and translation side by side, a "reviewed" mark, CSV export and import, and "Approve all" for machine translations. "Update translations" sends only the texts that have no translation yet; a text used on forty pages is translated once.
• Engines: Google Cloud Translation (with your own API key, in the background), the browser's built-in Translator API (no key), Pinegrap AI and Claude, or manual translation. Each language has its own engine, fallback and search-indexing policy. Translate on save sends new and changed texts as soon as a page is saved.
• Glossary: Terms with their fixed translation, and names (brands, products) that must stay as they are — respected by every engine.
• More than pages: Product and product group names, descriptions, attributes and options; form titles, labels, options and messages; texts typed into cart, catalog and search widget settings; custom HTML blocks.
• In the editor: A Translation section shows, edits and approves the selected text's translations; a new Language Switcher widget lists the site's languages.
• Visitors stay in their language: Forms and orders sent from a language page keep their error messages, redirects and e-mails in that language; the administrator's e-mail stays in the site's language. Prices and dates use the language's number and date format.
• Search engines: sitemap.xml lists language addresses with hreflang alternates, pages hidden in robots.txt stay hidden in every language directory, structured data uses the language address, and site search works within the language.
• External API: New translations module (translations:read / translations:write) for languages, strings, pages, bulk writes and translation jobs.

🎨 Visual Page Editor

• "Online Store" template (1.0.0): A shop front whose home page shows four categories in four layouts, an "All Categories" menu with images, a filtered shop page, one product page for every product, cart, checkout, order summary and account pages.
• SVG element: Drawing code embedded as it is; currentColor follows the surrounding text colour.
• Smarter HTML / ZIP import: Repeated sections across pages (header, footer, menu, bands) are offered as shared components; inline <svg> stays on the page; the importer asks "Bootstrap 5" or "Custom" first and keeps a custom project's own Bootstrap / jQuery; <script type="module"> files load as modules.
• "Say hello to Pinegrap" 2.4.1: The shop is bound to the top product group, so categories open in place and a product with variants is a single card.

🛒 E-commerce

• Variant price rules: A variant's price can be worked out from its options — an attribute sets the price, multiplies it, or adds an amount or a percentage (percentages compound).

🩺 System & Operations

• CA bundle check: System Status shows a red row when HTTPS certificates cannot be verified and CURL_CA_BUNDLE is empty or wrong; "Fix" points it at the bundled data/cacert.pem. The installer writes the line itself when needed.
• Minimum PHP is now 7.1: the installer and the System Status card flag older versions.
• Scheduled work: job.php runs Workspace scheduled actions on every pass (run it every minute); recurring tasks are queued every five minutes; the cron list shows sub-hour intervals correctly.

🔒 Security

• The config editor screen (Settings → Infrastructure → Edit Config) is removed: it allowed an administrator to re-enable PHP regions and read the database password. config.php is edited by hand; software clean-up deletes the old file.
• Design import applies the file manager's upload rules: server files such as .htaccess and executable extensions are not imported.

🛠️ Fixes

• Visual editor: Pages no longer turn "unsaved" just by opening them or switching tabs; form error messages appear inside their form instead of the account bar, and the typed e-mail stays in the login box; on variant products, name, price, image and the item added to the cart follow the selected options; Ctrl+G edits the page that is open; elements sized with h-100 draw on the canvas as on the site.
• Panel sign-in on sites built with the visual editor (including template installs) finds the login page instead of an unstyled fallback form.
• Dashboard: The Sales Map recognises a country row whose code was changed (e.g. "TÜRKİYE"); online users without a photo show their initials instead of "?".

⚙️ Upgrade notes

• This release includes database schema steps (translations, variant price rules); run the upgrade from the panel after updating.
• Run job.php every minute so webhooks and scheduled actions go out on time.

Full Changelog: v2026.4.5...v2026.4.6

v2026.4.5

Release v2026.4.5

💬 Workspace

• Guest rooms: Talk to a customer or supplier who has no account. They join through a one-time or time-limited link and get their own room with tables, images, files and polls, where they can reply and react.
• Scheduled actions: Leave a job to run on its own — once, every few minutes, hourly, daily, on working days, weekly, monthly or yearly — with conditions (a record's value, counters such as overdue tasks or new orders) and up to five chained follow-up steps.
• Channel management: Nested, colour-coded channel groups with drag and drop, public ↔ private switching, 20 channel colours, conversation versions and pinned messages.
• Messaging: Reply to or forward several messages at once, titled blocks that can be pulled into other conversations, "delete for me" / "delete for everyone", "Seen by", edited labels and a jump-to-latest arrow.
• Tasks & calendar: Due times with e-mail reminders, priority filters, an "Upcoming urgent" view, and multi-day tasks drawn as bars on the work calendar.
• Customers: A channel's customer can be a contact, a site user or an ERP account, shown with its linked records.
• Pinegrap AI (@ai): Call Kodpen's model in channels and notes; it suggests task and record changes the asker applies with one click. Illustrated steps for connecting Claude to channels, a guided tour, and initials avatars for people without a photo.

🎨 Visual Page Editor

• Themes: Every Bootstrap 5 design wears a look (corners, shadows, lines, type, buttons, cards) and a colour palette, chosen independently.
• Frameworks: Start a design with Bootstrap 5 or as a fully custom design.
• "Say hello to Pinegrap" template (2.4.0): A complete starter site — home, about, services, blog, a contact page whose messages become conversations, sign-in and registration pages, inbox and shop pages — built from shared components (navbar, footer, call-to-action band, staff bar). Blog search; shop search, sorting and browsing with categories and a side filter panel (price, stock, product attributes); the About page team comes from the staff directory.
• Form List View filters: Filter records by a form or system field and a condition, with dynamic values (today, a number of days ago, the signed-in visitor, their e-mail) worked out on every visit; the canvas preview is filtered too.
• E-mail pages: Form notifications and replies, comment e-mails and order receipts are designed in the editor.
• New system widgets: Error Page, Login Area and Cart Link.
• Records on the page: Per-record comments on form item views, edit pencils for authorised users, and new comment options (publish without approval, show dates, members only).
• Canvas & preview: Live records on the canvas, server-rendered widgets in preview, data-bound areas drawn at their real size, bulk delete of unused widgets and shared components, and "Publish" as the main action (Ctrl+S).
• Assistant: Describe how a selected element or the whole page should change and preview the proposal in the editor before applying it.

🛒 Checkout

• Required fields are marked up front; the shipping address comes before billing.
• ID / tax number and tax office fields, stored on the customer record for the ERP and e-document integrations.
• "My billing address is the same as my shipping address".
• Saved addresses for members (address book and past billing addresses).
• A clear notice, with the reason, when no shipping method serves an address.
• A plain one-line item summary for cart, checkout and order summary layouts.

🚀 Installation

• New Site Design step in the setup wizard: install with a ready-made template (recommended and preselected), pick its look and palette with a live preview. The standard starter site remains available.

🔗 Short Links

• One-time links that stop working after the first visit (messaging app previews do not use them up) and time-limited links (1 hour – 90 days, extendable).

🧭 Panel Menu

• Redesigned two-tone, animated icons; the Dashboard icon shows the site's clock and the Calendars icon today's date. Menus and Regions moved under Page Styles.

🌐 External API

• Team device sessions for mobile apps, notification and web push endpoints.
• ETag / If-None-Match (304) and fields= on every read endpoint.
• New design, ERP (offers, cheques and notes, stock levels and movements, stock counts, aging, VAT report) and Workspace endpoints; updated_since / active_since filters.
• An API app owner's e-commerce, contact and form permissions are now read exactly as the panel reads them.

🩺 System Status

• File integrity is verified against this release's tag on GitHub, independent of line endings (Windows clones, FTP ASCII uploads). When no reference can be fetched the check shows a yellow "could not verify" instead of a red alert.

🛠️ Fixes

• Checkout: With "billing address is the same as shipping" ticked, Complete Order no longer rejects the billing fields as required.
• File Manager quick look (#186): Pages and PDFs fill the window instead of a small frame; large images fit the window and no longer cover the toolbar buttons.
• Visual editor: Images and icons inside links and buttons now render on the live page in shared components (such as the navbar logo) and system widgets, and the badge component renders there too; deleting a link's text no longer brings back an "Image" placeholder; canvas width controls and resize handles are hidden on phones and touch tablets.
• Visual editor (more): Adding to cart on a product page without a next page keeps the visitor on the page; empty multi-line fields no longer contain whitespace; Ctrl+S always publishes instead of leaving the editor; classic edit mode no longer draws on designer pages.
• Orders: Order summary and receipt show the product SKU instead of image slider HTML; an error shared by two fields is listed once.
• Settings & e-mail: The cron job selection is saved in full; the Commerce tab opens with e-commerce disabled; SMTP works on port 465 (SSL); DKIM-signed bodies survive relaying.
• ERP: A rejected invoice completion form keeps what you entered.
• IIS: web.config keeps integration.php out of the catch-all rewrite rule.

⚙️ Upgrade notes

• This release includes database schema steps; run the upgrade from the panel after updating.
• Cron jobs switched off by the old truncation bug need to be ticked and saved once after the update.

Full Changelog: v2026.4.4...v2026.4.5

v2026.4.4

What's Changed

Release v2026.4.4

📊 Dashboard

• Sales Map Card: Visualize completed orders on a map by billing address (world & country/city views, turnover/order stats, and date filters).
• Firewall Card: Added status indicator and quick settings button when the firewall is disabled.

📁 File Manager

• Desktop-Style UI: Overhauled file manager with tree view, drag-and-drop, inline rename (F2), undo (Ctrl+Z), batch uploads, and access-type color coding.
• ERP Files: Dedicated read-only section for ERP documents (sales/purchase invoices, e-Documents, delivery notes, drafts) with quick search and navigation.
• Batch Rename: Batch rename files using find/replace, prefix/suffix, and sequence numbering rules with instant live preview.
• Utility Tools: Added "Where is it used?" inspector, custom list columns, quick filters (unoptimized, >1MB, missing alt, SEO score, etc.), resizable grid tiles, Spacebar quick look, and a Recycle Bin for restoration.
• Image & Archive Utilities: Right-click image optimization, WebP conversion, zip compression/extraction, system backup management, and dedicated user share lists.

🎨 Visual Page Builder

• Tabbed Editing: Work on multiple design pages simultaneously in a tabbed interface with shared styles, themes, and scripts.
• Real-Flow Forms & Widgets: Auth widgets (Login, Register, Password Reset) are now connected to real system handlers and address book fields.
• Live Collaboration & Locking: View avatars of co-editors in real time with automatic page-locking to prevent edit conflicts.
• New System Widgets: Account pages (Profile, Password, Address Book), Search Results, Calendar View, Event View, and updated Shopping Cart widgets.

🛠️ Toolbar

• Unified Page Info Panel: Access SEO scores, page attributes, visit stats, last edited info, and quick actions within a single expanded panel.
• Redesigned Interface: Sleek single-row icon bar, centered quick search (Ctrl+K), keyboard shortcut toggles (Ctrl+I), and native dark/light theme support.

🛒 E-Commerce: Campaigns

• Single-Screen Campaign Builder: Streamlined workflow combining Offer, Rules (If), Actions (Then), and Options into one unified interface.
• Advanced Campaign Conditions: 14 ready-to-use templates, tiered cart discounts, product group targeted discounts, and "New Customer" eligibility rules.

🏷️ E-Commerce: Products & Catalog

• Per-Product Tax Rates: Set individual tax (VAT) rates per product, overriding region-wide defaults.
• Inline Catalog Editing: Edit price, stock, and short descriptions directly inside the catalog list view.
• Updated Catalog UI: Rebuilt using the File Manager interface, offering Excel (.xlsx, .ods) import and automated image optimization limits on upload.

📦 E-Commerce: Orders

• Rebuilt POS (Local Sales): Fast, non-reloading barcode scanner mode, Cashier/Document views, shortcut keys, and real-time stock validations.
• Bank Transfer Tracking: Orders paid via bank transfer now default to "Pending Payment" status with configurable auto-cancellation rules.
• Unified Formatting: Consistent currency and numeric display rules across all store pages, emails, panel reports, and ERP entries.

🔌 Marketplaces

• n11 Integration: Connect store accounts, map product categories/attributes, sync price and stock changes, and automatically pull marketplace orders.

🌐 External API

• New API Framework (integration.php): Enhanced secure access with granular permissions per API key, secret keys, IP whitelisting, and rate-limiting.
• Extended Endpoints: API endpoints for full product/variant creation, real-time Webhook event notifications, and X-Dry-Run test execution support.

💼 ERP (Accounting & Invoicing)

• Built-in ERP Module: Full-fledged ledger system with Customer/Supplier accounts, account statements, Cash/Bank/POS management, and Reconciliation letters.
• Invoices & Delivery Notes: Convert orders into invoices and delivery notes with single-click actions, manual entry, draft saving, returns/cancellations, and PDF exports.
• e-Document (e-Invoice / e-Archive) Integration: Native Logo İşbaşı integration, GIB registry lookup, pre-flight data validation, and batch submission.
• Aging Reports & Reminders: Invoice aging reports, automated overdue payment alerts for managers, and customer email payment reminders.
• Multi-Currency Support: Issue invoices and manage customer balances in USD, EUR, GBP, etc., with automatic daily exchange rate tracking and currency variance settlements.

Also:

• Fix/api handover cleanup by @erdaltyy in #6
• Add read-only offers endpoints to the external API by @claude[bot] in #7
• Add the API category to Site Settings by @claude[bot] in #8
• ERP: write the VUK 509 internet sale fields on invoices by @claude[bot] in #2
• Docs: record the ERP invoice PDF and VUK 509 changes in CLAUDE-tam.md by @claude[bot] in #5
• Send list parameters as arrays from the API documentation console by @claude[bot] in #10
• Fix Card data: mcrypt-only encryption, plaintext PAN masking in print_order by @claude[bot] in #11
• Fix CSRF: mass delete/merge on GET and Cloudflare POST actions without token check by @claude[bot] in #12
• Fix api.php: anonymous actions, loose CSRF token compare, inverted designer role check by @claude[bot] in #9
• Fix ORDER BY direction taken raw from ?order= / session in 15 list screens by @claude[bot] in #13
• Havale siparişleri için ödeme bekleyen durumu ve süreli otomatik iptal by @claude[bot] in #24
• SMTP/Private Label ayar ekranları config.php'de komşu satırları silmesin by @claude[bot] in #25
• Fix system-layout order tax read from unselected column and broken catalog search field names by @claude[bot] in #14
• Fix fatal errors: undefined function/constants, TypeError, queries against non-existent tables/columns by @claude[bot] in #15
• Fix Stored XSS: visitor/shopper-submitted form data rendered as trusted HTML by @claude[bot] in #16
• Fix Checkout: payment method allow-list, Iyzipay callback amount/order verification, shipping method eligibility by @claude[bot] in #17
• Fix Order id / order number injected raw into SQL (front-end order screens, address book, ShipWorks) and unauthenticated order view by @claude[bot] in #18
• Fix anonymous inputs reaching privileged paths: change_password oracle, Host header in reset mail, notification XSS by @claude[bot] in #19
• Fix Designer area: posted file names used as paths, manager access to designer regions, custom_php nodes from lower roles by @claude[bot] in #20
• Fix Panel save handlers persisting wrong or empty values by @claude[bot] in #21
• docs: degisiklikler.md girdileri — #9, #11, #12, #13 by @claude[bot] in #22
• Report queued deliveries and the last error on the webhooks list by @claude[bot] in #23
• Add a session-less API console at integration.php/docs by @claude[bot] in #26
• Mozilla CA kök sertifika paketini güncelle by @claude[bot] in #27
• Güvenli Mod, HTTPS görülmeyen istekten açılamasın by @claude[bot] in #28
• Sistem Durumu: CA sertifika paketi yaşı kontrolü by @claude[bot] in #29
• Bakım ve Araçlar: CA sertifika paketini güncelle by @claude[bot] in #30
• Türkçe lang() anahtarları, api_docs favicon ve body class düzeltmesi by @claude[bot] in #32
• Complete a missing file extension from the address or the content in POST /files by @claude[bot] in #33
• api.php: require session and CSRF token for update_dashboard_widgets by @claude[bot] in #74
• Guard USER_* constants on visitor-reachable account and folder view widgets by @claude[bot] in #76
• get_file.php: never serve the DKIM private key by @claude[bot] in #77
• Stop content screens from acting on a missing record id by @claude[bot] in #79
• Silence PHP 8 notices in the normal content flow by @claude[bot] in #85
• Reject zero and non-numeric cart quantities; fix billing street in order preview layouts by @claude[bot] in #86
• Close the missing role gates on delete_key_codes, toolbar, migration and edit_page by @claude[bot] in #89
• Reject malformed date and id input before it reaches mktime() and SQL by @claude[bot] in #92
• Guard null reads on the order screens and checkout flow by @claude[bot] in #93
• Fix PHP 8.2 deprecated string interpolation in my...