v4.0.0

Major release\n\n- Adds the CRM Telephony domain module foundation and authenticated API.\n- Adds team-scoped numbers, queues, routing configuration, call logging, media, transfers, dispositions, audit records, and idempotent call writes.\n- Preserves existing telephony integrations and call-manager behavior.\n\nValidation: All discovered modules are valid., .

v3.0.0 — Wayfinder CRM modules and Zernio tenancy

Major release

This release introduces the next Wayfinder CRM capability set across independently owned domain, API, Filament, and Livewire packages.

Included

• Lead Qualification
• Work Management
• White Label
• Web Intent
• Usage Wallet and Rebilling
• Unified Conversations
• Territories and Ownership
• Templates and Snapshots
• Team-scoped Zernio profiles with supported platform account isolation and publishing safeguards
• Team invitation privilege hardening

Verification

• Module validation passes.
• Focused module tests pass.
• PHPStan passes for the new modules.
• Full repository suite passed before the final pause request; the final Templates/Snapshots run was in progress when implementation was paused.

No GitHub issues were closed.

v2.0.1

Security hardening from an OWASP audit.

• SSRF guard on OIDC discovery (#600) — https-only + block localhost/private/reserved/link-local before every outbound fetch; closes an SSRF that could exfiltrate the client_secret via a hostile token_endpoint.
• CORS allowlist + SSO route throttling (#601) — no more '*'-with-credentials default; SSO/SAML routes rate-limited (30/min/IP).
• Removed a dead unauthorized DocumentController (#602) — latent IDOR (unrouted, no authz).

Full suite 1153 passed / 1 skipped. PHPStan 0-new. Pint clean. No migrations.

v2.0.1-rc.3

Security: remove dead unauthorized DocumentController (#602).

v2.0.1-rc.2

Security: CORS allowlist + SSO/SAML route throttling (#601).

v2.0.1-rc.1

Security: SSRF guard on OIDC discovery (#600).

v2.0.0

Feature-complete milestone. PII encrypted at rest, and the full scoped roadmap is done.

PII encrypt-at-rest (Security) — #596, #598

The masked PII columns are now encrypted at rest:

• Contact.email — encrypted, with a deterministic email_hash blind index that carries equality lookups and uniqueness (encrypted ciphertext can't be uniquely indexed). Email search is now exact-match.
• Contact.phone_number + Company.phone_number — encrypted; phone search dropped (no blind index).

Money columns are intentionally left plaintext — they need database sort/range/aggregation for forecasting, and masking already hides them from the free role. An idempotent backfill encrypts existing rows on upgrade.

Since 1.0.0

Customer portal; SSO — OIDC and SAML, login and single-logout; per-team role enforcement (F4); attribute-based access control (territory scoping + field masking + PII encryption); detail views and CSV exports across the CRM.

Operational: run migrations on upgrade (email/phone rows are encrypted in place). APP_KEY rotation orphans the email blind index + ciphertext — re-run the backfill after a rotation.

Full suite 1141 passed / 1 skipped. PHPStan 0-new. Pint clean. MySQL-verified.

v2.0.0-rc.2

PII encrypt-at-rest slice 2: Contact + Company phone_number encrypted (search dropped).

v2.0.0-rc.1

PII encrypt-at-rest slice 1: Contact.email encrypted with an email_hash blind index.

v1.17.0

SSO single-logout — OIDC and SAML.

• OIDC RP-initiated logout (#592) — logout redirects to the IdP end_session_endpoint (id_token_hint + post_logout_redirect_uri) so the IdP session ends too; captured at login, applied via a Logout-event listener before session invalidation. IdPs without an end-session endpoint fall back to local logout.
• SAML SP-initiated single-logout (#594) — a OneLogin LogoutRequest (NameID + SessionIndex from login) targets the new idp_slo_url; a /saml/{team}/sls endpoint handles the IdP LogoutResponse; SP metadata advertises the SingleLogoutService.

G2 SSO is now complete end-to-end for OIDC and SAML — login and logout.

Operational: run migrations (saml_connections gains idp_slo_url); set the IdP Single Logout URL to enable SAML SLO.

Full suite 1133 passed / 1 skipped. PHPStan 0-new. Pint clean. MySQL-verified.