v2.0.0-m12-alpha-2.7

What's Changed

Versioning note: This release has been renamed from 2.0.0-m12-rc2.7 to 2.0.0-m12-alpha-2.7 to better reflect the current pre-release stage.

Billing & Pricing

• Fixed saving empty billing cycles and resolved NaN% display issues on free products (#218).
• Re-added the DKK currency option (#233).

DiscordSSO

• Improved Discord SSO registration behavior and added support for linking Discord accounts to existing users (#227).

Jguard

• Reimplemented JGuard to improve access control and account protection (#219).

Email System Improvements

• Added a manual email verification option (#229).

• Decoupled the email registration setting from Discord SSO registration (#221).

  Custom Emails:
  - Added an email template viewer (#223).
  - Added a Blade-based email template editor (#224).
  - Implemented the .custom format for customized email templates (#225).

User Experience & Account Management

• Added a logout button to the suspended user screen (#232).
• Improved suspended account messaging (#233).

Build & Tooling

• Upgraded Vite from 4 to 5.

Bug Fixes

• Fixed JGuard save/update synchronization issues (#230).
• Fixed an issue where custom email templates were not being used when sending email (#234).
• Fixed the email footer support address to use the configured reply-to setting (#222).
• Registered the forgotten /auth/discord/link-choice route in AuthenticationRouter (#231).
• Fixed email verification links (#220).

Full Changelog

v2.0.0-m12-rc2.6...v2.0.0-m12-alpha-2.7

v2.0.0-m12-rc2.6

What's Changed

• Propagate live coupon state to all checkout payment flows by #212
• Security hardening for checkout, billing, webhooks, and logging #213
• Fixed an rc2.5 billing-cycle bug where the selected billing cycle was not always applied correctly during checkout #213

Security Notes

This release candidate includes multiple security fixes across checkout, billing, request validation, webhook trust boundaries, and sensitive logging.

Severity Summary

ID	Severity	Category	Title
CVE-LOCAL-2026-0001	Critical	Authorization / Payment Integrity	Stripe paid checkout could fulfill the wrong order due to intent/order mismatch
CVE-LOCAL-2026-0002	Critical	Privilege Escalation / Input Injection	Billing provisioning accepted hidden or admin-only egg variables from user-controlled input
CVE-LOCAL-2026-0003	Critical	Sensitive Data Exposure / Logging	Sensitive admin settings could be written to activity logs in plaintext
CVE-LOCAL-2026-0004	High	Authorization / RBAC Enforcement	Admin billing pricing and cycle endpoints lacked explicit role-permission enforcement through typed FormRequests
CVE-LOCAL-2026-0005	High	Authorization / RBAC Consistency	Related admin billing donation listing endpoint lacked explicit request-based permission enforcement
CVE-LOCAL-2026-0006	High	Input Validation / Request Hardening	Client server group and ticket write endpoints accepted unvalidated payloads directly in controllers
CVE-LOCAL-2026-0007	Medium	Sensitive operational data in logs	Over-verbose PayPal checkout and webhook logging exposed sensitive operational payment data
CVE-LOCAL-2026-0008	Medium	Sensitive operational data in logs	Mollie webhook and payment-status logs retained unnecessarily detailed payment identifiers and error detail
CVE-LOCAL-2026-0009	Medium	Secret leakage / insufficient redaction patterns	Payment service failure logging and exception context used inconsistent redaction and could retain provider response detail
CVE-LOCAL-2026-0010	Medium	Webhook Security / Trust Boundary	PayPal webhook endpoint accepted unauthenticated public requests before trust-boundary verification
CVE-LOCAL-2026-0011	Medium	Webhook Security / Trust Boundary	Mollie webhook endpoint lacked authenticated boundary validation for public webhook delivery

Full Changelog: v2.0.0-m12-rc2.5...v2.0.0-m12-rc2.6

v2.0.0-m12-rc2.5

Email System Improvements

• #211, #210, #209, #207

• Consolidated updates to the email system:

  • Added SMTP support for email delivery
  • Refactored email settings into a tab-based interface
  • Completed a full audit of the email implementation
  • Implemented resend quota tracking

---

Database and Migration Fixes

• #202, #201

• Improved compatibility with stricter database configurations:

  • Fixed coupon allowed_for migration failure
  • Hardened migrations for strict MariaDB/MySQL enforcement

---

Security and Core Improvements

• #200, #205

• Enhancements to sensitive data handling and reliability:

  • Replaced legacy encryption flow with a centralized secret storage service
  • Hardened secret decryption to prevent billing and payment key failures

---

UI and Checkout Improvements

• #199, #204

• Improvements to usability and interface:

  • Refined mobile UI layout and styling
  • Simplified checkout flow into a three-step process

---

v2.0.0-m12-rc2.1

What's Changed

Fixes

• Fix migration and align email_deliveries foreign key to match the users.id type
• Apply RC-2 fixes:
  • theme adjustments
  • email settings now save correctly
  • activity avatar spacing and bubble size fixes
• Fix Discord SSO implementation
• Fix ConfigureAI modal:
  • resolved undefined theme reference
  • fixed dialog that could not be closed
• Fix icons and resolve bug introduced during Modrinth plugin search changes

Related PRs: #187, #189, #190, #191, #197

---

Security

• Fix multiple security vulnerabilities including:
  • IDOR vulnerabilities
  • OAuth 2FA bypass
  • OAuth CSRF/state validation issues
  • Admin RBAC permission bypass

Related PRs: #196

---

Improvements

• Constrain Modrinth plugin searches to server-side loaders
• Prevent default 30-day billing cycle from inheriting discount multipliers
• Prevent email dispatch when delivery is disabled
• Remove noisy session logging related to email dispatch

Related PRs: #195, #193, #198

---

Full Changelog
v2.0.0-m12-rc2...v2.0.0-m12-rc2.1

v2.0.0-m12-rc2

New Features

Email System Re-Integration

Resend Integration

Resend is now the default transactional email provider. All outbound mail is delivered through the Resend API to improve reliability, deliverability, and observability.

SMTP support will be introduced in a future release.

Event-Driven Email Architecture

Email dispatch now operates through a structured event-driven system, enabling:

• Centralized notification registration
• Deterministic event mapping
• Improved queue handling
• Enhanced logging

Invalid or blacklisted recipients are rejected at job entry to prevent queue failures.

Email Verification Enforcement

When email is enabled:

• Users must verify their email before accessing protected areas
• Verification links use secure signed URLs
• Password reset links use time-bound signed routes
• All outbound email activity is logged for auditing

Notification Registry

The panel now uses a structured notification registry.

Authentication Notifications (auth.*)

• auth.account_created – Welcome email upon account creation
• auth.email_verification – Email verification link
• auth.new_login – Alert for login from an unrecognized device or location
• auth.password_reset – Password reset link
• auth.password_changed – Password change confirmation
• auth.2fa_enabled - NOT IMPLIMENTED YET
• auth.2fa_disabled - NOT IMPLIMENTED YET
• auth.account_suspended – Account suspended notification
• auth.account_unsuspended – Account unsuspended notification

Billing Notifications (billing.*)

• billing.payment_failed – Payment failure alert
• billing.payment_received – Payment confirmation
• billing.server_renewal_notice – Server renewal reminder with expiration and suspension timing

Server Notifications (server.*)

• server.created – Server creation notification
• server.expiring_soon – Expiration warning
• server.suspended – Suspension notification
• server.unsuspended – Unsuspension notification

Marketplace Refactor

• Plugins migrated into the unified Marketplace system
• Mods and Modpacks consolidated under Marketplace
• Spigot integration implemented
• Installed mods and plugins listing
• Improved addon toggle states (clear success/danger indicators)
• Removed legacy per-server marketplace gating
• Deduplicated Spiget categories

API Documentation

API documentation added using Scramble.

Server Management Enhancements

• Integrated server settings
• Server schedule deletion support
• Scoped and tagged activity logs (account, server, admin contexts)

Pricing Transparency

• Customer-facing node pricing descriptions now visible in admin and checkout

Improvements

• Cloudflare Tensile integration
• Dependency security updates

Security Hardening

• Password strength validation UI with HIBP integration
• Password redaction in admin activity logs
• Improved file rename validation
• Hardened Mollie and PayPal redirect handling
• Access control corrections

Billing & Checkout

• Stripe.js loads only when required
• Improved handling of stale billing eggs
• Clearer checkout state messaging
• Stripe integration fixes
• Price adjustment step input fixes

UI & Theming

• Admin email activity and queue pages aligned with the theme system
• Email notification UI aligned with themed panels
• Themed integration status indicators
• Themed admin node selection backgrounds
• Centralized handling for non-dismissible alerts

Bug Fixes

• Login fixes
• Stripe-related fixes
• Search debouncing fixes
• Activity logging future-proofing (servers and admin)
• UI alignment inconsistencies resolved
• Final email logging stability fixes

Full Changelog

v2.0.0-m12-rc1...v2.0.0-m12-rc2

v2.0.0-m12-rc1

🚀 v2.0.0-m12-rc1

🙌 Special Thanks

Huge thanks to:

• @bimbab189
• @Anonimukas

For major help testing, submitting PRs, and assisting in building the foundation of V2.0.

🔥 Major Changes

🧾 Complete Billing System Overhaul

• Modular multi-payment architecture supporting Stripe, Mollie, and PayPal
• Servers are now created and renewed more consistently across all payment methods
• Multi-processor checkout flow
• Variable billing cycles with step-based pricing multipliers
• Renewal system rewritten
• Node-based pricing multiplier

Related PRs: #79, #84, #85, #96, #97, #106, #123

---

🛒 Checkout & Orders Redesign

• Checkout rebuilt into a step-by-step wizard
• Compact billing card layout
• Orders UI refactored with advanced filtering
• Billing navigation consolidated into dropdown
• Revenue chart filters integrated into analytics

Related PRs: #87, #107, #109, #118

---

🖥 Server Creation & Management Redesign

• Admin server creation rebuilt as wizard interface
• Resource presets
• Multi-allocation support
• Allocation management separated into its own menu
• Admin server edit page redesigned

Related PRs: #72, #113, #117

---

🧩 Advanced Mod Support Integration

• CurseForge mods browser integration
• CurseForge modpack downloader with rate limiting + memory optimization
• Modpacks relocated to account dashboard with reinstall workflow
• Modrinth mod download support (modpack support TBA)
• CurseForge egg implementation for modpack support

Related PRs: #73, #74, #76, #95, #100

---

✨ Improvements

• Webhook admin UI fully refactored and categorized (#131)
• Unified suspension threshold logic (#119)
• Improved alerts and UX refinements (#116)
• SubtotalCard positioning + location pricing clarity improvements (#125)
• Admin bypass button for past billed servers (#122)
• File edit differences logged to Server Activity Log — contributed by @bimbab189 (#105)

---

🛠 Fixes

Billing & Payments

• Fix renewal validation across all processors (#121)
• Fix billing settings persistence (DB vs config mismatch) (#112)
• Fix billing cycle persistence across admin & user interfaces (#127)
• Fix billing cycle auto-fill in EditServerBillingModal (#128)
• Fix webhook URL paths + rate limiting (#99)
• Fix PayPal webhook order extraction + transaction isolation (#98)
• Free renewal text dynamically uses server billing cycle (#132)

---

Server & Admin

• Fix validation errors when updating eggs and egg variables (#94)
• Fix Laravel query builder blocking bulk allocation assignment (#108)
• Fix infinite loop in CredentialsContainer causing API spam (#114)
• Fix mod settings persistence (missing DB reads + transformer fields) (#129)
• Fix duplicate usernames in server activity dropdown (#133)
• Fix admin analytics mismatch + Modrinth version filtering (#101)

---

v1.1.1-M12

• Reverted AI settings UI behavior back to the original working implementation; kept only naming/placeholder updates (small Ollama model suggestions + OpenAI endpoint example) and added basic endpoint “Invalid URL” validation messaging.

v1.1.0-M12

What's Changed

• Fix coupon migration failure on missing required columns by #92
• Update AI module for OpenAI's new API format while maintaining Ollama compatibility #93

Full Changelog: v1.0.0-M12...v1.1.0-M12

v1.0.0-M12

Features

• Add admin UI for server node transfers (#14)

• Add configurable renewal and suspension periods for billing (#17)

• Add coupon/promo code system to billing checkout flow (#20)

• Implement multi-egg support for billing categories with admin UI and post-purchase egg changes (#26)

• Redesign checkout page UI with progress stepper, improved layout, and theme integration (#28)

• Add multi-alert system with notification position, unread badges, universal alert reopen, and enhanced visual differentiation (#49)

• Add custom server name input for purchase flow (#50)

• Add per-coupon usage rules and improve renewal redirect behavior (#51)

• Refactor AI module to support OpenAI-compatible endpoints with Ollama mode, streaming, request cancellation, customizable system prompt, and improved UX (#63)

• Implement plan upgrade/downgrade with resource usage validation and anti-abuse measures (#64)

• Add per-category toggle to control billing plan changes (#65)

• Add standalone donation system with polished UI, admin management, and revenue analytics using Stripe integration (#69)

• Add file search to server file manager with correct filtering order (#71)

• Add admin toggle to hide donations from user navigation (#82)

• Add DKK (Danish Krone) currency support (#91)

---

Bug Fixes

• Fix support for custom egg environment variables in billing server creation (#3)
• Fix undefined property error in ThemeController (#4)
• Fix password fields displaying as plain text (#5)
• Fix startup command not updating visually when variables change (#6)
• Fix egg validation and editor callback preventing config from saving (#7)
• Fix TypeError when adding egg variables (#8)
• Fix 500 error on API key deletion due to model overwrite (#10)
• Fix validation rule for nullable description field in ServerPreset model (#11)
• Fix billing enable/disable toggle, renewal_date storage, and two-step category/product selector (#12)
• Fix free server billing: prevent $0 payment intents, add renewal dates, enforce 7-day renewal limit (#13)
• Fix validation error when updating servers with orphaned billing_product_id (#15)
• Fix server suspension logic, add renewal warning system, preserve server data, and sync Wings daemon state (#16)
• Fix free server renew button to respect suspension threshold (#18)
• Fix egg selection not persisting in billing category service configuration (#19)
• Fix coupon inactivation validation, zero-dollar bypass, ID styling, and table layout (#23, #24, #27)
• Fix 404 error on paid server renewals and improve billing flow (#33)
• Fix free server creation: missing getOrderType method and category eager loading (#34)
• Fix misleading file deletion warnings and add optional deletion feature for server reinstalls (#31)
• Fix user dropdown not populating on admin ticket creation (#37)
• Fix 500 error on schedule creation and listing (#52)
• Fix alert navigation hover, scope filtering, positioning, and user selector styling (#54)
• Fix UI rendering issues and replace hard-coded colors with theme system (#55)
• Fix form container background styling on login/registration pages (#56)
• Remove duplicate footers and title backgrounds in admin tickets UI (#57)
• Fix plan_change_cooldown_hours setting not persisting from database (#67)
• Fix optional password in Discord SSO registration to enable SFTP access (#70)
• Fix 500 error and egg selection sync issues in billing category management (#81)
• Fix product updates not persisting due to validation constraints (#83)
• Fix product price decimal handling (#86)
• Fix foreign key constraint error in coupon_usage migration (#89)

---

Reworks / Refactors

• Refactor server billing page UI with modern card-based layout and coupon functionality (#29)
• Consolidate free and paid server billing into unified services (#30)
• Refactor billing system to unified service architecture with consolidated CheckoutController (#35)
• Refactor product categories page with themed egg selection (#48)
• Refactor Discord SSO and registration to support customizable flow with real-time username validation (#59)
• Improve admin customizable alerts with modern AlertComponent design and expand coverage (#61)
• Add multi-field sorting to file manager with persistent user preferences (#62)

Full Changelog: https://github.com/macery12/Jexactyl/commits/v1.0.0-M12

v4.0.0-rc3T

What's Changed

• Add comprehensive OpenAPI 3.0 API documentation with Swagger UI (47+ endpoints) and in-app discovery by @Copilot in #2
• Fix: Support custom egg environment variables in billing server creation by @Copilot in #3
• Fix undefined property error in ThemeController by @Copilot in #4
• Fix password fields displaying as plain text by @Copilot in #5
• Fix startup command not updating visually when variables change by @Copilot in #6
• Fix Egg validation error and editor callback issue preventing config from saving by @Copilot in #7
• Fix TypeError when adding egg variables by @Copilot in #8
• Complete API documentation with comprehensive endpoint coverage and auto-detected server URLs by @Copilot in #9
• Fix 500 error on API key deletion due to model overwrite by @Copilot in #10
• Fix validation rule for nullable description field in ServerPreset model by @Copilot in #11
• Fix billing enable/disable toggle, add two-step category/product selector, and fix renewal_date storage and display by @Copilot in #12
• Fix free server billing: prevent $0 payment intents, add renewal dates, and enforce 7-day renewal limit with reset logic by @Copilot in #13
• Add admin UI for server node transfers by @Copilot in #14
• Fix validation error when updating servers with orphaned billing_product_id by @Copilot in #15
• Fix server suspension logic, add renewal warning system, preserve server data, and sync Wings daemon state by @Copilot in #16
• Add configurable renewal and suspension periods for billing cycle management by @Copilot in #17
• Fix free server renew button to respect suspension threshold by @Copilot in #18
• Fix egg selection not persisting in billing category service configuration by @Copilot in #19
• Expand API documentation with 30 missing endpoints across authentication, billing, and server management by @Copilot in #21
• Remove API documentation from repository by @Copilot in #32
• Fix 404 error on paid server renewals and improve billing flow by @Copilot in #33
• Fix free server creation: missing getOrderType method and category eager loading by @Copilot in #34
• Fix user dropdown not populating on admin ticket creation by @Copilot in #37
• Fix schedule creation 500 error - add missing validation rules for month and only_when_online by @Copilot in #39
• Fix ESLint violations: Tailwind class ordering and unused variables by @Copilot in #38
• Fix code style violations identified by PHP-CS-Fixer by @Copilot in #41
• Fix test failures from mocking final JWT class and incorrect assertions by @Copilot in #42
• Fix test assertions for API validation errors and Carbon datetime comparison by @Copilot in #44
• Fix PHP 8.4 implicit nullable type deprecation in Symfony Console by @Copilot in #45
• Fix foreign key type mismatches and add PHP 8.4 support by @Copilot in #46
• Revert PRs #45 and #46 - restore pre-upgrade state by @Copilot in #47

Full Changelog: https://github.com/macery12/Jexactyl/commits/v4.0.0-rc3T