2.0.2

What's Changed

• fix(docker): expand 0.0.0.0/0 trusted-proxy CIDR for mod_remoteip by @maxijabase in #1531

Full Changelog: 2.0.1...2.0.2

2.0.1

What's Changed

• docs: add sitemap + robots.txt for search-engine indexing by @rumblefrog in #1528
• fix(data-export): name index.php in S3 completion redirects by @rumblefrog in #1529
• fix(docker): stop "more than one MPM loaded" crash by @maxijabase in #1530

New Contributors

• @maxijabase made their first contribution in #1530

Full Changelog: 2.0.0...2.0.1

2.0.0

The biggest release in the project's history. Every page in the panel has been rebuilt: a modern look with light, dark and system themes, real mobile support, a player drawer, a command palette, and a long list of fixes and security work underneath.

Caution

Read before you upgrade:

• PHP 8.5 or newer is required. A panel on PHP 8.4 or earlier won't boot.
• Your active theme will reset to default. Custom themes need porting against the new templates before you re-enable them.
• Always back up your database first.

Full walkthrough:
Upgrading from 1.8.x to 2.0.x.

Tip

Don't want to host your own?

We are pleased to announce the preview of RookHelm!

RookHelm is a hosted option for operators who would rather not run their own panel. It features bans, public appeal, player history roster page, admission control, raid protection, Discord alerts across multiple servers and more! And you can imports your existing SB++ data.

RookHelm is in private alpha and free for now. Learn more and request access
at rookhelm.com.

---

What's new

A redesigned panel

The whole chrome was rebuilt. Cleaner layout, modern controls, proper typography, and a real dark mode that follows your operating system if you want it to.

Player drawer

Click any player in the ban list (or the comms list) and a side drawer slides in with their full picture: SteamID / Steam3 / Community ID with one-click copy buttons, ban state, history, admin comments, and admin-only notes, all without leaving the page.

Command palette (Ctrl/Cmd+K)

Press Ctrl+K (or ⌘K on Mac) anywhere in the panel to search players, jump between admin pages, or copy a SteamID without clicking around. The Navigate list only shows what you can actually reach, so no admin entries leak to logged-out users.

Mobile support

The panel works on phones now. The sidebar collapses behind a hamburger, desktop tables turn into stacked cards, the drawer covers the full screen, and every control is sized for touch.

A new admin landing page

Admin Panel is now a card grid of every admin task you can reach, each with a description and icon, so there's no more guessing what a tab does.

Audit log

A new Admin → Admin Panel → Audit log page surfaces every administrative action recorded by the panel, with search and severity filters (Info / Warning / Error).

Ban list polish

• Status filter chips: All / Permanent / Active / Expired / Unbanned
• A Re-apply button to quickly re-ban an expired or lifted ban
• Required reason on unban, behind a confirm dialog so a stray
  click doesn't trash an audit trail
• IP column visible to admins
• Admin-authored comments inline on the row
• Hover tooltips on truncated reason / length text so nothing's lost

Comms list (mutes / gags)

Same drawer-and-filter polish as the ban list, plus row-action parity (Edit / Unmute / Re-apply / Remove) on both desktop and mobile.

Forms rebuilt

Login, lost-password, submit-ban, protest, and every admin-side form (Servers / Mods / Groups / Comms / Settings / Admins / Bans) has been rebuilt with proper inline validation, loading spinners, clear server-side error feedback, and full keyboard / screen-reader support.

Markdown for the dashboard intro

The dashboard intro text now uses safe Markdown, with a live preview pane in Settings. The old WYSIWYG editor that kept introducing stored-XSS bugs is gone.

---

Security fixes & hardening

A long list of issues closed, plus defense-in-depth added across the
panel:

• Stored XSS in the dashboard intro text (#1113), fixed by
  replacing the WYSIWYG editor with safe Markdown rendering.
• CSRF protection added to every state-changing form and JSON
  call (#1089).
• Smarty escape-by-default turned on globally (#1087).
• utf8mb4 end-to-end so emoji and full Unicode in player
  names round-trip correctly (#1108).
• URL-encoded user-controlled values in generated links (#1085).
• SteamID validation tightened across every add / edit form so
  a typo lands on a friendly error instead of a 500 page (#1420,
  #1423).
• Mail injection tightened by switching to Symfony Mailer.
• Brute-force protection on login (carried in from 1.8.1).
• Search now matches both STEAM_0: and STEAM_1: stored
  authid variants so old / mixed-format records aren't invisible
  (#1130).

---

Behind the scenes

For anyone curious about the internals:

• PHP 8.5 minimum (was 8.2).
• Smarty 5, league/commonmark for safe Markdown,
  lcobucci/jwt for sessions, Symfony Mailer for SMTP.
• PDO replaces ADOdb entirely; xajax was removed in
  favour of a clean JSON API.
• The ~1,700-line legacy MooTools file (sourcebans.js) is gone;
  everything is small vanilla JS now.
• A local Docker dev stack ships in the repo (./sbpp.sh up)
  for theme forks and contributors.
• Static analysis (PHPStan level 5), PHPUnit, snapshot-tested
  JSON API responses, and end-to-end Playwright tests cover
  the chrome.
• A production Docker image
  (ghcr.io/sbpp/sourcebans-pp:2.0.0) is now signed and
  published. See
  Quickstart (Docker)
  if you'd rather run the panel as a container.

---

Plugin

• New SBPP_OnClientPostAdminCheck forward (#1431) for plugin
  authors who need to run code after admin checks complete.
• Connection-loss recovery in sbpp_sleuth and sbpp_checker
  so a database hiccup no longer leaves the plugin permanently
  disconnected.
• Various security fixes, with a plugin version bump (#1398).

Note

Crossing from a pre-1.6 install that still has separate
sourcebans.smx / sourcecomms.smx / sbchecker.smx /
sb_admcfg.smx / SourceSleuth.smx files? Delete them
after uploading the new plugin pack. The new
sbpp_main.smx / sbpp_comms.smx / sbpp_checker.smx /
sbpp_admcfg.smx / sbpp_sleuth.smx set replaces them.

---

How to upgrade

Important

Always back up your database first. A mysqldump or your
hosting panel's "Backup database" button takes 30 seconds and
is much easier to recover from than a half-completed migration.

Step-by-step walkthrough:
Upgrading from 1.8.x to 2.0.x

The short version:

1. Upgrade PHP to 8.5 on your host first.
2. Switch your panel theme to "default" before uploading
   (Admin Panel → Settings → Themes).
3. Back up the database.
4. Download sourcebans-pp-2.0.0.webpanel-only.zip, unzip
   it, and overwrite the contents of your existing web/
   directory.
5. Visit /updater/ in your browser and let the wizard run
   every pending schema migration.
6. Delete the updater/ directory when it prints
   "Installation up-to-date."
7. Upload the new plugin pack
   (sourcebans-pp-2.0.0.plugin-only.tar.gz) to your game
   servers and restart them.

If you maintain a custom theme, don't re-enable it until you've ported it against the new template signatures. See the [theme reset(https://sbpp.github.io/updating/1-8-to-2-0/#theme-reset) section of the upgrade guide.

If you already ran composer install from a git pull of the main branch, you'll need to re-run it after upgrading. See PHP version + new dependencies. Tarball downloads ship vendor/ pre-built, so that's the easy path.

Two small things ship on by default and can be turned off. Anonymous telemetry sends one daily JSON ping of categorical counts only (opt out under Settings → Features → Privacy; details). A daily project-announcements fetch feeds the dashboard banner (define('SB_ANNOUNCEMENTS_URL', '') in config.php to disable details).

---

Download

• Web panel: sourcebans-pp-2.0.0.webpanel-only.zip
• Plugin: sourcebans-pp-2.0.0.plugin-only.tar.gz
• Production Docker image: ghcr.io/sbpp/sourcebans-pp:2.0.0

Find them under Assets below, or on the Releases page.

---

Get help / get involved

• Docs: https://sbpp.github.io/
• Issues: https://github.com/sbpp/sourcebans-pp/issues

Thanks to everyone who tested release candidates, filed bugs, ported themes, and waited patiently while v2.0 baked.

2.0.0-rc7

What's Changed

• fix(updater): portable information_schema guard for lockout columns (#1498) by @rumblefrog in #1499

Full Changelog: 2.0.0-rc6...2.0.0-rc7

2.0.0-rc6

What's Changed

• fix(1435): bump install-wizard alert + pill text to WCAG AAA palette by @rumblefrog in #1437
• Automatic database reconnection for Sleuth and Checker modules by @Yur1Ca in #1378
• chore(docs+panel): trim LLM-flavored wording by @rumblefrog in #1447
• fix(1419): drop api-contract from prod Apache deny list (login spinner under prod Docker image) by @rumblefrog in #1445
• fix(1438): paint chromeless <head> surfaces in dark mode on first paint by @rumblefrog in #1450
• fix(1440): pre-fill nickname when Ban / Block from the servers context menu by @rumblefrog in #1452
• fix(1443): drop misleading row-wide cursor: pointer on data tables by @rumblefrog in #1451
• fix(1446): paint online-server count from page-header sibling summary by @rumblefrog in #1449
• fix(1448): require base btn token alongside every btn--* modifier by @rumblefrog in #1453
• fix(1439): kick-only flow no longer tells the player they were banned by @rumblefrog in #1454
• fix(1444): give toast notifications time to be read (and screenshotted) by @rumblefrog in #1458
• fix(1442): keep banlist advanced-search disclosure closed on click-through from dashboard / palette / protests by @rumblefrog in #1457
• fix(1441): kick the player from their server when the ban is added by @rumblefrog in #1459
• fix(1456): forgot-password no longer leaks whether email is registered by @rumblefrog in #1461
• feat(1455): SMTP test-email button on the settings page by @rumblefrog in #1460
• fix(1462): pair the admin System Log table with a mobile card mirror by @rumblefrog in #1463
• feat(goals#4): switch web panel licence to Elastic License 2.0 by @rumblefrog in #1465
• docs: tighten commercial-licensing copy and consolidate internal references (#1465 follow-up) by @rumblefrog in #1468
• fix(demos): download link and remove button on ban edit page (#1464) by @rumblefrog in #1469
• fix: show default theme author/version on Settings > Themes (#1466) by @rumblefrog in #1470
• feat(plugin): bump native MAJOR_REVISION to 2 for 2.0 (#1114) by @rumblefrog in #1471
• fix(updater): make migration 801 idempotent for existing lockout columns by @rumblefrog in #1473
• feat(export): full data export — ZIP download + S3 presigned upload by @rumblefrog in #1475
• docs: ban emdash in user-facing copy, tighten data-export wordings by @rumblefrog in #1477
• fix(settings): point telemetry help link at the real docs slug + anchor (#1474) by @rumblefrog in #1478
• Composer(deps): bump symfony/mime from 8.0.9 to 8.0.13 in /web in the composer group across 1 directory by @dependabot[bot] in #1476
• Composer(deps): Bump symfony/mailer from 8.0.8 to 8.0.12 in /web in the composer group across 1 directory by @dependabot[bot] in #1479
• feat(export): Zip64 for direct download, S3 PUT capped at 5 GiB by @rumblefrog in #1481
• fix(chrome): fall back to favicon shield when template.logo points at a missing file by @rumblefrog in #1480
• fix(chrome): show monitor icon for system theme preference by @rumblefrog in #1482
• feat(seeder): expand db-seed with demo files + multi-type comments by @rumblefrog in #1484
• refactor(synthesizer): route on-disk letter codes through BanRemoval + LogType enums by @rumblefrog in #1485
• fix(dashboard): stop truncating server names server-side; let CSS handle the cut (#1487) by @rumblefrog in #1489
• fix(bans): keep validated SteamID-of-record on IP-type bans; hide synthetic community id (#1486) by @rumblefrog in #1488
• Composer(deps): Bump symfony/mailer from 8.0.12 to 8.1.0 in /web by @dependabot[bot] in #1494
• Composer(deps-dev): Bump phpstan/phpstan from 2.1.54 to 2.2.1 in /web by @dependabot[bot] in #1495
• Composer(deps-dev): Bump phpunit/phpunit from 13.1.8 to 13.1.13 in /web by @dependabot[bot] in #1493
• docs(deps)(deps-dev): bump @playwright/test from 1.59.1 to 1.60.0 in /docs by @dependabot[bot] in #1496
• docs(deps)(deps): bump astro from 6.3.1 to 6.4.2 in /docs by @dependabot[bot] in #1497

Full Changelog: 2.0.0-rc5...2.0.0-rc6

2.0.0-rc5

What's Changed

• chore!(deps): drop updater support by @Rushaway in #1418
• fix(steamid): surface validation errors across comms / bans / admin add + edit forms (#1420) by @rumblefrog in #1423
• fix(admin-bans): gate protests/submissions queues on config toggles (#1421) by @rumblefrog in #1425
• feat(docs): add /sponsor/ landing page as canonical sponsor URL (#1416) by @rumblefrog in #1424
• feat(chrome): surface a "Support SourceBans++" link in the panel footer (#1417) by @rumblefrog in #1426
• ci(docs): fix screenshot capture against the #1335 C2 install guard by @rumblefrog in #1427
• ci(docs): capture panel screenshots in light + dark at 1920x1080 full-page by @rumblefrog in #1429
• ci(docs): stash config.php beside web/ instead of /tmp (sticky-bit trap) by @rumblefrog in #1432
• fix(chrome): align the footer sponsor link with the version baseline (#1417 follow-up to #1426) by @rumblefrog in #1430
• feat(sbpp_main): Add SBPP_OnClientPostAdminCheck forward by @Rushaway in #1431
• fix(1433): kick via panel + kick-on-ban + add server by hostname by @rumblefrog in #1434
• Re-allign miss-aligned adv search options by @iBoonie in #1428

New Contributors

• @iBoonie made their first contribution in #1428

Full Changelog: 2.0.0-rc4...2.0.0-rc5

2.0.0-rc4

What's Changed

• feat(dashboard): admin-only project announcements feed by @rumblefrog in #1393
• chore(sbpp_main): bump plugin version for security fix by @Rushaway in #1398
• fix(comms): route Block Comms context-menu item through panel chrome (#1395) by @rumblefrog in #1399
• fix(mods): restore Delete affordance with confirm-reason dialog (#1397) by @rumblefrog in #1400
• fix(servers): filter empty-name A2S entries so first-player ctxmenu works (#1396) by @rumblefrog in #1401
• chore(cleanup): drop dead PHP fields rendering unreferenced JS calls (#1404) by @rumblefrog in #1407
• fix(admin): rewire dead sourcebans.js helpers across admin surfaces (#1402) by @rumblefrog in #1408
• fix(toast): lift Sbpp\View\Toast::emit + convert 35 ShowBox sites (#1403) by @rumblefrog in #1411
• feat(admin-admins): hydrate per-server access list with live hostnames (#1405) by @rumblefrog in #1412
• fix(admin-edit-comms): run not-found guard before permission check (#1410) by @rumblefrog in #1415
• feat(toast): add optional $duration_ms parameter for persistent error toasts (#1409) by @rumblefrog in #1414
• feat(admin-groups): render per-group server cards with live-hostname hydration (#1406) by @rumblefrog in #1413

Full Changelog: 2.0.0-rc3...2.0.0-rc4

2.0.0-rc3

What's Changed

• fix(servers+dashboard): preserve map aspect ratio + show hostname in dashboard widget by @rumblefrog in #1376
• ci(plugins): compile SourceMod plugins on every PR by @rumblefrog in #1379
• refactor(SteamID): drop GMP/BCMath/SQL calc tier in favour of native 64-bit int math by @rumblefrog in #1385
• feat(cla): gate web/ PRs on a signed Contributor License Agreement by @rumblefrog in #1387
• docs(deps)(deps): bump devalue from 5.8.0 to 5.8.1 in /docs in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1386
• Rewrite the 12 MIXED files surfaced by goals#3's audit (Route B, all phases) by @rumblefrog in #1388
• docs: add Cloudflare Web Analytics beacon by @rumblefrog in #1390
• feat: production Docker image + compose for self-hosters (#1381) by @rumblefrog in #1391
• ci(docker): tag-only trigger for prod image build by @rumblefrog in #1392

Full Changelog: 2.0.0-rc2...2.0.0-rc3

2.0.0-rc2

• Added right click actions to server player lists
• Fix some flashing theme
• • other things

2.0.0-rc1

Release candidate 1 for v2

Full Changelog: 1.8.2...2.0.0-rc1