v0.6.0

• Security, admin panel: Settings → Login security → Admin panel can require two-factor authentication of the super
  admins or of every admin (they set it up before any other page opens; never on the public demo), and limit /admin to
  a list of addresses (yours must be on it; php artisan gaiacp:admin-ips --clear empties it after a lock-out).
• Security, server and registrar logins: adding one or changing its address, user, token or password is logged and
  emailed to the super admins. Replacing a server's stored API token, and Terminate on an account on a server, ask
  for the admin's password.
• Admin guide: what access to give each panel (reseller, limited tokens, the API calls GaiaCP makes) and a "Keeping
  GaiaCP safe" checklist.
• Security: the email log no longer keeps the text of sign-in link and password reset emails, since their link logs in
  whoever opens it; the entry says so. symfony/mime updated for CVE-2026-45070 (email header injection).
• Security, passkeys: adding one asks for the password unless the login signed in within the last 10 minutes, and
  emails the login ("A passkey was added"). A password reset removes the login's passkeys, and admins can remove them
  with Remove passkeys on an admin user or on a client's Sign-ins tab.
• The public demo's made-up company is now Odysseus Hosting (was Aurora Hosting), in its settings, pages, emails and
  downloads.
• Settings → System → Updates: the line under "GaiaCP X is available" now says which version the date belongs to
  ("You have 0.4.0. 0.5.0 was released on …"); it read as if your own version came out that day.
• Security, installer: the web installer's first page asks for a setup code that only someone with access to the
  server's files can read (storage/app/private/install-code.txt, made on the first visit, deleted once installed;
  10 tries a minute), so a visitor who finds a new copy before its owner can't install it and take it over.
  php artisan gaiacp:install needs no code.
• Security, admin users linked to a client: staff with only Clients access can no longer turn such an admin back on
  ("Turn on login" on the client, now only under Settings → Admin users) or remove their passkeys (super admins only).
  An admin looking at the client area as a client can't remove the client's passkeys.
• Security, sign-in links: a link emailed before the login's password or email changed no longer works. Links
  emailed before this update stop working too: ask for a new one.
• Security, Email to ticket 1.2.0 and Site checks 1.0.4: a DKIM signature of another domain or an SPF softfail no
  longer vouches for a client's address, with an option to trust only senders the mail server confirmed; site checks
  never connect to a private address a client's DNS points to.
• Security, headers: every page now also sends Referrer-Policy: strict-origin-when-cross-origin, a
  Permissions-Policy turning off camera, microphone and location, X-Content-Type-Options: nosniff, and over https
  Strict-Transport-Security for a year (GAIACP_HSTS, 0 turns it off; subdomains not included).

v0.5.0

• Pages of your own (Support → Pages): About us, your terms or a guide, written with an editor (headings, lists,
  links, quotes, tables, pictures), a text per language, at /pages/…. Published or a draft, for everyone or only for
  clients; add them to either side menu under Settings → Client area → Menus. Public ones are in the sitemap; a
  featured image shows above the text and in link previews. The text sits in a centred column, like the contact page.
  Support → Pages says where to add them to the menus, with a link to Settings → Client area → Menus.
• Menus (Settings → Client area → Menus): the client area's side menu, for logged-in clients and for visitors, as a
  list you drag into order. Rename a page in each language, give it another icon or take it out, and add products,
  product groups, links (opening in a new tab if you like) and headings of your own. Pages added by later updates
  appear in their section by themselves; Reset to default puts the menus back.
• Other ways to log in (Settings → Security → Login security): passkeys on both logins (each admin and client adds
  theirs from their profile, then logs in with a fingerprint, face or screen lock; no two-factor code after one), and
  "Email me a sign-in link" (one use, 15 minutes; on in the client area, off for admins until ticked; two-factor is
  still asked). The login pages mark the way this browser last used "Last used".
• Google sign-in 1.1.0: admins can log in to /admin with Google too when ticked in its settings; two-factor is asked
  after Google instead of refusing the login.
• WHOIS lookup (Settings → Public area → WHOIS lookup, off by default): visitors and clients look up a domain name at
  /whois and see whether it is registered, its registrar, dates, statuses and nameservers, never the owner's contact
  details. It asks the registry's RDAP server, else its WHOIS server, with the domain search's captcha and a limit.
• Downloads (Support → Downloads): files for clients in categories, with a title and description per language, for
  everyone, clients who are logged in, or only the clients of chosen products. They show under Support → Downloads in
  the client area, are never at a public address, and are counted.
• The admin panel and the client area open in light mode instead of following the device's setting. Dark and
  System are still in the user menu, and a choice already made in a browser is kept there.
• Admin menu: Quotes moved to the main group, after Orders; Billing now reads Payment notices, Payments, Invoices,
  Coupons, Reports.
• New / edit API key: Select all, Read only and Clear all above the permissions tick them in one go.
• The compare packages table is easier on a phone: the feature names sit in a narrow column that scrolls away with
  the packages, and the table nudges sideways when it comes into view and when another package is chosen, as a hint
  that it scrolls.
• On a phone: Devices and sign-ins fits long IPv6 addresses and shows the current sign-in as stacked rows, and the
  top bar's search and icon buttons have even gaps.
• Visitors' top bar: the light / dark mode button is an outlined button like the language one next to it.
• The README on GitHub has new light-mode screenshots and lists the features added since 0.3.
• The public demo shows the newer features: coupons, sale prices, invoices and a credit note, product group and
  product pages, the public cart, pages of your own in both menus, downloads and a WHOIS lookup that answers from the
  demo's own domains.

v0.4.0

• Notifications can be swiped away on a phone or tablet: a swipe left or right in the bell's list (admin and client
  area) deletes one, the same as its X, and closes a pop-up one.
• PayPal (Settings → Payment methods → PayPal, off by default): clients pay their payment notices with PayPal, with
  their PayPal balance or a card, on PayPal's own page. GaiaCP takes the money only if the notice still asks for that
  amount, and records the payment once PayPal confirms it, on the client's return or through the webhook (for a
  client who closes the page, or a payment that clears later), exactly once. Sandbox and live apps have their own
  keys.
• A small Star on GitHub button in the admin footer opens GaiaCP on GitHub, where you can give it a star; the public demo's top bar has a bigger one on every page.
• The client guide in German, Spanish, French, Italian, Dutch, Polish, Portuguese and Turkish now explains coupons,
  sale prices, the package badges and SSL certificates installed for you on your hosting, like the English and Greek
  ones, and credit notes under Invoices. A test checks that every translation of the client guide has every paragraph
  of the English one.
• Invoices (Settings → Billing → Invoices, off by default): each payment notice paid from then on also gets an invoice
  with its own number, the way WHMCS turns a paid proforma into an invoice. Numbers follow a format with {YEAR},
  {MONTH}, {DAY} and {NUMBER} (INV-{YEAR}-{NUMBER} by default; with {YEAR} each year starts at 1), have no
  gaps, and the next number can only go up. An invoice is a copy of the seller, client, lines and tax when it was
  issued and is never changed or deleted. Billing → Invoices lists them; a paid notice links to its invoice, or has
  Issue invoice when it was paid before.
• Credit notes: Issue credit note on an invoice credits the chosen lines (each once) in a series of its own
  (CN-{YEAR}-{NUMBER} by default); reversing the payment of an invoiced notice credits its invoice by itself, and the
  notice gets a new invoice when paid again. Credit notes have a PDF, show with the invoices (negative totals, Type
  filter) and in the client area. Export CSV on Billing → Invoices for the accountant. Plugins and webhooks hear
  tax_invoice.issued and credit_note.issued.
• Invoices as PDF: the client gets the new Invoice Issued email with the invoice attached, in their language, and
  finds their invoices under Billing → Invoices in the client area and on each paid payment notice. Admins download
  the PDF or send the email again from an invoice's page, and see a client's invoices on the Invoices tab of the
  client's page.
• Welcome tour: on the first login, admins and clients get a few cards, each lighting up the menu or part of the top bar it is about (on a phone the side menu opens for them), (clients and orders,
  services, payment notices, support, search and bell, help for admins; services, payment notices, ordering, support,
  profile and help for clients), only for the pages each one can open. The admin's last card opens the setup guide.
  The user menu → Tour shows it again; Settings → Client area → Welcome tour turns off the clients' one. Existing
  users don't get it by themselves.
• Product pages: a product's new Public page section gives it a page inside its group's address
  (/web-hosting/business) with a title, a search result description and a text per language, its prices, Order
  button and what it includes, plus Product data for search engines. Without a text it stays out of search results.
  Products also get their name and description in each language (Other languages), shown on the order pages.
• Product group pages: switch on Public page on a product group (Settings → Product groups) and it gets a page of its
  own at the site root (/web-hosting) with a title, a text and questions per language, its products with prices and
  Order buttons and the compare table, plus a search result description and structured data (products with their
  prices, FAQ) for search engines. The home page, the visitors' menu and the sitemap link to it.
• Search engines: each language of a public page has its own address (?lang=el), and every public page names its
  canonical address and the other languages (hreflang). New /sitemap.xml lists the public pages that are switched
  on (knowledge base articles and announcements included) in every language, and /robots.txt points to it and keeps
  /admin out, or keeps everything out while Settings → Client area → Search engines is off. Link previews show the
  page's title.
• Product colours: pick a colour for a product (its Order page section) and its name, icon, price, check marks and
  buttons take it on the order cards, in the compare table and on the public home page, with a line along the card's
  top. Product tags and products now pick their colour from ten circles instead of a list.
• Sale prices: a Sale section on each product (a price per cycle) and on each TLD (register and transfer per term),
  from a Sale from to a Sale until day. Orders placed then pay the sale price for their first period; renewals are at
  the normal price. Clients see the normal price struck through and a Sale badge on the order pages, the public home
  page, domain search and Domain prices, and it ends by itself. A coupon skips items on sale unless its new Also on
  sale prices switch is on.
• Product tags (Settings → Product tags): your own labels such as New or SSD, named per language with a colour. One
  shown to clients is a badge after Popular on the order cards, in the compare table and on the public home page (the
  first three of a product); every tag filters the Products and Services lists and Messages to clients.
• Coupons (Billing → Coupons): a code for a percentage or a fixed amount off, on the first payment only or on every
  renewal too, for chosen products and domain endings or for everything, with dates, a usage limit, once per client
  and new clients only. Clients enter it in the cart (or follow a ?coupon=CODE link), admins pick it on New order,
  and POST /api/v1/orders takes a coupon. Setup fees are never lowered.
• SSL certificates on your own hosting: when a certificate's domain is the client's hosting account on a cPanel or
  Plesk server here, GaiaCP validates it there (a file in the website on cPanel, a DNS record in the subscription's
  zone on Plesk) instead of emailing the client, and installs the issued certificate on the account. SSL → Install on
  hosting does it by hand; Settings → Domains → Set up certificates on our own hosting turns it off. Not yet tried on
  a real cPanel or Plesk server.
• AI assistant on tickets, each with its own switch under Settings → AI assistant: Draft a reply in a ticket's Reply
  (from the conversation, the client's services and the closest knowledge base articles), Summarise (one line with a
  suggested priority, department and mood; Keep shows it under the subject in the list) and More → Write a knowledge
  base article from an answered ticket (saved unpublished). The client's name, company, emails and phone numbers are
  replaced before anything is sent; notes and files are never sent.
• AI assistant about a client: Personal reminder on an unpaid payment notice (the reminder email rewritten for how the
  client pays, to read and send) and Suggestions on a client's page (what they might buy, signs they may leave, what
  to look after). Only facts are sent (services, prices, payment history, ticket subjects), never who the client is.
• Settings → Languages → Translate with AI (super admins): the AI assistant fills a language's missing texts, 40 at a
  time while the page is open, saved as uploaded translations; ones that lose a placeholder stay in English.
• Ollama plugin (off until switched on): the AI assistant with an open model (Llama, Qwen, Gemma…) on your own server
  or computer, so texts never leave your machines; Settings → Ollama takes its address and model, no key needed.
• The dashboard's Servers card fills its width: the uptime and accounts squares grow with the card (and sit side by
  side on a wide one) instead of stopping at about 60% of it; the same on the client hosting page's uptime. Every
  square is the same whole number of pixels wide.
• The Cloudflare Turnstile check is as wide as the form it is on (login, sign up, forgot password, domain search).

v0.3.1

• New GaiaCP releases are announced: a daily check rings the bell for super admins once per version (linking to
  Settings → Updates, or saying to deploy on a copy from Git) and the daily summary email mentions it.
  GAIACP_UPDATE_CHECK=false turns it off.
• Settings → Updates says when GitHub's rate limit stopped the check (60 requests an hour per server address without
  a token, shared with other sites on it), when to try again, and that GAIACP_UPDATE_TOKEN raises it, instead of
  "GitHub answered 403".

v0.3.0

• First release from the public repository. Releases are signed with a new key (made 2026-10-27): an install that
  trusted the 0.2.0 key refuses this release, so update it once by hand (download the zip, or deploy from Git).
• Settings → AI assistant is its own group: the assistant's page with Claude, ChatGPT, DeepSeek and Kimi beside it
  (no longer under Integrations); Settings → Plugins lists them under AI assistant.
• Eight more languages, machine translated: German, Spanish, French, Italian, Dutch, Polish, Brazilian Portuguese and
  Turkish, for the panel, every plugin, the client emails and the client guide (Settings → Languages marks them).
  An existing install keeps offering only the languages it had: tick the new ones under Settings → Languages
• Contact page (Settings → Public area → Contact page): your details beside the contact form, or alone on the page
  without it: the Settings → Company lines you tick (address, phone, email, website, VAT number), opening hours and a
  text per language, and an Open in maps button. Logged-in clients find it under Support → Contact us. The public area
  settings no longer forget the welcome texts while the home page is switched off
• Reports → Ask in plain words: questions such as "who owes more than €100?" answered from your data, read-only;
  the AI service only reads which of GaiaCP's ready-made questions it is, and never sees the answer. System → Help:
  Ask the AI assistant answers "how do I…" from the admin guide, with links. Each has its switch under Settings → AI
  assistant.
• The web installer looks like the admin panel (the Gaia theme's fonts, teal, logo, rounded cards and buttons), always
  in light.
• AI assistant writes texts from GaiaCP's own details, each with its switch under Settings → AI assistant: a
  product's description from its details (no prices), the server problem notice from what the monitors say (public
  server names only), and, off until switched on, Suggest other names in the client area's domain search (free names
  close to a taken one, only the name sent, 5 presses an hour per client or address).
• ChatGPT (OpenAI) plugin for the AI assistant, off until switched on: your own API key from platform.openai.com and a
  model typed in or picked from the chat models Test connection lists.
• Setup guide: a Public area step after Client area and terms, ticked once Settings → Public area is saved.