3.2.0

Upgrade notes

A few things to check when upgrading from 3.1.x:

• ActivityLog moved from App\Models\ActivityLog to Wave\ActivityLog (#344), update any imports
• config/settings.php was removed, the Stripe publishable key now lives in config('wave.stripe.publishable_key') (#349)
• The minimum password length went from 5 to 8 (#349)
• /api/token now returns 422 when key is missing (was 401) and 401 for an invalid key (was 400), and the response includes token_type and expires_in (#396)
• wave.api.key_token_expires now actually applies and defaults to 60 minutes, login/register/refresh tokens use wave.api.auth_token_expires (#396)
• .env.example ships an empty JWT_SECRET, if you're still on the old SeCrEtKeY placeholder run php artisan jwt:secret (#396)
• plugin:create derives the class name from the folder name, so "SEO Tools" now generates SeoToolsPlugin. Plugins generated before this need : void added to register() and boot() (#395)
• Draft and pending posts and inactive pages are no longer public, and Page::link() now points at /{slug} (#394)

What's Changed

• build(deps): bump tar from 7.4.3 to 7.5.3 by @dependabot[bot] in #343
• refactor: move ActivityLog from App\Models to Wave namespace by @bobbyiliev in #344
• build(deps): bump tar from 7.5.3 to 7.5.6 by @dependabot[bot] in #345
• feat: add wave:stats command with MRR, subscription, and user analytic by @bobbyiliev in #347
• fix: Remove duplicate User model definitions and legacy commented code by @bobbyonmagic in #348
• fix: Consolidate config files and strengthen password requirements by @bobbyonmagic in #349
• refactor(activity): improve ActivityLog structure and PHP best practices by @bobbyonmagic in #350
• test: Add API key tests by @bobbyonmagic in #352
• test: Add tests for Changelog, Page, and Notification controllers by @bobbyonmagic in #353
• Update devdojo/auth version to ^2.2.0 by @produktive in #354
• build(deps): bump tar from 7.5.6 to 7.5.7 by @dependabot[bot] in #355
• fix(deps): bump livewire/livewire to ^3.6.4 (CVE-2025-54068) by @p1xel007 in #357
• feat: Add plan-based feature limits (quotas) by @bobbyonmagic in #351
• Limit links on each side of pagination by @produktive in #358
• build(deps): bump tar from 7.5.7 to 7.5.9 by @dependabot[bot] in #359
• Use Filament default filesystem disk setting instead of 'public' for posts by @PatBriPerso in #363
• build(deps): bump tar from 7.5.9 to 7.5.11 by @dependabot[bot] in #362
• build(deps): bump rollup from 4.40.1 to 4.59.0 by @dependabot[bot] in #360
• Add the ability to choose the currency symbol by @PatBriPerso in #280
• feat: add Persian (fa) locale translations by @seyedrezabazyar in #374
• build(deps-dev): bump axios from 1.9.0 to 1.15.2 by @dependabot[bot] in #370
• Disable dark mode on marketing pages so light mode logo appears by @produktive in #377
• Bug fix in syncThemeForLayout function logic by @produktive in #378
• fix(ci): get Pint, Pest and Auth workflows passing again by @bobbyiliev in #397
• build(deps): bump picomatch by @dependabot[bot] in #364
• build(deps-dev): bump form-data from 4.0.5 to 4.0.6 by @dependabot[bot] in #381
• build(deps): bump tar from 7.5.11 to 7.5.22 by @dependabot[bot] in #388
• build(deps-dev): bump vite, @tailwindcss/vite and laravel-vite-plugin by @dependabot[bot] in #383
• build(deps-dev): bump follow-redirects from 1.16.0 to 1.16.2 by @dependabot[bot] in #398
• build(deps-dev): bump axios from 1.15.2 to 1.20.0 by @dependabot[bot] in #399
• build(deps-dev): bump vite from 8.1.0 to 8.3.6 by @dependabot[bot] in #400
• chore(deps): fix npm audit and refresh compiled assets by @bobbyiliev in #402
• chore: add dependabot config with grouped updates by @bobbyiliev in #403
• build(deps): bump the github-actions group with 2 updates by @dependabot[bot] in #404
• build(deps): bump the npm-minor-and-patch group with 8 updates by @dependabot[bot] in #405
• ci: drop the auth tests import workaround by @bobbyiliev in #406
• docs: ask for short code comments in CLAUDE.md by @bobbyiliev in #407
• Hide draft posts and inactive pages from the public site by @DimitrovK in #394
• Fix plugin:create output and harden the Plugins admin page by @DimitrovK in #395
• Fix API auth endpoints (register validation, refresh, token TTL) by @DimitrovK in #396
• chore: bump wave.json to 3.2.0 by @bobbyiliev in #408

New Contributors

• @seyedrezabazyar made their first contribution in #374
• @DimitrovK made their first contribution in #394

Full Changelog: 3.1.5...3.2.0