From a795c48bb38e21d2678b5e53f1cee900393b8219 Mon Sep 17 00:00:00 2001 From: Adam Daley Date: Tue, 1 Sep 2026 08:19:01 +0100 Subject: [PATCH 1/2] Update docs banner for 0.8.7 --- src/content/docs/index.mdoc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/content/docs/index.mdoc b/src/content/docs/index.mdoc index 91a160b..f985d12 100644 --- a/src/content/docs/index.mdoc +++ b/src/content/docs/index.mdoc @@ -4,8 +4,8 @@ description: Learn what FOSSBilling is, where to start, and how to get involved tableOfContents: false banner: content: | - 0.8.6 is here! Check out the - release notes + 0.8.7 is here! Check out the + release notes and 0.7 → 0.8 upgrade guide for details. --- From c638147a0ba73238293ef5dcc6b57408f11c0353 Mon Sep 17 00:00:00 2001 From: Adam Daley Date: Tue, 1 Sep 2026 09:49:14 +0100 Subject: [PATCH 2/2] Add 0.8.7 release notes Document the 0.8.7 security release in the upgrade guide and changelog, covering leaked credential fixes, API secret masking, cache backend support, RDAP availability checks, and the main bug fixes and dependency updates. --- .../docs/maintenance/Updating/0-7-to-0-8.mdoc | 9 +++++++++ src/content/docs/maintenance/changelog.mdoc | 13 +++++++++++++ 2 files changed, 22 insertions(+) diff --git a/src/content/docs/maintenance/Updating/0-7-to-0-8.mdoc b/src/content/docs/maintenance/Updating/0-7-to-0-8.mdoc index 9767ca3..a937d15 100644 --- a/src/content/docs/maintenance/Updating/0-7-to-0-8.mdoc +++ b/src/content/docs/maintenance/Updating/0-7-to-0-8.mdoc @@ -541,6 +541,15 @@ The bundled JavaScript API wrapper (`js/api.js`) already handles the new name, s - **CSV exports** (clients, invoices, orders) now strip secret columns and require both `view` and `export` permissions. Staff with only `export` will no longer see full records - review group permissions if exports appear empty. - **Extension permissions:** `manage_extensions` is now enforced for inactive modules. Staff without that permission can no longer open their configuration pages. +## Security Hardening & API Secrets (0.8.7) + +{% aside type="caution" %} +**0.8.7 is a security release** addressing several vulnerabilities, including leaked credentials in API responses. If you are running a version older than 0.8.0, update immediately. +{% /aside %} + +- Staff and client listing responses no longer include password hashes or API tokens. +- Payment gateway and domain registrar secrets are now masked in API responses and admin forms. Admins see a "Configured" badge instead of the raw value, and leaving a field blank preserves the existing secret. + ## Deprecations & Removals (Summary) | Component | Status | Notes | diff --git a/src/content/docs/maintenance/changelog.mdoc b/src/content/docs/maintenance/changelog.mdoc index dbc8ea3..25c479b 100644 --- a/src/content/docs/maintenance/changelog.mdoc +++ b/src/content/docs/maintenance/changelog.mdoc @@ -18,6 +18,19 @@ FOSSBilling publishes release notes and tagged versions on GitHub. Use the links For the latest changes, start with the [most recent release](https://github.com/FOSSBilling/FOSSBilling/releases/latest). +### Version 0.8.7 + +| Area | Summary | +|------|---------| +| **Security** | Guest signup flow hardened against email address enumeration; password hashes and API tokens no longer leaked in staff and client listing responses; payment gateway and domain registrar secrets masked in API responses and admin forms (admins see a "Configured" badge, and leaving a field blank keeps the existing secret); ResellerClub API credentials redacted from request logs; template existence checks hardened against invalid paths; install filesystem paths stripped from Sentry stack traces. | +| **New Features** | Configurable Redis/Memcached cache backend with an admin cache settings page, Redis TLS support, and per-installation namespace isolation; per-TLD option to require a domain transfer code; "Sync Now" action to refresh domain status, WHOIS contacts, and dates from the registrar on demand. | +| **Enhancements** | WHOIS domain availability lookups replaced with RDAP, with graceful fallback for the Custom and Email adapters; release archives mirrored to Cloudflare R2 so IPv6-only hosts can download updates. | +| **Bug Fixes** | `Order\Service::assertOrderUsable()` restored, fixing client service endpoints failing with error 9998; checkout `TypeError` when a gateway left an invoice unpaid; ResellerClub mixed-case availability lookups, bare-scalar API responses, whois/contact edits, `.FR` contact types, renewals without cached expiration, and non-JSON responses (which previously crashed and leaked credentials); admin-role client/staff logins no longer throttled under the guest anti-brute-force policy; maintenance page crash with "hide company public" enabled; failed public suffix list download no longer breaking checkout; multi-byte UTF-8 corruption in the guest countries response; "change password" error in the client area; subscription renewal invoices allowed for `suspended`/`failed_renew` orders; Stripe checkout race creating duplicate customers and unhandled invalid UTF-8 in API responses; admin order creation with immediate invoice issuance; stale reads causing "has no active service"; extension hook listener rebuild on failure; theme settings fallback when `settings_data.json` is missing; Massmailer crash on mail sending and test client fetching. | +| **Changes** | Native PHP deprecation notices no longer reported to Sentry. | +| **Dependencies** | `io-developer/php-whois` dropped in favor of RDAP availability checks; PHP and frontend dependencies refreshed. | + +[View the full 0.8.7 release notes](https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.7) for the complete list of changes. + ### Version 0.8.6 | Area | Summary |