upstream-krayin/CHANGELOG.md

CHANGELOG for 2.2

This changelog consists of the bug & security fixes and new features being included in the releases listed below.

v2.2.6 (10th of Sept 2026)

• [feature] Added MariaDB support.

• [feature] Added customizable lead card information. Datagrid columns and Kanban lead card fields can now be chosen per user through new column and card settings components.

• [feature] Added PDF export for dashboard reports, available from the dashboard alongside the existing views.

• [feature] Added Japanese (ja) translation for the Admin, Installer, GoogleContact and WebForm packages.

• [feature] Added an associated group column to the users grid in Settings > Users.

• [fixed] Fixed duplicated activity handling across the lead, person, product and warehouse activity controllers by consolidating the shared logic, and added the missing Japanese activity translations.

• [fixed] Fixed the data transfer import queue processing inconsistently, and corrected the form control group rendering used by the import screen.

• [fixed] Fixed the Google Contact settings screen erroring when no account was connected, and added the corresponding translations.

• [fixed] Fixed the mail ACL mapping so email actions are checked against the correct permission.

• [fixed] Fixed people created from a lead being saved with a null user_id, which hid them from the person listing for users restricted to group or individual data scope. They are now assigned to the lead owner, falling back to the acting user.

• [fixed] Fixed the stage API resource omitting lead_pipeline_id, so stages could not be matched to their pipeline.

• [fixed] Fixed email attachment downloads being blocked by the URL sanitizer middleware.

• [fixed] Added the missing Chinese translations for the users grid's associated group column.

• [fixed] Fixed flaky admin end-to-end tests around organization owner lookup, lead creation and rich-text comment fields.

• [security] Fixed user and role listings not being scoped by the acting user's data scope, which allowed users to see records outside their own group. Roles now track their creator via a new created_by column.

• [security] Hardened the admin ACL middleware to fail closed. An administrative route with no ACL mapping is now denied rather than allowed, inheriting the permission of its nearest mapped ancestor, with a narrow allow-list for authentication, self-service account management and generic UI helpers.

• [security] Removed SVG from the allowed upload types for the admin logo and favicon configuration fields.

• [security] Fixed a security issue configuration file uploads.

• [security] Fixed a security issue activity notes and the TinyMCE editor component.

• [security] Fixed a security issue in the web form embed view.

• [security] Fixed a security issue in attribute downloads.

• [security] Fixed a security issue in mail links.

• [security] Fixed broken tag handling in the tag settings controller.

• [security] Fixed SVG sanitization bypasses in media and configuration file uploads.

• [security] Secured installer APIs.

v2.2.5 (4th of Aug 2026)

• #2631[fixed] Fixed the persons CSV import creating duplicate records and dropping select attribute values on re-import. Existing people are now updated by matched email regardless of a changed phone or organization (so the reported count is accurate), and select/multiselect option labels (or ids) are resolved to their option ids instead of being stored as 0.

• #2630[fixed] Fixed date attributes in the persons CSV import silently saving as 0000-00-00. Spreadsheet serial numbers and regional formats such as DD/MM/YYYY are now normalised to a valid date, and a value that cannot be parsed is reported as a row error instead of being stored as a zero date.

• [feature] Added Chinese (Simplified) zh_CN translation for the Admin, Installer, DataTransfer, WebForm and Core packages.

• [feature] Added a configurable default dashboard date range — 1 month, 3 months, 9 months, 1 year, 2 years or a custom number of days — under Configuration > General > Settings > Dashboard Configurations.

• [fixed] Fixed menu item names set in Configuration not applying to section pages, breadcrumbs and the mobile sidebar. Previously only the desktop sidebar reflected a rename.

• [fixed] Fixed renaming the "Mail" and "Contacts" menu items having no effect anywhere, as their configuration fields did not match the actual menu keys.

• [fixed] Fixed the dashboard date range label omitting the year on ranges spanning more than one calendar year, which rendered as "30 Jul - 30 Jul".

• [fixed] Fixed Arabic DataTransfer translations never loading, as the file was named ar/ar.php instead of ar/app.php.

• [fixed] Fixed the missing Korean translation for the "None" input validation option on the create and edit attribute forms.

• [enhancement] Moved the Core and DataTransfer package translations into the Admin package. Only packages that ship their own Blade views now carry a Resources/lang directory.

• [enhancement] Reduced database queries on every admin page by loading the configured menu names in a single query instead of one per menu item.

• [enhancement] Documented the localization convention in the crm-package-development agent skill and in AGENTS.md.

• [feature] Added a collapse/expand toggle to the admin sidebar, matching the Bagisto admin. The choice is remembered across page loads, and page content now reflows to the sidebar width instead of being overlaid by it. The sidebar no longer expands on hover; it is controlled by the toggle only.

• #2614[security] Fixed unauthenticated installer access and executable email attachment upload vulnerabilities.

• #2612[feature] Added import and export support for custom attributes for Leads and Persons.

• #2609[feature] Added Google Contacts export for Persons with Google account connection, duplicate detection, queued export progress, and result summary.

• #2608[fixed] Added missing "none" key to the Korean locale for attribute validation.

• #2606[feature] Added a collapse/expand toggle to the admin sidebar, matching the Bagisto admin. The choice is remembered across page loads, and page content now reflows to the sidebar width instead of being overlaid by it. The sidebar no longer expands on hover; it is controlled by the toggle only.

• #2606[feature] Added an option to show or hide the "Powered by" bar under Configuration > General > Settings > Powered by Section Configurations.

• #2603[feature] Added Korean translations for the Installer, DataTransfer, WebForm, and Core packages.

• #2602[feature] Added Korean translation support for the Admin package.

• #2600[fixed] Fixed invalid activity calendar .ics date-times by emitting UTC RFC 5545 values.

• #2592[security] Fixed webhook validation to reject internal endpoint URLs.

• #2580[enhancement] Added a "None" option to input validation for text attributes.

v2.2.4 (20th of July 2026) Release

• #2590[fixed] Fixed page does not refresh after creating a record via Quick Add.

• #2589[fixed] Fixed Quick Add not working for users with group and individual permissions.

• #2582[fixed] Fixed pipeline field visible on public webform.

• #2581[enhancement] Fixed responsive UI issues when page is zoomed.

• #2579[feature] Allow group selection for individual view permission users.

• #2575[enhancement] Added previous month's sales update in Kanban view.

• #2573[enhancement] Added dashboard support for multiple pipelines.

• #2572[enhancement] Added filter by tag option in Contacts > Persons.

• #2571[fixed] Fixed issue with lead creation.

• #2570[fixed] Fixed auto-fill lead email issue.

• #2567[fixed] Fixed IDOR agent record access control vulnerability.

• #2563[fixed] Fixed Kanban infinite scroll duplicates issue.

• #2583[fixed] Fixed SQL injection in rotten lead filter.

• #2585[security] Fixed unrestricted file upload vulnerability (CVE-2026-38526).

• #2559[fixed] Fixed agent record access control issue.

• #2556[fixed] Fixed installation config save issue.

• #2550[fixed] Fixed Kanban infinite scroll duplicates.

• #2549[enhancement] Added support tab feature.

• #2548[enhancement] Allow search by phone and email when creating a lead.

• #2546[feature] Quick Attribute now available at lead form.

• #2545[feature] Added agent skills functionality.

• #2544[enhancement] Added validate skills.

• #2543[enhancement] Added Agents Skills folder.

• #2542[fixed] Fixed stored XSS vulnerability in notes field.

• #2541[fixed] Fixed quote description truncation issue.

• #2539[fixed] Fixed lost revenue arrow UI issue.

• #2538[fixed] Fixed missing translations.

• #2501[fixed] Fixed sales owner not saved in organization.

• #2500[fixed] Fixed activities date filter range issue.

• #2479[fixed] Fixed textarea field not rendered in WebForm.

• #2471[fixed] Fixed missing translations for lead won/lost modal.

• #2420[fixed] Added missing mega search translations for settings and configurations.

• #2533[fixed] Fixed GUI installation issue.

• #2419[security] Fixed stored XSS vulnerability in notes field.

• #2454[fixed] Fixed quote description truncation.

• #2407[fixed] Fixed missing translations.

• #2157[fixed] Fixed auto-fill lead email when creating a lead.

• #2258[fixed] Fixed issue with same-as-billing-address field.

v2.2.3 (1st of May 2026) Release

• [fixed] Pipline critical issue resolved.

v2.2.2 (1st of May 2026) Release

• [fixed] Update Change Log and version.

v2.2.1 (1st of May 2026) Release

• [fixed] Quote fields now auto-fill correctly when a quote is linked to a lead.

• [fixed] Fixed price formatting issue.

• [fixed] Fixed Lead Kanban list ordering.

• [fixed] Fixed header block position at the top.

• [fixed] Updated Activity UI.

• [fixed] Admins can now view and share quote details to a person from the quote list.

• [fixed] Fixed submission issue on the web form.

• [fixed] Fixed activity display issue in the Calendar view.

• [fixed] Logo update issue resolved.

• [enhancement] Drag-and-drop support added to Activity. Admins can now change date and time directly from the Calendar view.

• [feature] Quick App feature added for faster access to key CRM actions.

• [feature] Admins can now add or update a person directly from the lead view page.

• [security] Resolved an authentication bypass vulnerability caused by improper access control in the installer.

v2.2.0 (17th of March 2026) Release

• [Laravel 12 Upgrade] Upgraded framework to Laravel 12

• #2480[enhancement] Codebase updates and refinements.

• #2478[enhancement] Improved class instantiation handling.

• #2472[enhancement] Upgrade to Laravel 12.

• #2470[enhancement] Updated auto_commits.yml configuration.

• #2469[enhancement] General enhancements and optimizations.

• #2468[enhancement] Documentation updates (MD files).

• #2450[fixed] Added ACL support for warehouses.

• #2444[fixed] Improved global search functionality for organizations.