Changelogs

Fixed

• Chat failed with every reasoning model. The stored temperature was sent on each request, and reasoning models (gpt-5*, o1*, o3*, o4*) reject any sampling value other than the default, failing the whole request with 'temperature' does not support 0.7 with this model. temperature, top_p, presence_penalty and frequency_penalty are now omitted for those models instead of being sent with a value they refuse. Conventional models such as gpt-4o are unaffected and still receive the configured values.

Added

• alpha_chat_is_reasoning_model filter, for a model the bundled prefix list does not cover yet.

Security and correctness release from a full audit of the plugin. Please read the upgrade notes below if your site sits behind a proxy other than Cloudflare, or if anything calls the contact endpoint directly.

Security

• Rate limiting no longer trusts X-Forwarded-For from arbitrary callers. The header was accepted unconditionally, so rotating it gave every request its own bucket and left provider spend effectively uncapped. Forwarding headers are now honoured only when the request actually arrives from a trusted proxy. Cloudflare's published edge ranges are trusted out of the box; anything else is declared with the ALPHA_CHAT_TRUSTED_PROXIES constant or the alpha_chat_trusted_proxies filter.
• Added a site-wide chat and contact ceiling that no client-supplied identifier can partition, as a backstop on total provider spend.
• POST /contact now requires a valid wp_rest nonce. It was previously open to unauthenticated callers and sent mail on every request.
• Resuming a conversation now requires the caller to own it. A thread uuid alone used to be enough, and history is replayed into the prompt, so a leaked uuid exposed the earlier conversation.
• The current-page context injected into the prompt is now restricted to this site. An off-site origin_url with an attacker-chosen origin_title could previously write arbitrary text into the system prompt.
• Transcript CSV export now neutralises spreadsheet formula injection from visitor-authored message content.
• Masked API keys are a fixed width and no longer reveal the real key length.

Fixed

• A single chat message could trigger more than one paid completion. The widget retried across transports after the server had already answered, duplicating both the provider charge and the stored thread history. It now retries only when the request never reached the plugin.
• Transcript CSV export returned a JSON-encoded string rather than a CSV file, so the download could not be opened as a spreadsheet. It now streams real CSV, row by row, and no longer loads the whole archive into memory.
• The "Add to Alpha Chat" post row action rendered a button whose handler was never loaded, so clicking it did nothing.
• Stored API keys could not be cleared from the settings screen.
• A chat widget on a cached page recovers from an expired nonce instead of failing with a message that a reload could not fix.
• Restoring a post from the trash returns it to the knowledge base.
• delete_post no longer runs knowledge-base cleanup for revisions and autosaves.
• Update checks cache failures, so an unreachable licence server no longer adds a blocking request to every admin page load.
• Token counting handles CJK text, which was undercounted roughly fourfold and produced oversized chunks.
• Follow-up detection no longer treats every short message as a follow-up, which was dragging the previous topic into retrieval after a clean subject change.
• Uninstall cleans every site on a multisite network and unschedules its Action Scheduler jobs; network activation installs tables on every site.

Changed

• Curated Q&A is now ranked against the question and capped before it enters the prompt, instead of sending every enabled entry on every message.
• Settings are resolved once per request rather than rebuilt on each read.
• Retrieval scans a bounded candidate set when the fulltext index returns nothing.
• Errors and warnings are logged without requiring WP_DEBUG.
• Outbound fetches for the FAQ importer go through wp_safe_remote_request, and the pre-flight check covers IPv6 and literal addresses.
• The settings response reports whether moderation is actually active, which requires an OpenAI key regardless of the chat provider.

Added

• alpha_chat_trusted_proxies, alpha_chat_trust_cloudflare, alpha_chat_rate_limit, alpha_chat_max_prompt_faqs, alpha_chat_fallback_candidates, alpha_chat_max_queued_posts and alpha_chat_should_log filters.
• GET /nonce for widgets on cached pages.

Upgrade notes

• Behind Cloudflare, nothing to do. Behind any other proxy or load balancer, declare it or anonymous visitors will share rate-limit buckets: define( 'ALPHA_CHAT_TRUSTED_PROXIES', '10.0.0.0/8' );
• Anything posting to /alpha-chat/v1/contact must now send an X-WP-Nonce header.
• ChatController::is_rate_limited() is deprecated in favour of AlphaChat\Support\RateLimiter::hit().

Fixed

• Public chat no longer dies with Unexpected token '<' when /wp-json/ returns HTML. The widget retries ?rest_route=/alpha-chat/v1/chat and shows a retry message instead of the fallback answer plus a parse dump.

Changed

• Dashboard cards, queue tiles, and the activity chart are interactive. Range is 7 / 14 / 30 days.
• Dashboard uses one GET /dashboard request. Queue polling only runs while jobs are active and the tab is visible.

Added

• Curated Q&A can be imported from page URLs. The plugin prefers the local post, then the WordPress REST API (/wp-json/wp/v2/pages and /posts), then HTML. It reads FAQPage JSON-LD, Rank Math / Yoast FAQ blocks, <details>, definition lists, accordion markup, and headings that end with ?.
• POST /faqs/preview and POST /faqs/import (manage_options).
• alpha_chat_faq_extracted and alpha_chat_page_context filters.

Changed

• Public chat uses a wp_rest nonce so WordPress cookie authentication no longer returns "Cookie check failed".
• Every chat request sends the current page URL and document title. Page resolution now handles fragments, www, the static front page, and path fallbacks. Retrieval prefers chunks from that post.
• Settings and Q&A admin spacing is looser: larger section padding, field gaps, and a clearer import panel.

Added

• Streaming chat at POST /alpha-chat/v1/chat/stream (SSE). The widget streams tokens and falls back to JSON /chat if the host buffers the stream.
• Hybrid retrieval: FULLTEXT candidate cut, follow-up query rewrite, and a score boost for the current page’s chunks.
• Source cards now show at most three posts the reply actually used. Admin metadata still stores the full retrieved set.
• Mapped Thinking control (off / low / medium / high) for OpenAI, Grok, and DeepSeek. Default and all presets are low. xhigh/max are not sent.
• Voyage AI as an independent embedding provider (voyage-4-lite, voyage-4, voyage-4-large). Chat, embeddings, and moderation are now separate settings.
• alpha_chat_moderation_provider filter and a no-op moderator when no OpenAI key is set.
• xAI (Grok) and DeepSeek as chat-only providers, using the same Chat Completions client as OpenAI.
• PHP ModelCatalog as the admin source of truth. GET /settings now returns { settings, stats, catalog }.
• Settings secrets xai_api_key and deepseek_api_key.
• alpha_chat_model_catalog and alpha_chat_http_timeout filters.

Changed

• OpenAI chat models are now GPT-5.6 Luna / Terra / Sol. New installs default to gpt-5.6-luna.
• Retired OpenAI IDs (gpt-5.4-mini, gpt-5.4, gpt-4.1) remap on settings read so the dropdown is never blank; the new ID is persisted on Save.
• Provider HTTP timeout raised from 30s to 60s.
• OpenAI is no longer required for embeddings or chat. Retrieval search only uses chunks from the active embedding model.
• Public /chat and /chat/stream require the alpha_chat_frontend nonce the widget already localizes.

Core Forms 4.7.5 fixes duplicate field IDs and reworks MailerPress consent handling.

• Schema-rendered field IDs are now unique per form instance, so labels and descriptions stay correctly associated when multiple forms appear on one page.
• The MailerPress action defaults to double opt-in, preserves existing subscribers and suppressed contacts, and records form-level consent metadata. Confirmation is resent only when a pending or previously unsubscribed contact submits again.
• The legacy FluentCart-to-MailerPress bridge no longer creates subscribed contacts when its settings are empty.

Core Forms 4.7.4 fixes native FluentCRM double opt-in.

• Contacts added as Pending now receive the configured confirmation email after list and tag assignment.
• Existing subscribed or suppressed contacts are not force-resubscribed.

Licensing and automatic updates now run through gauravtiwari.org, the home for every Core Forms license.

• Your existing license key keeps working. Sites re-register themselves on the first admin page load after updating, so there is nothing to re-enter.
• If that automatic step cannot reach the server, the key is left untouched and a notice asks you to reactivate, rather than the license being cleared.
• License checks now retry once on a timeout or server error, so a brief network problem no longer marks an active license invalid.

Full changelog: https://core-forms.com/changelog/

What's Changed

Fixed

• Collapsible TOC rendered a double border on themes that style <details> as a card. The block drew its own hairline frame and summary divider around the <details> element, so themes with disclosure-card styling (such as Marketers Delight) showed two nested borders. The render template now adds an acf-toc--collapsible modifier class, and the block stylesheet drops its frame, summary divider, and duplicate content padding for that variant, letting the theme's disclosure card own the chrome. Non-collapsible TOCs are unchanged.

Notes

• blocks/toc-block/block.json now declares "version", so the enqueued stylesheet URL busts CDN caches on plugin updates.

Commits

• 2.10.2: fix collapsible TOC double border on themes with details cards (55a1f59)

Stats

• Commits: 1
• Changes: 9 files changed, 49 insertions(+), 12 deletions(-)

Plugin Info

• Blocks included: 29
• Requires WordPress: 6.0+
• Requires PHP: 7.4+
• Requires: ACF Pro 6.0+ or Secure Custom Fields

Installation

1. Download acf-blocks-plugin-*.zip from the assets below
2. Go to Plugins → Add New → Upload Plugin in WordPress admin
3. Upload the zip file and activate

What's Changed

Fixed

• Filled buttons were unreadable in 2.10.0. The 2.10.0 conversion mapped several filled controls to --acfb-surface-3, a light neutral, while leaving their text inverted white — so they rendered as pale text on a pale fill. Affected: the Product Box primary and Amazon buttons and its discount badge, the Product List primary button and rank chip, and the Coupon Code copy button.
• Filled controls now use --acfb-button, which the theme guarantees pairs with --acfb-button-text. Measured 5.44:1 in both light and dark.
• The Product Box Amazon button is now a readable neutral secondary (dark text on a light fill, 13.4–14.4:1) rather than a second full-strength fill, so the card keeps one primary action. Its hover no longer darkens toward the brand colour underneath dark text.

Notes

• Added a regression test rejecting any filled control whose background is a --acfb-surface-* token while its paired text is --acfb-on-primary.

Commits

• 2.10.1: fix unreadable filled buttons from the token conversion (79879cf)

Stats

• Commits: 1
• Changes: 11 files changed, 63 insertions(+), 12 deletions(-)

Plugin Info

• Blocks included: 29
• Requires WordPress: 6.0+
• Requires PHP: 7.4+
• Requires: ACF Pro 6.0+ or Secure Custom Fields

Installation

1. Download acf-blocks-plugin-*.zip from the assets below
2. Go to Plugins → Add New → Upload Plugin in WordPress admin
3. Upload the zip file and activate

What's Changed

Added

• Design token bridge (assets/css/tokens.css). Every block now styles through --acfb-* tokens that resolve to Marketers Delight theme tokens when MD is active and to neutral literals otherwise. Dark mode follows the theme's own toggle with no per-block rules.
• Build-time asset minification (tools/build-assets.php). Writes a .min sibling for every CSS and JS file; the enqueue layer serves it, SCRIPT_DEBUG serves the source, and a missing artifact falls back to the source rather than 404ing. composer build regenerates, composer generated (and CI) verifies freshness.
• Keyboard support for the Tabs block: arrow keys, Home/End, and a roving tabindex, per the ARIA tabs pattern.

Changed

• Tabs redesigned as a minimal segmented control. Tab buttons no longer carry wp-element-button, which had rendered every tab as a filled CTA button. Pills, underline and boxed variants retained.
• Tabs behaviour moved out of an inline <script> into tabs.js, registered as the block's viewScript.
• 797 hardcoded colours across the block stylesheets reduced to 89, all of which are deliberate (social brand colours, code-editor syntax themes, video letterboxing).
• 54 hand-rolled [data-theme] override rules removed; the token layer handles both schemes.

Fixed

• Video block rendered on the front end but not in the block editor. The player is absolutely positioned, so the wrapper's padding-bottom was the block's only source of height — if the stylesheet did not reach the editor the block collapsed to 0px and vanished. The aspect ratio is now carried inline, so the box survives with no CSS at all.
• Pros & Cons is now dark-mode capable. It previously hardcoded dark text on light pink and green tints, which was unreadable on a dark background.
• Semantic status labels (changelog, pricing) sat at 4.0–4.2:1 against their own tint, under the WCAG AA floor. They are now mixed toward the text colour.
• Button fills used --color-primary, which MD lightens for dark mode, dropping white button text to 3.3:1. They now use --color-button, which MD keeps stable and guarantees pairs with --color-button-text.
• Removed the rounded-container-plus-thick-coloured-rail treatment from the opinion box, video caption, compact URL preview and Pros & Cons.

Notes

• Total shipped CSS dropped from ~291 KB to ~257 KB: deleting the dark-mode override rules more than pays for the token layer.
• Every measured text/background pair passes WCAG AA in both light and dark (19 pairs across 14 block palettes, worst 5.44:1).

Commits

• Correct 2.10.0 changelog date to release day (5fd652d)
• 2.10.0: MD design tokens, minified assets, Tabs redesign (842f9da)

Stats

• Commits: 2
• Changes: 91 files changed, 2655 insertions(+), 322 deletions(-)

Plugin Info

• Blocks included: 29
• Requires WordPress: 6.0+
• Requires PHP: 7.4+
• Requires: ACF Pro 6.0+ or Secure Custom Fields

Installation

1. Download acf-blocks-plugin-*.zip from the assets below
2. Go to Plugins → Add New → Upload Plugin in WordPress admin
3. Upload the zip file and activate

Core Forms 4.7.2 adds per-form Skeleton CSS control without forcing a visual theme.

• Choose the global default, always load forms.css, or always skip it for each form.
• Keep the form-editor preview aligned with the frontend’s resolved Skeleton CSS and form-theme settings.
• Preserve existing form behavior until a per-form override is selected.