FOSSBilling

0.8.5

Alongside this release, we are publishing several security advisories for vulnerabilities addressed in 0.8.4 and later. Users should upgrade as soon as possible as prior releases contain critical vulnerabilities. 0.8.5 should be considered the recommended security baseline.

This release improves session security, adds end-of-period subscription cancellation and a separate billing email, stabilizes email template handling, and fixes several Stripe integration issues.

🔐 Security

• All active user sessions are now invalidated after a password reset, preventing an attacker from maintaining access after a password change. (#3983)

📈 Enhancements

• Batch invoice reminders are now limited to once daily, and invoice generation runs before reminders in cron so new invoices don't miss that day's notification window. Partial cron failures now exit non-zero so monitoring tools can detect them. (#3965)
• Support ticket edit history is now rendered as formatted Markdown instead of raw source, matching the display of the live message body. (#3970)
• Twig URL filter arguments have been standardized across templates for consistency. (#4001)
• Admin list pages load faster thanks to query optimization and migration of client list pagination to Doctrine. (#4023)

➕ New Features

• Clients can now set a separate billing email address for invoice notifications, distinct from their primary contact email. (#3973)
• Orders can now be cancelled at the end of the current billing period instead of immediately, so clients keep access to the service they already paid for. (#3974)

🐛 Bug Fixes

• Fixed a SQL GROUP BY error in the product category query on newer database versions. (#3964)
• Fixed an issue where cancelling a Stripe subscription from FOSSBilling did not correctly cancel it in Stripe. (#3968)
• Fixed Stripe webhook routing when multiple gateway configurations share a Stripe account, so webhooks now route to the correct originating gateway. (#3969)
• Fixed duplicate transactions being created when processing one-time Stripe payments. (#3975)
• Fixed ClientBalance single-payment gateway flags not being handled correctly. (#3990)
• Fixed guest users being redirected incorrectly when viewing invoices. (#3993)
• Fixed footer link checkbox state not persisting after saving settings. (#3995)
• Fixed invoice approval discarding unsaved changes to invoice details. (#3997)
• Fixed Twig currency formatting when using non-default locales. (#3998)
• Fixed missing or broken preview variables that caused errors when previewing invoice, staff signup, and support email templates. (#4000, #4003, #4015, #4019, #4020)
• Fixed bulk email template regeneration failing to process all templates, and prevented timeouts when regenerating templates with many entries. (#4008, #4018)
• Fixed email template upgrades from 0.7.2 installs via a new database patch. (#3986)
• Regenerated and reset built-in email templates to incorporate fixes from related template changes. (#4002, #4022)
• Fixed HTML entity encoding in knowledge base article titles where quotes were double-encoded. (#4005)
• Fixed client session handling, form field states, and error page rendering. Authenticated clients are now redirected away from the login page. (#4011)
• Fixed Thai and Lao text not rendering correctly in invoice PDFs by including the DejaVu Sans font stack. (#4012)
• Fixed escaped CSS font styles in invoice PDFs that broke visual formatting. (#4021)
• Enforced order expiry checks across service modules and fixed miscellaneous bugs in the Invoice, Order, and Servicehosting modules. (#4027)

📦 Dependencies

• stripe/stripe-php updated to v21 (#3984)
• league/commonmark updated to v2.8.3
• CKEditor 5 updated to v48.3.1