| 4.5.0 – 4.5.10 |
A more professional “Edit your profile” page, and marketing opt-in back at sign-up.
- Marketing opt-in at registration and profile. Signing up — and the profile page — now offers a clear, unticked “send me occasional product news” opt-in, the easiest way for customers to join the list, alongside the dashboard toggle and Verified Forms’ double opt-in. It only ever affects the marketing list, never your account emails.
Requires Verified Forms — the card only appears where it’s installed.
- A coherent profile page. The member profile is rebuilt as clean, consistent cards — Account, Email Communications, Passkey Login and Multi-factor Authentication — in keeping with the rest of the site. The username is shown read-only (it can’t be changed here), and the Change password, Passkey and Multi-factor sections tuck away behind their headers so the page isn’t cluttered. Settings a customer never needs (admin language, editor, dark-mode toggle, timezone) are removed.
- Clear, consistent consent. Privacy and email consents are now simple one-line checkboxes that line up with every other field: “I agree to the Privacy Policy” and the essential “Extension update notifications and support emails”, with optional product news below.
- No re-ticking on every edit. Consent is asked once, at registration. When an existing customer edits their profile they aren’t made to re-agree to what they’ve already accepted — the privacy agreement isn’t shown again, and the essential-email consent shows as already on.
|
| 4.4.0 – 4.4.1 |
A quieter, more readable validation log. Routine “valid” check-ins from customer sites are now recorded at most once per site per day, rather than every time an older extension calls home — so the Validations screen shows real activity instead of pages of repeats. Nothing actionable is lost: invalid, expired, suspended and domain-limit results are always logged with their reason, a site’s first check-in from a new domain is always recorded, and the “silent churn” and active-site figures are unaffected (they track the most recent check-in, not the volume). A new database index keeps the check fast on the validation endpoint. |
| 4.3.7 – 4.3.9 |
Email preferences on the subscriptions dashboard.
- Two clear rows. The dashboard’s “Email updates” card now separates Product updates (service emails about the products you own — part of your account, with no on/off switch here) from Marketing (opt in or out yourself, any time). The marketing toggle only ever affects marketing, never your product updates.
- Resume emails If you’ve unsubscribed from all email via an unsubscribe link, the card says so rather than showing “active”, and offers a Resume emails button that brings you back — lifting the underlying suppression so mail is delivered again.
Requires Verified Forms — the card only appears where it’s installed. |
| 4.3.0 – 4.3.6 |
Featured Panel — a weekly cross-sell card you edit once and every extension shows.
- New “Featured Panel” screen. Compose a short “Featured this week” card — eyebrow, title, body, a call-to-action button and a “stay informed” link — with a live preview. Edit it once a week; there is nothing to release.
- Shown across the whole family. Every Multizone extension’s admin dashboard “More from Multizone” panel — including Subscriptions Manager’s own dashboard — fetches the card from this site and shows it above the catalogue. This reaches trial users too — the one audience there’s otherwise no way to email — nudging them toward a subscription.
- Per-extension review link. Each panel shows a “Leave a review on the Joomla Extensions Directory” link pointing at that extension’s own listing, taken from its Extensions Manager JED URL (set the URL on the extension’s record and the link appears).
- Served over a public, cached API endpoint (
v1/subsmgr/featured/{product_slug}); panels fail quietly to the plain catalogue if the site is unreachable, and the card is kept off the licence-validation channel by design.
- Quieter validation log. Alongside a client-side fix shipped across the paid extensions, trial installs now re-validate about once a day instead quite frequently — so the Validations screen reflects less noise.
|
| 4.2.0 |
Registration consent simplified to a single clear card, self-service email preferences on the dashboard, and Marketing Subscribers retired from sign-up.
- One clear consent card at registration. The registration page now leads with a single “Email and Privacy Policy Consent” card that folds the website privacy policy and essential account emails into one plain-English statement — sign-in and account changes, subscription confirmations and expiry reminders, extension updates and licence changes, and support replies. These are essential service emails, accepted as part of creating an account (there’s no separate checkbox to miss); marketing is kept explicitly separate and opt-in. The Register button is now a clear green call to action.
- Self-service email preferences. When Verified Forms is also installed, the subscriptions dashboard gains an “Email updates” toggle so customers can opt in or out of product-news email themselves, any time. The toggle only ever changes the marketing list — it never affects the account access that keeps your downloads and updates available.
- Marketing Subscribers retired from sign-up. Optional-marketing consent no longer lives on the registration and profile forms; marketing consent is now handled entirely through Verified Forms’ double opt-in and the dashboard toggle. Existing members of a marketing user group can be folded into the Verified Forms list with its “Sync from groups” action. Account-email consent (which gates downloads and updates) is set once at registration and is not part of the marketing toggle.
- Installs cleanly on update — no uninstall/reinstall needed; the consent plugin self-heals its run order so the privacy fold works reliably.
|
| 4.1.2 |
Link your listings to the Joomla Extensions Directory. Each extension in your directory can now carry a “Joomla Extensions Directory URL”. When set, the public extension page shows a “Listed in the Joomla Extensions Directory” link, marked with the Joomla icon, under the extension type — giving visitors a direct route to your JED listing and reviews. |
| 4.1.0 (production) |
Signing-key management, rotation and recovery without the command line; the issuing authority is now proven by key possession, not by domain; new production signing key.
- Signing Key screen. A dedicated screen to Generate your signing key on a new install, Rotate it for routine hygiene, and run Recovery if a key is compromised — all in-product, no OpenSSL command line required. Your public key is shown in full with a copy button and fingerprint so you can embed it in the extensions you license, and the private key’s status (present / missing / mismatch) is shown without ever revealing it. New installs are guided by an onboarding prompt until a key exists.
- Rotation that customers never feel. A rotated key is endorsed by the previous one and trusted automatically through the signed chain — client extensions adopt it on their next validation with no rebuild and no re-keying. Your customers’ subscription keys never change; only the response signature does.
- Subscription authority by key possession. The old
*.multizone.co.uk “master mode” is gone. An install now runs as the issuing authority — at enterprise, so it can create keys — only when it holds the private signing key that its released extensions trust. This is checked cryptographically on every validation and cannot be faked by editing the database, self-issuing a key, or repointing validation. A third party running their own Subscriptions Manager licenses their products with their key, and validates their Subscriptions Manager subscription normally.
- New production signing key. This release ships a fresh signing key as a security precaution. Customer sites simply auto-update; subscription keys are unaffected.
- Self-validation hardened. Subscriptions Manager now validates its own subscription remotely and verifies the signature exactly like the other extensions (fixing a content-negotiation error that had silently dropped it to trial).
- Choice of private-key storage — database (default) or a file outside the web root for a stronger production posture. Rotation and recovery behave identically either way.
- Internal: retired the bundled Multizone seeding overlay (the product is updated in place now), and added regression tests that lock the dev/prod public-key build injection, the validation request format, and the signing-key trust chain.
|
| 4.0.33 – 4.0.48 |
Joomla framework gate — consent plugin now goes through the User model; DB Check self-heals stuck subscription_keys.status enum; dashboard Upgrade CTAs unified.
- Fixed Consent plugin to uses the same path Joomla’s own com_users uses, so events fire and the change is logged.
- Fixed an issue with Joomla 5’s DB Check throwing “wrong type or attributes for column 'status'.
- Trial Keys integrator panel. The Trial Keys list view now leads with a collapsible “About trial keys (for integrators)” card explaining what trial keys are and how third-party developers can wire them into an extension that licenses through this Subscription Manager. See the separate integration documentation.
- Dashboard Upgrade Subscription-status alert + support_pane upgrade prompt re-synced byte-identical with all our extensions. Subsmgr’s own dashboard is the upgrade destination so it doesn’t carry the full CTA stack, but the status alert and support pane match the rest of the family.
|
| 4.0.22 – 4.0.32 |
Dashboard, retention tooling and analytics.
- Dashboard rebuilt around retention and upgrades — an Analytics panel with a single date selector (This Week / Last Week / Last 12 Weeks / Yearly) driving a Views→Downloads conversion rate, trend graphs, and active subscriptions by tier.
- Customers worklist (formerly Activity) — five action queues: renewals at risk, upsell signals, hot trials, silent churn and lapsed support, each row linking to the key or a pre-filled email.
- Per-customer drill-down — one profile page gathering all of a customer's keys, tiers, domains and recent validation activity.
- Metrics — rebuilt on call-home “liveness” vs “entitlement”: active counts exclude expired keys, paying customers are counted per real customer, “New Paid” replaces the always-zero “converted to paid”, and installs are split into anonymous trial sites vs emailable registered installs.
- Domain-binding fix — the permitted-domains limit is resolved live from the tier and Enterprise keys are never wrongly blocked with “domain limit exceeded”.
|
| 4.0.21 |
Joomla 6 compatibility for tier sync & validation. Remote licence validation and tier-feature sync now read HTTP responses through the current Joomla API. On Joomla 6 validation and tier sync could silently fail. No configuration change required. |
| 4.0.20 |
Paid-extension checkout fixes.
- Paid extensions no longer present a “Free Trial” download button. Both the extension detail card and the pricing page now show Subscribe / Pricing calls-to-action only — free trials are offered for free and trial extensions, as intended.
- Buying a paid extension now routes to the correct checkout. Previously the trial button dead-ended at an old checkout URL and could drop you on the Standard tier regardless of selection.
|
| 3.2.0 |
Joomla 6 Pre-Update Check no longer flags plg_system_subsmgrtasks or plg_system_subsmgrconsent as Potentially Dangerous Plugins. Each system plugin now declares its own compatibility-only update manifest so the check can verify J5 / J6 compatibility — pkg_subsmgr itself remains the canonical update path, so customers always update via the package. |
| 3.1.7 |
Production release consolidating issues found in testing. Versions 3.1.1 through 3.1.6 iterated through the changes below before this consolidated release shipped.
Validation drill-down + traffic reduction + SEO.
- New Validations admin view (
view=validations) at Components → Subscriptions Manager → Validations. Filterable, paginated list of every validation API call from customer sites — time, domain, IP, extension, tier, customer, masked key, and result. Per-row details panel expands to show the full key, User-Agent, and pretty-printed response JSON. Filters: search (key/IP/UA), result, tier, domain, date range. Drill-down link from the Activity card's "Recent validations" section.
- Validation traffic reduced ~one-per-page to one-per-day-per-site. Two long-standing bugs combined to make the cache useless: server signed extra fields the client didn't reconstruct (signature always failed, cache always cleared), and paid-key TTL was 15 minutes anyway. Server now signs only the canonical 8 fields with metadata appended after; paid-key TTL bumped to 24 hours, matching trial. Net effect: at most ~1 validation per active customer site per day, per extension.
- The four shared
SubscriptionValidationTrait copies (across pkg_artigen, pkg_payments, pkg_themer, com_veriform) are now byte-identical except for namespace; pre-push test gate refuses any future drift.
- Trial validations now logged. Trial-key validations went through a separate code path that updated rollup analytics but never wrote a per-event row. The Active Sites count under-reported and the new Validations view never showed trial sites. Fixed: trial validations write to
key_validation_log alongside paid validations.
- SEO meta description per extension and per app. Both edit forms gain a Meta Description field. The site-side detail pages render it as
<meta name="description"> in the page <head>, falling back to short description when empty. Same value drives the Open Graph description for social previews. Aim 150–160 characters.
- Public download counts hidden under 100. Low numbers read negatively on a young site (“12 downloads” undersells a good extension). Threshold-gate; the per-extension show-downloads opt-out is unchanged on top of it.
- Internal: phantom “Table 'subsmgr_validation_cache' does not exist” warning in the Joomla DB checker silenced. Pre-push test infrastructure (PHPStan + Pest + per-extension drift checks + HTTP smoke) gating pushes to main.
|
| 3.1.0 |
All five extensions updated to 3.1 — coordinated production release. |
| 3.0.38–3.0.48 |
Dashboard rebuild.
- KPI strip switched from rolling 7 days to the last full Monday–Sunday calendar week so numbers are stable and comparable week-over-week. Date range shown next to the heading.
- Two wide cards replace the four old nav cards: Subscription Keys (total active + tier breakdown grid + expiring-soon warning) and Activity (directory views, downloads, trials, active sites — all for last week).
- New Active Sites metric counts distinct customer domains that called the validation API in the period — a proxy for active customer sites.
- New Activity admin view (
view=activity) with weekly (12-week) and monthly (12-month) bar charts plus recent downloads, recent registered trial keys, and recent validation events.
- Bot User-Agents are no longer recorded in
extension_hits, extension_downloads or mobile_app_hits, so directory-view counts reflect humans rather than crawlers. Existing rows are untouched.
- "Trials" combines unregistered trial downloads with any registered trial keys created in the period (since the public download endpoint serves trials anonymously).
- Subscription Status card gains a small Usage panel: progress bars on capped tiers (info / warning / danger thresholds at 75% / 90%), a single muted "Unlimited on your tier" line on master.
- Revalidate Subscription moves to a dashboard toolbar button. The standalone
view=subscription admin view is removed (its content was already on the dashboard). Same toolbar button added to com_artigen, com_payments, com_themer and com_veriform.
- Quick Actions panel removed: Send Expiring Emails, Manage Tiers, Purchase Subscription, Get Support, and the dangerous Factory Reset button are all gone.
TestemailController and FactoryresetController deleted.
- Schema cleanup (4.0.24.sql migration): drops
subsmgr_validation_cache (zero references), subsmgr_download_log (model existed but never written), and subsmgr_key_usage_log (data lives in key_validation_log via SubscriptionKeyService). Dead admin views/models/controllers tied to those tables are removed too.
- Validation logging fix: the JSON API at
/api/index.php/v1/subsmgr/validate now correctly populates key_validation_log via SubscriptionKeyService::logValidation; client-side SubscriptionService::getValidationBaseUrl gains dev-host detection so .test and *.multizone.co.uk subdomains validate against the dev master rather than production.
|
| 3.0.37 |
Joomla 6 update XML targetplatform now includes 6.* so the Pre-Update Check no longer flags the package as J6-incompatible. Dashboard tile regex fix in the “Multizone Extensions” panel: the previous removal regex was lazy-matching the first nested </div> inside a tile, leaving the back half of <li> markup orphaned in the module content; replaced with a tempered-greedy pattern anchored to </li> so future uninstall + reinstall cycles can no longer corrupt the panel. |
| 3.0.36 |
Joomla 6 compatibility for the bundled plg_system_subsmgrtasks system plugin. The legacy flat-file plugin (root-level subsmgrtasks.php with deprecated protected $app/$db properties and an empty onAfterInitialise()) was the source of the J5→J6 pre-update warning. It has been replaced with the modern namespaced Ezone\Plugin\System\Subsmgrtasks structure that was already in the source tree but never packaged: real ExpiryNotificationTask for scheduled subscription-expiry emails, service provider, PSR-4 layout. pkg_script postflight removes any orphan flat-file from existing installs. |
| 3.0.33–3.0.35 |
Internal refinement of the Mobile Apps Directory shipped in 3.0.32 — admin list filters, dashboard KPI counters, security-audit dates rolled forward. |
| 3.0.32 |
Mobile Apps Directory — new sibling to Joomla Extensions.
- Admin CRUD for mobile apps with name, SKU, description, category, platforms (iOS / iPadOS / macOS / watchOS / tvOS / Android / Android TV / Wear OS / Windows), price note, development tool (Flutter, React Native, Swift, Kotlin, Java, Xamarin, Ionic, PWA, Cordova, NativeScript), source licence (BSD 3-Clause default, MIT, Apache, GPL, LGPL, MPL, Unlicense, proprietary) with plain-English explanatory notes, current version, company URLs and copyright.
- Store links: Apple App Store, Google Play, plus a subform repeater for additional stores (Amazon Appstore, F-Droid, Microsoft Store, etc.).
- Media: app icon, feature graphic (wide banner shown on featured directory cards), platform-tagged screenshots, and video URLs (YouTube, YouTube Shorts, Vimeo, direct MP4).
- Site Apps Directory (
view=apps) with search and platform filter. Featured apps render as full-container-width hero cards with feature graphic + store badges; non-featured apps in a responsive card grid.
- Site app detail view (
view=app): hero with icon/author/badges, official Apple/Google store badges, screenshots organised by platform in Bootstrap tabs, videos grid, technical details card, links card and publisher/copyright footer.
- Per-event hit tracking (
#__subsmgr_mobile_app_hits) with directory-landing sentinel row.
- Dashboard "Directory Views (7 days)" KPI now shows a combined total with a Joomla Extensions / Mobile Apps breakdown row (apps row shown only when
manage_mobile_apps feature is available).
- Premium feature gate: admin management requires Premium or Enterprise (
manage_mobile_apps product feature). Trial/Standard installs see the submenu but are redirected to the dashboard with an upgrade message. Public directory and already-published apps remain visible on all tiers.
|
| 3.0.30 |
New stable JED-compatible download URL: index.php?option=com_subsmgr&task=download.latest&extension={slug}. Free extensions serve the latest ZIP directly; trial/paid extensions redirect to the detail page where registration/login gates the download. Suitable for JED "Free" and "Free but registration required at link" listing types. |
| 3.0.29 |
Per-event activity tables (#__subsmgr_extension_hits, #__subsmgr_extension_downloads) enable time-windowed analytics: new Period filter (All Time / Last 7 days / Last 30 days) on the admin extensions list scopes hits and download counts accordingly. Dashboard KPIs refreshed: "Directory Views (7 days)" (tracks the site Extensions Directory landing page) and "Downloads (7 days)" replace the single "Downloads This Month" card; the Extensions KPI is removed in favour of a focused 4-card layout. Extension edit view now reads version from the installed Joomla manifest XML on every load (no longer shows stale DB value between deploys). |
| 3.0.28 |
Component renamed to “Subscriptions Manager” (plural) across language strings, manifests, documentation and JED graphics. Download count now increments on all three download paths: free-extension direct downloads, key-authenticated downloads, and the Joomla update system package endpoint. Guest download support for free extensions (keyless one-click download flow from the site detail view). |
| 3.0.27 |
GDPR email consent plugin: update and marketing consent checkboxes on registration, marketing opt-out toggle on profile edit, consent-based user groups for Joomla mass mail filtering, sendEmail management, consent audit trail in privacy consents table. |
| 3.0.26 |
Fixed SQL installation error on MariaDB – removed unsupported ADD COLUMN IF NOT EXISTS syntax from installer SQL that caused fresh installs to fail |
| 3.0.25 |
Hit counter tracking page views per extension detail page (admin list and edit view); manifest auto-detection populates copyright, author, author email, author URL and licence type from installed Joomla manifest XML; author email updated to This email address is being protected from spambots. You need JavaScript enabled to view it. across all manifests |
| 3.0.24 |
Automated security scanning added to release workflow – grep-based static analysis covers CSRF, XSS, SQL injection, input validation, information disclosure, and error handling across all extensions. Security testing card on extension detail page now shows “Tested” date in card footer. CTA subtitle output escaped for defence-in-depth. |
| 3.0.23 |
Extensions directory polish: version number on its own metadata row, last-updated date display, Joomla version badges (J5, J6) parsed from compatibility data, extensions grouped by category with auto-generated headings and item counts |
| 3.0.22 |
Smarter CTA cards: trial/paid extensions without payment plans now show a “Contact Us” card instead of incorrectly displaying “Free”; updated extension editor help to document all three access models |
| 3.0.21 |
Unified pricing card structure: premium hero card, extensions list cards and extension detail card now share identical layout via shared PricingCardHelper; new payment trust line ("No payment required" / "Secure checkout by Stripe"); featured ribbon hidden when no label is set |
| 3.0.17 |
In-component Help view with component-wide and per-view content, matching the pkg_payments pattern; help strings and view wiring updates |
| 3.0.16 |
Split Stripe configuration checks into separate test/live sections in Setup Checklist for clearer visibility of which key set is configured |
| 3.0.15 |
Multizone overlay refresh, data extract utility, and release notes housekeeping |
| 3.0.14 |
Setup Checklist view: per-product configuration status with checklist items for extension directory and payment setup, KPI summary cards with threshold colouring, cross-component links to edit views |
| 3.0.13 |
Cross-promotion panel, hide pricing button for free access model extensions |
| 3.0.12 |
KPI backfill fixes, product feature filter improvements, cancel page tag corrections, safe multizone uninstall |
| 3.0.11 |
Extension detail view redesign: pricing card matches list view pattern, tier comparison highlights featured tier, screenshots in full-width carousel, Requirements and Compatibility side-by-side, Documentation/Version History/Demo buttons in hero, Details button on premium view |
| 3.0.10 |
Extensions list CTA card redesign with access model pattern, carousel chevron and indicator styling fixes, public changelogs for all extensions |
| 3.0.9 |
Extensions directory redesign: responsive hero card replacing banner image, CTA pricing cards with trial days and download buttons, Bootstrap carousel with styled chevrons and indicators, consistent card widths, back link SEF URL fix, "Joomla Type" moved to extension info |
| 3.0.8 |
Extension directory cards enriched with icons, category and licence badges, screenshot carousel, and copyright auto-detection from manifests |
| 3.0.7 |
Featured tier pricing cards on extension detail view, payments plan unique key constraint fix |
| 3.0.6 |
Publication changelogs for all extensions, SQL migration sync in postflight |
| 3.0.5 |
Subscription widget link corrections, terminology alignment, grouped dashboard tile format migration and sizing fixes |
| 3.0.4 |
Whole-number pricing display, Stripe tax label support, plans Stripe column additions |
| 3.0.3 |
Active subscribers KPI, checkout improvements, success page account details |
| 3.0.2 |
Bootstrap text-bg-* colour treatment across all site templates for theme compatibility |
| 3.0.1 |
Dashboard house style standardisation, tier limits and pricing alignment across all products, grouped Home Dashboard tile |
| 3.0.0 |
Major dashboard redesign with KPI cards, navigation cards, support pane, compact subscription status, and simplified tier limits |
| 2.9.9 |
Bootstrap text-bg-* colour treatment across all site templates (premium, error, extension, extensions, dashboard) for theme compatibility |
| 2.9.8 |
Per-row CTA buttons (Upgrade/Renew) for each subscription key, download button always visible |
| 2.9.7 |
Theme compatibility fix for dashboard CTA card colours using Bootstrap 5.2+ text-bg-* utilities |
| 2.9.6 |
Contextual CTA hero card on dashboard, domain usage column, streamlined subscription table with plural-aware headings |
| 2.9.4 |
Tier comparison table on premium view, dev/prod URL isolation, multizone overlay manifest fix |
| 2.9.2 |
Consolidated downloads into component admin folder, auto-detect version from download artifacts |
| 2.9.1 |
Simplified download system with database-driven resolution, removed config-based URLs |
| 2.9.0 |
Block unpublished extensions from direct URL, JED Checker compliance, idempotent multizone overlay |
| 2.8.10 |
Fix in Extensions HtmlView |
| 2.8.9 |
Removed internal tooling |
| 2.8.8 |
JED Checker compliance: GPL licence fixes, deprecated API migration, language file deduplication |
| 2.8.7 |
Mutually exclusive contact method fix, menu item param lookup for per-extension contact settings |
| 2.8.6 |
Contact call to action for paid extensions, premium view contact scenario, and security hardening |
| 2.8.5 |
Contact fixes |
| 2.8.4 |
Theme compatibility refinements |
| 2.8.3 |
Cassiopeia theme compatibility, contact conversion scenario |
| 2.8.2 |
Security hardening across component |
| 2.8.1 |
Product feature limit enforcement, branding updates |
| 2.8.0 |
Site view restyling, extension directory with URL slugs, dashboard improvements |
| 2.7.0 |
Product Features system, master mode validation, multizone data separation |
| 2.6 |
Admin interface improvements and workflow refinements |
| 2.5 |
Subscription key management enhancements |
| 2.4 |
Email notification improvements and logging updates |
| 2.3 |
Tier system refinements and performance optimisation |
| 2.2 |
Extension directory and frontend improvements |
| 2.1 |
Stripe payment integration via com_payments |
| 1.0 |
Initial release — subscription key management with tiered system |
