Stable releases of October 30, 2026

Everything that shipped on the stable channel on October 30, 2026 — v2.10.88.

Stable v2.10.88 — Security

Bugfixes & Security — v2.10.88

• Remove unauthenticated cross-tenant PrestaShop handlers
• Verify JWT signature via panel API before trusting admin claim

Stable v2.10.88

Features — v2.10.88

• Migrate malware-scanner to ADR-022 dynamic frontend loader
• Migrate git-deploy to ADR-022 dynamic frontend loader
• Migrate prestashop-toolkit to ADR-022 dynamic frontend loader
• Migrate wordpress-toolkit to ADR-022 dynamic frontend loader
• Migrate joomla-toolkit to ADR-022 dynamic frontend loader
• Migrate uptime-monitor to ADR-022 dynamic frontend loader
• Migrate docker-runtime to ADR-022 dynamic frontend loader
• Migrate seo-geo-toolkit to ADR-022 dynamic frontend loader
• Migrate mcp-server to ADR-022 dynamic frontend loader
• Add optional ExtMountCtx.update() hook for live theme/lang sync
• Add dynamic frontend bundle loader
• Add SEO & GEO Toolkit extension

Improvements — v2.10.88

• Tolerate seo-geo-toolkit 404 when extension not installed
• Correct misspelling in plesk SQLDump comment
• Run vitest for ADR-022 extension frontend bundles
• Repair seo-geo-toolkit vitest act() import under React 19
• Revert foreign extensions/mcp-server + sharedExternals swept into commit
• Replace Cloudflare Turnstile with self-hosted ALTCHA on login
• Resolve 4 escalated changelog cases from audit
• Move subdomain name/document_root along with retarget
• Preserve SQL dump content and separate PHP boolean from version in backup-upload mode
• Recover old release's scope across same-day changelog merges
• Surface forwarding/source-IP query failures as warnings
• Own re-migrated subdomain must not block a re-run
• Normalize mysql CLI's literal "NULL" to empty string
• Untrack foreign file swept into prior commit by shared-checkout race
• Merge near-duplicate changelog bullets, purge two more internal lines
• Don't rename a live domain's Site row on a sanitizeUsername collision
• Rewrite FTP home_dir to the new /var/www/customers/ convention
• Use sudo + .psa.shadow fallback for SSH DB-content dump
• Add dynamic extension frontend bundle-loading architecture design
• Real Plesk importer Execute run against TEST panel .93
• Cache panel-verified JWT signature for 90s per token
• Bump to 1.0.2 for security fix republish
• Add Privacy Scanner architecture design
• Verify Plesk browser license wizard shows no trial option
• Record refuted Plesk auto-trial premise on audit testbox