v1.8.0 Latest
September 29, 2026
New 3 Improve 1 Fix 30 Security 5 Dev 5 Compat 1
New
- The Roadmap block is rebuilt as a thin wrapper over [roadmap], sharing the exact same option list and a real live preview in the editor canvas instead of a static card.
- Roadmap items and changelog entries are now scoped to one product each in the editor and over the REST API, matching how a board, a status and a vote count already work. A filter restores the previous multi-product behaviour for sites that relied on it.
- An admin notice appears if Pro 1.8.0 ever runs on an older Free install; Pro pauses itself and names the update needed instead of white-screening the site.
Improve
- The Pro frontend (profile tab, analytics tab, feedback widget, timeline bars) now reads the same shared colour tokens as the free plugin, so a per-product Theme Color and dark mode reach every Pro surface too; the feedback widget's own colour setting now drives its button contrast correctly.
Fix
- Analytics REST routes (overview, trends, popular items, recent activity, charts) let any Contributor bypass the required capability and read site analytics they should not have access to.
- The analytics CSV export gate had the same bypass, and is now closed the same way.
- CSV exports (item export, popular-items report) neutralise formula-injection payloads instead of exporting them as-is.
- Analytics events are now pruned automatically past a configurable retention window (90 days by default), instead of accumulating in the database forever.
- The Templates tab's Default Template dropdown could show a different template selected than the one that actually renders.
- The Templates tab kept advertising Timeline View as an option after it had been turned off in Pro Features, even though boards and the block correctly stopped offering it.
- A hook-timing bug meant Pro's own initialization never ran on any request, silently breaking the invalid-license admin notice and Pro's own translations.
- Merging duplicate items now works from the edit screen, in either editor; the merge box's own form was nested inside the page's form, which browsers silently drop. The target picker also searches beyond the previous 200-item cap, scoped to the source item's product.
- Removed a legacy, unused 18 KB timeline script that loaded on every board; "Enable timeline view" now actually removes the Timeline template from the block and shortcode when turned off.
- Removed the remaining browser confirm()/alert() dialogs from the Pro admin screens (Clear Cache, item merge), replaced with in-page two-step confirmations and notices.
- The block editor's live roadmap preview no longer loads the board's drag-and-drop script into every item edit screen, which had been throwing a JavaScript error there.
- With multi-product assignment turned off, Quick Edit, bulk actions and CSV import could still assign more than one product to an item; all three now keep a single product, and CSV import rejects malformed rows with a per-line reason instead of silently creating junk data.
- The status-change email digest ignored the recipient list configured on the Settings screen and used an older, separate setting instead.
- The Roadmap block showed visitors a "Please select a product" message on the live page when no product was chosen, instead of falling back to the default product like the shortcode does.
- Publishing a new item or changelog entry in the block editor could silently wipe the product it had just been assigned to, dropping it off its board.
- The item editor's Dependencies picker capped its list at 200 items, so most items on a large board could never be selected as a dependency.
- The Items by Status chart silently dropped any item with no status term instead of counting it, so its slices could add up to fewer than the board's real total.
- Added a missing settings field for the guest-suggestion notification email address; fixed the admin Analytics dashboard's header totals not updating when a product filter was applied; fixed the guest-suggestion webhook payload shipping an empty name and email on every submission.
- Pro now has an upgrade path. WordPress only fires activation on activation, never on update, so installs were missing the analytics table and every default option added since they first activated.
- The Pro feature settings have somewhere to live. Ten of eleven options rendered on no tab at all, so guest suggestions, webhooks and digests could not be switched on without WP-CLI. This is also why the 1.7.1 notes about settings fields rendering were not observable - that fix landed in a renderer nothing called.
- Guest suggestions can be enabled from the Advanced tab. The setting existed, defaulted to off, and had no control anywhere.
- Removed the empty "Permissions and Access" card on the Advanced tab, whose only button pointed at a settings page that does not exist.
- Database migrations now reach existing installs; dbDelta was passed "CREATE TABLE IF NOT EXISTS", which it cannot parse.
- Analytics numbers now agree with the board. The charts counted pending submissions that appear nowhere else, so an unapproved suggestion produced a slice of its own - a board holding one item could show a 50/50 split.
- "Votes Over Time" is scoped to the selected product. It accepted the product and ignored it, so it always showed site-wide figures next to product-specific panels.
- The Analytics screen honours the product in the address bar, so arriving from a product's own Analytics tab no longer shows site-wide totals above product-specific charts.
- The analytics CSV export honours the product and period it was given; both were read and then discarded, so exporting one product returned the whole site.
- The admin items list keeps the selected product in its dropdown instead of snapping back to "All Products".
- The Roadmap / Analytics tab bar rendered below the items list and jumped to the top on the Analytics tab; it now stays above the board.
- Merging items from different products through the REST route moved votes and comments across boards; it now returns a 400 and changes nothing.
Security
- Reordering and merging items now check the capability against the specific post. A Contributor could previously reorder any post type on the site, create arbitrary status terms, and merge-trash roadmap items.
- Reordering only accepts a status that already exists, instead of creating one from whatever the request sends.
- The analytics CSV export now requires a capability and a nonce. It ran on admin_init, which fires before WordPress applies the page capability, so any signed-in user could download it.
- The member activity and top-contributor endpoints now require a sign-in. Logged out, they returned usernames, avatars and voting history, and could be walked to enumerate every user id. Sites that want them public can opt in with the roadmap_pro_public_user_profiles filter.
- The public analytics tracking endpoint now caps payload size and rate-limits per IP, and no longer creates database tables on an unauthenticated request.
Dev
- Removed four settings that nothing read: enable export, enable analytics, enable custom fields, and export permission roles. They were registered and never consulted, so changing them had no effect.
- The analytics charts endpoint reads its REST parameters properly, so it can be called from anywhere rather than only from a browser address bar.
- Removed the filter presets feature. Saving always failed with a PHP error, the table was never created on upgraded sites, and nothing in the product called its endpoints. Uninstall still drops the table for installs that have it.
- Removed the duplicate default-template option. Two keys held the same setting and had already drifted apart; the one with a control and a reader is kept.
- Deactivation now runs. It had been registered too late in the load order to ever fire.
Compat
- Requires Product Roadmap 1.8.0. Install both updates together.