CeSGO Dashboard 2.1.0

BuddyPress 14.5.0, 12.7.0, and 11.6.0 are now available.

These are security and maintenance releases that include two security fixes, along with a number of compatibility improvements, bug fixes, and code modernization updates. We strongly recommend updating your sites as soon as possible.

Highlights

• Two security issues:
  • Prevent user ID spoofing in the Messages REST API endpoint via improved validation.
  • Restrict Component management to Users with the appropriate Capabilities.
• Improves compatibility with WordPress 6.9, including support for block style loading optimizations and replacement of deprecated WordPress APIs where appropriate.
• Includes numerous bug fixes across BuddyPress, including BP Nouveau, Groups, Friends, Activity, Administration, and several PHP 8.x compatibility improvements.

Download

You can update automatically from your WordPress Dashboard, or download BuddyPress 14.5.0 directly:

• https://wordpress.org/plugins/buddypress/
• https://buddypress.org/download/

For the complete list of changes included in this release, see the changelog:

• https://codex.buddypress.org/releases/version-14-5-0/

Many thanks to our 14.5.0 contributors 

Thanks to everyone who contributed patches, testing, reviews, bug reports, and responsible security disclosures that helped make this release possible.

Contributors include: emaralive, vapvarun, westonruter, joelkarunungan, nikunj8866, shawfactor, r-a-y, t.schwarz, dcavins, noruzzaman, rollybueno, potcus, pratiklondhe, yatesa01, bhargavbhandari90, amitraj2203, GaryJ., espellcaste, needle, and johnjamesjacoby.

Security issues were responsibly disclosed via the WordPress Bounty Program over at HackerOne and through the WordPress Plugins Team. If you were not properly attributed for your contribution here, leave a comment and we’ll get you added.

BuddyPress 14.4.0, BuddyPress 12.6.0, and BuddyPress 11.5.2 are all now available. This is a security release. Please update as soon as possible.

14.4.0, 12.6.0 & 11.5.1 fixed one bug and one security issue:

• The BP REST API signups endpoint could leak signup data, including user email addresses, because of a too-lenient lookup function. Thanks to Asim Alshaya for responsibly reporting this issue.
• Improve behavior of bp_email_unsubscribe_handler(). After the changes in the “Improve security of status update messages” changeset, non-logged-in users clicking an unsubscribe link received no feedback on the success of their action.

Note: 11.5.2 contains the same code changes as 11.5.1 but has been repackaged to hopefully resolve some SVN oddities.

For complete details, visit the 14.4.0 changelog.

Many thanks to our 14.4.0 contributors 

emaralive, jjj, r-a-y, vapvarun, and dcavins.

BuddyPress 14.3.4, BuddyPress 12.5.3, and BuddyPress 11.4.4 are all now available. This is a security release. Please update as soon as possible.

14.3.4, 12.5.3 & 11.4.4 fixed two bugs:

• Restrict bulk notification management to owner. Many thanks to Brian Mungah for responsibly reporting the problem.
• Improve security of status update messages. Many thanks to mikemyers for responsibly reporting the issue.

For complete details, visit the 14.3.4 changelog.

You can get the latest version by clicking on the above button, downloading it from the WordPress.org plugin directory or checking it out from our Subversion repository.

Many thanks to our 14.3.4 contributors 

emaralive, jjj, and dcavins.

BuddyPress 14.3.3 is now available. This is a maintenance release.

14.3.3 fixes a mistake made in the build process for 14.3.1 (and 14.3.2 attempted to fix, but didn’t completely fix the issue, so was never released).

14.3.1 fixed two bugs:

• WordPress 6.7 compatibility: WP 6.7 will throw notices for plugins that load their textdomain before ‘init’ (see #9247).
• BP Legacy Theme Pack: Make sure the bp_heartbeat property is included in the WP Heartbeat data object (see #9248).

For complete details, visit the 14.3.1 changelog.

You can get the latest version by clicking on the above button, downloading it from the WordPress.org plugin directory or checking it out from our Subversion repository.

Many thanks to our 14.3.3 contributors 

dreampixel, boonebgorges, emaralive & imath.

BuddyPress 14.3.1 is now available. This is a maintenance release.

14.3.1 fixes two bugs:

• WordPress 6.7 compatibility: WP 6.7 will throw notices for plugins that load their textdomain before ‘init’ (see #9247).
• BP Legacy Theme Pack: Make sure the bp_heartbeat property is included in the WP Heartbeat data object (see #9248).

For complete details, visit the 14.3.1 changelog.

You can get the latest version by clicking on the above button, downloading it from the WordPress.org plugin directory or checking it out from our Subversion repository.

Many thanks to our 14.3.1 contributors 

dreampixel, boonebgorges, emaralive & imath.