Changelog

Release quality

• + Full pre-release CI matrix passed, covering PHPUnit, Psalm, JavaScript, four Playwright shards, MySQL 5.7 installation, and the v1.19.7 upgrade path.
• + Delta packages are available from v1.18.0 onward, including v1.19.5, v1.19.6, and v1.19.7; older sites should use the full package.

Fixes

• * Fixed a release runtime manifest gap where homepage language defaults were not registered.
• * Fixed the Node test gate so dependencies are installed before tests run.
• ~ Minimal keeps its lightweight native footer, while Yikai Builder preset footers continue to keep full content.

Yikai Builder and media

• + Yikai Builder now supports same-level multi-selection, batch delete, copy, cut, paste, and batch property editing, with each batch as one undoable action.
• + Improved video backgrounds, poster images, mobile fallbacks, and reduced-motion support for banners, sections, and columns.
• + The media library now supports image/video filters, sorting, pagination, and referenced-asset protection.

Compatibility and fixes

• + Added a dynamic URL mode for hosts without Rewrite support, with improved search, pagination, language, and canonical handling.
• * Fixed MySQL demo-data ordering, SQLite site-wide search, SVG dangerous-link sanitization, Yikai Builder publish caching, and installer empty-password handling.
• ~ Release gates cover PHP 8.0-8.5 lint, MySQL 5.7, real N-1 upgrade, full PHPUnit/Psalm, and three-viewport browser regression.

New and improved

• + Yikai Builder blocks, containers, columns and banners now support video backgrounds, posters, mobile fallbacks and reduced-motion preferences.
• + The media library adds image/video filters, pagination, sorting, usage auditing and deletion protection for referenced assets.
• + Default, Business and Minimal now share improved headers, mobile layouts and banner video rendering.

Fixes and security

• * Fixed SQLite all-category search, stale pages after Yikai Builder publishing, download search fields, Baota Nginx routes and disabled language prefixes.
• * Hardened SVG dangerous-link sanitization, installer administrator-password validation and packaged UTF-8 seed integrity checks.

Upgrade notes

• ! Before upgrading online from v1.19.5, temporarily switch to PHP 8.2 or newer. PHP 8.0 remains supported after the upgrade completes.

Fixed

• * Fixed online upgrades that could activate a new page before its dependency files, causing an HTTP 500 partway through the upgrade.
• * Upgrade files are applied in dependency order; site entry points, the upgrade endpoint and the version marker switch last.

Upgrade notes

• ~ Sites already showing 1.19.4, or returning HTTP 500 after upgrading, should recover with the full v1.19.5 package. This release has no database schema changes.

Security

• * Demo-sandbox protection now covers static page generation, SEO settings and system settings, blocking both page views and actions. Requires an administrator account; no unauthenticated access is involved.
• * The demo-site owner passphrase is separated from the scheduled-task token, which no longer authorises demo-mode management. Sites with demo mode enabled must claim a new passphrase — see the upgrade notes.
• * Static page generation only fetches from the site's own origin, refuses redirects and verifies HTTPS certificates. Requires an administrator account; no unauthenticated access is involved.
• * Site recipe import no longer writes security settings such as trusted proxies or the admin IP allowlist; export and import share one exclusion list.

Fixed

• * Rollback after a failed upgrade now restores the database snapshot as well; if that fails, file restore stops and recovery material is kept. Data created after the snapshot is lost — preserve it before upgrading.
• * Settings changes take effect immediately; with the Business theme, editing the site header starts from the live header and the header in the homepage canvas no longer flashes and disappears.
• * Disabled channels no longer appear in the footer navigation; the download centre renders English and Japanese correctly; Minimal and Aurora sidebar and contrast fixes.
• * Page-builder catalogues keep the current language across search, pagination and management lists; element display conditions work on PHP 8.0.

Added

• + Unified background colour, image and four-level overlay for Container, Div, Card, Quote and Icon Box in the page builder; containers accept a direct-link background video. The style panel is grouped into General / Background / Animation with modified-state dots.
• + Dashboard shows theme updates separately with a direct link to the theme market; theme appearance settings keep a colour profile per theme; market themes declare the minimum CMS version they need.
• + Business homepage sections alternate light/dark surfaces automatically; dynamic blocks gain a "Section surface" option.
• + Catalogue blocks get edit-detail entries, auto-refreshed previews and four distinct empty states; carousel editing is grouped with undoable slide actions; the About block shows inherited content with per-field restore.

Upgrade notes

• ~ This release changes the database schema — run "Database upgrade" after upgrading. Sites with demo mode enabled: run php bin/yikai.php demo:owner-token on the server to claim the owner passphrase. The static generation base address must share the site's origin. Market themes require CMS ≥ 1.19.4.

Security

• * Switching demo mode now requires the site owner token. Anyone holding a demo site's administrator account could previously turn demo mode off and gain full write access, and public demo sites usually publish that account. This does not allow unauthenticated access; an administrator account is required.
• * Site recipe exports no longer include secret settings. Exports previously carried the scheduled-task token, licence key, SEO submission key and mail server account, which would be distributed with any recipe shared as a template. Regenerate recipe files you have already exported and rotate the keys that appeared in them where appropriate.
• * Importing a site recipe can no longer write secret or machine-identity settings. A third-party recipe could previously overwrite the encryption key, the scheduled-task token and the demo mode switch.
• * The official media endpoint is restricted to the official domain over HTTPS, and header, footer and statistics background image addresses are validated against an allowlist before being written into styles.
• * Roles without the code element permission can no longer use code elements through the editor preview channel, and licence, mail, AI, translation and API settings pages cannot be opened while demo mode is active.

Permissions and page design

• + Yikai Builder access can be granted per scenario: single page and section editing, the home page, site-wide design (header, footer, popup) and code elements. The home page and site-wide design are not granted automatically and must be assigned explicitly.
• + Page hero sections can take their styling from the current channel, inherit it from the parent, or use the site default; height, overlay strength, alignment, focal point and text tone are adjustable.
• + Headers and footers can be assigned dedicated versions per language and per channel or page; elements support conditional visibility and the slider gained mobile display modes.
• + Official media library: browse and import officially supplied imagery from within the editor.

Fixed

• * Statistics figures and captions edited under Home Settings now take effect on the front end.
• * Opening and saving the demo settings page on a sandbox site no longer turns the sandbox off, and the grid alignment of two home page sections was corrected.

Improved

• ~ The default demo content was redesigned: the primary colour is now blue and body text meets accessibility contrast requirements. Demo imagery ships with the package instead of being fetched from an external image service, so offline and intranet deployments render identically.
• ~ Package size reduced by roughly 6 MB. Site Health separates required from recommended runtime requirements, so PHP 8.0 and 8.1 are no longer reported as critical (8.2 or newer is recommended).

Before upgrading

• * This release changes the database schema. Run the database upgrade in the admin area after updating.
• * Header, footer and statistics background images entered as protocol-relative addresses, as uploads/ without a leading slash, or as data URIs need to be selected again after upgrading. The original values remain in the database and no data is lost; images chosen through the media library are unaffected.

URLs and Pinyin

• * Chinese title URLs are generated from Pinyin again. The 1.19.1 package was missing the Pinyin runtime, so Chinese titles produced item- timestamp URLs. Existing content URLs are unaffected. 1.19.1 users should upgrade.
• ~ Pinyin conversion was rewritten for better handling of characters with multiple readings; model numbers and acronyms in a title are preserved ("完整的API文档" now yields wan-zheng-de-api, where the acronym was previously dropped).

Yikai Builder editing

• + Added a focused header preset editor, so header styling can be adjusted without locating it on the full-page canvas.
• * A blank canvas on a new page no longer renders the site header and footer; the empty-state prompt returns to the content area.
• ~ Header actions now state their editing scope, the element library sits above the structure panel, and the page canvas shows the site header and footer frame.

Install and packaging

• * Removed a placeholder entry from the FAQ section of the demo data.
• ~ Packaging gained a runtime self-check: it verifies that required runtime files are present and exercises a key function. No new database migrations in this release.

Yikai Builder editing

• + Elements and prebuilt sections now have separate searchable libraries with categories, favorites, and recent items; built-in sections expanded from 8 to 14.
• + Drag elements or sections to precise canvas and structure-tree positions with clear before, after, and inside feedback.
• ~ Side panels are resizable and collapsible; previews preserve context, and dragging no longer scrolls through the entire page.

Admin and fixes

• ~ Site Health notices can be closed or dismissed permanently without disabling Site Health.
• * Missing logo and favicon assets are diagnosed without showing broken images. This release has no new database migration.

Added

• + Responsive image output and optional WebP derivatives reduce page weight while preserving original-format fallbacks.
• + Site Health reports media optimization status and runs guarded, resumable batch repairs for large libraries and shared hosting.
• + Eight reusable Yikai Builder sections and a practical service-process page template are included.
• + Stable section and element identifiers connect frontend edit actions to the exact editor target, with return navigation, highlighting and draft actions.

Improved

• ~ Redirected-page editing opens the content visitors actually see; header, footer, home, channel, article and contact editing share a consistent return flow.
• ~ Footer template editing opens with the editable footer in view. Yikai Builder logo blocks now use the configured site logo and offer logo-creation links.
• ~ Plugin marketplace search, install labels and feedback are clearer. CI now validates a real MySQL 5.7 install, migrations and admin rendering.

Fixed and upgrade note

• * Fixed long media-scan expiry, legacy Yikai Builder image URLs, moved uploads roots, missing browser pre-scaling and the image-pixel-limit off switch.
• ! Yikai Builder logo blocks now use the site logo. Sites that used a separate white logo on dark headers should verify contrast. This release adds no database migration.

Added

• + Resumable, chunked upgrade downloads: each request fetches a small range and records progress on disk, so a gateway timeout or dropped connection resumes from where it left off instead of starting over. On some hosts the gateway used to cut the download at 60 seconds; ships with this release and takes effect from the next upgrade onward.
• + Site Health gains an uploads-directory execution probe, verifying whether the server would execute PHP placed in the uploads directory. The three server configuration samples in deploy/ have been updated with matching rules.
• + A site-health summary is included in the upgrade heartbeat: only check identifiers and counts are reported — no site paths or content.
• + Two full-page templates ship with the package: “Company Introduction” and “Contact Us”, ready for one-click insertion from the template library. The contact page’s form, address and map all read from Settings → Contact.

Fixed

• * FAQ accordion items were lost after saving in the page builder (affected since 1.18.6; sites using this element should upgrade promptly and review the pages concerned).
• * Home page banners showed Chinese text on English and Japanese sites. Fresh installs now feed the home banner from Banner management filtered by site language; affected sites are repaired automatically by this release’s database migration (as long as the default banner content had not been customised).
• * Formatting of factory sample content did not take effect: list, centering and badge styles in factory blocks such as the pricing section were removed by the security filter. They now use bundled style classes; existing sites are repaired by the database migration.
• * The “Insert template” button for local templates in the template library could not be clicked; two overlapping hint messages appeared on the empty canvas when creating a new page.

Improved

• ~ The package root has been slimmed down by removing two internal files unrelated to running a site. This release includes one database migration — after upgrading, please run the database upgrade in the admin panel.

New

• + Site Health. A new Site Health page and dashboard summary run 22 checks across runtime environment, security settings, pending database migrations, update service and recent backups. Three of them request your own site to verify that the web server really does block the configuration, program and runtime data directories — some hosts ignore the rules shipped with the package. Also available from the command line.
• + Server configuration samples ship with the package. The deploy/ directory now contains sensitive-directory rules for full Nginx, BT panel and Aliyun shared hosting.

Security

• ! Two legacy installer upgrade entry points have been removed. They performed database writes without checking for a signed-in session and were directly reachable on servers that do not block install/. New packages no longer contain them, and upgrading removes any copy already present on the site. Upgrading promptly is recommended.
• ! Admin activity logs no longer store raw request content: passwords, keys and API credentials are redacted, and oversized payloads are stored as a summary. This release includes a migration that cleans sensitive data already recorded in older log entries.
• ! Disabled or deleted member accounts lose their signed-in sessions on the next request. Product spreadsheet import enforces archive resource limits and disables external entity parsing. Form signatures are bound to the form identifier and timestamp; redirects use strict same-origin validation.

Fixed

• * The manual upgrade guide now states the real risk: the package contains no site configuration or uploaded content, so replacing files cannot affect them; what needs attention is files you have modified that also exist in the package.
• * Site icon: the package no longer ships a root icon file, and sites without a configured icon no longer point at a missing address. The admin sign-in page and the layout editor now carry a tab icon.

Improved

• ~ During an online upgrade, a failed automatic database backup now stops the run before any program file is written. A super administrator with an external backup can confirm and continue; that action is recorded in the activity log.
• ~ Database restore, import, truncate and optimise operations are dispatched per database driver, so SQLite sites no longer fail on MySQL-only statements. Page cache keys are built from normalised query parameters.
• ~ fileinfo, dom and simplexml are required extensions; zip is recommended. This release includes one database migration — run the database upgrade in the admin area after updating.

New

• + Automatic updates (beta). Enable under System Upgrade → Upgrade Settings to have the site install updates during a maintenance window you choose, either security-only or all releases. Before each run the database is backed up and every file to be replaced is snapshotted; a health check runs afterwards and any failure rolls the site back to its previous state. Releases carrying database migrations are never installed automatically and are left for manual upgrade. Off by default and currently marked beta — try it on a non-production site first.
• + Manual upgrade guide. System Upgrade → Manual Upgrade walks through the file-replacement steps and states which files the package overwrites and which site files must be kept — useful on hosts where online upgrades are unavailable.
• + Navigation icons. A single site-wide switch matches an icon to every menu item from its name and channel type; each channel page offers an icon grid to change it, and manual choices always win. Long menus collapse into a “More” group instead of wrapping.

Security

• ! Rich-text sanitisation is now a tag and attribute whitelist, closing script injection via embedded frames, entity-encoded pseudo-protocols and unquoted attributes. Reaching this requires an admin account; there is no unauthenticated path.
• ! Builder element control data is validated and cleaned by type on save, so malformed values no longer reach page output.
• ! SEO endpoints now check content editing permissions.

Fixed

• * Builder: switching between home page and header editing, Logo element image and pixel height, template preview links.

Improved

• ~ The install package is down from 18.7 MB to 7.8 MB. The icon library ships as an indexed bundle, and Logo Designer and SEO Assistant moved to the plugin marketplace.
• ~ Incremental upgrades now cover 19 previous releases instead of the last 3, so most sites download a few megabytes instead of the full package — noticeably fewer upgrade timeouts on shared hosting.
• ~ Online and automatic upgrades share one download, snapshot and rollback pipeline.
• ~ Mail settings include presets for common providers that fill in server and port. The language switcher shows a globe icon with language names by default.
• ~ The package no longer contains a root favicon.ico, so upgrading never replaces your own site icon. fileinfo and dom are now required extensions. No database schema changes in this release; no migration is required after upgrading.

Security

• ! The Yikai Builder "Code/HTML" element now requires a dedicated permission (super administrators only by default); regular editor roles can no longer emit arbitrary scripts through pages.
• ! Yikai Builder element hardening: two-layer rich-text sanitizing on save and render; button/card/image links reject pseudo-protocols; video embeds are limited to trusted platform hosts; iframe hosts in rich text are matched exactly. All items require a back-office account — no unauthenticated attack path. Upgrading promptly is recommended.
• ! Theme/plugin/upgrade archives gain extraction resource limits; banner links gain protocol validation.

Added

• + Trailing CTA button for navigation elements (nav / mega menu / mobile drawer): text, link and solid/outline styles, adapting across desktop and mobile.
• + Online upgrade gains file-level snapshots, an automatic health self-check and one-click rollback to the pre-upgrade state.

Fixed

• * The HTML page cache no longer stores files for URLs with marketing or unknown query parameters (unbounded disk growth); expired entries are pruned automatically.
• * The template manager no longer stalls when the online template catalog is temporarily unreachable.

Improved

• ~ Template manager: header/footer presets show layout wireframes and fit one row on wide screens; refined collapsed admin sidebar.
• ~ Public API rate limiting counts accurately under concurrency; passing the API key via query string is deprecated — use the X-API-Key header. No database schema changes in this release.

Added

• + The site Header can be edited visually in Yikai Builder, with several ready-made presets (centered, full-width…) for one-click use.
• + Language switcher flag option; browser-side image compression on upload; one-click cache clear in Yikai Builder.

Improved

• ~ Broad mobile accessibility & responsive polish (nav drawer, compact header, larger touch targets, reduced-motion); PHP 8.5 compatibility.

Fixed

• * Interrupted online upgrades resume from the server cursor; various header-edit and editor interaction fixes.

Fixes

• * Online-upgrade batch progress is now tracked on the server: lost responses or replayed requests resume from the server-side cursor instead of re-copying or skipping files.
• * Fixed Yikai Builder element library not scrolling and its bottom rows being clipped in some environments.
• * Fixed newly added Yikai Builder sections briefly appearing at the top of the page until the editor was reopened; the canvas scroll position now stays stable during inline editing.

Other

• ~ Upgrade compatibility regression now covers six baselines from 1.12.9 through 1.18.1. No database schema changes; no action required after upgrading.

Added and changed

• + Free installations can edit, preview, and publish the homepage, standard pages, top-level product channels, and top-level list channels with Yikai Builder.
• + Built-in, local, and plugin templates remain available; remote downloads and site-wide advanced features still require entitlement.
• + The updater now supports stable and beta subscriptions, with stable as the default.

Security

• ! RSA signatures are mandatory for full and delta packages. Admin IP restrictions support trusted proxies and IPv4/IPv6 CIDR with lockout prevention.

Fixes and compatibility

• * Saving a channel without selecting a replacement image now preserves the existing image.
• ~ Default-theme upgrades do not publish or replace the live homepage, page HTML, Header, or Footer; classic homepages only receive an unpublished Yikai Builder draft.

Fixed

• * Opening some legacy pages in the visual builder showed an empty canvas (content stored in the channel record); the existing content is now imported automatically.

Added

• + Site logo display control: frontend and admin logos keep their natural ratio with configurable max heights (px).
• + The on-page “Change logo” action is now a full dialog: pick from the media library, upload, set alt text and max height in one place.
• + The hero background image in page and channel editing now supports upload and media-library selection.

Improved

• ~ Added bottom padding to the builder element library so the last row is no longer covered when scrolled to the end.

Added

• + Built-in visual builder (Yikai Builder), enabled by default: visual editing, preview and publishing for pages work out of the box. After upgrading, the classic homepage is only converted to a draft — the live site is unchanged.
• + Customizable page hero: set a dedicated banner background per page/channel, or hide the banner entirely; the contact page supports an image banner.
• + Channel landing pages (e.g. News) can now be designed and published with the builder.
• + New builder elements: organization chart (zoom & drag), content catalog, product catalog; the CTA element supports a background banner and "follow homepage CTA settings".
• + Logo Studio random generator: batch-generate logo candidates by industry and color scheme, apply as the site icon in one click.

Improved

• ~ Navigation: desktop menu renders as a single non-wrapping row from 1280px; narrower screens use the drawer menu. Language switcher now uses the standard ZH/EN/JA codes.
• ~ AI assistant model catalog refreshed to the vendors' current line-ups, with one-click sync in the admin panel.
• ~ Demo content fully refreshed: new homepage, organization chart and contact page samples.

Security

• ! The builder canvas preview now enforces a strict Content-Security-Policy; scripts inside user Code elements no longer run in the editing canvas (frontend output unaffected). No unauthorized-access risk; no action required.

Fixed

• * Console script errors on every admin page (caused by the AI assistant overlay) and unresponsive overlay buttons.
• * </head> / </body> hints in Custom Code settings displayed as escaped text.
• * Missing images on demo pages of fresh installations.
• * Chinese factory texts leaking into homepage settings of non-Chinese sites (auto-repaired on upgrade).

Added

• + Appearance settings: set fonts separately for Chinese, English and Japanese, with built-in font presets, self-hosted font upload and adjustable base font size.
• + Custom currency: pick from 24 common currencies with symbol and decimals filled in automatically, or define your own — per language if needed.
• + Upgrade completion page and an Upgrade History tab showing what changed, past upgrades and backups.
• + Privacy Policy and Terms of Service pages now ship with starter text in three languages. Please adapt before publishing.

Fixed

• * An error when switching the site default language.
• * The sitemap included pages of languages that were not enabled, and robots.txt used a non-standard Sitemap address. Re-submitting your sitemap after upgrading is recommended.
• * Online upgrades overwrote robots.txt, favicon.ico and .htaccess; your own changes are now preserved.
• * Chinese text appearing in many places on English and Japanese sites (product pages, pagination, login page, upgrade pages, plugin screens and more).
• * A missing space between the home page About heading and the site name, and English headings broken mid-word in some themes.

Fixed

• * Price currency symbol did not follow the site language in the admin product list, content detail page and product carousel (English sites showed ¥).
• * On non-Chinese sites, newly created product categories / links / timeline entries did not appear in the list.
• * A brand-new site could not create its first product tag group.
• * The factory default of the language field on three tables was incorrect, which could file new records under the wrong language (corrected automatically on upgrade; existing data untouched).

Added

• + Site menus: build multiple navigation menu groups (channel references / custom links, 3-level nesting, drag & drop sorting), usable as the header navigation source.
• + Footer columns can reference menu groups (with titles) — build a menu once, reuse it in header and footer; footers can be configured independently per language.
• + Product price currency follows the site language: $ on English sites, ¥ on Japanese sites.

Improved

• • Full English / Japanese support across the admin, including the layout editor, media library and system pages.
• • Multiple Yikai Builder upgrades: mega menu, in-canvas insertion, one-click template installs, official header templates, dual icon libraries.
• • Product channel URL alias is now fixed to "product", matching the category page prefix.

Fixed

• * After switching the default language, settings forms showed the old language and edits did not take effect.
• * Single-language sites could render channels from other languages on the home page.
• * "Recently used" kept showing titles in the previous admin language.
• * A blank panel remnant appeared at the top-left when expanding the sidebar.

Fixed

• * Media library "Scan & import" failed with an "Invalid request" error on 1.16.x. All 1.16.x sites should upgrade.
• * The "Choose image" media picker could not confirm a selection: clicking an image or the "Use this image" button now fills the original field and closes the window.

Improved

• + Admin async requests now carry the security token automatically, preventing this class of "Invalid request" issues.

Fixed

• * Sites using a non-default theme (Business, Aurora, Minimal, …) could not open the Contact page after upgrading to 1.16.0. All 1.16.0 sites should upgrade.
• * The Partners section did not render on non-default themes when enabled.

Important

• ! The software licence changes to the YikaiCMS Software Licence: still free for commercial use with no front-end attribution required; the free edition keeps the Powered by mark in the admin panel, which a commercial licence may hide; redistributing the software itself requires prior written permission. v1.15.x and earlier remain under the original MIT licence.

Fixed

• * Links containing character entities in article content could render a blank page. The relevant module has been rewritten and covered by unit tests.

Added

• + The Contact page now supports layout editing: contact cards, the enquiry form and the map are elements you can place freely, with any other content in between.
• + New shortcodes [contact-cards] and [map] call the contact cards and map from any article, page or layout block.
• + Layout editor can hide a section: hidden sections are not rendered on the site but stay visible and restorable in the admin.
• + Drafts can be previewed: the admin list marks draft status, and the preview link opens only for its author and is not counted as a view.

Improved

• ~ Edit links in Category and Page management now open the editor matching the page type, so layout pages no longer lose their layout by opening the plain editor.
• ~ After installation the admin login URL, account and password are shown directly and can be copied in one click.
• ~ Dashboard shortcuts can be reordered by dragging again; homepage sections expand by clicking the title.
• ~ The plugin market distinguishes free and paid plugins with a PRO badge; features already obtained remain usable after a licence expires.
• ~ All Icon Studio features are now free.

New

• + Element-level canvas picking in Yikai Builder: click any element on the canvas (including children inside containers) to select it, with two-way sync to the structure tree, auto-scroll and an overlay highlight showing the element path.
• + Drag-and-drop sorting in the structure tree: reorder sections, elements within a column and container children; selection follows after sorting.
• + In-editor revision history: browse, preview and restore saved snapshots from the top bar, with an unsaved-changes badge and a leave-page confirmation.

New

• + Yikai Builder (experimental): a full-screen three-pane workspace — element library and settings on the left, live canvas preview in the middle, structure tree on the right. Layouts are organized as Section → Container → Column → Element, with the section as a full-width background layer and the container as the content layer, each styled independently. Supports canvas click-to-select, drag-and-drop insertion and desktop/tablet/mobile preview. Available from Pages and the layout editor.
• + Container element: one extra level of nested layout inside a column, with direction, gap, alignment, background, padding and radius controls; fully interoperable with the layout editor.
• + Gradient section backgrounds: eight presets plus custom two-color gradients with direction; container width now accepts custom pixel values with independent background, padding and radius.
• + More elements: image, video and code/shortcode (paste a form or carousel shortcode to embed the feature); icon settings now open a searchable library of 5,000+ icons.
• + Media library scanner: registers legacy files under uploads/ into the media library in one click; built-in image picker and uploader in the editor.

Fixes

• ! Legacy layout data with missing or duplicate section IDs prevented the Yikai Builder structure tree from rendering; now auto-repaired on load and persisted on save.
• · The icon-box element only accepted hand-typed icon names; both editors now provide an icon picker.

Improvements

• · Rich-text elements now open the system visual editor (modal, with image upload and media library).
• · The admin sidebar toggle moved to the top bar; when collapsed, clicking the logo or empty sidebar area expands it.

Security

All issues below require an existing admin account; none permit unauthenticated access. Sites using multiple roles should upgrade first.

• ! Fixed unauthorised read access in Trash. Any content permission previously allowed viewing the titles and counts of deleted items of every type. Category tabs and listings are now permission-filtered, and items sharing a table are evaluated by their own type.
• ! Upload permissions split into three tiers: inline images, documents and archives, and media library management. The upload type was previously supplied by the client, so any content editor could upload every permitted file type.
• ! Session permissions are now re-evaluated on every request. Role permission changes and role reassignments previously had no effect on active sessions, and disabled or deleted accounts remained usable.

Fixes

• ! Invalid article URLs in the sitemap. The content type was not retrieved when building links, producing malformed article URLs; the same cause affected static generation and site search. Re-submit your sitemap after upgrading.
• ! With static generation enabled, administrators could not use the admin bar or inline editing on the front end, and content updates were not immediately visible. Administrator requests now bypass static delivery. Self-hosted Nginx requires a configuration update per deploy/nginx-server.conf; the static generation page detects and reports this automatically.
• · Job editing, Trash and Member settings were inaccessible to non-superadministrators.
• · Dashboard update checks were cached for too long and continued to report the previous result after a release. The cache duration has been reduced and manual re-checking is now supported.
• · The page list did not indicate the editing mode, and Edit always opened the rich-text editor, where saving clears the builder layout. The list now shows the mode, Edit opens the corresponding editor, and overwriting a layout requires confirmation.

New

• + Theme package specification and install validation: CMS and PHP version requirements, required plugins and required templates are verified, including before switching themes. Older theme packages are validated leniently and installed themes are unaffected.
• + The demo page "Company Profile" is now a layout-builder example comprising seven sections and eight element types.

Improvements

• · Theme preview images converted to JPEG with a width limit. The installation package is reduced from 19MB to 11MB and delta upgrades from 5.2MB to 632KB.

Security

A cluster of privilege-escalation gaps left behind by the fine-grained permission rework. All require an existing admin account — none allow unauthenticated access. Low risk for single-admin sites; sites with multiple roles (editors / contributors) should upgrade promptly.

• ! The AI assistant's capability checks were effectively no-ops: 14 of 15 capabilities only asked "is someone logged in". "Publish content" acts on an id without checking its type, and articles, cases, pages and downloads all live in one table — so an account with article-only rights could publish any page
• ! The upload, media-library and revision-history endpoints had no permission checks; revision history could be used to roll any page back to an older version
• ! Some sensitive settings (cron token, translation API key, …) were readable by any admin account

Fixes

• ! Job editing, Trash and Member settings were inaccessible to non-superadmins — they were gated on keys retired during the permission rework. "The job list opens but clicking Edit says permission denied" was this bug
• · The HTML cache wrote error pages to disk, serving a one-off 500 to every visitor for the whole cache window — with no new log entries, making it very hard to diagnose
• · Current category not highlighted on the news list

Upgrade integrity

A new automated check asserts "fresh install ≡ old site after all migrations". Its first run surfaced long-standing gaps:

• ! The multilingual base columns (twelve tables) never had a migration — they only ever went into the install SQL, so sites installed on older versions broke mid-chain on upgrade
• ! The two custom-field tables were likewise only ever created by the install SQL — that feature was entirely unavailable on every upgraded site
• · Three missing columns; two migrations that could not run at all on SQLite

Customization & permissions

• · Upgrades no longer overwrite the site override layer (overrides/); a new routing extension point lets legacy URLs from a migrated system work without touching core files
• · Jobs and Timeline get their own permission keys (they previously borrowed article rights); the upgrade preserves existing rights exactly, and they can now be tightened individually
• · The Contributor rule is now explicitly if you can edit, you can add images; the role description has been corrected to match

Fixes

• ! 404 on some article pages: article URLs were generated in a form the rewrite rules routed to the single-page handler. This also affected sitemap URLs and the addresses SEO Toolkit submitted to search engines — re-submit after upgrading
• ! Nine database columns missing on sites upgraded from older versions: saving builder pages, products or cases failed with Unknown column. This release adds the missing migration
• · Parent product category pages listed only directly attached products, excluding those in subcategories (sites whose categories live in the channel tree)
• · Current category not highlighted on the news list; mobile admin topbar title stacked vertically and the search icon overlapped its input

Security

• ! URLs entered by administrators (friendly links, social accounts, external download links) were only HTML-escaped, so javascript: and similar pseudo-protocols remained clickable. Friendly links render in the public footer, exposing every visitor. This release enforces a protocol whitelist on both output and save

New

• · Redesigned admin lists (articles / products / cases / downloads / jobs): hover a title for Edit｜Duplicate｜Trash｜View, status merged into the date column, placeholder for missing covers, and a "Bulk actions ▾ + Apply" bar at the bottom
• · Reworked sidebar: single-open accordion, group icons, collapsible to an icon rail with hover flyout submenus
• · New "Product category tree" homepage block with configurable title, columns, item count and search box
• · Copy button and language label on front-end code blocks — existing articles benefit automatically
• · Update notifications configurable as All / Security only / Off; the plugin list now flags and one-click upgrades available updates

Improvements

• · License keys are no longer echoed in plain text (masked, with an explicit replace flow); the license page is now fully localized in English and Japanese
• · Unified tab bar on the upgrade pages; the "Database upgrade" tab now appears only when needed

Fixed

• ! 500 error on admin login with PHP 8.0 + SQLite: integer columns come back as strings on PHP 8.0, causing a type error. Sites installed in SQLite mode on PHP 8.0 hosts should upgrade
• · Two warning noises on the new-article page and during online upgrades

Engineering

• · New PHP 8.0–8.2 compatibility test suite: every release now performs a real install, login and content-saving pass on both versions before shipping

Critical Fix

• ! 500 error when saving articles/products on PHP 8.0 hosts: the pinyin component required PHP 8.1. Replaced with an 8.0-compatible version, plus a fallback so slug conversion failures never block saving. PHP 8.0 users are strongly advised to upgrade

Fixes & Improvements

• · Dropped characters in auto slugs for pure-English titles
• · Editor showed "JSON parse failed" instead of the real error message
• · Broken URLs in SEO Toolkit llms.txt / submission list for slug-less content
• · Color tint on front-end inline-edit hover; updated Nginx notes on static output page

New

• + Error self-detection: severe errors are always logged (no debug mode needed); view details and stack traces in Admin → System Info → Error Log; friendly error pages instead of blank screens
• + SEO Toolkit plugin (pre-installed): free llms.txt generator, real-time writing analysis, SERP snippet preview, Baidu/IndexNow submission; Pro unlocks one-click AI meta optimization, 301 redirect manager + 404 monitoring, site-wide SEO audit with bulk fixes
• + White-label delivery: licensed sites automatically hide system branding and version info across the admin panel — ideal for agencies delivering to clients; current version remains visible on the upgrade page
• + Admin date picker (flatpickr), content video player (Plyr), image lightbox (PhotoSwipe)

Improved

• · Full-width layout for license / upgrade pages; license page now lists Pro benefits
• · Cross-links between SEO settings and the SEO Toolkit plugin

Fixed

• · Garbled Chinese in llms.txt (.txt now served as UTF-8)
• · Some module names shown as raw keys on the license page

New

• + Granular role permissions (WordPress-style): content split into edit/delete per type; five default roles (Super Admin / Contributor / Editor / Content Manager / Operations); a product editor cannot touch articles; existing roles migrated losslessly on upgrade
• + Product spec presets: define presets in Product Settings (model/size/material…); new products are pre-filled, collapsible, fillable from presets; the front-end spec table renders by display name

Improved

• · Upgrade guardrails: site-wide alert + one-click link when DB migrations pend; clear error when deleting with an un-migrated schema; online upgrade auto-forwards to the DB upgrade step
• · Dashboard quick-access is now role-aware, drops the rarely-used theme tile, adds DB backup / articles / products

Fixed

• · Upgrade history page white-screened when a migration lacked a title

New

• + Runs on any WordPress-ready host: just pick the "wordpress" rewrite preset (built-in single-entry router); installer guidance simplified accordingly
• + FAQ toolkit: homepage accordion block (with FAQ structured data), builder accordion element, "FAQ" preset channel in the batch catalog; editable right from Homepage Settings
• + List channels can now configure which card elements to show (cover / summary / author / date / views / category)

Improved

• · Upgrade guardrails: site-wide alert with one-click link when DB migrations are pending; clear error message when deleting with an un-migrated schema; online upgrade auto-forwards to the DB upgrade step
• · nginx config samples moved out of the web root to avoid scanner probing

Fixed

• · Saving a channel silently cleared "Show on Homepage", making homepage blocks disappear
• · Unknown URLs now return a real themed 404 (previously rendered the homepage, hurting SEO)

New

• + Icon Maker plugin: canvas-based logo editor (multi-line text, drag positioning, quick align, letter spacing, color presets); generate a favicon online and apply it to your site in one click; entry points in Site Settings and the front-end admin overlay (free on the plugin market)

Improved

• · Online upgrade page now checks automatically on open, clearly showing version comparison, release date, upgrade level and full cross-version changelogs
• · Homepage news images unified to the same 4:3 ratio as product images; no more stretching on mobile
• · The 404 page now follows your theme style

Fixed

• · Admin sidebar now filters by role permission; menus you cannot access are no longer shown

New

• + Content revisions — articles / pages are archived before every save; view recent versions and restore with one click

Improved

• · Action columns in admin lists no longer wrap
• · Online upgrade lists any files it failed to overwrite and writes a persistent log
• · Page builder improvements (more elements, live preview, block-level titles / subtitles, etc.)

Fixes

• · Fixed "install failed" when installing plugins from the plugin market (a missing security module left zipUnsafeEntry undefined); the online-upgrade page's backup notice now links directly to the built-in database backup.
• · Pressing Enter in the Tags field and then Save created a duplicate article — fixed (Enter is prevented, and a save now updates instead of re-inserting).
• · A deleted article disappeared from the site but lingered in the admin list — the admin article list now filters soft-deleted rows.
• · Article-list cover images now use a fixed aspect ratio (default theme) instead of varying with title/summary length.
• · Remote/external image URLs no longer trigger open_basedir warnings on restricted servers.
• · Uploads no longer fatally fail when the fileinfo extension is missing (graceful fallback; installing it is still recommended).

Editor

• · Insert images directly from the media library in the rich-text editor.
• · Code-block insertion plus front-end code-block styling, so code renders distinctly on the site.

New features

• + Homepage block extension hooks: homepage blocks can now be registered by plugins. Comes with an official "Product Carousel" plugin (hand-pick products for a homepage carousel), free on the plugin market.

Fixes

• · Case / news list pages now aggregate content from all sub-categories — "All cases" and other parent channels no longer show only their directly-assigned items.
• · New articles saved without a category no longer "disappear": they default to News, and the admin list also shows uncategorized articles so they can be re-filed.
• · Channel blocks that are mounted on the homepage but have "show on homepage" turned off no longer vanish from the homepage settings and can be re-enabled.

Improvements

• · Single-page admin gains a "Disable" action; delete buttons across the cases / articles / downloads / jobs lists now show an icon + label.

Security

• + Block nginx.conf / config templates / dependency manifests from being served as static downloads; release packages now exclude deployment sample files.

Fixes

• · Online upgrade getting stuck at the "extract" step on some shared hosts — replaced the failure-prone ZipArchive extraction with per-file streaming from the package; upgrade errors now surface clearly instead of hanging indefinitely.
• · When adding content / cases in the admin, the category dropdown mixed in channels from other languages (e.g. Japanese) — now filtered by the current editing language.

New features

• · Case category management: a dedicated Categories tab under Cases (add / edit / delete, ordering, status, navigation) — no need to go to Channels.

Improvements

• · Download categories now use clean URLs /download/{category}.html (instead of ?cat=N), consistent with products / news and better for SEO; old links still work.

New features

• · Incremental (delta) upgrades: only changed files are downloaded and overwritten, applied in batches — fixes stuck / timed-out online upgrades on shared hosting.
• · Version check on the dashboard: shows the current version and checks for updates, with one click to the upgrade page.
• · AI assistant site editing (preview): describe the change in chat → assistant proposes → apply on confirm → one-click undo.

Improvements

• · Homepage block editor: partners are now a draggable block, disabled blocks sink to the bottom, plus custom blocks and a pricing-table preset (with a recommended highlight); the banner block lists each carousel group's shortcode.
• · Page builder: heading alignment and custom card background color.

Fixes

• · Unified download categories: the download page sidebar, filter and admin editor now stay consistent — fixes mismatched categories; empty category sets are seeded with defaults.

Fixes

• · New content / products / downloads / jobs saved their language field (lang) as “ja” from the DB column default, so new records were hidden when filtered by the site default language. The current editing language is now written explicitly on create.

Fixes

• · Admin Case & Content lists did not filter soft-deleted items, so deleted (recycle-bin) entries still showed. Now filtered. Thanks @dukehug.

New features

• · Product multi-condition filtering: filter product lists by brand / tag group / price range; link-based, cacheable & shareable
• · Template tag enhancements: {yk:if}/{yk:else} conditionals, the “current content” context in detail bodies, and {yk:list} id / related
• · Public content API (/api/v1): read-only JSON for mini-programs / apps / static sites; off by default, optional API key + rate limiting

Improvements

• · Homepage visual refresh, alternating block backgrounds; selectable section-title styles, customizable “About” title
• · Testimonials up to 10 items, auto carousel when more than 3
• · Front-end inline editing extended to every front-end page; admin settings pages made full-width

Fixes

• · 500 on homepage/admin for fresh installs (install SQL now includes soft-delete migration columns + regression guard)
• · Minimal theme scroll-in animation, nav dropdown, and language switcher

New features

• · Page builder: visual section → column → element layout with 17 built-in elements (heading/rich text/image/button/icon/video/CTA/card/alert/quote/icon box/dynamic list/carousel/nav…), drag-and-drop sorting
• · Live preview: debounced iframe refresh with desktop / tablet / mobile viewports
• · Responsive values: padding, gaps and spacer height can be set per device tier
• · Reusable blocks: save sections to a library and insert by reference — edit once, update everywhere
• · Preset library: 7 section presets (hero/features/CTA/team/gallery/stats/testimonial) plus full-page templates, one-click insert
• · Custom content models: define content types in admin and use them instantly via template tags and the builder dynamic list

Improvements

• · Channel and page managers tuck disabled items into a "Disabled" list with one-click restore
• · Builder polish: icon picker collapses after selection; wider two-column section settings dialog

Fixes

• · Live preview request blocked by CSRF protection
• · Duplicated table prefix in block library endpoints

New features

• · Template tags {yk:list|nav|field|channel|banner|config}: embed dynamic data in content without PHP; editor cheat-sheet included
• · Admin two-factor authentication (TOTP), compatible with common authenticator apps
• · Recycle bin / soft delete: restore or permanently delete content, products, albums, downloads, jobs
• · Scheduled tasks: timed publishing / recycle-bin cleanup / automatic database backup
• · Deploy configs deploy/: turnkey for BaoTa nginx and Aliyun shared hosting

Security & SEO

• · SVG sanitization, zip-slip protection, cookie_secure, login timing hardening, member login throttling
• · BreadcrumbList structured data; unified absolute site URLs

New features

• · Album shortcode [album-N]: embed an album anywhere in a page or article body, self-contained lightbox, one album reusable in many places
• · Album display modes (grid / masonry); admin album list & photo pages show the shortcode with one-click copy
• · Single-page cover toggle; cache-busting asset versioning; default inner-page hero background
• · Site announcement plugin (bundled, disabled by default); sticky header scroll transparency

Fixes & security

• · News list cards now reuse the theme card template; fixed disabled-language seed rows leaking into settings, and demo seed migrations falsely showing "pending"
• · Security hardening: removed a legacy tool file, hardened album shortcode JSON against XSS, enabled TLS verification for the AI service, added CSRF checks to AI endpoints, and whitelisted the member-login redirect

Maintenance

• · Removed the admin "pending migrations" upgrade prompt (dashboard banner + sidebar dot): on some sites it kept reporting a false pending count after upgrading, and was a bit intrusive
• · Added a standard MIT LICENSE file
• · Build hardening: release packages now contain only necessary files, preventing stray files from leaking in

New Features

• + Static HTML Generation: pages can be rendered to static files (one-click generate / clear in admin, auto-invalidated on content change), reducing shared-hosting load and improving SEO and first-paint speed
• + Front-end Admin Bar: when a logged-in admin browses the front-end, a top bar appears (back to admin / new / edit this page / clear cache / logout)
• + Update Detection: the admin counts pending database migrations so you can see at a glance whether an upgrade is due

Improvements & Fixes

• · Top-bar "Visit Site" changed to an icon button, language switcher changed to a dropdown; single pages now include gallery/album columns; upgrade menus merged into a single "System Upgrade" entry
• · Fixed rar / 7z uploads being wrongly rejected as "content does not match extension" on some servers
• · CSRF hardening: all admin POSTs are now verified, including progress-bar (XHR) uploads
• · Online-upgrade pre-check now tolerates hosts with disk_free_space disabled; rich-text editor init compatibility fix

New Features

• + Online Update: one-click check / download / extract-and-overwrite of new versions from the admin panel, with environment pre-check, SHA256 verification, and automatic config backup
• + Licensing System: License authorization with RSA signature verification, for easier distribution and license management
• + Form CAPTCHA: forms can enable an image CAPTCHA to further prevent bot submissions
• + Fullscreen Banner: carousel groups now support fullscreen display

New Features

• + Web analytics integration plugins: Baidu Analytics / 51la / CNZZ Umeng / Google Analytics 4 — just fill in the site ID and the script is injected automatically, no hand-written code needed
• + Interactive map on the contact page: the Chinese edition uses Amap / Baidu, while the Japanese / English editions use Google Maps (key-free); configure coordinates and provider under admin "Contact Settings → Map API", with application links and a latitude/longitude lookup guide
• + "WeCom" channel for live chat: scan the QR code to reach WeCom customer service
• + Article multi-image galleries: upload / drag-to-reorder multiple images on the content editor, displayed as a grid on the front-end detail page

Fixes / Maintenance

• + The admin browser tab icon now reads the site's site_favicon (no longer always showing the default icon)
• + The release package now bundles the runtime dependency overtrue/pinyin: previously the vendor directory was missing, so auto-generating a slug from a Chinese title would error out; production dependencies are now packaged in, ready to use right after extraction
• · Version number aligned to 1.8.0; Tailwind recompiled to include plugin UI styles

Maintenance

• · Admin footer "Powered by YikaiCMS" + version number; default theme <meta name="generator"> (can be disabled via expose_generator)

Cumulative Fixes

• + Fixed a parse error (white screen) on the job edit page: admin/job_edit.php mistakenly used <?php echo __('msg_save_success') ?> inside an echo '...' single-quoted string, and the inner single quote closed the string early, causing a PHP parse failure (present since v1.7.5)
• · Added the 6 translation keys used by the Aurora theme's advantage block (home_advantage_1~3_title/desc), fully covered across zh-CN / en / ja
• · Continues the "site settings cannot be saved" fix from v1.7.6.1

Engineering

• · CI fully green: PHP Lint (8.0–8.4), Lang Key Consistency, PHPUnit (8.2–8.4), and Psalm all pass

Fix: site settings cannot be saved (critical)

• + v1.7.6 had a critical bug that prevented the admin "Site Settings" page from saving; this release fixes it
• · Root cause: the sidebar menu foreach in admin/includes/header.php used $group as the loop variable, and because require shares scope, it polluted setting.php's $group (overwriting it with the menu array). At the bottom of the settings page, e($group) received an array and triggered a fatal TypeError → page output truncated → the form-submit JS listener was never registered → the form degraded to a native GET → the back-end POST save branch never ran
• · Fix: renamed the loop variable $group → $navGroup, eliminating the scope pollution

Content Operations

• + Batch import command bin/yikai import <products|articles> <csv>: idempotent by slug, categories/channels resolved by slug, supports incremental --update and --dry-run preview
• + Optional demo data: if you don't check "demo data" during install, products/categories/content/banners/albums marked with @demo are automatically stripped, keeping only the channel skeleton — a cleaner empty site to hand off

Front-end Experience

• · Empty channels auto-hidden (homepage blocks no longer render an empty shell when there's no content); homepage block titles such as "Our Advantages" are now configurable in the admin panel
• · News list articles without a cover show a placeholder image so the layout no longer breaks; contact page card icons have a fallback

Fixes

• + New settings are correctly categorized per config/defaults.php (live chat and other settings no longer pile into "Basic Settings" or display as raw keys)
• · The homepage SEO title now defaults to empty (even with demo data installed), falling back to the site name for the user to fill in themselves
• · Front-end HTML cache is invalidated automatically after settings change (the data_changed hook)

New Features

• + Live chat: floating button + multi-channel contact panel; position, button label, and displayed items are all configurable in the admin panel
• + Scheduled article publishing: articles go live automatically at the set time, no cron needed (status is lazily promoted on access)

Internals

• · Removed the legacy articles table, unified on contents; the install wizard version number now reads the real CMS_VERSION (no longer hard-coded to v1.0.0)
• · Install collation changed to utf8mb4_general_ci for compatibility with older MySQL 5.x hosts

New Features

• + CLI toolchain bin/yikai: a command registration / dispatch framework, laying the groundwork for batch imports and maintenance scripts
• + Scenario presets / plans system (a rework of the former "recipes") + cookie consent banner + demo mode persisted to the database (a read-only demo toggle in the admin panel)

Themes / Fixes

• · Aurora theme screenshots in place; fixed a </script> literal in a JS comment in recipe.php that broke out of the page

Fix the broken Aurora theme from v1.7.3.1

• + Tailwind compilation missed scanning themes/ —— dozens of utility classes used by Aurora, such as bg-slate-950 / backdrop-blur-xl / from-indigo-500, were never generated into tailwind.css. After the fix, tailwind.css grew from 96K to 111K
• + Added ~150 lines of .aurora-theme main inner-page dark scope overrides to Aurora: the bg-white / bg-gray-* / bg-primary / text-gray-* / .prose hard-coded in the root-level PHP (article/list/page) are all converted to their dark counterparts
• · User-visible: homepage blue button → purple-blue gradient; inner pages' large white-background black-text blocks → glassmorphic dark cards

Engineering wrap-up

• · Removed assets/css/src/ from .gitignore —— so app.css is checked in, preventing other developers from missing the themes/ scan when recompiling after a clone (the root cause of v1.7.3.1)

New theme: Aurora (modern tech / SaaS style)

• + Dark + purple-blue gradient + glassmorphism + grid background texture; target audience: internet companies / SaaS / AI service providers
• · 14 files: layouts (header+footer) / blocks (banner+about+advantage+stats+cta) / partials (5 card types) / aurora-* utility CSS
• · Enable it in the admin panel at /admin/theme.php to switch

i18n hotfix (missed in v1.7.3)

• + The admin login-failure error message was hard-coded in Japanese → now routed through __(). A leftover bug from the same source as the theme color / AI assistant labels already fixed in v1.7.3
• + Added 3 lang keys: login_invalid / login_throttle_locked / login_success (fully covered across zh-CN / en / ja)

Toolchain

• · release-precheck.sh / build.sh version-number regex extended to support 4 segments (hotfix version numbers like 1.7.3.1)

Comprehensive cleanup of i18n short-circuit bugs

• + configLang / configRawLang / configJsonLang / renderFormTemplate and 5 other functions no longer short-circuit on lang === defaultLang —— a fundamental bug where *_lang translation lookups were bypassed after the user switched the default language
• + ChannelModel / ContentModel / ProductModel::findBySlugLang() reworked: exact slug+lang → translation_group_id mapping → fall back to source row
• + isMultiLangEnabled() split into "switcher visibility" (the display toggle) and "filter-by-lang" (data correctness), so disabling the switcher no longer makes the homepage pull in multilingual rows
• · form_submit / page.php same-source short-circuit fixes (success message + album translation lookup)

Final cleanup of hard-coded strings in the admin panel

• + 8 hard-coded Japanese theme-color presets (クラシックブルー / エメラルド ...) → routed through __(), synced across all three language packs
• + AI assistant labels (sidebar menu + top-bar popover + the inline panel on the article editor + the assistant main page) unified through __('admin_ai_assistant')
• · admin/setting.php basic tab wired up to the lang switcher (site_name / logo / keywords / description per-lang); ICP / public-security filing numbers shown only on the zh-CN site
• · per-lang nav_home_show checkboxes only render enabled languages (no longer writing dirty keys for disabled languages)

Packaging optimization

• · build.sh excludes front-end dev files such as node_modules / package.json / tailwind.config.js, reducing the install package size by ~5MB

Internationalization fixes (same-day patch following v1.7.0)

• + Japanese pack 100% coverage: filled in 90 historically-missing keys (54 fd_* form-designer + 25 inq_* inquiry + 11 pe_* single-page editor)
• · History page (history.php) / timeline component hard-coded Chinese internationalized (added 8 lang keys, fully covered across all three languages)
• · Fixed Chinese text mixed in when the Japanese site visits /company/history.html

Core New Features

• + Multi-level product category menu: navigation supports arbitrary nesting depth, with hover-triggered flyout submenus (fully adapted for the default / business / minimal themes)
• + 3 timeline layouts: vertical two-sided (classic corporate milestones) / horizontal Swiper slider (responsive 1–4 columns) / compact list (suited to version logs and news feeds)
• + [timeline] shortcode: embed a timeline in the rich text of any single page / article / product, with layout / limit parameters

Admin UX Upgrades

• + HTML cache TTL setting changed to a 9-tier scenario-based preset dropdown (including recommended values for "content site", "corporate site", and "news site")
• + Timeline admin organized into TABs (event management / display settings) + inline live preview (see the effect as you edit)
• + Product category list gains a "show in navigation" toggle column for one-click control of front-end menu visibility
• + Album-type channel editor gains a "Manage Images →" quick-jump button (opens a new window to avoid losing edits)
• • Fixed the misaligned icon in the admin search box

Architecture Improvements

• + Replaced AOS with native IntersectionObserver (dropped a 21KB unmaintained dependency for a 1KB in-house replacement)
• + Timeline turned into a block: extracted into includes/blocks/timeline.php, providing a generic timelineBlock() entry point
• • Theme inheritance: partials/timeline-*.php fall back to includes/partials/ as the all-theme default
• • Registered 16 lang keys referenced in the original code but never defined (fully covered in Chinese and English)

Abilities API

• + An ability registry inspired by WordPress 6.9, with JSON Schema validation
• + AiService::chatWithTools() implements an OpenAI/DeepSeek function-calling agent loop
• + 8 core abilities: search / list_drafts / get / publish / create_draft / seo_summary / auto_tag / translate

HTML Pipeline

• + A content-enhancement pipeline based on the vendored WP_HTML_Tag_Processor
• + Automatic image lazy-loading, nofollow on external links, and completion of security attributes
• • Compatibility layer: preserves old hook signatures + new event routing

Internationalization Foundation

• + Full __() conversion of the admin panel: 1151 calls across admin/*.php replacing hard-coded Chinese
• + Three language packs expanded: zh-CN.php 287→979 keys, new en.php (961 keys) / ja.php (1009 keys)
• + Language switcher on the login page + admin top bar (中/EN, flag SVGs)

AI and Translation

• + Content multilingual sync tool: tools/sync_translate.php (DeepSeek incremental translation yikai_*→enkai_*)
• + AiService integrates the DeepSeek v4-flash / v4-pro models
• • upgrade.php JSON response hardening (ob_start + try/catch)

AI Content Assistant

• + Integration with 5 major AI providers: OpenAI, Claude, DeepSeek, Tongyi Qianwen, Zhipu AI
• + One-click article generation (title + summary + tags + slug + content)
• + Rewriting & polishing, continuation & expansion, SEO optimization, summary generation
• + Prompt configuration panel: industry, audience, keywords, style, word count, preset templates
• + Encrypted API Key storage (AES-128-CBC) + masked display
• + AI usage statistics + call log detail page

Theme System

• + Multi-theme switching, with two built-in themes: Default and Minimal
• + Theme preview screenshots + file override mechanism (layouts / blocks / partials)

Editor and Front-end

• + TinyMCE rich text editor + font-size selection (12-48px)
• + Homepage scroll entrance animations (fade / stagger / number counting)
• + prose rich-text typography styles + clamp() fluid font sizing

Products and Inquiries

• + Product brand management + product tag system (multi-dimensional grouping and filtering)
• + Inline inquiry form on the product detail page + email notification template management
• + 5-stage inquiry status management (new → contacted → following up → won → lost)

Multilingual and Tools

• + Multilingual translation management (DeepL / Google Translate API) + Japanese language pack
• + Database backup with MySQL 5.7/8.0 format selection + SQLite-to-MySQL export
• • SQLite install compatibility fixes + automatic DDL conversion in the upgrade system