3.62.0 (2026-06-30)
New Features
- cabinet: add /branding/footer-enabled GET+PATCH endpoint (#3011) (fee15cb)
- per-method payment description override (white-label) (#3014) (500259e)
- pre-warm logo file_id at startup to kill broadcast re-upload (b93db73)
- subscription: reuse expired trial of same tariff on paid purchase (bot/guest) (ac9268b), closes #3004
- surface 2.8.0 service.api_token_created/deleted webhook events (499dfb8)
- surface payment decline reason in the admin panel (#3015) (c378431)
- update Remnawave API integration for panel 2.8.0 (db39b69)
Bug Fixes
- bound MonitoringService notification sends with a per-send timeout (9046bee)
- cabinet: reuse expired trial of same tariff on purchase instead of duplicating (#3004) (c95aec0)
- carry subscription_id through tariff renewal callbacks (#3012) (348491e)
- clarify balance-related notification texts (autopay hint + INSUFFICIENT_BALANCE) (#3013) (baf6782)
- email: build From header with formataddr to avoid duplicated address (e66c526)
- handle 2.8.0 user.expiration webhook event (7ce455f)
- read webhook envelope meta from data['_meta'] in user.expiration (1e1a309)
- resolve the correct subscription in tariff-switch flows (#3012) (08c08dd)
- respect RESET_DEVICES_ON_RENEWAL in Remnawave user sync (#3006) (#3008) (0f608a7)
- security: block stored XSS via ticket media (HTML/SVG served inline) (0cbf624)
- security: harden admin logo serving against SVG script execution (2e512fc)
- show Lava payment methods in the bot when enabled (#3016) (591b154)
- stop multi-tariff HWID device limit bleeding across tariffs (7463ec0)
- sync used traffic from nested userTraffic in user.modified webhook (7fd397e)
Refactoring
- close low-pri 2.8.0 follow-ups (trafficLimitBytes coerce, api-token name) (dc4eaad)
- harden HWID byApp aggregation (2.8.0) + test coverage (a82614c)