FlowHunt AI Assistant - The merchant panel now offers an AI assistant powered by FlowHunt — the "AI assistant" button in the screen header opens a chat side panel that helps you navigate and work with Post Affiliate Pro. Activated automatically (#15414)
Security
Improved Output Escaping - Improved escaping of content displayed in the merchant panel (#16089)
Strengthened Access Control - Tightened permission checks on several merchant panel endpoints (#15999)
Improved URL Validation - Stricter validation of URLs processed by tracking scripts (#16041)
Login Protection - Fraud Protection IP rules are now evaluated earlier during login (#16095)
Improvements
REST API v3
Grid Request Limit Documented - The 1-request-per-second limit on list endpoints is now described in the Rate Limiting docs, and exceeding it returns a proper "Too Many Requests" response with a retry hint instead of a generic error (#16133)
Tracking vs. API Access Clarified - The Tools → Integration screen now separates tracking methods from programmatic API access, and the POST /transactions docs clarify that the endpoint creates commission records directly and is not the sale tracking mechanism (#16028)
Integrations
Shopify write_orders Notification - The missing-scope warning now appears only when updating order attributes actually fails, instead of proactively polling the Shopify API on every notification load (#16103)
Shopify Notification Length - The "Stores requiring update" list in the Shopify notification is capped at 10 stores, with an "and X more stores" summary for the rest (#16099)
Plugins
AWeber OAuth 2.0 - The AWeber plugin now uses AWeber's OAuth 2.0 authorization, replacing the discontinued OAuth 1.0 flow; merchants using the plugin need to re-authorize the connection (#16003)
HubSpot Field Mapping - Removed the redundant "unused" option from affiliate-field listboxes in both HubSpot plugins; leaving the field empty is now the single way to express "no mapping" (#16082)
Banners
Open Link Banner in New Tab - Link banners in the affiliate panel now show an "open in new window" icon, so the link can be opened without copy-pasting it (#15445)
Webhooks and Outbound Requests
Default User-Agent - Outbound HTTP requests (webhooks, plugin downloads, license checks) now send a User-Agent header identifying the application, preventing rejections by firewalls and bot filters; white-labeled installations use their configured branding name (#15829)
API Client User-Agent - Applications integrating via the PAP API client library (PapApi.class.php) can now set a default User-Agent for their outgoing calls without affecting the visitor browser data sent to tracking (#15764)
Bug Fixes
REST API v3
PATCH /transactions/{id} Field Names - The endpoint now accepts the documented snake_case total_cost and merchant_note fields instead of their legacy camelCase names (#16132)
Campaign Detail Account Status - GET /campaigns/{id} now returns the actual account approval status (approved, pending, declined, suspended) in account_status instead of an unrelated internal value (#15816)
Deterministic Pagination - Cursor-based pagination on /reports/top-affiliates no longer repeats a row across pages when affiliates share the same name (#15902)
Integrations
Shopify Webhook Processing - Fixed visit processing failing on queued Shopify webhook tasks such as refunds and order status changes (#16059)
Plugins
HubSpot Optional Custom Fields - The "HubSpot - create affiliates" plugin no longer requires all custom field values to be filled in to save the settings (#16047)
Commissions
Sale Filter on Manual Commissions - The Sale filter plugin is now applied when a sale commission with multi-tier support is created manually (#16046)
Affiliates
Number Field Range Filters - Range filters (greater/less than, between) on number-type custom fields now compare values numerically instead of alphabetically, in both the merchant affiliate grid and the API v3 q filter (#16007)
User Interface
Integration Method Instructions - Step-by-step screenshots in Tools → Integration now render correctly, and the marketing banner was removed from the instructions (#16051)
Notification Dismissal - "Don't show this message again" now persists for notifications without an expiry date, such as the "Default campaign is stopped/paused" warning; the dismissal resets once the campaign is active again (#15969)
Themes
Dark Mode Fixes - Fixed unreadable selected items in the top-right user menu in the August theme and the unstyled popup for editing available signup field values (#16068) (#16031)
