1.2 (September 4, 2026)
- feat: Finalize the BNX 1.2 release line with support for Moodle 5.1–5.2 and a stable maturity designation.
- fix: Harden the guest flow, reminder handling, recordings UX, and lock-settings behavior across the release line.
- fix: Close the remaining security and compatibility issues identified during the 1.2 beta/RC review cycle.
- chore: Stabilize Behat and plugin integration behavior and complete the final release readiness pass for BNX.
- fix: Hide lock settings for Recording Only activities so the form reflects the supported configuration.
- fix: Restore visible-group recording results and preserve the recording table sorting contract used by Moodle and BNX.
- fix: Stabilize the meeting-role Behat flow with a deterministic JavaScript response for the named conference window.
- chore: Complete a BNX hardening pass and add a plugin-side workaround for Moodle Behat coverage affected by BNX's intentional parent-plugin view override.
- chore: Promote the 1.2 release line from beta to release candidate (rc.1) with no additional schema or runtime changes beyond 1.2-beta.2.
- fix: Keep lib.php unguarded because Moodle CodeSniffer flags MOODLE_INTERNAL as unnecessary in a callbacks-only file (OL2-3.1.1).
- fix: Build the placeholder search/replace arrays before a single str_replace() so reminder substitutions cannot re-match earlier output (OL2-3.1.2).
- fix: Import mod_bigbluebuttonbn\logger so the meeting::join_meeting() default origin resolves at runtime (OL2-3.1.3).
- fix: Add a pix/i/bell.svg fallback for the reminder icon map and declare the bbbext_bnx_reminders_guests table in the privacy provider metadata (OL2-3.1.4).
- fix: Sign reminder unsubscribe links with a per-row HMAC token and verify it before any subscription write in subscription.php (OL2-3.2.1).
- fix: Require POST and a valid sesskey for the subscription toggle form to close a CSRF vector (OL2-3.2.2).
- fix: Read originpage with PARAM_ALPHA and validate it against an allow-list to prevent an open redirect from import.php (OL2-3.2.3).
- chore: Annotate the previously empty db/upgrade.php savepoints so every version bump is justified (OL2-4.1.1).
- chore: See docs/release-notes/1.2-beta.2.md for the per-finding Open LMS code review #2 remediation log.
- fix: Harden security and authorization across external services and guest/import entry points to address Open LMS code review findings (OL-3.2.1, OL-3.2.2, OL-3.2.3, OL-3.2.5, OL-3.2.6, OL-3.2.7, OL-3.2.10, OL-3.1.5).
- fix: Enforce explicit capability checks in external APIs and the import flow, and deny restricted context access by throwing exceptions.
- fix: Apply stricter input cleaning for guest and external parameters, and add explicit external parameter validation in the BNX meeting info service.
- fix: Sanitize user-submitted values before storage and format meeting description through context-aware output APIs in template and recording metadata paths (OL-3.2.8, OL-3.2.9, OL-3.2.11).
- fix: Add null guards in external destination instance resolution to avoid runtime fatals on invalid import requests.
- fix: Add null guards after instance::get_from_instanceid() in addon and output paths (OL-3.1.6), and replace array_merge_recursive() with array_merge() for recording SQL bind parameters (OL-3.1.8).
- fix: Batch recording status updates to remove N+1 writes, reuse the mod_bigbluebuttonbn renderer across recording table rows, and short-circuit the BNX footer hook on non-BBB pages (OL-3.1.9).
- fix: Switch settings labels to deferred lang_string resolution (OL-3.1.10).
- chore: Rewrite the overridenav AMD module without jquery (OL-3.1.1), move recordings search signaling to a CustomEvent flow while retaining one pagination compatibility global (OL-3.1.7), and move the inline guest-login JS into a new bbbext_bnx/guest_login AMD module (OL-4.1.4).
- chore: Remove unused optional_param declarations and the nested dirname() chain in bbb_view.php (OL-4.1.1, OL-4.1.3), drop unused class imports in hook_callbacks and action_url_parameters (OL-4.1.2), and gate developer diagnostics in the import output behind DEBUG_DEVELOPER (OL-4.1.7).
- feat: Discover presentation providers via the sidecar contract instead of hard-coded coupling (OL-3.1.4), emit a `\bbbext_bnx\event\state_changed` event on enable/disable, and remove the legacy sidecar_state_manager that mutated parent module enablement (OL-3.1.3, OL-4.1.5).
- fix: Isolate parent-table lookups behind a documented shim (OL-3.2.4).
- fix: Memoize sidecar sort order to remove N+1 get_config() calls on every recordings-table render (OL-3.1.9).
- chore: Document the sidecar contract and integration boundaries in README and backfill the version history.
- chore: Add PHPUnit tests for the guest-login password compare, external null guards, and external parameter validation (OL-3.2.6, OL-3.1.6, OL-3.2.10), and Behat scenarios for guest-login password validation and the BNX recordings table (OL-4.1.6).
- chore: Sync the db/install.xml schema VERSION with version.php on each release (OL-3.1.2).
- chore: Consolidate db/events.php to a single config_log_created observer; the second observer was removed together with sidecar_state_manager (OL-4.1.5).
