Release: QUIQQER 2.28
Executive summary
QUIQQER 2.28 concentrates this release window on safer request handling, clearer authorization boundaries, and the continued modernization of integrations. Core 2.28.1 validates more AJAX and dynamic-control inputs; AI MCP 1.10.4 and OAuth Server 3.9.2 refine how tools, tokens, issuers, and dynamic resources are authorized; and Payment Amazon 3.0.0 completes the move to Amazon Pay Checkout v2.
This report is based on the available release notes and is intended as orientation for project teams. Some changes affect schemas, credentials, or integration contracts rather than visible editor features. Update decisions should therefore reflect the packages installed in a project and be tested with representative data in a staging environment.
What changed
Core validates requests closer to their entry points
Core 2.28.1 adds validation for registered AJAX calls, request-loader inputs, and dynamic control requests. Setup now uses the configured permission user, permission code reaches PHPStan level 7 compatibility, and cache handling is more defensive when Mongo test data is missing.
The practical effect is a narrower and more predictable request surface. Invalid calls should be rejected earlier, while permission-sensitive setup work follows the configured account instead of relying on an implicit user.
AI MCP makes tool authorization more explicit
AI MCP 1.10.4 adds long-term bearer-token support, builds the MCP registry before authorization, and publishes only tools authorized for the current user. The release also makes client JSON encoding type-safe and improves automatic skill discovery and discovery-page sizing.
These changes clarify the sequence between discovering a tool and being allowed to use it. Teams operating long-running automations gain a more suitable token model, but should still verify scopes, expiry policies, and the tool set exposed to each service account.
OAuth discovery and token behavior become more consistent
OAuth Server 3.9.2 exposes a canonical issuer-discovery path, respects unlimited permanent-token limits, and migrates legacy token-expiration columns during setup. It also constrains the consent dialog to the viewport and trusts configured virtual hosts when resolving dynamic resources.
For connected clients, this reduces ambiguity around issuer metadata and permanent-token handling. Existing installations should pay particular attention to the setup migration and to host configuration, because both can influence authentication flows outside the CMS interface.
Amazon Pay moves to Checkout v2
Payment Amazon 3.0.0 replaces the Checkout v1 credential and billing-agreement model with Checkout v2 public/private keys, checkout sessions, charge permissions, charges, and API-based refund reconciliation. Its billing, recurring-payment, refund, and schema work also moves to DBAL-compatible storage.
This is the most consequential integration change in the release. It aligns the module with Amazon's current API, but projects need new credentials and should test checkout, recurring payment, charge, and refund paths end to end before production rollout.
Focused improvements across publishing and operations
Feed 3.3.1 treats a feed limit of zero as unlimited and includes virtual-host path languages in Google sitemaps. Bricks 2.31.0 adds configurable image loading to TextAndImage and validates the privacy-policy site type in SimpleContact. Utils 2.5.4 replaces deprecated DBAL calls and handles missing XML tables more defensively.
ERP 4.0.8 normalizes date boundaries in time filters, while Invoice 2.11.1 preserves generated invoice dates in demo data. These are smaller changes, but they remove practical inconsistencies in multilingual publishing, editor configuration, reporting, and test environments.
What this means for projects
- Core and AI MCP reduce ambiguity at request and authorization boundaries; review custom AJAX calls, controls, service accounts, and exposed MCP tools.
- OAuth installations should test issuer discovery, permanent-token policies, legacy expiration-column migration, and dynamic-resource hosts.
- Amazon Pay 3.0.0 requires a planned Checkout v2 migration rather than a routine patch update.
- Multilingual projects using path languages should verify their generated sitemaps after updating Feed.
Operational notes
Take a current backup before applying schema migrations. For Amazon Pay, provision Checkout v2 credentials and test payments, recurring flows, charges, and refunds in the provider's test environment. For OAuth and AI MCP, inspect token policies and authorized tool inventories rather than assuming previous defaults remain appropriate. Package-level changelogs remain the authoritative source for installation-specific requirements.
Looking ahead
QUIQQER 2.28 is a boundary-hardening release. The individual changes are spread across Core, authentication, automation, payments, publishing, and maintenance, but they share a practical direction: inputs are checked earlier, authorization becomes more explicit, and older integration paths continue to move toward current APIs and database abstractions.