Living changelog
Product changelog
Bigger updates that matter to organizers and attendees. Newest changes are listed first. Use the pager at the bottom to browse older releases.
Fix2026-05-09
M-PESA payment reliability improvements
Fixed scenarios where temporary network issues could incorrectly mark a successful M-PESA payment as failed, and improved feedback speed when a payment is cancelled or declined.
- —Network errors during payment status checks are now treated as transient instead of terminal failures, preventing false negatives while the webhook can still deliver the correct result.
- —The confirmation page now returns the stored failure reason immediately when a webhook has already recorded the outcome, instead of redundantly calling the provider again.
- —Added a safety guard preventing a stale status-poll from overwriting a completed payment.
- —Extended the confirmation page retry window to handle slower M-PESA callbacks without showing a premature error.
Fix2026-04-22
M-PESA confirmations no longer contradict provider SMS
If your mobile money network confirms payment, the app now keeps the transaction pending until callback confirmation instead of auto-cancelling after a polling timeout.
- —Removed automatic timeout cancellation in M-PESA polling to prevent false 'cancelled by buyer' outcomes while provider confirmation is still in flight.
- —Checkout now redirects to a confirmation screen that retries verification for a short window before showing an error.
- —Status-poll unavailable alerts are now throttled so operations channels get cleaner, less noisy diagnostics.
- —Buyer-facing toasts now use a neutral 'still confirming' message during temporary provider delays instead of misleading unreachable/cancelled language.
Feature2026-04-22
Guests can now book paid tickets on the storefront
Visitors to an organizer's storefront subdomain can complete a paid ticket purchase without creating an account — just a name, email, and (for M-PESA) a phone number. The ticket PDF and calendar invite arrive by email exactly like a signed-in checkout.
- —Added a guest details form (name + email) to the ticket checkout card on storefront event and hangout pages; signed-in pages on app.eventparlour.com are unchanged.
- —If the email already belongs to an account, the new ticket attaches to that account silently — sign in and it'll be there. Otherwise we create a lightweight account so the buyer can set a password later to claim their ticket history.
- —M-PESA polling, Stripe redirect, cancel flow, and the /payment/complete confirmation page now all work without a session, using the payment reference as a bearer token (still ownership-checked when a session is present).
- —Stray redirects to /auth/sign-in on a storefront subdomain are bounced to app.eventparlour.com so buyers never hit a 404 mid-checkout.
- —Added a silent honeypot field + per-IP and per-email rate limits on the guest checkout action to keep bots out.
Improvement2026-04-22
Redesigned ticket PDF with anti-forgery print
Your downloadable ticket is now a single-page, security-printed pass with guilloché background, microprint border, serial watermark, corner seals, and a perforated check-in stub. The QR in your confirmation email is also properly centered.
- —Ticket PDF fits on a single half-letter landscape page, no more accidental blank second page.
- —Added guilloché wave pattern, microprinted 'EVENT PARLOUR · <event ref>' around the perimeter, diagonal serial watermark, and matching corner seals — all hard to reproduce with a casual screenshot or Canva rebuild.
- —Right side of the pass is now a clearly perforated check-in stub with a large QR and the event ref, so door staff can scan without unfolding anything.
- —Confirmation email now centers the QR and the 'Join Event Now' / 'Download PDF pass' buttons reliably across Gmail and Outlook.
Improvement2026-04-22
Prices now follow where you are
Dashboard totals, analytics, billing, and withdrawal amounts show in KES when you're in Kenya and in USD everywhere else, so visitors abroad no longer see shillings by mistake.
- —Billing overview, available balance, withdrawals, and transaction totals use the viewer's location as the primary currency.
- —Attendee analytics (Total Spent, Spending by Month, per-event totals) now display in your location's currency, with converted amounts.
- —Admin dashboard and revenue page totals (Platform Revenue, Total Revenue, Organizer Share, Provider Fees, 30-day revenue chart) now aggregate KES + USD payments correctly and render in the admin's location currency instead of a meaningless mixed sum labelled KSh.
- —Create Event and Create Hangout forms now default the ticket sell currency to the organizer's location (KES in Kenya, USD everywhere else); the dropdown still lets you switch.
- —Visitors in the US, Europe, Asia, and elsewhere default to USD; visitors in Kenya stay on KES.
- —Manual currency preference in account settings still wins when you pin it.
Improvement2026-04-22
Clearer create-workspace dialog
Opening the Create Workspace sheet now dims and blurs the rest of the app (including the sidebar) so the form stands out and clicks don't hit nav elements behind it.
- —Fixed a layering issue where the sidebar could compete with the open dialog.
- —Added a proper backdrop with blur and click-to-close behaviour.
Fix2026-04-22
More accurate M-PESA payment failure messages
Failed M-PESA attempts now show the real reason from the network (for example a phone that is off or unreachable) and transient provider hiccups no longer mark a payment as failed.
- —Payment failure notices and ops alerts now carry the actual reason reported by M-PESA.
- —Temporary provider status-check outages keep the payment in its current state and wait for the confirmation callback instead of flipping it to failed.
- —Admin ops channel gets a distinct heads-up when the payment provider's status endpoint is temporarily unavailable.
Platform2026-04-21
Commit-time secret scanning with gitleaks
A pre-commit hook now blocks accidental commits of API keys, tokens, or environment files so credentials cannot leak into git history.
- —Added a gitleaks pre-commit hook wired into both husky and lefthook setups.
- —Shipped `.gitleaks.toml` with a narrow allowlist for .env.example and lockfiles.
- —Exposed `pnpm secrets:scan` and `pnpm secrets:scan-staged` for on-demand scanning.
Showing 17–24 of 48 updates · Newest