17.2.0 (2026-06-25)
- Fixed creating and importing questions and answers on databases using the utf8mb4 character set (issue #461); the binary uniqueness-check collation is now configurable via the new K_MYSQL_QA_BIN_COLLATION constant.
17.0.0 (2026-06-23) [BREAKING CHANGE]
- Major modernisation release. Please read UPGRADE.md before updating an existing installation.
- PHP 8.2 or newer is now required.
- Dependencies are now managed with Composer; running "composer install" is required before use.
- Externalised the previously bundled libraries to Composer packages: PHPMailer, phpCAS, RADIUS and TCPDF.
- Replaced TCPDF with the tc-lib-pdf engine (plus tc-lib-barcode, tc-lib-color and tc-lib-file) for all PDF generation, OMR answer sheets, QR codes and the colour picker.
- PDF fonts are now generated at install time into the vendor directory; the bundled 27 MB fonts/ folder has been removed.
- Upgraded PHPMailer to the 7.x series.
- Removed the legacy register-globals emulation; all controllers now read request inputs explicitly from $_POST/$_REQUEST.
- Security hardening: install-time random K_RANDOM_SECURITY with fail-closed PDF result tokens, fixed SQL injection and XSS issues, IDOR fix for non-admin editors, safer file/URL handling and CSPRNG-based codes.
- Accessibility overhaul (WCAG 2.1 level AA): semantic landmarks, skip links, ARIA roles, labelled forms and screen-reader cues.
- Migrated the HTML output from XHTML 1.0 Strict to HTML5.
- Replaced the virtual keyboard and old Internet Explorer workarounds; added a new calendar widget and a native HTML5 colour picker.
- Added a PHPUnit test suite plus Docker-based integration tests against MySQL/MariaDB and PostgreSQL.
- Added a Docker runtime (Dockerfile + docker-compose) for evaluation and deployment.
- Added build tooling: Makefile targets, GitHub Actions CI and mago lint/format.
- Internationalisation: kept the TMX format and added a "make lang" build/validation step for the translation caches.
- New configuration constants: K_USRREG_ALLOWED_GROUPS, K_CAS_SERVICE_BASE_URL, K_FILE_ALLOWED_PATHS, K_FILE_ALLOWED_HOSTS and several K_PDF_* options.
- Overhauled the documentation: rewritten README, INSTALL, UPGRADE, CONTRIBUTING, SECURITY and CODE_OF_CONDUCT, and consolidated the installation instructions into a single up-to-date manual (install/README.md).
*************************************************
16.6.3 (2026-04-16)
- Fix potential security vulnerability issues.
16.6.2 (2026-03-08)
- Add K_USRREG_ALLOWED_GROUPS configuration entry to set the allowed registration groups.
- Sanitize fields and additional checks.
16.6.1 (2026-03-04)
- Update TCPDF.
- Sanitize XML fields.
