LoginSign Up
← Back to all sparks
I

InvoicePlane

FINANCE
Velocity5.0

Open-source invoicing, quoting, and client management application.

www.invoiceplane.com ↗

InvoicePlane's 1.7.2 is a mass security remediation, still working through its release candidates.

invoicingself-hostedphpsecurity-remediationvulnerability-disclosure
◆Current state
InvoicePlane is a self-hosted PHP invoicing and quoting application. The 1.7.2 line, now at its second release candidate, is dominated by security remediation: roughly thirty researchers are credited across the beta and RC notes for responsibly disclosed vulnerabilities, with severity, CVSS and GHSA advisories held back until the final release. The RC also warns that installations running custom invoice and quote templates must take manual steps before upgrading.
◆Where it's heading
The project has spent this cycle absorbing an unusually large volume of external vulnerability reports while simultaneously modernising the platform — PHP 8.2 compatibility arrived on the 1.7.0 branch, and Stripe and PayPal were reintroduced at 1.7.2 beta 1 after having been absent. The decision to withhold advisory details until 1.7.2 goes final is a deliberate disclosure posture, meaning the true scope of what these releases fix is not yet public. Release notes here are dominated by hashes and contributor credits rather than change detail.
◆Prediction
The final 1.7.2 release and the simultaneous publication of the security advisories are the clear next step, given RC 2 is described as working toward it. Whether further RCs intervene depends on what testing surfaces.

◆Recent moves

  1. 2d ago

    1.7.2 RC 2, with a manual step for custom templates

    The second 1.7.2 release candidate, crediting a long list of security researchers and pointing to the changelog for details. It carries an explicit upgrade warning for installations using custom invoice and quote templates, so this is not a drop-in update for customised deployments.

    View source ↗
  2. 19d ago

    1.7.2 RC 1 consolidates disclosed vulnerability fixes

    The first 1.7.2 release candidate, thanking around thirty researchers for responsibly disclosed vulnerabilities tracked in a separate security summary. Same release as RC 2, one candidate earlier — the two should be read as one in-progress release, not two.

    View source ↗
  3. 3mo ago

    1.7.2 beta reintroduces Stripe and PayPal alongside security fixes

    The 1.7.2 beta opens the security cycle, naming eleven researchers and stating that advisories will be disclosed only once 1.7.2 goes final. It also reintroduces Stripe and PayPal support, restoring payment gateways the application had lost.

    View source ↗
  4. 8mo ago

    1.7.0 beta adds PHP 8.2+ compatibility

    A 1.7.0 beta whose only listed change is PHP 8.2+ compatibility. Stamped twenty-four minutes after the 1.6.4 beta, so both branches were tagged in one sitting rather than released independently.

    View source ↗
  5. 8mo ago

    1.6.4 beta adds Venmo, named footers, recurring invoice ordering

    The 1.6.4 beta collects contributor work: PayPal Advanced Credit Cards and Venmo support, templates with named footers, a default ordering method for recurring invoices, and open invoices shown on the guest index. Substantive feature content compared with the security-focused releases that follow it.

    View source ↗
  6. 1y ago

    1.6.3 RC 2 fixes VAT calculation and recurring invoice payment methods

    The final pre-release before 1.6.3, fixing VAT calculated incorrectly in RC 1 and a payment method not copied from a recurring invoice to its generated invoice. It also auto-sets legacy_calculation to false when e-Invoice is in use, a correctness default rather than a user-facing option.

    View source ↗