Changes Logs

This is the complete Xilancer changelog. Everything is on this one page: both releases, the plugin versions, and the upgrade steps.

Released: October 22, 2026

Release 4.3.0 turns Xilancer from a marketplace with plugins bolted on into a marketplace where plugins are the normal way to add a feature. It also closes three gaps that mattered to real operators: invoices, tax, and identity.

4.3.0 highlights

1. Invoices are issued automatically when an order is placed and when a subscription is purchased.
2. VAT, sales tax, and EU reverse charge are calculated, frozen on the order, and printed on invoices.
3. NDA signing ships as a plugin, with an optional paid NDA funded by wallet or gateway.
4. Phone OTP verification can be required before a user reaches the dashboard.
5. SEO Tools adds per-URL rules, templates, JSON-LD, and noindex controls without code edits.
6. Webhooks deliver signed events to external systems with retries and a delivery log.
7. Realtime notifications and browser push work for admins, clients, and freelancers.
8. Notify on rejection gives users a reason in-app and by email instead of a silent status change.

Invoicing and tax

Automatic invoice numbers

Invoices now receive a number at the moment the payable record is created, not when an admin prints something later.

• Orders: INV-YYYYMMDD-000001 (date-scoped sequence).
• User subscriptions: INV-00001 (global sequence).

Numbers are generated on the model created event, so they are stable across gateways, manual payments, wallet payments, and API checkout. The number is never reused and is not edited when an order is refunded or cancelled.

Invoice settings page

Admin Settings → Invoice Settings now controls what appears on every invoice:

• Company name, address, email, phone, and VAT number.
• Invoice title and service description.
• Accent font and footer notes.
• Whether commission is shown to clients.
• Whether the invoice is downloadable as PDF.

The page is permission-gated, so support staff can view invoices without changing company data.

VAT, sales tax, and reverse charge

TaxService resolves the tax treatment for each order line:

• Freelancer tax profile: tax type, rate, scheme, VAT number, and tax country.
• EU reverse charge: applied only when both parties are VAT-verified and the supply is cross-border inside the EU.
• US sales tax: applied by the configured state rules.
• Tax frozen on the order: the rate and amount are snapshotted so later profile edits do not rewrite historical invoices.

Tax appears on the checkout summary, the order details page, the invoice PDF, and the admin order view. The client pays the tax-inclusive total; the freelancer's payout is unaffected by the tax line.

VIES verification

VatNumberValidator validates EU VAT numbers in two steps:

1. Format check against the country pattern.
2. VIES SOAP lookup with an 8-second timeout.

Saving a profile never blocks on VIES. If the service is down or the number is unverified, the profile still saves and the number is marked unverified. Reverse charge requires a verified number on both sides.

Employee-only registration mode

A new setting, Freelancer registration, can be switched off to run an agency-style site:

• Freelancer signup is disabled.
• Client signup continues normally.
• Existing freelancers keep working.
• Admin-created freelancer accounts are unaffected.

This is the correct switch for a managed marketplace where admins assign talent to jobs.

NDA signing plugin

The nda plugin adds a signature step to an order without changing the core order flow.

• One agreement row per order, signed by both parties.
• Typed signature plus IP address and timestamp.
• Immutable signed record; later edits create a new revision, not an overwrite.
• PDF download for either party and for admins.
• Admin strip on the order details page showing signature state.
• Optional NDA fee. The fee can be paid from the wallet or through a supported gateway.
• Requests can be gated behind a subscription plan.
• Permission: nda-manage.

The NDA fee is snapshotted at signing time. Only gateways that support the generic payment.complete round-trip can settle an NDA fee: Pesapal, SePay, CoinPayments, and YooMoney. Core's other gateways settle orders, not NDA fees.

See NDA Agreements for the operator view and the plugin catalog for the technical contract.

Phone OTP and SMS Gateway

Phone verification before dashboard access

• New setting: sms_registration_otp_status.
• Middleware UserPhoneVerify redirects unverified users to the phone verification screen.
• is_phone_verified is exposed to views and API responses.
• Routes: phone.verify, resend.phone.code, update.phone.number.
• If the SMS plugin or provider config is missing, verification fails open rather than locking every user out.

SMS Gateway plugin

The SMS Gateway plugin ships 23+ drivers across Global, India, Bangladesh, Middle East, Africa, Latin America, and WhatsApp:

Twilio, Vonage, Sinch, Plivo, MSG91, Fast2SMS, TextLocal, SSL Wireless, BulkSMSBD, AlphaNet, Mimosms, SMSMisr, Msegat, Unifonic, Africa's Talking, Termii, BulkSMS, Hubtel, Zenvia, Gupshup, Infobip, Sendra, and Wati.

The plugin lives at core/plugins/sms-gateway and uses SmsGateway\Services\OtpService. It is loaded through the legacy plugin path, not the top-level /plugins framework. This is intentional: the OTP service must be available during login, before the framework boots.

SEO Tools plugin

The seo-tools plugin takes over the SEO seams that core exposes.

• Filters: seo.page_title, seo.site_title, seo.meta_title, seo.meta_description, seo.meta_keywords, seo.og_title, seo.og_description, seo.og_url, seo.canonical_url, seo.extra_tags.
• Per-URL rules with three match modes: exact, prefix, and regex.
• Templates per page type: home, job, project, profile, blog, category, and static page.
• JSON-LD schema blocks for jobs, services, profiles, and breadcrumbs.
• Robots directives and per-entity noindex.
• Permission: seo-tools-manage.
• Table: seo_tools_rules.

Core also gained:

• Profile meta title and noindex fields with a weekly edit limit.
• Per-entity noindex columns for jobs, projects, and blog posts.
• A single H1 per page, with duplicate headings demoted.
• Canonical URL handling fixes.
• A sitemap that always writes to sitemap/sitemap.xml, the stable path Search Console expects.
• Robots and trailing-slash fixes.
• SEO-friendly slugs with Vietnamese and Cyrillic transliteration.

Webhooks plugin

The webhooks plugin sends signed HTTP POSTs to external endpoints.

• Events: 60+ across users, jobs, projects, proposals, orders, wallet, subscriptions, and commissions.
• Signature: HMAC over the raw body with a per-endpoint secret.
• SSRF guard: private and link-local targets are blocked by default.
• Retries: 5 attempts with backoff at 1, 5, 30, 120, and 360 minutes.
• Delivery log with request, response, status, and next attempt.
• Scheduler sweep every minute, batch size 25.
• Permission: webhooks-manage.
• Tables: webhooks_endpoints, webhooks_deliveries.

Configuration defaults: timeout 10 seconds, max attempts 5, batch 25, private targets disabled.

Announcements plugin

• Site-wide announcement bar or popup.
• Rendered at body_end, so it does not disturb layout.
• Dismissal stored in localStorage per announcement version.
• Scheduling window and audience targeting.
• Permission: announcements-manage.
• Table: announcements_announcements.

Payments

Pesapal gateway plugin

• Pesapal API v3 hosted checkout.
• IPN and return-URL verification.
• Merchant reference encodes payment type and record ID, so one callback route can settle orders, wallet deposits, subscriptions, and NDA fees.
• No plugin tables.
• Permission: pesapal-settings.

SePay gateway plugin

• VietQR bank transfer with webhook confirmation.
• HMAC or API-key verification.
• VND conversion.
• Payment codes: {PREFIX}{LETTER}{RECORD_ID}, where the letter identifies the record type: WC wallet client, WF wallet freelancer, O order, S subscription, P promotion.
• IPN endpoint at /sepay/ipn.
• Permission: sepay-settings.

Gateway currency matching

Gateways are now charged in a currency that matches the charged amount. This fixes mismatches where a converted display total was sent to a gateway configured for another currency.

Subscriptions and connects

• Paywall CTAs on gated actions, with the plan comparison inline.
• Quota meters for connects, projects, and orders.
• Cancellation from the dashboard.
• Renewal starts from the latest active expiry, so early renewals do not lose time.
• No downgrade path: a user must cancel and wait for expiry before choosing a lower plan.
• Subscription overrides for commission, connects, project limits, and bid-boost cost.
• subscription.offers support for recurring service offers.

Bid boost

• Freelancers can boost a proposal with connects.
• Cost: proposal_boost_connect_cost, default 5.
• Subscription plans can override the cost.
• The promote-freelancer plugin handles the proposal promotion type.
• Admins can assign a job to a freelancer with a dedicated permission.

Admin and operations

Experience levels and work areas

• Experience levels: Entry, Expert, Lead.
• Multi-select work areas on profiles and job posts.
• Character count bug fixed.

Service FAQ builder

• FAQ section on service creation and public service pages.
• Add, edit, reorder, and delete questions.
• Answers support rich text.

Minimum prices

• minimum_job_price and minimum_project_price.
• Enforced on job budget, hourly rate, and project package charges.
• Enforced on both web and API.
• Helper: min_price_rule().

Apply Now

• Apply Now button on job cards.
• Admin audience setting under job.apply.now.settings.
• Respects login state; guests get the login modal.

Spending and commission visibility

• client_spending_toggle and users.show_spending.
• Job sidebar total spent respects the toggle.
• API honors the toggle.
• commission_disable_client_panel hides commission from client order surfaces by default.
• Invoice has its own commission toggle: invoice_show_commission_client.

Bulk actions

• Bulk delete across admin entities.
• User bulk verify, suspend, and delete.
• Status filters and email export.
• Notification settings per event.
• Every bulk action writes an audit entry.

Admin re-categorization

• Move a gig or job to another category without changing status or approval.
• Permissions: project-category-change, job-category-change.
• Shared service: ListingCategoryService.
• Fires job.updated / project.updated, so plugins see the change.

Blog categories and tags

• Dedicated blog_categories, blog_tags, and blog_post_tag tables.
• Admin CRUD for categories and tags.
• Tag filtering on the blog index.
• Legacy tag_name preserved for existing posts.

Other admin changes

• Delivery reminders, manual and scheduled, with email_notify_delivery_reminder.
• Green completed visual system on client and freelancer order cards.
• Milestone setting enforcement in backend order services.
• Verified blue shield badge with hover caption everywhere.
• Admin dashboard shows all revenue streams.
• Device tracking for sessions.
• Reusable media crop component.
• Social share, bookmark, and report buttons on gigs, profiles, and chat.
• CSV bulk import for categories, subcategories, and skills.
• Proposal rejection emails.
• Admin user control center.
• IQD currency.
• Unified reCAPTCHA settings page with per-version keys, secrets, and switches.
• Rejection and suspension reasons in-app and by email.

4.3.0 chat and notifications

• Last seen, active now, typing, delivered, and seen indicators.
• Offline chat email throttled to once every 6 hours.
• Last message preview in the sidebar.
• Realtime channel: private-chat.{liveChatId}.
• Realtime admin, client, and freelancer notifications over Pusher or Reverb.
• Server-truth badge counts.
• Clear all notifications.
• Browser push with VAPID, optional Firebase transport.

Fixes in 4.3.0

• Client revision requests now validate input, ownership, and transaction boundaries.
• Search triggers on input events, so pasted and non-English queries return results.
• Job wizard skills are scoped by category and subcategory.
• Project subcategory is optional across web and API.
• Commission is hidden from client order surfaces by default.
• Admin project and job notification emails respect user email toggles.
• Support ticket emails include the message body.
• Gateways charge in the matching currency.
• Project and job create/update land on the correct role dashboard.
• Sidebar skips plugin menu items with undefined routes.
• Skill job URLs redirect to the canonical slug format without spaces.
• Order cards show "Review Submitted" instead of "Submit Review" when a review exists.
• Native date pickers are usable in coupon create/edit.
• Dark mode readability fixes across AI and affiliate admin screens.

What did not change

• No public route was renamed or removed.
• No core table was dropped.
• Existing plugins keep their slugs, view namespaces, and config keys.
• The checkout.price.calculate filter keeps its float contract.

Released: September 27, 2026
Window covered: September 1 - September 27, 2026
Upgrade from: 4.1.x

Release 4.2.0 is the release where Xilancer stopped treating premium features as modules fused into the core and started treating them as plugins with a stable contract. It also added the financial and communication features that operators had been asking for.

This section is the expanded changelog. The original 4.2.0 note listed the affiliate plugin, the email marketing plugin, chat upgrades, review moderation, and a handful of fixes. The items below were merged in the same window and are included here for completeness.

4.2.0 highlights

1. Decoupled plugin system with discovery, validation, activation, and boot ordering.
2. Eight premium modules ported to /plugins, with legacy view and config namespaces preserved.
3. Affiliate Marketing, Email Marketing, AI Power, AI Engine, AI Toolkit, Currency Switcher, Reports, Subscription Offers, Impersonate, SMS Gateway, and Coupons plugins.
4. Tax and VAT, plus the SePay bank-transfer gateway.
5. Unified wallet history across deposits, withdrawals, earnings, spends, and refunds.
6. Role-based admin sidebar with 60+ permissions and every link gated.
7. Subscription paywall, quotas, renewal, and no-downgrade rules.
8. Chat reactions, replies, voice notes, receipts, typing, and file galleries.

Plugin platform

Decoupled /plugins system

The new layout separates three layers:

core/                 Laravel application; calls plugin_*() helpers at seam points
plugins/framework/    Zero-dependency engine: hooks, slots, registries, discovery
plugins/<slug>/       Individual plugins; depend only on PluginsFramework/*

What shipped:

• Manifest discovery via plugins/*/plugin.json, skipping framework.
• Topological boot order over requires.plugins.
• Activation state in plugins/statuses.json, outside core, inactive by default.
• Per-plugin error isolation for invalid manifests, missing dependencies, version mismatches, cycles, and throwing boot() methods.
• Composer PSR-4 registration for active plugins.
• Guarded core helpers that no-op when the framework is absent.
• CLI: php artisan plugins {list|activate|deactivate|validate}.
• Admin upload with zip extraction, path-traversal protection, validation, migrations, and cache clears.
• Plugin-owned MVC: routes, views, migrations, language files, and config auto-wired.

The first eight ported modules were cloud-storage, coin-payment-gateway, community, coupons, freelancer-level, hourly-job, promote-freelancer, and security-manage. yoomoney-payment-gateway followed in the same window.

Each port kept its legacy legacyName, so old view namespaces (hourlyjob::), translation namespaces, and config keys (hourlyjob) still resolve. Menus, Blade hooks, and page-builder addons moved from module.json into plugin.json under xilancerMetaData.

Plugin Manage admin screen

• Upload a zip with plugin.json at the root or one folder deep.
• Validation runs before activation: directory, manifest JSON, entry file, PHP syntax, PHP and framework versions, plugin dependencies, and a sandboxed boot test.
• Migrations run before activation and are idempotent.
• Route, view, and config caches clear automatically.
• Re-uploading replaces the plugin.
• Toggle works without jQuery or SweetAlert, with a form fallback.
• Plugin menus moved into their own admin sidebar section above Settings.

Coupons promoted to production

• Database-backed coupons and redemptions.
• Percent and fixed discounts.
• Scopes: project, job, offer, hourly, promotion, subscription, and connect.
• Caps, minimum order value, date windows, and usage limits.
• Instant quote endpoint at /coupons/apply.
• Checkout field via the checkout.coupon_field slot.
• Admin usage page and order-detail display.
• Permission: coupons-manage.

New plugins

Affiliate Marketing 1.0.0

• ?aff= cookie and session attribution.
• First-touch and last-touch modes.
• Conversions on signup, login, and hire.
• Admin approval workflow.
• Wallet credit on approved conversion.
• Dashboard panel via dashboard.affiliate_panel.
• Permission: affiliate-manage.
• Tables: affiliates, affiliate_conversions.

Email Marketing 1.0.0

Ten providers: Mailchimp, ActiveCampaign, ConvertKit, MailerLite, Brevo, GetResponse, Constant Contact, Klaviyo, Aweber, and SendGrid.

• Sync on user.registered and order.paid.
• Per-provider credentials under email_marketing_*.
• List and tag mapping per event.
• Admin test connection.

AI Power 1.2.0

• Multi-provider: OpenAI, Gemini, Anthropic, DeepSeek, and Ollama.
• Admin text-generation presets by input type and category.
• Content writer, SEO generator, moderation, semantic search, translation, and images.
• Inline AI buttons across admin forms.
• Usage and cost tracking.
• Tables: ai_prompts, ai_usages; settings key aipower_settings.
• Strict frontend guardrails: rate limit, input cap, output cap, contact filtering.
• No AI chat assistant (removed during development).

AI Engine 1.0.0

• Intent parser, scorer, and ranker.
• Search filters at priority 15.
• Recommendations and related items.
• Guided CTAs on jobs, projects, and talents listings.
• Optional LLM polish; no API key required for deterministic ranking.

AI Toolkit 1.0.0

• Deterministic-first drafting, profile review, LinkedIn mapping, and search reranking.
• Filters: ai.suggest.offer, ai.suggest.project, ai.suggest.profile.
• Slots: job.ai_assist, project.ai_assist, offer.ai_assist, profile.completion.
• Providers: OpenAI-compatible, DeepSeek, Ollama.
• CLI for operator tasks.

Currency Switcher 1.0.0

• Admin CRUD for currencies and rates.
• Per-user switch route.
• Table: selected_currency_lists.
• Conversion through conversion_rate.
• Permission: currency-switcher-manage.

Reports 1.0.0

• Overview, freelancers, clients, jobs, projects, orders, earnings, withdrawals, and subscriptions.
• Filters and date presets.
• Permission: reports-view.

Subscription Offers 1.0.0

• Freelancer recurring service offers, monthly or annual.
• Plans, client subscriptions, invoices, and deliverables.
• Tables: subscription_offers, subscription_offer_plans, client_subscriptions, subscription_invoices, subscription_deliverables.
• Activation on order.paid.
• Default commission: 10%.

Impersonate 1.0.0

• Admin "Login as" for freelancers and clients.
• Entry points in the user list and user details page.
• Banner while impersonating.
• Permission: impersonate-users.

SMS Gateway 1.0.0

• 23+ OTP and SMS drivers across Global, India, Bangladesh, Middle East, Africa, Latin America, and WhatsApp.
• Located at core/plugins/sms-gateway, loaded through the legacy path.
• Service: SmsGateway\Services\OtpService.
• Used by phone verification and OTP login.

Referrals 1.0.0

• Attribution through user.create_data context.
• Tamper-evident codes.
• Signup bonus and order commission.
• SQLite side-channel store, with a MySQL store swap path.
• Dashboard panel and admin menu.
• CLI for configuration and inspection.

Tax and payments

VAT and sales tax

• TaxService resolves tax type, rate, scheme, and country.
• Freelancer tax profile fields: tax type, rate, scheme, VAT number, tax country.
• Tax frozen on the order at checkout.
• Tax columns on invoices.
• EU reverse charge rules.
• US sales tax rules.

SePay bank-transfer gateway

• VietQR generation.
• Webhook confirmation with HMAC or API key.
• VND conversion.
• Payment codes by record type.
• IPN at /sepay/ipn.

Wallet unification

One wallet_history stream now covers:

• Deposits (pending, approved, rejected).
• Withdrawals (requested, approved, completed, cancelled).
• Earnings from orders.
• Spends on orders, promotions, and NDA fees.
• Refunds.

Also added:

• Withdrawal holding period: withdraw_holding_enabled, withdraw_holding_days.
• available_at stamped on earnings.
• Available and held balance helpers.
• Decimal withdrawal fee support.
• Auto client approval setting.
• Admin credit and debit actions with history rows.

Subscription upgrades

• Paywall CTAs on gated actions.
• Quota meters for connects, projects, and orders.
• Cancel from the dashboard.
• Renewal from the latest active expiry.
• No downgrade; cancel and wait for expiry.
• Subscription overrides for commission, connects, project limits, and bid boost.
• subscription.offers relation.
• proposal_boost_connect_limit.

Admin and access control

Role-based sidebar

• 60+ permissions seeded.
• Every admin link wrapped in @can.
• Empty permission groups hidden.
• Legacy layout removed.
• Missing-permission seeder for upgrades.

Approval workflow

• Project and job edits require approval.
• Project delete enters a pending state.
• Job close enters a pending state.
• Admin approve and reject routes.
• Badges on the listing and notifications to the owner.
• Rejections carry a reason.

Security Manage 1.9.1

• Restricted words with a robust matching engine.
• Off-platform contact detection: email, URL, phone, and social handles.
• Violations queue with retained items until admin deletion.
• Freeze 2.0: reasons, expiry, audit trail, notifications, and auto-freeze.
• Auth hardening: login lockout, new-device alerts, disposable-email blocking.
• IP and country access control.
• Rate limiting for state-changing requests.
• Security alerts for violations and failed logins.
• Log retention and pruning.
• Permissions: security-word-manage, security-log-manage, user-freeze-manage.

Freelancer Level 1.3.0

• Level rules and benefits.
• Qualifying period in days, weeks, or months.
• Badge preview.
• Prize payout at 00:30 into freelancer_level_prizes, unique per user, year, and month.
• Benefit filters for commission, connects, withdrawal holding, project limits, and support priority.
• Free connects are a cost waiver, not a grant.

Hourly Job 1.2.0

• Hardened time tracking.
• Admin job actions.
• Legacy views removed.

Promotional plugin 1.1.0

• Profile and project promotion.
• Proposal bid boost via connects.
• Promotion packages, revenue, clicks, and impressions.
• Around 22 IPN methods.

4.2.0 chat and notifications

• Typing indicators with debounced input.
• Emoji reactions: thumbs up, heart, laugh, surprised, cry, fire.
• Delivery and read receipts.
• Reply threading with a preview bar.
• Voice notes via MediaRecorder.
• Drag-and-drop upload.
• Edited message indicator.
• Rich file display: video, audio, images, archives, documents.
• Batch image galleries grouped by batch_id.
• Last seen and active indicators.
• Offline email throttle at 6 hours.
• Last message preview in the sidebar.
• Realtime channel private-chat.{liveChatId}.

SEO and content

• SEO-friendly slugs with Vietnamese and Cyrillic transliteration.
• Canonical tags.
• Single H1 per page with duplicate headings demoted.
• Sitemap always writes to sitemap/sitemap.xml.
• Profile meta title, noindex, and weekly edit limit.
• Blog rich-text editor fixes.
• Social share buttons on project cards.
• Report, share, and bookmark buttons on gigs, profiles, and chat.

Registration and reviews

• Registration security settings.
• Optional social login.
• Review moderation: review_auto_approve, individual approve/reject, bulk actions, and public visibility filtering.
• Package label setting.
• Identity verification email includes requester details.
• CSV bulk import for categories, subcategories, and skills.
• Multiple file attachments on job post and edit.
• Media crop component with Cropper.js.
• Device tracking.
• Admin dashboard revenue streams.
• Clear all notifications for admin, client, and freelancer.

Fixes in 4.2.0

• Project purchase translation, submission, z-index, and button color issues.
• Scroll position after a translation update.
• Sidebar menu items with undefined routes.
• Affiliate marketing dark mode, imports, controller namespace, and URL paths.
• Coupon list sidebar, edit action, date picker, and stacked scope tags.
• Duplicate coupon admin menu entry.
• Freelancer level actions and legacy namespace.
• CoinPayment IPN hardening and stray page-builder addon.
• Hourly job time tracking and admin actions.
• Community search and details.
• Security Manage GeoIP lookup and dead API stub.
• Job details guest apply opens login and register modals.
• Disabled categories remain inaccessible.
• Admin user search and email verification status.
• Color settings on job details pages.
• Milestone enable/disable setting enforced in backend services.
• Transaction fee display in the proposal accept popup.
• Decimal withdrawal fee input.
• Admin logout from other devices on password change.
• Review badge shows "Review Submitted" when a review exists.
• Offer popup stays open with inline errors.
• Profile earning visibility gated on the admin setting.
• Chat send on Enter.
• Summernote and textarea prop declarations.
• AI Power prompt panel colors, dark mode, 401 on generate, DeepSeek thinking mode, and output caps.
• Impersonate uses a SweetAlert dialog and the platform primary color.

Plugin releases

This section lists every plugin present in the repository on October 15, 2026. All plugins are inactive by default; activation is written to plugins/statuses.json.

Summary

Platform and trust

Growth and revenue

AI

Payments and messaging

Ported premium modules

Scaffold

Version policy

• Patch (1.0.x): fixes, translations, styling. Safe to apply without reading release notes.
• Minor (1.x.0): new hooks, new settings, new providers. Backward compatible.
• Major (x.0.0): manifest or contract change. Read the upgrade notes before applying.

Plugin versions are independent of the core version. A plugin version never forces a core upgrade unless its manifest declares requires.framework.

Activation order

Most plugins have no dependencies. Where order matters:

1. security-manage before plugins that call security.scan.
2. cloud-storage before any plugin that stores files through cloud drivers.
3. freelancer-level before promote-freelancer if you want level-based promotion pricing.
4. sms-gateway before enabling phone OTP.
5. nda after the gateway plugins it will settle through.

The manager resolves requires.plugins automatically. Manual activation order only matters for plugins that share data without declaring a dependency.

Upgrade notes

This section is for site owners upgrading an existing Xilancer installation to 4.3.0. It covers the safe order of operations, what to back up, and the limits you should know before enabling the new plugins.

Before you start

1. Back up the database. Every release since 4.1.0 adds tables and columns; none of them can be reversed by rolling back code alone.
2. Back up plugins/statuses.json. It holds which plugins are active. A restore that misses it silently deactivates every plugin.
3. Back up core/.env. New settings read keys that may not exist yet; keep the old file so you can compare.
4. Check PHP. 4.3.0 requires PHP 8.3 or newer.
5. Check disk space. The plugins/ directory is now the largest part of the codebase.

Upgrade sequence

Step 1 - Put the site in maintenance mode

php core/artisan down

Step 2 - Replace the codebase

Replace core/ and plugins/ together. Do not mix a new core/ with an old plugins/ directory: the bridge expects the framework at plugins/framework.

Keep these paths from the old installation:

• core/.env
• core/storage/
• core/public/uploads/
• plugins/statuses.json (after review)
• Any custom plugin directories under plugins/

Step 3 - Install dependencies

cd core
composer install --no-dev --optimize-autoloader

Step 4 - Run migrations

php artisan migrate --force

Migrations are additive. If a migration reports that a table already exists, it is usually a ported plugin whose tables were created by the old module. In that case mark the migration as run rather than dropping data:

php artisan migrate --force --pretend

Review the list, then use the database upgrade screen in Admin → Database Upgrade, which marks already-applied plugin migrations as complete.

Step 5 - Clear caches

php artisan optimize:clear
php artisan route:clear
php artisan view:clear
php artisan config:clear
php artisan cache:clear

Step 6 - Rebuild the search index

php artisan scout:sync-index-settings

If you use the sitemap, regenerate it once:

php artisan sitemap:generate

The sitemap path is stable at sitemap/sitemap.xml. Search Console does not need a new submission after the upgrade.

Step 7 - Restart workers

php artisan queue:restart

Restart queue workers, Horizon, and any Octane or RoadRunner process. Plugins are booted per process; a long-running worker that started before activation will not see the new plugin.

Step 8 - Bring the site back

php core/artisan up

Enabling the new plugins

Activate in this order. Each command validates the plugin, runs its migrations, then writes activation state.

php core/artisan plugins list
php core/artisan plugins activate security-manage
php core/artisan plugins activate cloud-storage
php core/artisan plugins activate freelancer-level
php core/artisan plugins activate referrals
php core/artisan plugins activate coupons
php core/artisan plugins activate seo-tools
php core/artisan plugins activate webhooks
php core/artisan plugins activate announcements
php core/artisan plugins activate nda

Then activate any AI, payment, or growth plugins you have licensed. The admin Plugin Manage screen does the same thing without shell access.

Activation checklist

Configuration that needs attention

Invoice numbering

Invoice numbers begin at 000001 on the first order after the upgrade. Existing orders keep their old numbers. If you need continuity, set the sequence start in the invoice settings before taking new orders.

Tax

Tax is off until you configure it. Check:

• Freelancer tax profiles.
• Global tax collection switch.
• EU reverse charge switch.
• US state rules.
• Invoice tax display.

Phone OTP

Phone OTP is off by default. If you enable it:

• Configure an SMS provider first.
• Test with an admin account before enabling for all users.
• Keep the fail-open behavior; do not change it to fail-closed unless you have provider redundancy.

Realtime notifications

Realtime requires Pusher or Reverb credentials. Without them, notifications still work through polling and the notification list. Browser push requires VAPID keys; Firebase is optional.

Webhooks

The scheduler must run every minute:

* * * * * cd /path/to/core && php artisan schedule:run >> /dev/null 2>&1

Without the scheduler, deliveries queue but never retry.

Known limits

These are deliberate limits, not bugs. They are documented so you can plan around them.

NDA gateway coverage

Only gateways that support the generic payment.complete round-trip can settle an NDA fee: Pesapal, SePay, CoinPayments, and YooMoney. Core's other gateways settle orders, not NDA fees. A free NDA works with every gateway because there is nothing to charge.

Plugin architecture is hybrid

The framework forbids plugins from importing App\* or Modules\*, and the new plugins follow that rule. Ported premium plugins still import core classes in places. This is phase-one behavior: they are decoupled in both directions at the seam level, but their internal code is not fully portable. New plugins should follow the strict rule.

SMS Gateway location

sms-gateway lives at core/plugins/sms-gateway, not plugins/sms-gateway. It must be available during login, before the framework boots. Do not move it into the top-level plugin directory.

Subscription expiry is passive

Expiry is evaluated at read time (expire_date < now). There is no status transition to hook, so a plugin cannot listen for "subscription expired". Use a scheduled check if you need one.

Mail has no funnel

Outbound mail has no central hook. Use order and view slots for custom mail, or a webhook receiver for external automation.

Social signup attribution

Social OAuth signups do not carry a referral code. Web and API password signups do.

Rolling back

Code rollback is supported for one release:

1. Restore the previous core/ and plugins/ directories.
2. Restore plugins/statuses.json.
3. Leave the new tables in place; old code ignores them.
4. Clear caches and restart workers.

Do not roll back the database unless you restored a full backup. Dropping the new tables also drops invoice numbers, NDA signatures, and webhook delivery history.

Post-upgrade verification

Run through this list on a staging copy before repeating it on production:

• Admin login works and the sidebar shows the expected permission groups.
• A client can register, verify email, and reach the dashboard.
• A freelancer can create a service and a client can order it.
• Checkout applies tax and issues an invoice number.
• Wallet deposit, withdrawal, and order earnings appear in one history.
• A subscription purchase issues an invoice and activates the plan.
• Chat sends text, a file, and a voice note; receipts update.
• Notifications arrive in realtime and the badge count matches the list.
• The sitemap loads at sitemap/sitemap.xml.
• A test webhook delivery returns 2xx and is logged.
• php artisan plugins list shows no problems.
• Queue workers are running and the scheduler is active.

Date: July 31, 2026

Date: 26th January

⚠️ Important Update Notice

A completely redesigned UI has been released with major structural and visual changes.

Please do NOT update directly on your live or main server. We strongly recommend installing and testing this update on a test or staging server first before deploying it to production.

This will help you avoid unexpected issues and ensure a smooth upgrade experience.

Last updated: October 22, 2026