Security

• Enforce per-post edit capability on venue / event meta and post-specific REST routes so unauthenticated or under-privileged callers cannot modify another user's events or venues. [#1520] [#1694]
• Lock down GITHUB_TOKEN permissions across CI workflows to least-privilege scopes, reducing the blast radius of a compromised workflow. [#1650] [#1694]
• Override vulnerable transitive npm dependencies (qs, uuid, webpack-dev-server) via npm overrides. [#1651] [#1694]
• Rate-limit the geocoding REST endpoints to prevent abuse-by-loop. [#1546] [#1694]
• Split privileged PR workflows to remove the untrusted-checkout / cache-poisoning exposure that pull-request-target workflows otherwise inherit. [#1652] [#1694]

Added

• Add a block transform from core/post-date to gatherpress/event-date, re-implemented via the WordPress Block Transforms API. [#1565] [#1664] [#1694]
• Add a configurable RSVP mode with a sitewide disable switch and per-event control, plus an Open RSVP setting that lets non-logged-in users RSVP via magic-link comments. [#1468] [#1469] [#1694]
• Add a default template for the Event Query Loop block so it has a sensible starting point on themes that don't ship one. [#1399] [#1694]
• Add a setting for the Google Maps API key, so sites that prefer Google over OpenStreetMap can wire credentials in through the UI. [#1568] [#1694]
• Add a site health test that flags installs running on plain permalinks, since several GatherPress features (notably RSVP magic links and .ics downloads) require pretty permalinks. [#1660] [#1694]
• Add a show_if field key to the Settings API so settings fields can be conditionally hidden based on the value of other fields. [#1634] [#1694]
• Add network-wide GatherPress settings with per-option inheritance so multisite installs can share or override individual settings at the site level. [#1500] [#1694]
• Add server-rendered static maps to the venue-map block, with a regenerate button, prewarming, retina (2×) srcset rendering, a scale attribute, and Inspector polish. Editor previews now poll for async-arriving map descriptors so the block reflects geocode-on-save state in real time. [#1480] [#1483] [#1485] [#1489] [#1491] [#1492] [#1497] [#1498] [#1694]
• Add starter pattern pickers to the Event, Venue, RSVP Form, RSVP Response, and RSVP blocks, plus an Event Query Loop starter pattern with a Start blank event scaffold. Patterns are hookable so themes can register their own. [#1571] [#1578] [#1579] [#1580] [#1581] [#1582] [#1584] [#1694]
• Add tag-driven release automation. Pushing a stable tag now triggers a workflow that builds a versioned distro zip, rolls up .github/changelog/* into a new CHANGELOG.md section (auto-PR'd back to develop), creates a GitHub Release with the zip attached, and deploys to wordpress.org. Pre-release tags (alpha/beta/rc) produce a GitHub Pre-Release with the [Unreleased] changelog snapshot and skip the wp.org deploy. See docs/developer/release-process.md. [#1692]
• Add the Event Archive setting so site organizers can choose whether the post-type archive defaults to upcoming, past, or is disabled. [#1587] [#1694]
• Add the gatherpress-event-date post type support so any post type can opt into event datetime storage, the gatherpress_events DB table, date-based query ordering, and the Event Date / Add to Calendar blocks. [#1440] [#1694]
• Add the gatherpress-rsvp post type support so any post type can opt into the comment-based RSVP system, attendee management, waiting lists, and the RSVP block family. [#1444] [#1694]
• Add the gatherpress-venue and gatherpress-online-event post type supports so venue association and online-event link handling can be enabled on any custom event post type. [#1453] [#1694]
• Add venue address autocomplete search powered by the Photon geocoder, with a rate-limited REST endpoint and graceful fallback to manual entry. [#1451] [#1546] [#1694]
• Adopt the Jetpack changelogger workflow with a per-PR .github/changelog/* file format and a rolled-up CHANGELOG.md. Backfills history from 0.27.0. [#1690]
• Expose the gatherpress_venue_map_prewarm_pre_enqueue_job filter so extensions can short-circuit individual venue-map prewarm jobs (useful for sites with hundreds of venues where a switch_theme would otherwise flood WP-Cron with warm jobs). [#1504] [#1694]
• Expose WordPress Geodata standard meta on venue post types so third-party themes and plugins that consume geo_latitude / geo_longitude / geo_address work out of the box. [#1471] [#1694]
• Extract the gatherpress-shadow-source primitive. Hidden _<post_type> taxonomies with post-name-derived terms can now be enabled on any post type, providing the foundation for the venue ⇄ event tagging mechanism and letting companion plugins register their own source-style CPTs (productions, organizers, etc.). [#1569] [#1694]
• Integrate with the Advanced Query Loop plugin, including a Venue facet in the taxonomy filter. [#1411] [#1694]
• Persist structured venue address fields (house number, street, city, county, state, postcode, country, country code) via an async geocode-on-save cron handler. Exposed via individual meta keys for block bindings. [#1517] [#1530] [#1694]
• Refactor the Settings API with flat storage, a config-driven architecture, import / export, and reorganized tabs. [#1434] [#1694]
• Support the Interactivity API's clientNavigation flag for the venue block so navigation between venue pages stays SPA-style on themes that opt in. [#1464] [#1694]

Changed

• Apply the GatherPress hook naming convention across the codebase. New shadow_* subsystem row added to the hooks-naming-convention doc. [#1550] [#1694]
• Apply the WordPress 6.8 __next40pxDefaultSize opt-in to every SelectControl instance so admin form controls match the upcoming default sizing. [#1661] [#1694]
• Bump 'Tested up to' to WordPress 7.0. [#1649] [#1694]
• Calendar endpoint registration is now an explicit (new Foo(...))->init() chain instead of a side effect of new Foo(...). The Calendar\\Endpoint constructor only stores validated args; init() performs rewrite-rule registration and hook wiring, and returns $this for chaining. Fixes five SonarCloud php:S1848 bugs flagged on Calendar\\Setup and makes the registration side effect surface at the call site. [#1695]
• Enforce per-post edit capability on venue / event meta and post-specific REST routes. [#1520] [#1694]
• Extend the admin list-table columns, sorting, and views to every event-supporting post type — not just the built-in gatherpress_event. [#1467] [#1619] [#1694]
• Extract Event\Meta and Venue\Meta from their respective Setup classes so meta registration lives in a dedicated, testable component. [#1542] [#1694]
• Flatten Event_* classes into the GatherPress\Core\Event subnamespace. Event_Admin_List is extracted into its own class. [#1450] [#1508] [#1694]
• Flatten Rsvp_* classes into the GatherPress\Core\Rsvp subnamespace. [#1524] [#1694]
• Flatten Venue_* classes into the GatherPress\Core\Venue subnamespace. [#1522] [#1694]
• GatherPress UI strings now pull from each post type's registered labels rather than hardcoding 'Event' / 'Venue'. Custom event-supporting post types see their own labels everywhere in the settings sub-menus, admin list, sidebar panels, and Query block UI. [#1627] [#1629] [#1631] [#1647] [#1659] [#1694]
• Generalize the gatherpress/venue block and the gatherpress/event-query block's contextual toggle to work with any gatherpress-shadow-source post type (productions, tours, organizers, etc.), not just venues. Adds a new gatherpress_shadow_taxonomy_object_types filter so extensions declaratively wire their shadow taxonomy to event CPTs, plus two reusable Shadow_Source helpers (resolve_post_from_query_context, build_tax_query_clause) for custom Query Loops. [#1689]
• Honor the WordPress comment privacy filters when inserting RSVP comments. [#1470] [#1694]
• Make postIdOverride work for the event and venue blocks, with the dim-gate suppressed on non-event hosts when the override resolves. [#1552] [#1554] [#1694]
• Move RSVP-related settings to a dedicated RSVP settings panel and relocate the online event link to Venue settings for better organization. [#1394] [#1694]
• Move the gatherpress-utility-style enqueue onto enqueue_block_assets so it reaches the editor iframe in FSE themes. [#1655] [#1694]
• Re-implement block-unregistration handling and clean up legacy unregister flow. [#1409] [#1694]
• Re-implement the calendar .ics download endpoint with proper rewrites and feed handling, replacing the legacy Event ICS code. [#1669] [#1694]
• Read isEditorPanelOpened from core/editor instead of core/edit-post, silencing a WordPress 6.5 deprecation warning. [#1653] [#1694]
• Refactor the venue-detail block architecture and fix context handling so it composes cleanly inside Query Loops and FSE templates. [#1391] [#1405] [#1694]
• Refactor the venue map block into a swappable provider strategy so Google Maps and OpenStreetMap (and future providers) share a common interface. [#1534] [#1694]
• Rename the safeHTML helper to stripScriptsAndEventHandlers and document its narrow scope (it strips <script> tags and on*= event handlers — it is not a full HTML sanitizer). [#1545] [#1694]
• Rename OnlineEventLink to OnlineEvent and remove the legacy Listener / Broadcaster code that was no longer used. [#1420] [#1694]
• Replace the original RSVP / RSVP Response / RSVP Template / Venue blocks with their V2 equivalents that shipped in 0.32.0. The V2 naming is dropped now that the new blocks are canonical. [#1407] [#1694]
• Restructure settings tabs — Date & Time moves under Events, Maps moves under a new Venues tab. Venue splits into an instance class plus a Venue_Setup singleton. [#1477] [#1694]
• Separate README.md (GitHub-facing) and readme.txt (wp.org-facing) so each surface gets content tailored to its audience. [#1423] [#1694]
• Stop dimming GatherPress blocks inside Query Loop contexts when valid event context is present. [#1549] [#1694]
• Support arbitrarily deep namespaces in the GatherPress class autoloader. [#1526] [#1694]
• Use the WordPress-native taxonomy column for venues in the events admin list, replacing the custom column. [#1544] [#1694]
• WordPress conventions sweep across the codebase (blank line after class openings per WP core style, JS docblock dependency-header normalization, str_contains / str_starts_with migration from strpos), plus two small settings panel fixes. [#1589] [#1694]

Removed

• Remove the window.GatherPress global in favor of editor settings, interactivity state, and per-block data stores. [#1465] [#1694]

Fixed

• Add the gatherpress_exclude_rsvp_from_comment_query filter so integrations (like comment moderation plugins) can opt back into seeing RSVP comments in the comment query. [#1640] [#1694]
• Deduplicate admin column sorting in Event_Setup and fix SQL identifier quoting on the sort query. [#1449] [#1694]
• Editor no longer forces the events admin list back to the Upcoming filter when the user explicitly selects All — the previously-saved filter sticks. [#1515] [#1694]
• Fix a datetime-picker stack overflow when pressing the down-arrow on the year field in relative mode. [#1621] [#1694]
• Fix anonymous RSVP deletion breaking magic-link tokens. [#1424] [#1694]
• Fix ICS export escaping of lowercase n characters in event titles and descriptions. [#1416] [#1694]
• Fix the default archive temporal handling (upcoming / past / none) for event-supporting custom post types. The gatherpress_event_archive_mode filter receives the queried post type as its second argument. [#1624] [#1694]
• Fix the Event Query Settings panel and REST collection params so they work for any event-supporting post type. [#1622] [#1694]
• Fix the orderby behavior of the default Past events filter. [#1442] [#1694]
• Fix the Post Date block to display the event date when the 'use event date for post date' setting is enabled. [#1430] [#1694]
• Fix timezone parsing so option values can no longer leak HTML attributes into rendered markup. [#1558] [#1694]
• Fix venue sorting in the admin venues list. [#1448] [#1694]
• Follow-up to the 0.33.3 protected-meta hardening. Additional GatherPress meta keys are now protected from the Custom Fields panel to prevent stale data overwrites on event save. [#1387] [#1694]
• Gate the 'Send Updates' email notice so it only appears on event-supporting post types, and surface post-type-aware label / pattern filters for related UI. [#1598] [#1694]
• Hide the Filter by Current Venue toggle when the host post type doesn't support venues, and gate the Event Query Settings panel by context. [#1566] [#1694]
• Invalidate caches on RSVP token redemption and bypass page cache for magic-link URLs so the user sees the result of their RSVP immediately. [#1636] [#1694]
• Multiple JS fixes for blocks inside FSE templates. [#1459] [#1461] [#1694]
• Pre-release tags (alpha / beta / rc) now produce a release body containing the rolled-up changelog of every queued entry, computed in an ephemeral checkout so the entry files stay in place for the eventual stable release. Previously the body only showed CHANGELOG.md's [Unreleased] section, which is empty until the stable rollup happens, so testers downloading pre-release zips never saw what they were testing. [#1693]
• Read SVGs from the filesystem instead of issuing an HTTP self-request, fixing icon-block rendering on hosts behind authenticating reverse proxies. [#1455] [#1694]
• Refuse activation when duplicate GatherPress folders are on disk to prevent silent class collisions. [#1560] [#1694]
• Remove the dead RichText onSplit prop on the dropdown-item block, silencing a WordPress 6.4 deprecation warning. [#1663] [#1694]
• Return 404 for the event archive URL when no matching page exists, instead of rendering an empty archive. [#1381] [#1694]
• Scope the RSVP UI to the gatherpress-rsvp support so non-RSVP event post types don't see RSVP fields. [#1594] [#1694]
• Set referrerPolicy: 'no-referrer-when-downgrade' on OpenStreetMap tile requests so tile providers that gate access on the Referer header (e.g. CARTO basemaps) receive the request correctly. [#1433] [#1694]
• Several improvements and bug fixes to the Event Query Loop block surface (template handling, attribute migration, pattern selection). [#1396] [#1398] [#1694]