v5.47.5 Homebrew Analytics; CSP on hold

API

• Feature: Capture some basic KPIs in our own database instead of sending data to third party analytics platforms (@phillipthelen)
• Fix: Disable CSP rules that were breaking Google login and apidoc, for now (@SabreCat)

Client

• Feature: Caution user about including sensitive personal information, or SPI, in task fields (@SabreCat)
• Fix: Rerender task columns as necessary to ensure DOM stays consistent in display of user's task order (@SabreCat)
• Refactor: Remove prior analytics solution (@phillipthelen)

v5.47.4 IPN Logging

API

• Feature: Remove logging at subscription time for PayPal; instead capture data at IPN endpoint (@SabreCat)
• Fix: Include habitica.com literal as well as *.habitica.com wildcard in CSP whitelist (@SabreCat)

v5.47.3 CSP and Apple email fix

API

• Feature: Implemented Content-Security-Policy (@SabreCat)
• Refactor: Moment locales delivered from core translations API (@phillipthelen)
• Chore: Locale files updated (@weblate contributors)

Client

• Fix: Capture email during registration flow for some Apple users with accounts that lack emails (@SabreCat and @Hafizzle)
• Refactor: Remove Webpack and vue-fragment (@SabreCat)

v5.47.2 Group Plan reclamation fix

API

• Fix: Look up expired group plans by dateCreated instead of customerId, which gets blanked out after cancellation (@Hafizzle)
• Chore: Locale files updated (@weblate contributors)

v5.47.1 Pre April Fools fixes

API

• Fix: Add a default price to the latest event background, to better fit mobile logic (@SabreCat)
• Chore: Locale files updated (@weblate contributors)

Client

• Fix: Restore mistakenly deleted CSS related to animated GIFs (@SabreCat)

v5.47.0 April Fooling 2026

API

• Content: April Fool's event for 2026 (@beffymaroo, @SabreCat)
• Chore: Locale files updated (@weblate contributors)

Client

• Refactor: More futureproof implementation of AF shenanigans (@phillipthelen)

v5.46.4 Fixes

API

• Fix: Don't allow users to search up and join archived Guilds (@SabreCat)
• Fix: Use correct variable name in group invite emails (@SabreCat)
• Chore: Locale files updated (@weblate contributors)

Client

• Fix: Don't create a new tag in tag creation flow if user has input an exact match with an existing tag (@Tanmay-Nalawade, @SabreCat)

v5.46.3 Rebirth Adjustment, Security Fix

API

• Feature: Simplify logic for awarding Orb of Rebirth achievements. It's no longer necessary to exceed previous level to stack the achievement, only to grow the "highest level rebirthed" portion (@Hafizzle)
• Fix: Generate fresh IV for cryptography instead of using a static environment variable. Addresses GHSA-wj5m-v567-ph9j (Corban Villa)

v5.46.2 Fixes and QoL

API

• Fix: Deduplicate streak achievement notifications (@rohithgowda18)
• Fix: Don't unpin quest potions from Rewards at cron (@SabreCat)
• Chore: Locale files updated (@weblate contributors)

Client

• Feature: Add standard close X to Bailey news modal (@SabreCat)

v5.46.1 Emoji Overhaul and Improved Group Plan Flow

API

• Feature: Allow users to find old lapsed Group Plans and revive them instead of subscribing a brand new Plan (@Hafizzle)
• Chore: Locale files updated (@weblate contributors)

Client

• Feature: Overhaul of emojis library to use a more recent and complete emoji set, and add autocomplete functionality (@Hafizzle)
• Feature: Client support for new Group Plan selection flow (@Hafizzle)
• Fix: Correct margin override for avatar in buy modals (@SabreCat)