New

• 25 languages at full parity — every shipped locale brought level with en-GB across the component, the modules and all add-on plugins, including the new Channel Manager, Channel Restrictions, Inventory and Rate Plan strings.
• Modern date picker — the zero-dependency range picker now covers the booking funnel, the search modules, the hub, the admin reservation form, the inline availability calendar and the public availability overview, with an OTA-style occupancy popover on the search bar. Remaining single-date fields moved to Joomla's native calendar. The legacy jQuery UI engine remains selectable.
• Dark mode — the remaining hard-coded colours in the core component stylesheets and the Lumina booking views are tokenised, with overrides under both prefers-color-scheme and [data-bs-theme="dark"]. Light mode is unchanged.

Improvements

• Configuration: the Live Update fieldset is relabelled Subscription & updates, and the Download ID field now states that it also authenticates the Channel Manager subscription. Followed through all locales.
• Update checker: the shipped plugin/module inventory resolves in a single query instead of ~90 row-at-a-time loads, removing dozens of duplicate queries per admin page load; the 24-hour window is honoured on its own and stamped before the request, so an unreachable update server no longer causes a refetch on every page; the cached response moved out of the component tmpl folder into Joomla's cache folder.
• Update checker: a response that is not a recognisable extension/version list is no longer cached and read back as pending updates, and a missing cache retries after 65 minutes so the retry cannot land inside the service's rate-limit window.
• System: the update-available notice is restyled as a themed badge, and the update check uses PSR-7 response accessors.
• System: File Verification works again — the results accordion no longer collides with the Important paths accordion, and checksums are now generated and installed for the frontend, media and API component paths. Runtime upload directories are excluded from hashing.
• Installer: uninstalling the Solidres core package is blocked while Solidres add-on plugins and modules are still installed, listing the extensions that would be stranded.
• Validation: the jQuery Validate locale is attached automatically to every page that loads the validator, instead of only the few entry points that remembered to. Regional tags fall back to the language that serves them, and translated additional-methods files are loaded; 64 of Joomla's 78 tags now resolve.
• Rate plans: rate-plan support is now gated on either rate-plan editor plugin, so a site migrated off the legacy Complex Tariff editor no longer falls back to default-tariff-only pricing on the frontend, in the booking paths and in several admin screens. Room types with rate plans but no default tariff no longer fatal.
• Sample data: replaced by a single generated file imported inside a transaction, so a half-imported set is rolled back and can be retried instead of leaving the site stuck; statement splitting now uses the framework splitter, which understands comments as well as string literals.

Bug fixes

• Tariffs: a tariff saved with no check-in day restriction was rejected by strict-mode MySQL, because the column has no default on tables created from install.sql. The model now normalises the value and install.sql matches the migration.
• My Profile: a logged-in customer opening My Profile got a 404, and saving failed the same way. Fixed, and a customer can only edit the profile row they own.
• Availability calendar: the check-out diagonal was dropped for every reservation spanning two months. The occupancy state now carries across the month boundary.
• Date fields: saving a date could store the previous day for users in a timezone ahead of UTC. Calendar dates now round-trip unchanged.
• Router: plugin-owned view segments were never resolved, which could fatal when building an SEF link (notably Experience links with no com_solidres menu item) and prevented per-item menu items from matching.
• Reservation: deleting a reservation with the Feedback plugin enabled was fatal.
• Room Type: deleting a room row from the Rooms tab called controller tasks that no longer route, and the add-row button rendered a raw language key.
• Site controllers: frontend controllers that subclass administrator controllers exposed every inherited back-end method as a site task. They now publish an explicit task list and refuse anything outside it; four unused aliases were removed.

Security

• Image uploads are validated by extension against a hard allow-list and by decoding the actual bytes, rather than trusting what the browser said the file was.
• The media manager now only accepts record field names from a per-type allow-list, checks a form token on every task, and requires edit or create rights rather than just the right to open the screen.
• Frontend controllers that inherit from administrator controllers now publish an explicit list of permitted tasks and refuse everything else, so back-end methods are no longer reachable under a site task name.
• Payment gateway callbacks got a systematic pass: signatures and secure hashes are verified before anything is written, an unconfigured shared secret counts as a failure rather than an exemption, every callback is bound to the reservation it names, retried callbacks change nothing, and the amount is checked against what is actually owed. This runs through a shared, unit-tested settlement path instead of being restated — or omitted — per gateway.
• The refund endpoint requires a form token and a genuine refund right, and refuses a booking with nothing captured to send back.
• Channel manager inbound deliveries are authenticated, and the channel console endpoints require a signed-in manager of that property plus a token.