What changed on the forum in each update, newest first. Each section starts with a short summary.

Bug Fixes

• When an upload is refused, the page now says which file and why; you can always delete your own files, and deleting files works again.

Housekeeping / Clean-up

• The maintenance page has new text and a random under-construction picture.

Bug Fixes

TL;DR: Jewel Quest works again.

• Jewel Quest no longer stays on its loading screen, and each of its four boards has its own colours.

Housekeeping / Clean-up

TL;DR: Every arcade game that had been broken for years can now be played again.

• 28 more arcade games that had been broken for years can be played again.
• 4 more arcade games can be played again: Four Seconds of Fury, Mario Starcatcher 2, Monster Truck Curfew and Yetisports 8.
• 8 more arcade games can be played again: Bejeweled, Bomb Jack, Bubble Spinner, Curveball, Gold Strike, Himalaya, Mario Glide and Plupon.
• Throw Me can be played again.
• Turret Defence 2 can be played again, the last of the arcade games broken for years.

Behind-the-scenes changes only; nothing members will notice.

Security Fixes

TL;DR: Fixed all the security holes

• Posts, signatures, profiles and private messages can no longer carry scripts that run in other members' browsers: all member text is escaped or cleaned before it is shown.
• Posts, signatures and private messages that use HTML are always cleaned, so only safe formatting gets through.
• Profile homepage links, ban reasons, screen names and usergroup titles can no longer carry scripts.
• Redirects, [url] links, quote links, the arcade, search and RSS no longer let scripts in through the address bar.
• All database queries were rewritten with prepared statements, closing off SQL injection.
• Passwords are stored with modern salted hashing, and the login cookie no longer holds your password hash.
• Login sessions use secure cookies, and repeated failed logins are slowed down per account and per network.
• Failed-login limits can no longer be dodged with other spellings of a username, and guests can't lock members out.
• Password-reset links, email-change links and new-account passwords are random and can't be guessed.
• Changing your password cancels any pending email change, and your old address is told when your email changes.
• Forms and admin actions are protected against cross-site request forgery (another website acting in your name).
• Moderation actions and the login form have the same protection.
• Quoting, poll votes and email changes check permissions properly, and moderators can no longer ban admins.
• Titles of private and hidden threads no longer show up in the activity list.
• Subscriptions and saved searches no longer show threads you have lost access to.
• Moderator tools check the moderator's own permissions when moving threads, warning members and showing IP addresses.
• Locked threads are really locked: no more replies, poll votes, ratings or deletes.
• New screen names that look like another member's name are refused.
• Searching for names with % or _ treats them as normal characters.
• Error pages no longer show technical details such as database queries, form data or cookies.
• Avatar and file uploads are checked more strictly.
• Uploaded files get safe names, and file types that could run in the browser are refused.
• Upload-by-URL only fetches from public web addresses.
• External avatars are fetched safely, and https avatars work.
• The old built-in chat, which had security problems, has been removed.
• The web server configuration was tightened to block access to private files.
• Private messages to some members could be delivered to a different member whose screen name matched their login name; that can no longer happen.
• When two members share a screen name, usergroup and moderator forms ask for "Name #id", so saving a group can't swap one member for the other.
• Registration checks new login names again: only allowed characters, and a name that matches another member's screen name is refused.
• Public server information pages and leftover files were removed.
• Arcade import and repair actions are admin-only.
• Admin database maintenance only works on the forum's own tables and always takes the forum out of maintenance mode afterwards.
• Custom statistics graphs in the admin panel run with read-only database access, and their results are no longer published as public files.

New Features

TL;DR: Added all the new features

• Every template's menu links to this Change Log page, which lists what changed in each update.
• Every page footer shows the forum's release number.
• The member map is back, now using OpenStreetMap.
• Optional two-factor login: in the Control Panel you can add a code from an authenticator app (Google Authenticator, Authy, 1Password, ...) to your login, with recovery codes and "remember this device for 30 days".

Bug Fixes

TL;DR: Fixed all the bugs

• Sending private messages works again.
• The upload space limit per member is now enforced.
• Header links work on pages in subfolders: logging in from the arcade no longer goes to a missing page.
• Uploading an avatar works for members who never had one.
• Long email addresses and passwords are no longer cut off.
• Email addresses with a + or starting with a digit are accepted.
• Profile homepages typed without http:// link to the site instead of a forum page.
• No more stray "|" after the last subforum on the main page.
• The © sign in the footer shows correctly.
• The control panel menu no longer has blank lines around Inbox and Sent Items in Firefox.
• Moderators can move several selected threads at once again (only the last one moved before).
• Sent Items shows your own copies of the messages you sent, and opening one no longer marks the recipient's message as read.
• Search only looks in the forums you selected.
• Deleting a poll option no longer deletes votes for other options.
• Edit history shows when each earlier version was really written.
• A word filter whose replacement contains the filtered word no longer hangs the page.
• Sign-up and email changes need a real email address.
• The private-message RSS feed shows the right dates.
• A "per page" setting of 0 or a huge number no longer breaks thread and forum pages.
• Two broken images, including the "no new posts" icon, show again.
• The usergroup and template pages of the admin panel show inside the admin layout, and dead admin menu links were removed.
• The threads-per-day statistic is calculated correctly.
• Pages are compressed again, so they load faster.
• Login and two-factor error messages are easier to read.
• Error messages across the forum are easier to read.

Quality of Life

TL;DR: Fixed all the problems in your life

• The chat link shows a short page about the INTL Discord before sending you there.
• The map is much bigger on modern screens.
• Skin background images load from the forum itself instead of the old, dead image server.

Infrastructure

TL;DR: Fixed Dreamhost

• The forum now runs on PHP 8.5 and MySQL 8, up from PHP 5.6.
• The registration check uses Cloudflare Turnstile instead of Google reCAPTCHA.
• Planned maintenance shows a proper "under maintenance" page instead of errors.
• My Controls → Change Style opens with your template's stylesheet instead of an empty editor, and Download As File works again.

Housekeeping / Clean-up

TL;DR: Cleaned up all the messes

• Arcade games play again without the Flash plugin, using a built-in Flash emulator.
• The photo gallery has been switched off.
• The Google 100 page and its links are gone.
• Links to the old INTL Wiki were removed.
• Dead links to the old forum games were removed.
• Pages load faster: the forum no longer looks up every visitor's host name, and busy database tables got indexes.
• Who's online no longer names search engine crawlers; they count as guests.
• Admins can recount members' post counts and karma from the admin panel.
• The New Password field in the admin user editor hides what you type.
• Candy Tetris works in the arcade again.
• Two arcade games were removed for good.
• Pages no longer load Google's old analytics script.
• Page titles, breadcrumbs and the jump menu say INTL v5.1.
• 34 arcade games that had been broken for years can be played again.