Fixed the copyright agent's email regex so example.com, .test and .invalid addresses are skipped instead of reported with the last letter cut off.

Made the CycloneDX 1.7 SBOM export schema-valid by replacing the removed vendor field and writing non-SPDX licenses as expressions.

Stopped license imports without a type column from resetting every matched license to a misspelled 'Permisssive' type, with unit test coverage.

Fixed typos across multiple UI components and user-facing CLI messages for better clarity.

Resolved unsafe strcpy(), NULL-before-free crashes, and HTML double-encoding in package info.

Fixed strlen(Type) misuse in tracking extension length during temporary path generation.

Fixed SQL formatting bugs, array intval() misuse, and added full test coverage for License DAOs.

Corrected null safety gaps and updated REST conventions (200→201/202) in member API endpoints.

Eliminated redundant DB lookups and prevented TypeErrors on synthetic license entries in the /scanned API.

Replaced deprecated assertRegExp calls across the test suite for modern PHPUnit compatibility.

Resolved unhandled null states, corrected status codes, and fixed typos in error payloads.

Made the single broadcast endpoint choose JSON or binary from the Content-Type header, so JSON bodies with a _binary key or non-object payloads are no longer mangled.

Stopped one oversized broadcast event from crashing the shared GenRpcPubSub worker by containing serializer errors in the message dispatcher.

Validated presence keys as strings so a single bad join can no longer crash the Presence shard shared across tenants.

Fixed 6 flaky integration tests across Presence rate limiting, untracking, and replication slot handling.

Fixed flaky cdc_rls, metrics_pusher and tenant_controller tests, including an assertion that compared a list to an integer and never checked anything.

Fixed max_wal_senders test flakes caused by missing public.test table in Realtime.

Refactored and consolidated extension tests into one canonical location mirroring lib/.

Added tests to verify that Ranch killed connection logs are properly suppressed in the tracker.

Prevented emoji surrogate pair slicing bugs in the Realtime inspector's fuzzy search feature.

Fixed character list handling in the Ranch log filter to prevent logging errors.

Proxied /.well-known/* and /pg/* routes to the API gateway in Caddy/Nginx configs to fix 404s.

Moved hardcoded Realtime DB_ENC_KEY to a configurable .env variable for self-hosted instances.

Added strict validation for JWT audience and issuer fields to improve authentication security.

Fixed the formatter dropping parens on anonymous function calls with do-end blocks, which turned valid code into unparseable output and also affected Macro.to_string/1.

Restored the comment check the formatter uses when a tuple or bitstring is the last call argument, so mix format gives stable output on the first pass.

Made a comment before an operator's right operand force a line break, so mix format no longer changes its output on a second run.

Cleaned up typos across docs, comments, and setup copy for PayPal integrations.