= 1.12 =
Security
* Scheduled backups could be created or changed by any logged-in user (and by other sites through CSRF): saving a schedule now needs an administrator and a nonce, and every field is validated
* Schedule titles were printed unescaped (stored XSS); all schedule data is escaped
* The secret key that authorizes imports was handed to every user with the "export" capability: Export, Settings and Schedules now require an administrator, Reset Hub requires the import capability
* The Reset Hub password could be skipped; every step after the password check now needs a one-time token
* Backup actions, settings and the folder browser check the user's capability; the custom backups folder can no longer be WordPress itself, a folder that contains it or a code/uploads folder
* Archive extraction can no longer write outside its target folder (Windows path bypass closed)
* Job folder names are validated, so cleanup can never delete the plugin directory
* Reset database snapshots (password hashes, sessions) live under a random name in the job folder and are always removed

Stability
* Imports of encrypted backups never write still-encrypted files: before, a client that dropped the password between steps took the site down
* Corrupt or truncated backups fail with a clear error instead of hanging, filling memory or writing empty files
* Failed steps always end with an error status and cleanup, so progress screens and API pollers never wait forever; steps that stop making progress abort
* Must-use plugins and database files resume correctly after a time slice instead of being cut short
* Chunked uploads verify every chunk and resume safely after retries; server errors are shown instead of retried
* Exports: no more endless loops on unreadable files, consistent archives when files change during the export, no repeated full-file checksums on resume, symlink loops skipped
* Exports never include other .rocket/.wpress files found in wp-content
* Database export fails loudly on lost connections instead of saving an incomplete dump; tables without a primary key, generated columns and empty binary values export correctly; serialized data is never corrupted by search/replace
* Reset Hub: Plugin Purge no longer deletes the whole plugins folder (Rocket Migrator included) when a single-file plugin is installed; theme reset always leaves an active theme; multisite fatal fixed
* Schedules: an interval of 0 or a corrupted schedule no longer hangs the Schedules page; notification e-mails are sent to the admin address by default; times shown in the site time zone
* Retention settings are applied again
* Recursive deletes never follow symbolic links

Product
* Rocket Migrator by Xaflo: plugin header, links and fallback theme credit Xaflo
* New backups use a neutral table prefix token; backups from earlier versions and .wpress files still restore (define ROCKET_MIGRATOR_LEGACY_TABLE_PREFIX_EXPORT to export for 1.11 or older)
* Icon font cleaned up (WOFF and TTF only)

= 1.11 =
* Cleaner plugin layout: all code lives in library/ (the Unlimited module in library/unlimited/) and runtime files such as the job status and error log in data/
* No calls to third-party servers: removed the old activation ping, usage statistics, the feedback backend and the legacy extension updater. The only outgoing request left is the update check to wpconnect.xaflo.com
* Renamed the shared stylesheet, script and icon font; the fallback theme created by Reset Hub is now called "Rocket Blank"
* The changelog now starts at 1.10

= 1.10 =
* Self-hosted updates from wpconnect.xaflo.com through the normal WordPress update screen, with the auto-update toggle. Every package is checked against the SHA-256 in the update manifest before WordPress installs it
* New interface: one header with logo and tabs on every screen, blue-violet styling and Space Grotesk display type (SIL Open Font License)
* Create a backup from a launch pad with "on board" chips (Database, Media, Plugins, Themes) that follow the exclude options below it
* Progress dialog with a counting ring, a phase trail (Pre-flight, Scan, Files, Database, Finish), animated step headlines, a mission clock and a quieter Stop button
* "Your backup is ready" card: file name, size, file and table counts, duration, contents, a download button and a link to Backups
* Backups: Restore, Download, Contents and Delete sit in the row; "x ago" follows the site language
* Settings: the backups directory shows its folder name and full path next to a "Change folder" button
* Backups are stored in wp-content/rocket_migrator in the .rocket format; .wpress files can still be imported
* WP-CLI command wp rocket-migrator and REST namespace rocket-migrator/v1
