Changelog

Security

• Added capability checks to the course notification, settings section, exit survey and extension install requests.
• Close comments on lessons the current user cannot view, so they cannot post comments to them.
• Drop block inline style values that add extra CSS declarations and escape the progress bar label.
• Escape the email title in the checkbox column of the Emails settings screen.
• Escape the module name in the Learning Mode lesson module block and in the lesson breadcrumb.
• Improved the permission checks when assigning a lesson to a course.
• Improved the validation of file upload answers in quizzes.
• Improved the validation of quiz submissions.
• Match lessons on title and excerpt only in site search for users who cannot edit lessons while Access Permissions is enabled.
• Only render question posts when loading the questions a student was asked in a quiz.
• Remove the comments of lessons the visitor cannot view from the comment feeds.
• Respect the course completion mode and the quiz pass requirement when completing a course or lesson from the front end.
• Restricted the Order Lessons and Order Modules screens to courses the current user can edit.
• Return a 404 on the course results page when the course is not published and the user cannot read it.
• Tighten the permission checks of the quiz editor, lesson prerequisite and grading admin requests.
• Tighten validation in the REST API, private messages and the students list, and escape more frontend output.
• Validate the quiz colors and the setup wizard data saved through the REST API.
• Validate the values written by the legacy quiz editor.

Added

• Add the sensei/course-create ability so AI agents can create draft courses with the default course layout. #8370
• Add the sensei/course-structure-set and sensei/course-structure-get abilities so AI agents can build and read a course outline, and refuse structure saves that reference another teacher’s module. #8375
• Add the sensei/quiz-questions-set ability so AI agents can set a lesson quiz’s settings and questions, and reject invalid quiz questions before creating the quiz. #8376

Changed

• Exclude guest and preview students from Last Activity rows and the Completions, Completion Rate, and Average Grade headers in the Courses report. #8306
• HPPS: Add support for Average Grade in the Courses report. #8346
• HPPS: Add support for Average Progress in the Courses report. #8346
• HPPS: Add support for completion counts and rates in the Courses report. #8346
• HPPS: Add support for Days to Completion in the Courses report. #8346
• HPPS: Add support for enrollment counts in the Courses report. #8346
• HPPS: Add support for Last Activity in the Students report. #8353
• HPPS: Support student management listings. #8378
• HPPS: Use the selected progress storage for course status and dates in the enrollment debug tool. #8432
• Improve Grading load times. #8434
• Use MailPoet for Sensei newsletter signups. #8412

Deprecated

• Deprecate Sensei_Course_Theme::get_learning_mode_customizer_url(), unused since the Customize Colors link was removed. #8364
• Deprecate Sensei_Quiz::the_quiz_progress_bar(). #8332
• Deprecate Sensei_REST_API_Lesson_Quiz_Controller::get_single_question_schema() and get_common_question_properties_schema() in favour of Sensei_Lesson_Quiz_Saver. #8376
• Deprecate Sensei_REST_API_Lessons_Controller::lesson_course_meta_auth_callback(). The lesson course is now checked on the REST request.
• Deprecate Sensei_Utils::get_course_progress_comment_id() in favor of get_course_progress_id(), which returns the ID from the selected progress storage backend. #8429
• Deprecate the legacy Courses report completion callback. #8348
• Deprecate the raw SQL query argument for comments-based progress status counts in favor of structured filtering arguments. #8434
• Deprecate the sensei_analysis_course_completions filter – the Courses report now uses the progress aggregation service. #8346
• Deprecate the sensei_analysis_course_percentage filter – the Courses report now uses the grading statistics service. #8346

Removed

• Remove sorting by Completions from the Courses report. #8341
• Remove the progress bar option from the Quiz block and its automatic frontend rendering. #8332

Fixed

• Exclude guest and preview progress from Lessons report counts, activity and completion durations. #8357
• Exclude guest and preview users from lesson Students, Completed, and Average Grade in course reports. #8322
• Exclude guest and preview users from Reports listings, totals, and exports. #8323
• Fix a PHP warning on module archives that have no lessons, such as a module filtered to a course it does not belong to. #8328
• Fix a PHP warning when duplicating a course whose lesson requires a lesson from another course. #8416
• Fix bulk student actions failing with an empty student list despite students being selected on the Students page. #8399
• Fix compatibility with PHP 8.5. #8289
• Fixed course completions not synchronizing to HPPS tables when comments storage redirects after completion. #8310
• Fixed Last Activity values and date filtering for translated courses in Reports. #8350
• Fixed the lesson progress being kept when resetting a student’s course progress in a secondary language with WPML. #8295
• Fixed the Students screen not updating a student’s status after resetting their progress until the page was reloaded. #8296
• Fixed the Students screen showing every student as Not Started on a course opened in a secondary language with WPML. #8282
• Fix Grading status counters including other courses when a teacher filters by course. #8367
• Fix lesson and module ordering for non-admin users when a course contains modules owned by another user. #8324
• Fix out-of-memory errors when searching for courses with Jetpack Search on sites with many enrolled students. #8327
• Fix PHP notices on the course report Students view. #8303
• Fix PHP warnings in the course students batch and update teacher REST permission checks when required parameters are missing. #8333
• Fix quiz answer feedback blocks always showing expanded in the editor, and several Learning Mode blocks that could not be selected in the editor. #8292
• Fix report searches, CSV export filters, and HTML entities in exported titles. #8373
• Fix Sensei Home review notice buttons not responding when clicking their labels. #8290
• Fix stale course progress totals after completing a course. #8390
• Fix submitted files failing to open or download from Grading. #8330
• Fix the Course List block showing no courses, no filters, or the page itself on pages translated with WPML. #8283
• Fix the Courses report showing an unrelated student’s Last Activity date when the course and student share the same numeric ID and the users-table relationship is unavailable. #8351
• Fix the lesson Quick Edit fields not showing the lesson’s current values on the lessons list. #8402
• Fix the MailPoet daily sync job not being scheduled. #8254
• Fix the module order of a lesson translated or duplicated with WPML when the current language differs from the original lesson’s. #8431
• Fix translated lesson activity and completion metrics in Lessons reports. #8354
• Handle failed course and lesson progress creation and retain submitted quiz text for retry. #8403
• HPPS: Fix incorrect progress metadata updates. #8390
• Improve keyboard navigation, navigation semantics, and progress text contrast in Learning Mode. #8335
• Improve progress-write error logs with readable messages and diagnostic context. #8426
• Report failed and partial student enrollments in the Students course-selection modal. #8398
• Report failed progress comment creation when saving course, lesson, or quiz progress. #8419
• Save the quiz on the first save when the Quiz block is added from the block inserter. #8379
• Show an error when quiz progress cannot be created. #8433
• Use lesson completion dates for Courses and Students report Last Activity when reading progress from HPPS tables. #8369

Development

• Centralize Grading and Reports query-service composition. #8255

Security

• Check the destination course permissions when changing the lesson course from the bulk editor.
• Enforce course edit permissions when creating a module from the course editor.
• Enforce lesson edit permissions when saving the course structure.
• Ensure Learning Mode applies colour values without changing block markup.
• Escape the label attribute in the Exit Course block.
• Escape the teacher name and archive link rendered by the sensei_teachers shortcode.
• Improved how locked lesson content is excluded from frontend listings.
• Improved how private messages are excluded from frontend queries.
• Improved how the admin lesson and course fields are initialised so that post content cannot influence them.
• Improved the authorization of lesson completion.
• Improved the authorization of private messages sent to teachers.
• Improved the authorization of usage tracking events.
• Improved the handling of files uploaded as quiz answers.
• Improved the privacy of private messages.
• Improved the scoping of teacher comment moderation.
• Made request-input handling consistent across the admin and frontend.
• Prevent students from changing their quiz answers after the quiz has been submitted.
• Require the Order Courses capability to save the course order.
• Restrict the legacy lesson quiz save handler to the lesson being saved.

Changed

• Reports Overview Students and Courses header counts now read HPPS progress tables when High-Performance Progress Storage is enabled. #8231
• Reports Overview students per-row average grade now reads HPPS progress tables. #8205
• Reports Overview students per-row course counts now read HPPS progress tables when High-Performance Progress Storage is enabled. #8231
• Resolve HPPS storage configuration consistently across progress query services and repositories. #8248
• Update Sensei blocks to Block API version 3 so they render in the WordPress iframe block editor. #8190
• Update the Action Scheduler package to version 4.1.0. #8166
• Update the pelago/emogrifier package to version 7.3.0. #8231

Deprecated

• Deprecate the sensei_analysis_user_lesson_grades filter. #8205

Fixed

• Fix a fatal error when a teacher triggers a module hierarchy rebuild.
• Fix a PHP 8 TypeError when post_updated fires with a null post object during autosave. #8222
• Fix a PHP 8.4 deprecation notice when exporting CSV files. #8213
• Fix a thick border showing on Course Outline modules in the editor when the module border setting is off. #8191
• Fixed a PHP deprecation notice when reviewing a grade for an unanswered True/False question. #8214
• Fixed a PHP warning when changing a course’s teacher on a course with no modules. #8225
• Fixed edits to a WPML-duplicated lesson’s quiz landing on the original language’s quiz and questions. #8220
• Fixed quiz answers, grades, resets, and lesson and course quiz surfaces breaking when the admin uses a secondary language or the lesson is translated on multilingual sites. #8130
• Fixed saving a translated course overwriting and stealing the original course’s lessons on WPML sites. #8219
• Fixed the quiz saved message not showing in Learning Mode. #8272
• Fixed the student management and grading screens showing no students when the WPML admin language is not the original one. #8224
• Fixed the text domain on the “Generate quiz questions with AI” upsell label so it can be translated. #8230
• Fix garbled text in button blocks whose text uses non-Latin characters when the button URL is set at render time. #8226
• Fix lesson/module hamburger menu being hidden on mobile when the course title is too long. #8094
• Fix lesson order not reaching WPML translations when the translated lessons are not duplicates. #8246
• Fix lessons removed from a course staying in its WPML translations after the translation is updated. #8245
• Fix PHP 8.4 deprecation warnings from implicitly nullable function parameters. #8199
• Fix Sensei templates in the Site Editor when Gutenberg’s Template activation experiment is enabled. #8250

Development

• Refactored course report lesson metrics into dedicated progress aggregation and grading statistics services. #8249
• Remove the unused sensei_question_slug filter registration from the WPML compatibility class. #8215

Security

• Scope the Students management user search to student accounts. #8174
• Require the grading capability on the lessons dropdown AJAX endpoint and scope it to the caller’s own lessons.
• Restrict adding a student to a lesson so it is only allowed through the lesson’s own course.
• Prevent a teacher from deleting another teacher’s unused module.
• Remove the admin notice that exposed the administration email address to non-administrators.

Removed

• Remove the course and lesson editor tours. #8150

Fixed

• Fix a false “already owned by another teacher” error that blocked saving a course containing a module without a resolvable owner. #8180
• Fix course layouts and Sensei blocks not loading when Show template is enabled. #8139
• Fix quiz results and grading showing a previous attempt’s grades after a retake from another language on multilingual sites. #8125
• Fix spacing and styling of quiz question options when using the iframed block editor. #8172
• Fix the Grading screen Grade button and row titles when the admin uses a secondary language on multilingual sites. #8121
• Fix the quiz results page showing questions in the language the quiz was taken in instead of the viewer’s language on multilingual sites. #8124
• Fix lesson prerequisites pointing to the original-language lesson on WPML-translated lessons. #8132
• Fix lessons appearing out of order in translated courses when a new lesson is translated with WPML, and attach WPML lesson duplicates to the translated course. #8149
• Fix PHP 8.1 deprecation notices rendered into the quiz page for unanswered Multi Line questions. #8146
• Fix quiz question titles and answers not being translated on WPML-translated lessons. #8100
• Fix the Add Student form layout on the Students page. #8147
• Fix the misaligned Reset filter button on the Grading screen. #8122
• Fix typo in My Courses Page setting description #8106
• WordPress 7.1 Compatibility: Course and lesson block colors match the theme in the iframed post editor. #8179
• WordPress 7.1 Compatibility: Fix a PHP notice logged by Learning Mode templates. #8179
• WordPress 7.1 Compatibility: Learning Mode and email templates appear in their own group in the Site Editor. #8179