Inventoros 2.0.0

Inventoros 2.0.0 expands the inventory core with shipping, payments, customer portals, approvals, scheduled reports, multi-organization memberships and a runtime plugin platform. This is the first release after 1.0.8.

Upgrading from 1.0.x

Upgrade manually once. The updater shipped in 1.0.8 and earlier cannot follow GitHub's release-download redirects. Back up your database and files, drain active work, and follow the upgrade guide. Clear old caches before migrating. PHP 8.4.1 or newer is required; PHP 8.4 and 8.5 are supported. The scheduler must run every minute.

Other compatibility changes include snake_case MCP tool names, plugin assets moving to public/plugin-assets, bearer-token-only REST authentication and AGPL-3.0-only licensing. Releases through 1.0.8 remain MIT licensed.

Highlights

• Shipping and fulfilment with EasyPost or manual shipments, partial shipment support, tracking and shipment emails.
• Customer portal, line/order discounts, payments, refunds, invoices and currency-aware receivables and analytics.
• Optional approval workflows, scheduled cycle counts and report emails, expanded barcode scanning and warehouse access controls.
• Organization memberships and switching, organization-bound API tokens and atomic inter-company stock transfers.
• Signed plugin marketplace, runtime plugin pages/widgets/tabs, additional lifecycle hooks, plugin MCP tools and webhook events, and a documented core PHP extension API.
• Production Docker image and a signed cPanel package with compiled assets, production Composer dependencies and a verified release manifest.

Release audit fixes

The release audit tightened tenant access to installation updates/backups, serialized stock-operation transitions, rechecked scheduled-report recipients at delivery, fixed queue reservation lifetimes, capped low-stock reports, improved update rollback behavior and persisted Docker plugins across services. It also fixed guest-member cycle counts, plugin query isolation and variant transfer webhook payloads. Vue, source-map-js and shell-quote security fixes are included.

Downloads

• cPanel/shared hosting: inventoros-cpanel-2.0.0.zip and its detached Ed25519 signature, inventoros-cpanel-2.0.0.zip.sig. Follow INSTALL.md inside the archive. No Node.js build is needed on the server.
• Docker: ghcr.io/inventoros/inventoros:2.0.0, with Docker deployment instructions.
• Example plugin: hello-world-plugin.zip. Prefer the signed marketplace copy when listed; manual ZIP uploads require INVENTOROS_ALLOW_PLUGIN_UPLOADS=true.

Known limits and next work

Stock reservations/available-to-promise are planned and are not included. Work orders currently support untracked, non-variant products; tracked products and virtual kits are refused to preserve inventory integrity. Inter-company transfers do not move batch/serial-tracked stock or kits.

Organization membership administration screens and business-specific 3PL workflows remain plugin work. Some notification/assignee pickers still list home-organization users only. Large cycle-count performance, expired-export cleanup and the Tailwind 3 development dependency advisories remain follow-up work. Production npm and Composer dependency audits pass.

See the full changelog and release audit for details and the prioritized backlog.