v0.15.1
12 October 2026 Latest- Decode HTML-escaped equals signs as well as ampersands before wrapping tracked links, so password-reset and other query-string URLs retain their parameters.
Email Tracking changelog
Every release of @huloglobal/vendure-plugin-email-tracking. Latest release: v0.15.1 — 12 October 2026.
v0.15.0
11 October 2026- Weekly report. Every Monday at 08:00 (server-local) the worker emails last week's figures — emails tracked, opens, link clicks, bounces and complaints, open rate — each against the previous week, plus next steps taken from the set-up checklist and a link to the admin page. Sent through the host's
SMTP_SERVER/SMTP_HOST,SMTP_PORT,SMTP_USER,SMTP_PASSWORD/SMTP_PASSandSMTP_FROMenvironment (the plugin has no mailer of its own); without SMTP nothing is sent and nothing breaks. The recipient defaults to the licence's customer email, else the address given for the trial reminder. Admin endpoints under/email-track/digest/:GET settings,POST settings({enabled?, recipient?}),POST send-test({to?}) andGET preview(HTML). The Email Log page has a "Weekly report" card (toggle, recipient, last/next send, Send me a test, Preview). - Set-up checklist at the top of the Email Log page and
GET /email-track/setup: sender wrapped (a log row in the last 30 days),publicBaseUrlset to a public host, bounce webhook secret configured, first open or click recorded. The undone items become the weekly report's tips. "Hide" (per browser) once everything is done; the card returns if an item comes undone. - Dashboard widget "Email Tracking" (Dashboard → Add widget): emails tracked, opens and clicks for the last 7 days, the licence notice when a trial or key is about to end, and a link to the page. Backed by
GET /email-track/widget. - Usage stats to the licence server.
emailsTracked,emailOpens,emailClicks,emailsBouncedandopenRatePctfor the last 30 days (numbers only, no addresses) go with the evaluation ping and, from this version, with the daily heartbeat too, so renewal mail can say what the plugin did.HULO_HEARTBEAT_DISABLED=truestill stops the heartbeat. - Licence banner.
GET /email-track/licence/statusnow carriesnotice(trial ending / key expiring / evaluation ended),premiumFeaturesandrecentStats(top three non-zero 30-day figures). The licensed banner shows "renews automatically — current key valid until <date>" for subscriptions and the notice in an amber strip; the trial banner has "Email me before it ends" (POST /email-track/eval/remind-me{email}, forwarded to the licence server and kept as the report's default recipient), the premium feature list and a "So far: …" line; the free banner shows the same with "During your evaluation: …" once the evaluation has run. - By template table (30 days: sent, opened, open rate, clicked, click rate, bounced, failed) under the summary cards, and an Export CSV button that downloads the current filter. Both are premium: on the free tier they show an unlock chip instead of an error toast.
- Every "needs a licence" failure (HTTP 402, or an error code of
premium-feature,licence-requiredorlicence_required) renders one message in the admin: "<what you tried> needs a licence — start the free trial or activate a key at the top of this page."
- One update banner instead of two. "Dismiss" now remembers the dismissed version in the browser; the banner returns for the next release.
- The help drawer no longer promises a resend action that does not exist; the third card describes the per-message open and click history.
- The second update banner was fed by a status request the page never made, so it could never appear; removed with its dead code.
v0.14.3
28 September 2026- Signing secret on by default. Without
signingSecreta random per-install secret is generated once at boot and stored inhulo_licence_store(keyvendure-plugin-email-tracking:signing-secret; first writer wins so server and worker sign and verify alike), then applied as if configured. Bare-id links in already-sent emails behave exactly as in 0.14.2 (pixel served, clicks to own hosts only). A boot warning explains that settingsigningSecretkeeps links valid across reinstalls. A generated secret is never used to authenticate the bounce webhook. - Per-link tokens are live.
/email-track/click/:tokenaccepts the 64-hex tokens minted byEmailLinkService.issueLinkToken()(?u=…&s=…): the row must exist and be unexpired, and both the HMAC and the stored destination hash must match, so the token binds its URL. Sensitive links are recorded by their redacted form.EmailLinkServicesigns with the env override, else the plugin'ssigningSecret. - Postgres corpus test (
src/pg-corpus.test.ts, runs whenHULO_PG_URLis set): every raw SQL statement insrc/is translated by the dialect adapter and executed against PostgreSQL 17 with TypeORM-quoted stand-ins.
- Bounces could not be matched to pipeline mail.
TrackingEmailSenderdelegated toNodemailerEmailSender, which discards nodemailer's result, so rows for order confirmations, OTPs and password resets never had asmtpMessageId/smtpResponse. ACapturingSendersubclass keeps the result per send; the row now gets the Message-ID (stored without angle brackets, also forsendTracked) and the SMTP reply, and its status is set from the reply code likesendTrackeddoes.
- Retention is now plugin-side: it runs daily on the worker only, deletes
email_login batches of 5 000 (oldest id first, short pause between batches) instead of one unbounded statement, appliesmaxRowsthe same way, and prunesemail_linkrows pastexpiresAtor older thandays. - Tests are no longer compiled into
dist.
v0.14.2
28 September 2026- Postgres boot. Date columns were declared as
datetime, which TypeORM rejects on Postgres at start-up; they are now portableDatecolumns. Raw SQL quotes every camelCase column and usesSUM(CASE …)instead ofSUM(boolean), so the log, summaries, exports and the GraphQL list work on Postgres. - GraphQL
huloEmailLogsselected alastClickedAtcolumn that does not exist and failed on every database. - Open redirect. The click redirector no longer redirects for a token it cannot tie to an email; unsigned legacy ids may only redirect to the shop's own hosts (
publicBaseUrl,trackedHosts,clickRedirectAllowedDomains); signed links are unchanged. Bare ids must be plain decimals (a 64-hex link token no longer resolves to row 7). - A database hiccup no longer blocks the email. The tracking sender now sends untracked when the log row cannot be written, and column caps match the schema (a long subject used to make MariaDB refuse the row and the OTP/password-reset email was never sent).
- Permissions. Self-update, licence activate/deactivate, purchase and portal links need SuperAdmin (they were reachable with UpdateCustomer). Admins in a non-default channel only see their channel's rows; the sender records the order's channel instead of always channel 1.
- Bounce webhook is refused without a secret unless
allowUnauthenticatedBounceWebhook: true; it is rate limited; Message-IDs match with or without angle brackets; soft/transient bounces (bounceType: 'soft') are recorded as deferred and never suppress the address; suppression inserts are race-safe. - Opens and clicks are counted with atomic
UPDATE … + 1statements (concurrent pixel fetches from Gmail's proxy and Apple MPP used to lose increments); the pixel is no longerdisplay:none(Outlook skips hidden images) and no longer carries a same-origin resource policy. - Links whose
hrefcontains&are decoded before being wrapped, so click-through query strings survive. - Admin list/export/summary inputs are validated (400 instead of 500 on bad ids or dates); CSV cells starting with
=,+,-,@are quoted so they cannot run as spreadsheet formulas; suppression reasons are checked against the known set. - Deactivating a runtime licence restarts the evaluation client instead of leaving it stopped.
- Admin UI: the update banner is no longer shown twice, the copy button copies a real
@, the restart poll is cancelled on destroy.
retentiondefaults to{ days: 365 }(was: keep everything).- New options
trustedIpHeaders(proxy headers that may overridereq.ip; default none) andallowUnauthenticatedBounceWebhook. - The list orders by
id DESC(same order, uses the primary key).
v0.14.1
2 September 2026- Branding. The bundled
hulo-global-logo.svgis now the HG wordmark on the HULO black rounded square (the same mark as the huloglobal.com header), with explicit-lightand-darkvariants alongside the auto-switching default.
v0.14.0
2 September 2026- Licence & billing card in the admin. Always visible: the current state (free tier, free trial with first-charge date, monthly/annual subscription, lifetime, or master licence) with the actions that apply — start the 14-day free trial or subscribe, buy lifetime, Manage billing (Stripe customer portal: update card, cancel, switch plan) and Upgrade to lifetime (the old subscription stops billing at the end of its paid period). Requires licence SDK ^0.14.0.
v0.13.1
2 September 2026- The 14-day free trial is now card-backed. Unlicensed installs run in the free tier; start the trial from the admin banner (monthly or annual → *Start 14-day free trial*) — Stripe collects a card, nothing is charged until day 15, cancel any time before then, one trial per customer — and the licence installs itself within a minute. The automatic no-card evaluation window is retired (licence SDK ^0.13.0).
v0.13.0
2 September 2026- Buy licence from the admin. The evaluation / free-tier banner now has a plan picker and a Buy licence button: checkout opens in a new tab and, once payment completes, the licence installs itself — no email round-trip, no
.envedit, no restart. Renewed subscription keys are picked up automatically too. New admin endpointslicence/purchase-linkandlicence/claim-status.
- Requires
@huloglobal/vendure-licence-sdk^0.12.0. - The 7-day card trial at checkout has been retired: every install already gets the 14-day no-card evaluation, and paid plans now bill from day one.
v0.12.2
2 September 2026- Pricing. Email Tracking is now £6.95/month, £69.50/year or £139 lifetime (was £9.95 / £99.50 / £199). README updated; the 14-day evaluation is unchanged.
v0.12.1
2 September 2026- Licence SDK ^0.11.0. Master licences (one key that activates every HULO plugin) and hardware-bound keys are now accepted by the runtime licence check.
- Branding. Refreshed HULO Global logo (inline HG monogram) in the admin UI.
v0.12.0
25 August 2026- PostgreSQL support. All of the plugin's SQL now runs on Postgres as well as MySQL/MariaDB — the licence SDK's new dialect adapter translates queries transparently at runtime, so no configuration is needed: the plugin follows whatever database your Vendure
dbConnectionOptionsuse. Verified against PostgreSQL 17. MySQL/MariaDB installs are unaffected (byte-identical passthrough).
v0.11.1
25 August 2026- The update banner's "What's new" link now opens the plugin's changelog page on huloglobal.com, so you can read exactly what a release contains before updating.
v0.11.0
23 August 2026- One-click in-app updates. The update banner now has an "Update now" button: the plugin installs the new version via your project's own package manager (yarn/npm/pnpm auto-detected), verifies it landed, and gracefully restarts under your process supervisor (pm2/systemd). Admin-only; the target version is verified against the npm registry; a failed install never restarts anything. Disable with HULO_SELF_UPDATE=off; force restart without a detected supervisor with HULO_SELF_UPDATE=force. Note: a separate worker process picks the update up on its next restart, and the admin UI itself refreshes after your next admin build.
v0.10.1
23 August 2026- Update notifications in the admin UI. When a newer version is on npm, a dismissible banner shows current → latest with a copy-ready install command and a link to what's new. (Update data comes from the existing daily registry check — no new network calls.)
v0.10.0
21 August 2026- In-admin licence activation. A banner on the admin page shows the evaluation countdown (or free-tier state) with a paste-your-key box: the key is verified with the exact boot-time checks and activates instantly — no .env edit, no redeploy. Persisted in the shared hulo_licence_store table and restored on boot; env/init keys always take precedence. New licence/status, licence/activate and licence/deactivate admin endpoints.
v0.9.0
21 August 2026- 14-day full-featured evaluation. Unlicensed installs now get the complete feature set for 14 days instead of the restricted free tier. Premium tracking features now also run during the evaluation window. The clock is anchored server-side (a hashed instance id — no personal data), so reinstalling does not restart it, and it fails open: if the licence server is unreachable the plugin keeps running fully. After the window the plugin drops to the free tier; all configuration is kept and reactivates instantly with a key.
v0.8.2
4 July 2026- Recipient-email →
customerIdlookup inTrackingEmailSender. If the subject doesn't contain an order code (password reset, OTP, email verification, account welcome, etc.) the sender now does a case-insensitiveCustomer.emailAddresslookup so the row still links to the right customer. Combined with 0.8.1's order-code extraction, this means the per-customer Emails view now surfaces every send the customer ever received — order-related and non-order-related.
v0.8.1
4 July 2026TrackingEmailSendernow populatesorderCode,orderIdandcustomerIdon every EmailLog row it creates. Before this fix, only emails sent by our own service code (which passed those ids in explicitly) had them set — the Vendure email-plugin's built-in order-confirmation, invoice, password-reset etc. handlers do not hand order/customer entities through to the sender, so those rows saved with all three ids asNULL. That broke the per-order and per-customer Emails buttons on the admin (they filter byorderCode/customerId), showing an empty list even though the emails were sent. The sender now extracts the order code from the email subject via a#<code>regex (Vendure's default order-related templates render it there — e.g."Order confirmation for #S2BZ54TEK91HUUBA"), then looks up the corresponding Order row to backfillorderIdandcustomerId. Best-effort: unmatched subjects fall back to the previous behaviour (envelope-only row).
v0.8.0
4 July 2026- Boot-time compatibility check via the new SDK helper
warnIfIncompatibleVendure(). Logs a non-fatal warning when the runtime@vendure/coreversion is outside the tested range. Silent when inside; fail-open on unparseable versions.
- Peer dep on
@vendure/coretightened to>=3.5.0 <4.0.0— Vendure 3.5, 3.6 and 3.7 are all covered. Anything under 3.5 has never been tested by us; anything from 4.0 upwards is deferred until we've seen the changelog. - Uses
@huloglobal/vendure-licence-sdk@^0.6.0.
v0.7.0
30 June 2026EmailLinkentity — per-link metadata for tracked transactional emails. Each clickable link in each email gets its own random 32-byte token. Records the link's type, human label, visible text, position index, template section (main_cta,footer, etc.), destination host, path, and a SHA-256 hash of the full destination URL.EmailLinkService— issues per-link tokens, verifies HMAC signatures on click, looks up link metadata at redirect time. Graceful degradation: if the host doesn't have the migration yet, the redirect still works via signature verification alone; the click event just won't carry server-side link metadata.- Sensitive-link handling —
isSensitive: trueon password-reset, invoice-access, or licence-delivery URLs. The raw destination never lands on an admin-visible event row; only the redacted form and hash. - Zero runtime coupling to invoice / support-ticket / order plugins. All foreign-id fields are nullable ints with no FK constraints; hosts without those plugins simply never pass the id.
- Uses
@huloglobal/vendure-licence-sdk@^0.5.0for the sharedclassifyEmailEvent()classifier.
v0.6.0
23 June 2026- Vendure Admin API GraphQL extensions. All of the operator endpoints are now available as first-class GraphQL queries and mutations alongside the existing REST admin endpoints:
huloEmailLogs,huloEmailLog,huloEmailStatsByTemplate(paid),huloEmailSuppressions,huloAddEmailSuppression,huloRemoveEmailSuppression. - Storefront paths (open pixel, click redirector, DSN webhook) stay REST — they're anonymous, high-frequency, and return non-JSON in some cases. GraphQL was never the right shape for those.
v0.5.0
23 June 2026- Relicensed the GitHub source to AGPL-3.0. Published npm builds remain under the commercial licence documented at <https://huloglobal.com/legal/terms/>.
- npm builds now include Sigstore provenance attestations. Consumers can verify a tarball came from the official source repo with
npm view --json <pkg> dist.attestations.
v0.4.3
21 June 2026- Dropped the conflicting
display: blockon mobile tables that broke the row / cell alignment. Table now scrolls horizontally inside its card at narrow widths.
v0.4.2
21 June 2026- 44px minimum tap targets on every interactive element in the admin UI. Buttons, checkboxes, chip filters, expand toggles.
v0.4.1
21 June 2026- Comprehensive README refresh — documents the full v0.4 feature set with copy-paste config including every security and retention option.
v0.4.0
20 June 2026- Signed open + click URLs — when
signingSecretis configured, the URLs embed an HMAC tag and forged ids are rejected. - Click redirector domain allowlist (
clickRedirectAllowedDomains). - HMAC verification on the
POST /email-track/bouncewebhook (bounceWebhookSecret). - IP hashing on opens + clicks history (
hashIpsInHistory, default true;ipSaltsetting). - Best-effort MaxMind geo lookup (country / region / city / timezone) on every recorded open and click, surfaced in the admin detail.
- Rate limiter (60 requests / 60s default) on
/open+/click. - Security headers on every response via the licence-sdk helper.
- Opt-in retention sweeper via
options.retention.
v0.3.3
20 June 2026- Mobile-friendly admin UI — summary cards reflow, filters stack with 44px tap targets, tables overflow-x scroll inside the card. Update banner reflows on mobile.
v0.3.2
20 June 2026- Republish targeting
@huloglobal/vendure-licence-sdk@^0.2.0.
v0.3.1
20 June 2026UpdateCheckerintegration via the licence-sdk —/email-track/statusendpoint returns version + update info, admin UI shows a banner when a new version is available.
v0.3.0
20 June 2026- Suppression list — new
EmailSuppressionentity. Hard bounces and complaints auto-add to the table;sendTracked()refuses recipients on the list and writesstatus='suppressed'. CRUD endpoints (GET /email-track/suppression,POST /email-track/suppression,DELETE /email-track/suppression/:recipient). - Per-template analytics —
GET /email-track/log/stats/by-templatereturns open rate, click rate and click-to-open per email type. - Device + client detection — every open is classified (Gmail web, Outlook desktop, Apple Mail iOS, Thunderbird, Yahoo, prefetch proxies, bots / scanners). Stored on each open history entry.
- CSV export —
GET /email-track/log/export.csvmirrors the list endpoint's filters (max 50 000 rows).
- Admin UI Email Log detail view now renders the full open and click history tables (was just clicks before).
v0.2.0
19 June 2026- Full per-event open history (
opensJson) alongside the existing click history. Capped to the last 50 opens per email — older opens still contribute toopenCount. Surfaced asopens: []onGET /email-track/log/:id.
v0.1.0
19 June 2026EmailTrackingPlugin— wraps@vendure/email-pluginand persists every send to theemail_logtable.TrackingEmailSender— drop-inEmailSenderreplacement that wraps the default Nodemailer sender and injects an open-tracking pixel and a click redirector into the outgoing HTML.EmailTrackingService— exposed for custom controllers that send transactional email outside the email-plugin pipeline.- Public endpoints
/email-track/open/:id.gif(1×1 pixel),/email-track/click/:id?u=<encoded>(302 redirect), and/email-track/bounce(webhook hook for DSN parsers). - Admin endpoints
/email-track/log(paginated list with filters),/email-track/log/summaryand/email-track/log/:id. - Admin UI: standalone Email Log page + a per-customer Emails view.
- Licence verification via
@huloglobal/vendure-licence-sdkwith revocation polling against the HULO licence server.