Security (primary focus):

• ???? Pin resolved IPs via CURLOPT_RESOLVE for outbound bot REST API requests to defeat DNS rebinding; reject loopback/private/reserved ranges and redirects; add rest_api_limit config (deny_local default true, allow_host).
• ????️ Require authenticated operator session for external image zoom and reject non http/https and private/reserved destinations; harden file downloads against SSRF.
• ⏳ Bound REST API session token lifetime (session_token_expire, default 30 days) with isExpired(), expires_on stamping, revocation on use, and stricter loginbytoken/notifications token validation.
• ???? Bind sessions and remember-me cookies to password hash via hash_equals() so password changes invalidate all sessions/tokens.
• ????️ Restrict cron.php to CLI, whitelist cronjob/extension options with realpath confinement; whitelist user import field mapping; validate theme import attributes and image uploads.
• ???? Use var_export() for inlined translations/config and skip values that could form <? tags to prevent PHP code injection via stored config.
• ✅ Add CSRF/permission checks to lhwebhooks dispatch, copyautoresponder, transferuser, canned message subject, saveonlinenotes, addonlineoperation, addsubjectbytemplate, changemailbox, apifetchmails, deleteconversation and loadview; limit group chat invites to private-group members; enforce assignment permissions and self-edit restrictions.
• ???? Sanitize referrer/session referrer/footprint/current page URLs to block unsafe schemes; add getSafeReferer() to prevent open redirects.
• ???? Strip visitor [html_snippet]/[html] blocks, cast snippet/message IDs to int, validate ID arrays before SQL IN clauses, and use bound values in abstract filters.
• ????️ Cast archive/chat/role/user IDs to int and validate fetched objects before use; guard preview/print/sendmail with is_object; render explicit permission error in abstract/edit; validate react-to-message id and require write access.
• ✨ Functional improvements:
• ???? Expose latest matched condition as {bot_condition.*} via new MatchedConditions helper with "Expose matching variables" checkbox; clearer condition debug; bot closechat/setdepartment also update related mail conversation; extend bot detection list with Meta crawlers and make matching case-insensitive; log PHPMailer send failures.
• ???? Render admin widget theme preview in Shadow DOM using real widget CSS bundle for accurate parity with live widget; use resolved theme id for single-message re-render.
• ???? Add in-context help texts and grouping for mailbox follow-up/re-open/default operator/department options; remove tracking pixel URLs from HTML and plain text on import.
• ???? Add User ID filter to user list search; fix proactive invitation "Any" department selection with validated multi-dropdown; clarify standard queue priority labels with hints.

For update just follow standard update procedure. No database update this time.

**Full Changelog**: https://github.com/LiveHelperChat/livehelperchat/compare/4.94v...4.95v