WP Manifestindependent plugin directory
manifest / content / talenttrack

TalentTrack WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Wordpress plugin for Talent Tracking

★ 1stars
85release downloads
≈10active sites
v4.141.5latest · 18d ago

Install

Download talenttrack.zip From the v4.141.5 release on GitHub, Oct 4, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/caspernieuwenhuizen/talenttrack/releases/download/v4.141.5/talenttrack.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

Frontend-first, modular youth football talent management system for a single club.

Changelog

4.117.0 — PDP evidence: one packet, extended to what a conversation actually needs (#3302) EvidencePacket now carries the full picture a PDP conversation is meant to be held against: evaluations with their assessor, notes and per-category scores rather than a bare date; minutes played with the per-match breakdown; injuries and return-to-play; the player's staff notes; goals with what moved since the last talk; and, on a conversation, the player's own self-reflection. Attendance keeps its present / absent / excused split and now carries the rate. A second entry point sits beside forFile(): forConversation() narrows the same assembly to the window since the previous talk in the cycle. The first conversation of a season has no predecessor, so it falls back to the season — a coach preparing the opening talk wants the season, not an empty page. Every group is club-scoped and excludes archived and trashed rows. That is the point of the slice: three surfaces used to assemble their own evidence and filter it differently, so the same player on the same day could show a coach one set of numbers and the head of academy another. The rendering surfaces move onto this packet next; nothing a user sees changes yet. The thread visibility gate moved out of ThreadsRestController into ThreadAccess, so the packet answers "may this reader see this note" the same way the notes tab does rather than deciding it a second time.

4.117.0 — PDP preparation: configurable question sets per conversation (#3305) A coach preparing a PDP conversation had one free-text box labelled "Agenda". Nothing differed between the start-of-season talk and the end-of-season one, and nothing made one coach's preparation comparable with another's or with their own from three months earlier. Configuration → PDP preparation questions replaces it with a question set per conversation in the cycle. Every academy starts with a shipped set — "Where is this player now?", "Which goals have moved, and which have not?", "What will you recommend to the head of academy?" — and can add, reword, reorder or remove questions per conversation. Rewording a question that has already been answered does not rewrite history. The old wording stays on the preps that hold those answers and the new wording applies from the next conversation onward, so a prep written last season still reads the way it was written. The answers are private to the coach and the head of academy, enforced at the repository rather than per screen, so a surface added later cannot forget to ask. A player or parent token gets nothing back for their own conversation. The form that puts these questions in front of a coach ships next; this release adds the schema, the REST endpoints and the settings screen.

4.117.0 — VCT match-day context works again, and the fixture peeks fill in (#3355) Four queries filtered on a tt_activities column that does not exist, using a pattern the activity vocabulary has never contained. Each returned nothing and each caller quietly took its "found nothing" branch. The visible effects: every VCT training resolved a match-day context of NONE regardless of when the team actually played, so the MD-specific training shapes were never selected and the per-age "match-day logic" setting did nothing. Publishing a VCT training wrote no bound activity at all. A player's "my team" next-fixture and recent-form lines were permanently empty. Match detection now runs off the canonical activity type, counts a tournament as the multi-game day it is, and skips called-off fixtures. A regression test goes through the production reader against real rows rather than the in-memory fake the existing rule tests inject — which is why none of them caught this.

4.117.0 — Analytics reports name the activity again instead of showing a bare id (#3356) The activity dimension read a column that does not exist on the activities table, so the lookup failed and every activity in a grouped report or CSV export fell back to its raw id. The report still rendered — it was just wrong, which is the hardest kind of reporting bug to notice. Grouping by activity now shows "Training — 2026-02-17" as intended.

4.117.0 — A three-week reference phase profile, and the groundwork for per-team cycles (#3357) The VCT configuration screen's reference profiles gain a three-week option alongside the existing four-week, six-week and five-week speelwijze cycles. It runs introduce → load → unload: three weeks leaves no room for a peak week, so it is a different shape rather than a shortened six-week ladder. Behind it, the schema for per-team repeating cycles — a cycle length and start week per team, and a place to record a week a coach has set to neutral by hand. Nothing reads them yet; configuring a cycle arrives with the screen that edits one. An academy that never sets a cycle up plans exactly as it does today.

4.117.0 — The cycle knows which week a team is in, and pauses for a game (#3358) The rule behind per-team cycles: a week in which the team plays is neutral, and that week is not spent. A team in week 3 of its cycle that plays on Saturday stays in week 3 the following week — the cycle stretches around the fixture list instead of drifting out of step with it. Games and tournaments both count; a cancelled game does not. A coach can also set a week neutral by hand, or force a week to run normally despite a fixture, for the friendly that was never meant to interrupt anything. Nothing surfaces this yet — the planner starts using it next, and the screens to configure and correct a cycle follow.

4.117.0 — Drafted trainings follow the team's cycle, and say when the cycle is paused (#3359) Where a team has a cycle, the planner now takes the week's intensity from it rather than from the macro-block alone. A week with a game is planned at neutral intensity, and the draft says why — "there is a game this week, so the cycle is paused" — instead of quietly coming out flat. A team with no cycle plans exactly as it did before. One long-standing silence also gets a voice: a macro-block that runs longer than its weekly profile has always planned its later weeks at neutral intensity without saying so. It still does, but now it tells you the profile ran out and that adding weeks to it keeps the progression going.

4.117.0 — Give a team a training cycle of three, four or six weeks (#3360) Each team's row on VCT configuration → Team schedules now carries a cycle: how many weeks it runs, the week it starts, and the weekly shape it repeats. Six weeks is the default. A line under the fields names each week, so you can read the shape without opening anything else. Picking a weekly shape that does not have one row per week of the cycle is refused rather than quietly accepted — a cycle whose last weeks come out flat for no visible reason is not something anyone traces back to this screen. Removing a cycle sends the team back to planning from the season's macro-blocks, and takes any hand-set neutral weeks with it. Trainings already planned keep the week they were given. Setting a cycle needs the VCT configuration permission, which the head of development holds.

4.117.0 — See the cycle week by week, and correct any week (#3361) A new Cycle tab on VCT configuration lays out a team's season one week at a time: which week of the cycle it is, the phase, theme and intensity, and why the week is what it is. A neutral week says either "there is a game this week" or who set it by hand and when — without that, a neutral week just looks like a bug. The list is also the only place the pause rule is visible: cycle week 3 turns up after a neutral week rather than being spent on it. Each week offers three choices rather than a checkbox — automatic, force neutral, or run anyway. The third is the one that comes up in practice: a friendly you never meant to interrupt anything. Setting a week back to automatic removes the correction rather than remembering it. One Save commits the lot, and the list redraws so you can see how the later weeks shifted.

4.117.0 — A training says which week of the cycle it is (#3362) Where a team has a cycle, each training now records the week of it they were planned as, and the activity shows it: "Week 3", or "Neutral — game this week". A neutral week always says why; on its own it just looks broken. The week is a record of what the training was, not a live calculation. Add a game in October and every training after it shifts back a week — the ones before it keep what they said. A player's training history from three months ago should still read the way it read at the time. The edit form's Cycle week field changes one training: follow the cycle, run it neutral, or pin it to a week you choose. Anything but "follow the cycle" fixes that training's week for good, so it stops moving when fixtures do; setting it back hands it straight to the cycle again. To move a whole team's week, the cycle calendar under VCT configuration is still the place.

4.116.0 — One period control on the reports and grids, not two (#3331) Eight screens asked the same question twice: a period dropdown (Last week, This month, This season) and, separately, a From/To date range. Two controls for one window, and it was never obvious which of them the numbers came from. They are one control now. Picking a preset sets the window; Custom range… opens the dates inside the same dropdown, and typing there wins. Whatever the control says is the window the report actually used — pick a preset and it names the preset, type dates and it names the dates. Existing links, bookmarks and saved views keep working: the dates are the same from and to they always were.

4.116.0 — Filtering the audit log no longer reloads the page (#3336) Changing a filter on the audit log used to reload the whole screen: a white flash, no sign anything was happening, and nothing stopping you picking a second filter into a request that had already gone. On the widest date ranges that is a long wait staring at a blank page. The results now update in place. While they load, the filter bar dims and stops taking input, and screen-reader users are told how many results came back. Back and forward still work, and the address bar still carries your filters, so a filtered view is still something you can bookmark or send to someone. Without JavaScript nothing changes — the filters still work by loading the page, exactly as before.

4.116.0 — The attendance and minutes grids filter without reloading — and without losing your work (#3337) Both grids now update in place when you change a team, a period or a type, like the reports do. The part that mattered most: if you have entered attendance or minutes and not yet saved, changing a filter asks first. Say no and the grid and the filter both stay exactly as they were. Nothing is saved on your behalf, and nothing is thrown away without being asked — a filter is still a way of looking, not a way of committing.

4.116.0 — The attendance and minutes reports filter without reloading (#3338) Changing a team, a period or an activity type on a report reloaded the whole page — and on a season-wide minutes audit that is a long wait staring at nothing, because the slow part is the server working out the numbers. The five Analytics reports now update in place: the tiles, the tables and the empty states all change together, the filter bar dims while it works and stops taking input, and screen readers are told what came back. Narrowing to a window with no data now replaces the tables with "nothing recorded", instead of leaving the previous window's numbers on screen. Without JavaScript nothing changes — the filters still work by loading the page.

4.116.0 — The message log and alerts inbox filter without reloading (#3339) Changing a filter on either screen reloaded the whole page. They now update in place, like the audit log: the bar dims while the results load, a second filter cannot be queued into a request that has already gone, and screen readers are told what came back. Filtering an alerts inbox down to nothing now replaces the list with "nothing needs your attention" rather than leaving the previous alerts on screen. Without JavaScript nothing changes — the filters still work by loading the page.

4.115.7 — Filtering by player means typing a name, not scrolling the academy (#3332) The player filter on goals and evaluations was a dropdown listing every player you could see — the whole academy for an admin, in whatever order the database returned, with no way to type toward a name. On a phone it was a native picker the length of the squad list. Both now use the same type-to-filter player picker the rest of the app uses: start typing a name and pick it. A coach still sees only their own teams' players, exactly as before.

4.115.7 — Filters sit in the same order on a phone as on a laptop (#3334) The archive menu was the last thing on the bar on a desktop and the first thing in the filter sheet on a phone — the same list, the same coach, the two devices they use in one afternoon. Filters now come first and the utility controls last in both places. Trial cases also asked about archived rows with an on/off switch where every other list uses the ⋯ menu. It uses the menu now, so archive state looks and behaves the same wherever you meet it — and an unfiltered list no longer says it is filtered.

4.115.6 — A test measured in minutes now offers mm:ss without being asked (#3275) Setting up a test in minutes and opening the entry grid gave you a decimal number box: 11:30 was refused, and 1130 was accepted without complaint and stored as nearly nineteen hours. The mm:ss option existed, but it sat below "Custom unit" where nobody looking at the unit picker would find it. Tests measured in minutes or hours now use mm:ss by default — seconds and milliseconds stay decimal, because a sprint is 2.05 s and not 0:02.05. The toggle moved directly under the unit picker and still overrides in either direction, and a single reading is capped at four hours so a typo like 1130 is refused instead of stored. The entry row also stops printing the unit twice.

4.115.6 — The player header shows every position, not just the first (#3329) A player with four preferred positions showed one pill in the header while the Identity row, the sidebar card and the edit form all listed four — so a coach reading only the header saw a specialist where the record says the player covers half the pitch. The header now carries one pill per position, using the short code you have set for it, with the full name on hover. Positional range is part of who a player is in the squad, and the header is where that picture forms.

4.115.6 — Taking one filter off a list works, and the comparison view can be cleared (#3333) The ✕ on a filter chip is built from the name of the control that set the filter, and on every list screen those names are nested — which the code that built the link could not remove. It was not yet reachable on most screens, but it was one change away from being so. The comparison screen also had no Clear at all: a date range and a dropdown, neither with a "none" option, and no way back to the unfiltered view. It has one now.

4.115.5 — The match sheet is one landscape page again (#3297) The exported match-prep PDF was readable but ran to two pages — a touchline sheet you have to turn over is a sheet you lose. It is one page now, laid out for paper rather than for the screen: selection with the roles underneath it on the left, the two half-pitches and the match goals down the middle, and Doen per speler filling the right-hand column. That block now always reserves fifteen rows — the players who already carry a note, then ruled lines to the count — so the room you write in during the warm-up is there whether or not you filled it in beforehand. Empty goal boxes print as writing lines too, and a full 22-player squad still fits the page. The Print match sheet route prints the same layout, so the page you print and the PDF you export are finally the same document.

4.115.5 — You can save a view you built from the dropdowns (#3327) Narrowing a list with its Team, Position or Archive dropdowns gave you no way to save that view — the bookmark control simply was not there. Typing something into the search box made it appear, which made the whole feature look intermittent. The control now appears whenever anything is filtered, however you filtered it, and a list you open on a saved view says so again.

4.115.4 — Saved views moved into the filter bar (#3296) Saved views used to sit in their own band above the filter bar. On a phone that meant a list opened with a saved-views strip, then a filter bar, and only then your rows — two rows of chrome before any content. They are now part of the bar itself. Your views appear as chips at its right-hand end and still apply in one tap. It tells you which view you are on. The view matching the filters on screen is highlighted; before, only the starred default was marked, so applying any other view left nothing on screen to say so. Saving lives behind a bookmark icon beside the chips, along with rename, replace, set-as-default and delete. The icon only appears when there is something to do with it — on an untouched list, for someone who has never saved a view, it is not there at all. Several views no longer crowd the bar. Three chips show on a wide screen and one on a phone; the rest collapse behind a +N you can tap to see them all. Saving now offers a Cancel beside it, so opening the name field by mistake is one tap to back out of.

4.115.3 — Filter chips now name the team, the type and the toggles you set (#3318) The filter bar's summary chips — the ones that say what a list is filtered by, each with a ✕ to take it off — reached only text boxes and the one-tap pill groups. A team, a position, an age group, a severity or any on/off switch produced no chip at all, so on most screens the bar still could not tell you why you were seeing the rows you were seeing. Every filter type now chips, and each ✕ removes just that one filter and leaves the rest of the list as it was.

4.115.3 — The ⋯ menu sits at the far right of the filter bar again (#3319) On a wide screen the archive menu had drifted into the middle of the bar, with the active-filter chips and Clear sitting to its right. It now ends the bar, where a utility control belongs: filters first, then what you have applied, then the pills and the ⋯ hard against the right edge. The order no longer depends on how a screen happens to declare its filters either — the ⋯ is last on every list that has one.

4.115.3 — The alerts inbox says which filters are actually on (#3320) The inbox showed a "State: Open" chip the moment you opened it, even though Open is simply the state the list starts in and nothing was filtered — and its ✕ led back to the state you were already on. Meanwhile the Area and Severity you had actually picked showed no chip at all, and the little number on the Filters button counted something different again. The chips now name exactly the filters you set, the number on the button is the number of chips, and an inbox you have not filtered says so.

4.115.2 — Applying a date or text filter on a phone now works (#3288) On a phone, a date range or free-text filter set inside the Filters sheet was thrown away. You picked From and To, tapped Apply, the sheet closed and the list was exactly as before — with nothing to say the filter had not been applied. Apply now applies. The button was closing the sheet and nothing else. Dropdowns and toggles were never affected, which is what made this hard to spot: set a team as well as a date range and the page reloads, so the dates look like they worked too. This affected the grids and reports that carry a From/To or a search box — attendance and minutes grids, the attendance and minutes reports, standard reports, the audit log, comparison and the message log.

4.115.2 — Clear and the applied-filter chips now show on desktop too (#3289) On a wide screen the filter bar offered no way to clear filters and no readback of what was applied. Set a team, a position and an age group and the only way back was to walk through every control by hand — and for the period pills and the archive menu there is often no "none" option to walk back to. Both were rendered by every surface all along; they were only ever visible below 1024px. The bar now ends with the active-filter chips and a Clear button, on every screen size. Clicking Clear returns the unfiltered list, exactly as it does on a phone. The Filters button and its count stay mobile-only, since desktop shows the controls inline; the sheet keeps its own Clear where a phone user expects it.

4.115.2 — The filter bar's utility controls sit where they were meant to (#3291) On a desktop filter bar the ⋯ menu and the status pills are meant to sit hard right, set apart from the filters proper. They sat mid-row, flush against whichever control happened to precede them, with empty space to their right — so the ⋯ read as one more filter instead of a utility. The rule that was supposed to push them right had never matched anything, on any screen, since it was written. They now right-align as intended. On a bar carrying both the status pills and the ⋯, the two stay together as one cluster rather than being pushed apart.

4.115.2 — Filter chips say what is applied — and can be taken off (#3292) The chips beside Filters were the only place the bar named which filters were applied, and they were hidden from screen readers entirely: the announcement was "Filters, 3", with no way to learn what the three were. They could not be tapped off either, so dropping one filter meant opening the sheet and hunting for the control that set it — and for the period pills and the archive menu there is often no "none" option to go back to. Each chip now names its filter and carries a ✕ that removes only that one, leaving the rest in place. The chips are readable by screen readers and reachable by keyboard, and the count on the Filters button is the number of chips, so the two can no longer disagree. The alerts inbox and the player comparison, which never showed chips at all, get them.

4.115.2 — The period pill stops contradicting the report (#3293) On the grids and reports that offer both a period pill and a From/To range, setting your own dates re-ran the report on them — but the pill went on showing "This month". The chrome said one thing and the numbers were another, with nothing to tell you which. Set your own window now and no pill claims to describe it. Related: on seven of those surfaces a manual range was not counted at all, so setting only From/To left Filters with no badge and no chip — the bar reporting "nothing filtered" over a filtered report. The window now shows as a chip like any other filter. Clearing your dates returns to the season default with the season pill active, as before.

4.115.2 — The filter sheet behaves like the modal it claims to be (#3294) On a phone, tabbing through the Filters sheet walked straight out of it and into the list behind — which is covered by the overlay, so the focus ring was invisible and you ended up operating a page you could not see. A screen reader could wander into the same covered content, and dragging on the dimmed area scrolled the list underneath instead of doing nothing. The sheet now uses the browser's own modal dialog, the same one the confirm prompts and the saved-views dialog already use. Focus stays inside it until you close it, the page behind is properly hidden from assistive technology and no longer scrolls, Escape closes it, and tapping the dimmed area closes it as before.

4.115.2 — PDP file detail: three chrome fixes (#3299) One help icon, not two. The summary card carried its own ? button next to the Status pill, opening the same drawer on the same topic as the header's help icon. It is gone; the header icon is unchanged. The Template link looks like a link in this app. It was a bare anchor, so a theme's own styling applied — blue and underlined, next to the status badges in the same row. It now matches the record links in every other table. The conversations list reads on a phone. Below 640px the table becomes stacked cards, with each value labelled by its column. This table carried no labels, so a card read "1 / Begin seizoen / 2026-09-30 / Gepland / Nog niet" with nothing saying which was which. Each value is now named.

4.115.2 — PDP files archive like everything else, instead of being deleted outright (#3300) A PDP file's detail page carried a red Permanently delete PDP button — on a live, in-progress development file for a minor, as the loudest element on a page whose actual purpose is recording a verdict. It was the only record type in the plugin that worked this way. The button is gone. A PDP file now archives like a player, a team or a goal, and permanent deletion lives where it does for everything else: in the recycle bin, once the file is already out of the way, behind the recycle-bin permission. The underlying reason it was different: PDP had never been registered with the recycle bin at all, so an archived file appeared nowhere, could not be restored, and was never picked up by the retention cleanup. It is registered now — listed under PDP file, and named by player and season so you can tell whose file you are looking at before you act on it. Permanently deleting a PDP file still removes its conversations, verdicts, uploaded files and goal-evidence links.

4.115.2 — Record links look like links, and keyboard focus is visible again (#3308) Player names and other record links across the app were styled to look exactly like body text until you hovered them — which on a phone means never. Twelve names in a PDP block read as a paragraph rather than as the list of people you can open. They now carry a little more weight at rest, so they read as tappable without turning every name in the product a link colour. Tabbing to one shows a proper focus ring again. The old rule removed the outline and offered a barely-visible shadow instead, which is not a focus indicator. Hovering tints the name rather than lifting it on a shadow. The lift was a card treatment applied to a single word: it nudged the text off its baseline, so a table rippled as the pointer crossed it, and the shadow hugged the letters. Nothing moves now, and the tint follows your theme instead of being fixed blue.

4.115.1 — The match prep PDF is readable, and says which match it is (#3272) The exported sheet printed at roughly 5pt with most of the paper left blank, and nowhere on it said who was playing whom. Three things changed. It prints landscape and fits the page. The grid is a wide, three-column sheet that was being squeezed into portrait width — that squeeze was the tiny type. The export now lays it on landscape A4, fits it to the page in both directions and centres it, instead of fitting the width alone and leaving a band of content across the top of an otherwise empty sheet. Where the sheet is still taller than one page it is printed at full size across two, rather than shrunk to something you cannot read on a touchline. It names the match. A header band carries the fixture, date, kick-off, home or away and the venue, alongside the formation, the half length and how much of the squad is available. Whatever your academy has recorded appears; what it hasn't is left out rather than printed empty. The same match exports the same document. The sheet is composed at the page's own width rather than at whatever window you happened to press the button in, so a phone and a desktop no longer produce two different PDFs.

4.115.1 — Positions your academy adds itself now read as their label, not their key (#3276) A position added through Configuration → Lookups → Positions printed its internal database key on every screen that showed it — a profile reading Verdedigende middenvelder · rechter_middenvelder, with the seeded positions translated and the academy's own ones not. The label the operator typed was stored correctly all along; no read surface asked for it. Twelve surfaces are fixed by one resolver: the profile header, identity card, sidebar and player card, the teammate card, my profile, the overview, the coach and player dashboards, the rate-card hero, the blueprint roster, the goal wizard's link step, journey position-change events, and human-facing CSV / XLSX exports. An academy that renames a seeded position to its own vocabulary is now obeyed too, and a position with no label anywhere reads as words rather than as a key. The stored code is unchanged and stays the matching key, so renaming a position moves nothing between chemistry buckets, formation slots or squad selection.

4.115.1 — The player's Activities tab lists newest first (#3277) The tab showed a player's most recent 25 activities oldest-at-top, so the latest one — usually the reason for opening the tab — sat at the bottom of the list. It now reads newest first. Anything already planned for the player sorts above today, so the tab opens on what is next and then reads back through what happened. The window is unchanged: still the most recent 25, never the oldest 25 of a player's career. Other activity lists are untouched and stay in chronological order.

4.115.1 — The player's Measurements tab shows the BMI figure, without the explainers (#3278) The BMI block at the top of a player's Measurements tab carried more prose than figure: two paragraphs explaining the growth reference and how to read a BMI, a line saying how far apart the two readings were, and a line about how the figure had moved. On a player's file, opened mid-task, that is a wall to read past. The tab now shows the BMI and its percentile, and nothing else. Nothing is lost — Reports → Player · BMI-for-age is unchanged and still carries the caveat, the days-apart column and the change column. That is the screen you open when BMI is what you came to read. A player the growth reference does not cover still says so on the tab rather than showing a figure that looks complete.

4.115.1 — Team attendance report: the player drill-down now lists players (#3279) Expanding a team row on Reports → Team attendance always said "no player attendance in this window", even where the same row reported 15 activities and 93,4% present. The accordion read the player rows off the wrong level of the REST response, so it received nothing and printed the empty state — on every install, since the drill-down shipped. The rows were always there. Expanding a team now lists its players worst-first with their present percentage, and the at-risk badge appears on flagged players — which, being fed from the same rows, had never been seen either.

4.115.1 — A player's height and weight are on their profile again (#3280) The Identity card on a player's Profile tab showed date of birth, position, foot, jersey, consent and status — but not height or weight. The player's own My profile screen showed both, so a coach opening a player's file could not read a number the player could. Both are back, each with the date it was measured: 172 cm · measured 18 Aug. The figure comes from the dated measurement series rather than from whatever was typed when the player was entered, so it is right even where the profile field behind it has not caught up. A number typed on the player form rather than measured shows without a date, because there is none; a player with neither gets no row rather than a blank one. A viewer without access to measurements sees the profile field instead of the reading.

4.115.1 — The profile weight follows the measurements, like the height already did (#3281) Recording a height has updated the player's profile since the last release. Weight did not, so an academy weighing its squad every cycle had a correct dated series and a profile still showing whatever was typed at signup. Now both follow the readings. Record a weight and the profile shows it as soon as that reading is the player's most recent one, under the same rules height uses: the most recent measurement wins rather than the last one you typed, deleting the last reading leaves the profile value alone, and a clearly mistyped number is not copied across. The recognised test names are Gewicht, Weight and Mass, matched the same way as the height names — capitals and spacing don't matter.

4.115.1 — Existing height and weight readings are caught up on the profile (#3282) The profile height and weight only started following the dated readings partway through, and by design they only updated when a reading was saved — so on any existing academy a player measured before that shipped still showed whatever was typed at signup, and there was nothing on screen to explain why. Upgrading runs a one-off pass that brings every profile in line with the readings behind it. Nothing is blanked or guessed: a player with no usable reading keeps the value that was already there, an archived reading does not count, and a clearly mistyped number is refused exactly as it would be on a fresh save.

4.115.0 — The unit of measure is now part of the measurement (#3273) A test's unit used to be a caption printed after a number. It is now a property of the datum: every unit belongs to a dimension — time, length, mass, count, rate, percentage or level — and knows its factor to that dimension's SI base. Values are stored canonically (seconds, metres, kilograms) and shown in the unit the academy measures in, and each recorded result also keeps the unit and the number it was entered in, so changing a test's unit later can no longer rewrite the meaning of readings already taken. This fixes a silent data error in the growth surfaces. The BMI series and the player's height_cm both identified the height test by name and then assumed centimetres; m has always been a selectable unit, so an academy recording height in metres got a BMI two orders of magnitude out with nothing reporting a problem. Both now convert through the unit instead of dividing by a hundred. Time tests can be entered and shown as mm:ss. Tick "Enter and show as mm:ss" on a test measured in a time unit and a result is typed as 5:30, reads back as 5:30, and is stored in seconds — so trends, averages and target bands work on the real quantity. Target bands are typed in the test's own unit throughout. A custom free-text unit still works, and is now explicitly dimensionless: its values are stored exactly as entered and never converted or compared across units.

4.114.0 — Trial inputs are frozen once the trial is decided (#3238) A staff input is the evidence behind a decision about a child — whether the academy wanted them, and why. It could be rewritten through the API after that decision had been made, with no earlier version kept and nothing on any screen saying it had changed. Inputs now freeze when the case leaves Open or Extended. Up to that point an assigned coach can still correct their own wording, including after submitting it — re-reading what you wrote an hour later and fixing a sentence is normal and should not need a manager. After it, nothing can change them, and an attempt is refused with a message saying why rather than quietly doing nothing. The rule already existed on the Staff inputs tab and now lives in one place that both the screen and the API read, so the two cannot disagree again. Freezing an input does not close the case to the coach who wrote it — they can still open a decided case and read what they said.

4.114.0 — The demo academy has behaviour, potential, and players old enough to have them (#3242) The demo academy had no potential and no behaviour data at all, and its oldest player was seven. Two of the traffic light's four inputs were empty for every player, so the status it showed was not the status the product produces for a real club — and the potential trajectory, the team-chemistry contribution and the PDP evidence packet all rendered blank. A feature that shows nothing looks like a feature nobody uses, and this is the academy a prospective club is walked through. Demo squads are now spread across your age-group ladder instead of taken from the youngest end, so a three-team academy gets a young squad, an older one and something in between. Age groups whose name carries no age — a Senior catch-all — are skipped, because the generator reads a player's birth year out of the group name and would otherwise fill a senior squad with children. Behaviour ratings are seeded across the window for every squad. Potential is seeded as a dated history rather than a single row, so the trajectory has something to draw, with at least one player per squad revised down — the case the trajectory exists to make visible. The gaps are deliberate. About one player in five old enough for a band does not have one, and one per squad is left overdue, so the Potential not revisited alert has something true to say on a demo install. Potential is not seeded below age 13 at all, matching the rule the product now applies. Also fixes the demo-coverage check, which could not see tables created by migrations that build the table name into a variable first. Six such tables were invisible to it; all six now have a decision recorded.

4.114.0 — Switching a module off now actually removes its screens (#3254) With Training plans switched off, the activity page still offered Execute training and ?tt_view=training-run still opened the sideline view. Training was not special — it was the one somebody noticed. Two causes, both now fixed. A screen's owning module was worked out from the tile the module registers itself, and a switched-off module registers nothing — so the check for "is this module off?" had nothing to read in exactly the situation it exists for. Ownership for 45 screens now lives where it cannot disappear. And the buttons that link between screens only ever asked whether the user had permission; a WordPress administrator passes every permission check by design, so the operator who had just switched the module off was the one person still being offered it. Those buttons now ask whether the screen exists on this install before asking who may open it. A new CI check walks every screen the dashboard can route to and refuses a module screen whose ownership is not declared, so the gap cannot reopen.

= 4.114.0 — Sorting or searching a list no longer serves the blog index (#3256) On an install whose front page is the TalentTrack dashboard page — which is every install created through onboarding — clicking a column header or running a search on any list view served the theme's blog index instead of the list. WordPress only substitutes the static front page when the URL carries no core public query var, and order, orderby and search are all core public query vars, so the substitution was skipped and the dashboard shortcode never ran. The dashboard now claims those requests back. Sorting and searching work on every list view regardless of what the site's front page is set to. Sites that serve posts on th

This README is longer than the copy stored here. Read the rest on GitHub →

Releases

Newest 25 of 60 recorded releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v4.141.5 latest
Oct 4, 2026 18d ago
talenttrack.zip
4
Oct 4, 2026 18d ago
talenttrack.zip
0
Oct 3, 2026 19d ago
talenttrack.zip
2
Oct 3, 2026 19d ago
talenttrack.zip
0
Oct 3, 2026 19d ago
talenttrack.zip
2
Oct 3, 2026 19d ago
talenttrack.zip
0
Sep 29, 2026 23d ago
talenttrack.zip
4
Sep 28, 2026 24d ago
talenttrack.zip
3
Sep 28, 2026 24d ago
talenttrack.zip
0
Sep 28, 2026 24d ago
talenttrack.zip
1
Sep 28, 2026 24d ago
talenttrack.zip
0
Sep 28, 2026 24d ago
talenttrack.zip
0
Sep 28, 2026 24d ago
talenttrack.zip
2
Sep 27, 2026 25d ago
talenttrack.zip
2
Sep 27, 2026 25d ago
talenttrack.zip
2
Sep 27, 2026 25d ago
talenttrack.zip cohort
6
Sep 27, 2026 25d ago
talenttrack.zip
1
Sep 27, 2026 25d ago
talenttrack.zip
1
Sep 27, 2026 25d ago
talenttrack.zip
0
Sep 23, 2026 29d ago
talenttrack.zip
4
Sep 22, 2026 1mo ago
talenttrack.zip
6
Sep 22, 2026 1mo ago
talenttrack.zip
0
Sep 21, 2026 1mo ago
talenttrack.zip
0
Sep 21, 2026 1mo ago
talenttrack.zip
1
Sep 21, 2026 1mo ago
talenttrack.zip
1
All releases on GitHub →

Active-site estimate ≈10 comes from the v4.138.0 cohort. Method.

B grade

Security

TalentTrack 4.141.5 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
4.141.5
Findings
1
Worst severity
medium
Content hash
051d55f8c8c6d0743a806884…

Findings

  • medium Forged Strava webhook events disconnect players and archive their activities

    missing_auth

    POST /talenttrack/v1/strava/webhook is registered with permission_callback __return_true and passes the raw body to WebhookService::handleEvent. Strava does not sign webhook events, and the handler never checks the payload's subscription_id against the stored subscription or confirms the event with Strava. Any visitor can send {object_type:'athlete', owner_id:<athlete id>, updates:{authorized:'false'}} to trigger onDeauth(), which nulls the player's encrypted access and refresh tokens, marks the connection revoked and soft-archives every imported activity. Sending aspect_type 'delete' with an object_id archives individual activities. Athlete ids are public on Strava profile URLs, and the resolver searches across all clubs.

    src/Modules/Strava/WebhookService.php:72-107, 124-135

    Recommendation

    Reject events whose subscription_id does not match StravaConfig::subscriptionId(). Before acting on a deauthorization, confirm it with Strava (e.g. a token refresh or athlete call fails with 401). For deletes, verify via the API that the activity no longer exists.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.