Security fix — RMA attachments are no longer served from a public URL. Files are now stored outside the webroot and streamed through a secure rma/attachments/serve action that verifies the requesting user owns the request before returning the file. This closes a path traversal / remote code execution risk in the previous direct-URL upload handling.
Introduced the RMA control panel experience — request listing, detail view, and status management from the RMA section.
Return workflows (statuses, reasons, resolutions) are now database-driven and configurable from plugin settings, no code changes required to add a new one.
Customers and admins can attach files (photos, proof of damage, invoices) to a return request.
Added a dashboard with return quantity metrics per item and custom navigation icons.
Added frontend routes for RMA order item mapping and customer self-service hooks.
Adopted the shared ycore UI framework: RMA now extends AbstractNavPlugin and shows its license status directly in the control panel navigation.
Fixed a fatal error when the xlsx exporter registered itself during console (CLI) requests.