> For the complete documentation index, see [llms.txt](https://docs.inova.us/v1/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.inova.us/v1/twilio-in-browser-call-plugin/change-log.md).

# Change Log

Bubble Twilio Voice plugin updates

## Change Log

### Version 1.25.0

{% hint style="danger" %}
**Security release — action required.** Two of these issues can only be fixed in your own Twilio Functions. Follow the [migration guide](/v1/twilio-in-browser-call-plugin/migrating-to-v1.25.0.md) before or immediately after upgrading.
{% endhint %}

**Requires changes in your Twilio Functions**

* Your **Access Token Function** must stop trusting the `identity` it is sent. The version previously published in [Getting Started](/v1/twilio-in-browser-call-plugin/getting-started.md) mints a token for any identity requested, from a public endpoint with CORS open to every origin — so a visitor can obtain a token as one of your agents and receive their calls or place calls on your account.
* Your **Voice Function** must authorize the caller ID and the destination server-side rather than trusting `event.appCallerId` and `event.To`.

**Breaking changes**

* **Identity** is now validated: letters, digits and `_ . + @ -` only, maximum 121 characters, trimmed automatically.
* `event.agent` now reaches your Voice Function. It was previously always undefined because the plugin read it from the wrong place.
* `instance.data.token` has been removed. Custom JavaScript reading the access token off the element now gets `undefined`.
* **Time to live** is clamped to 86400 seconds (Twilio's maximum); blank, zero or non-numeric values fall back to 3600.
* The **Voice Access Token** action now rejects credentials with the wrong Twilio SID prefix, so a misconfigured API Key fails immediately instead of surfacing later as error 31202.

**Privacy**

* The plugin no longer sends the **app owner email** or the **Twilio Account SID** to our analytics. Both were previously read in browser code and transmitted on every page load. We now receive only the plugin name and version and the Bubble app name and version. If your own privacy policy described the old behaviour, please update it.
* **DTMF digits** are no longer written to the browser console at any log level.

**Other fixes**

* The Agent Identifier is URL-encoded before being added to the token request.
* Credentials are redacted from any error the Voice Access Token action returns.
* Scripts load over HTTPS instead of protocol-relative URLs.
* Corrected an internal signature in **Reset Twilio Device** (no behaviour change).

### Latest updates

* Twilio Voice SDK upgraded to **2.18.3**.
* Added **audio input/output device selection** — choose the microphone and speaker, with device-list and requested-vs-applied states. See [Audio Device Selection](/v1/twilio-in-browser-call-plugin/audio-device-selection.md).
* Added the **Allow Incoming Calls While Busy** and **Agent Name** element settings.
* New reference docs: [Actions & Events](/v1/twilio-in-browser-call-plugin/actions-and-events.md), [APIs](/v1/twilio-in-browser-call-plugin/apis.md), [Audio Device Selection](/v1/twilio-in-browser-call-plugin/audio-device-selection.md), and [Troubleshooting](/v1/twilio-in-browser-call-plugin/troubleshooting.md).

### Version 1.19.0

* SDK upgrade to **2.12.1**
* Added [Log Level](/v1/twilio-in-browser-call-plugin/getting-started.md#log-level) to allow debug mode when needed

### Version 1.18.0

* SDK upgrade to **2.11.2**
* Added support to set a custom live time token expiration to the Access Token Action

### Version 1.17.0

This version supports making and receiving calls on behalf of sub accounts. Learn more [here](/v1/twilio-in-browser-call-plugin/subaccounts.md).

### Version 1.16.0

* SDK upgrade to **2.10.2**
* Added Agent Name
* Added "Auto Reject Incoming Calls When Busy" feature (Beta). [Learn more](/v1/twilio-in-browser-call-plugin/receiving-calls.md#auto-reject-incoming-calls)

### Version 1.14.0

* Upgrade to Twilio Voice SDK 2.8.0
* Fix a client voice function racing condition. Please update your voice client function. Replace `event.From` with `event.appCallerId`

### Version 1.12.1

Console log bug fix

### Version 1.12.0

Upgrade to Twilio Voice SDK 2.7.2

### Version 1.11.0

* Auto update client token before expiration
* Added new action to update the client token
* Added an event trigger that fires 10 seconds before token expire

### Version 1.10.0

* Upgraded to Twilio Voice SDK v.2.5
* Using [access token instead of capability token](/v1/twilio-in-browser-call-plugin/getting-started.md#create-token-and-service-functions). To create an access token function, please follow the instruction
* Changes to the device states. New states are <mark style="color:red;">registered</mark>, <mark style="color:red;">unregistered</mark>, <mark style="color:red;">registering</mark>
* Added a new device state, isBusy which returns <mark style="color:red;">yes</mark> or <mark style="color:red;">no</mark>
* Fix incoming call status when the call disconnected from the caller side
* Fix ringing sound when the incoming call is disabled

### Version 1.9.5

* Added a reset action that'll hung up any active calls and reset all states
* Added device status <mark style="color:red;">busy</mark> when there is an active call
* When an inbound call comes on accept, the incoming call will change to <mark style="color:red;">connected</mark>, the active call will hung up, and the call status will change to open
* Added a new tigger event, on accept incoming call
* When the caller hangs up a connected call the call status will change to <mark style="color:red;">closed</mark>

### Version 1.9.4

* Error handling improvements

### Version 1.9.3

* Added new state: incoming call status
* Bug fix on accepting incoming call while having an active call

### Version 1.9.2

* The Reject incoming call action will return the call status <mark style="color:red;">`busy`</mark>
* The ignore incoming call action will return the call status <mark style="color:red;">`closed`</mark>
* Call status state now is returning the [call status](/v1/twilio-in-browser-call-plugin/states.md) instead of mediaStream status
* Behind the seen performance improvements
* Some improvements for actions tracking to help improve plugin support