Between March 16 and March 31, 2026, nginx 1.28.3 and 1.29.7 patched six issues, Stripe released the Dahlia API version with breaking changes to Stripe.js and Checkout, and Google opened Android developer verification to all developers. Here is what shipped and what it means for your website, store and app.
Below is a quick summary table, then a section for each release covering what shipped, what it means for you, how we use it in WordPress builds, what it means for mobile apps and what to do next.
At a glance
| Release | Date | Type | Who should care | Action |
|---|---|---|---|---|
| nginx 1.28.3 and 1.29.7 | Mar 24 | Security | All nginx servers | Update and check modules |
| Stripe API 2026-03-25.dahlia | Mar 25 | API version | WooCommerce stores on Stripe | Test before pinning |
| Android developer verification | Mar 30 | Policy | Every Android app owner | Verify and register apps |
nginx 1.28.3 and 1.29.7 Patch Six Issues Including WebDAV and MP4 Overflows
What shipped
On March 24, 2026, nginx.org shipped 1.28.3 stable and 1.29.7 mainline with six security fixes:
- nginx 1.28.3 and 1.29.7 were released March 24, 2026.
- CVE-2026-27654: buffer overflow in ngx_http_dav_module.
- CVE-2026-27784 and CVE-2026-32647: buffer overflows in the mp4 module.
- CVE-2026-27651 and CVE-2026-28753: mail module authentication issues; CVE-2026-28755: OCSP result bypass in the stream module.
- 1.29.7 also adds Multipath TCP support and makes HTTP/1.1 with keep alive the default for proxied requests.
What it means for you
Two of the overflows sit in modules that serve files: WebDAV and MP4 streaming. A server that has either module enabled was exposed to crafted requests until patched.
How we use it in WordPress builds
WordPress does not need nginx WebDAV or the mp4 module, and we leave both off in our server templates. We still patch, because packaged nginx builds often include them.
What it means for mobile apps
Apps that stream MP4 video straight from the WordPress server through nginx used the affected module. Video served from a CDN or video host was not affected.
What to do next
Update to 1.28.3 or 1.29.7 or later and list which nginx modules are compiled in. Our WordPress security and hosting team can review the config for you.
Stripe Dahlia API Version Brings Breaking Changes to Stripe.js and Checkout
What shipped
Stripe released API version 2026-03-25.dahlia on March 25, 2026. The breaking changes most likely to touch a store:
- 2026-03-25.dahlia is the first Dahlia API version and the only one in the Dahlia release with breaking changes.
- Deprecated Payment Intents, Setup Intents and Sources methods were removed from Stripe.js.
- The Checkout and Embedded Checkout initialization methods were renamed, and elements.update() now returns a Promise.
- Checkout Session UI mode enum values changed.
- UPI support and decimal invoice quantities were added.
What it means for you
Stripe API versions only apply when an account or integration opts in. A store that upgrades its API version without testing could see checkout scripts fail because of the removed Stripe.js methods.
How we use it in WordPress builds
In WooCommerce, the payment plugin sets the API version it uses. We test plugin updates that move to a new Stripe version on staging with real test cards before they reach production.
What it means for mobile apps
AppPresser apps that show WooCommerce checkout inside the app use the same Stripe scripts as the site. If the site checkout works after the upgrade, the in app checkout should too, but we test both.
What to do next
Do not change the API version in the Stripe Dashboard until your payment plugin supports it. Our WooCommerce team tests payment updates on staging.
Android developer verification opens to all developers
What shipped
On March 30, 2026, Google announced that Android developer verification is rolling out to all developers in Play Console and the new Android Developer Console. Google's posts state:
- Developers verify their identity and register their apps
- Play Console developers who already completed verification have eligible Play apps registered automatically
- User side protections start on September 30, 2026 in Brazil, Indonesia, Singapore and Thailand, then expand globally in 2027
- Installing an unregistered app on a certified device will require ADB or an advanced flow
- A free limited distribution account lets students and hobbyists share apps with up to 20 devices
What it means for you
If you publish an Android app, confirm your developer account is verified and every app is registered.
How we use it in WordPress builds
No WordPress change is needed.
What it means for mobile apps
For AppPresser apps published under your own Google Play account, we check verification status and app registration in Play Console with you.
What to do next
- Log in to Play Console and check your verification status
- Confirm every app shows as registered
- Register any apps you distribute outside Google Play too
How AlphaWeb handles updates for you
Platform releases like these rarely change WordPress itself, but they change the servers, databases and app stores your site and app depend on. Our support and maintenance plans cover tested updates on staging first, then in production, and our WordPress security and hosting service keeps PHP, web servers and databases current.
Request a custom development quote, or tell us about your project through our Mission Brief.
Frequently asked questions
Do WooCommerce stores have to move to the Dahlia API version?
Not by hand. The payment plugin sets the API version it uses. Upgrade the plugin when its release notes say it supports the new version, and test checkout on staging first. Our WooCommerce team can run that test.
Brief Us on Your Mission
Want to talk about a website, mobile app, migration or AI project? Fill out the Mission Brief and a specialist will follow up to schedule a call and put together a free quote.
