Changelogs

Add super admins as a selectable role for User Groups.
Add reCAPTCHA to the Reset Password form.
Add support for resending a Two-Factor Email code.
Add support for resending a Passwordless Login email.
Allow selecting users across all sites in a network for User Groups, Security Profile cards, and User Security Check.
Include all super admins by default in the Security Profile card, even if they are not a member of the network’s main site.
Display all of a user’s roles in the Security Profile card.
When logging in with Passwordless Login, skip Two-Factor if the primary Two-Factor method is Email.
Force a space after each Two-Factor Backup Code to assist with copying and pasting.
Include the website URL in the download file for Two-Factor Backup Codes.
Add a warning if a WordPress Salt is set to an invalid value.
Allow re-entering the Two-Factor Onboard flow even after Two-Factor is setup by visiting /wp-login.php?itsec_after_interstitial=2fa-on-board directly.
Add a new WP CLI command for managing user Two-Factor enrollment.
Add a new WP CLI command for retrieving logs.
Include child log items in the logs list table. These are helpful for debugging issues.
Improve performance of the logs page on sites with large number of log items.
Only show Lockout Bypass Magic Link for valid users.
When logging $_SERVER, only log a snapshot of available properties.

New Password Requirements for already created accounts were not enforced until the second login.
User Security Check would not display in Multisite.
Prevent fatal error if invalid user IDs are encountered by User Groups.
Infinite loop when trying to use Application Passwords on Multisite.
User Logging did not correctly capture the user id of the logged-out user on WordPress 5.3.
Warnings when doing a settings import.

The “getlockouts”, “releaselockout”, and “getrecent” WP CLI commands. Use the “lockout” and “log” commands instead. They will be removed in a future release.