Have reviewed your install. You've several users whom intentionally have renewed manually multiple times so those aren't a concern. You allow renewal in advance by 10 years and their renewals are 1-5 minutes apart all manual payments.

The primary issue here is you've 1 recurring subscription that double billed. You'll need to check that within your Stripe dashboard as instructed above and see if they have 2 subscriptions at Stripe. I'm not sure how that managed to happen though and am still investigating possibilities there.

The only possible way I could cause a subscription to duplicate is if the subscription payment handling process was submitted twice before the first process was completed. This would result in double subscription at Stripe. Normally an intent is consumed, but for setup_intents they're reusable to allow for recurring payments. Effectively this happens mostly due to user error (being impatient and trying to mash through the payment submit process).

I've implemented safe guards to check if a setup intent was used to create a subscription (or subscription schedule) before a subscription is created. This will avoid such abuse cases. This didn't seam to happen that often though as you've others whom have subscribed fine. The fix will be available in next CBSubs build release sometime today or tomorrow.

forge.joomlapolis.com/issues/9397

As for what to do about this. You'll need to cancel the duplicates at Stripe > Billing > Subscriptions.

A new CBSubs build release is now available to safe guard against Stripe creating duplicate subscriptions if the user interrupts the process while it's processing. This won't fix the existing duplicates though which you need to delete from within Stripe > Billing > Subscriptions. The fix should however ensure a setup intent can no longer be used more than once to generate a subscription and tested that it indeed guards against this well.

That shouldn't matter for payment flows as profile field validation does not apply there. Regardless it shouldn't be possible anymore as we've implemented some pretty aggressive safeguards to prevent the SetupIntent used for establishing subscription from being used more than once to initialize a subscription.

As for the field if no validation range is supplied it just defaults to current year. You should ideally be supplying a validation range for your date fields.