Releases »

11.1 »

11.1.12

Cerb (11.1.12) is a maintenance update released on October 21, 2026. It includes 8 minor features, fixes, and security patches from community feedback covering the 11.1 update. You can follow these instructions to upgrade.

Changelog

Added

  • [Automation/Scripting] Added |bin2hex and |hex2bin filters to automation scripting. These convert between binary strings and their hexadecimal representation, which makes decoded binary data – like a base64 message header – readable and safe to slice in a template.

Fixed

  • [Mail] Fixed outgoing HTML mail failing to send when an embedded inline image couldn't be read from storage.

  • [Platform/HTTP] Fixed HTTP requests failing on servers with libcurl older than 7.85 (e.g. RHEL 8 and 9). Thanks to Karson @ KnownHost for the report.

Security

  • [Security/HTTP] Updated cURL options to use string-based protocols for enhanced safety. Thanks to kta1kri for the report!

  • [Security/Platform/HTTP] Replaced bare Guzzle client with shared HTTP client to ensure proper proxy, timeout, and egress configurations. Thanks to kta1kri for the report.

  • [Security/Support Center] Fixed an authorization gap in the legacy Support Center portal. Thanks to kta1kri and wranked.1 for the report.

  • [Security/Tickets] Fixed an authorization gap where the ticket editor and reply drafts didn't enforce per-ticket group permissions. Thanks to Omar Ahmed Abdelsalam Elsayed for the report!

  • [Security/REST] Fixed OAuth2 access to the REST API continuing to work for workers who were deactivated. Deactivated workers are now rejected on the OAuth2 path (matching legacy API keys), and their OAuth2 access and refresh tokens are revoked on deactivation. Thanks to wranked.1 for the report!