Hi.Events

v.1.11.0-beta Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 17d Productivity & Wikis

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

attendize-alternative door-management event-check-in event-management event-registration event-ticketing

+12 more

eventbrite-alternative events laravel php react self-hosted sell-tickets sell-tickets-online ticket-selling ticketing-system tickettailor-alternative tito-alternative

Affected surfaces

auth rbac

ReleasePort's take

Moderate signal

editorial:auto 11d

The release prevents XSS via event titles in inline script contexts and blocks purchase of hidden products through the public checkout flow.

Why it matters: Mitigates high-severity (severity 90) cross‑site scripting risk and stops exploitation of hidden product purchases, directly protecting user data and revenue integrity.

Summary

AI summary

Updates 🎟️ Ticketing & Checkout, 🌍 Translations & Localization, and 🔐 Security & Privacy across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Prevented XSS via event titles in inline script contexts Prevented XSS via event titles in inline script contexts Source: llm_adapter@2026-07-16 Confidence: high	—
Feature
Feature	Low	Added Slovak (`sk`) translation and fixed missing strings across all locales Added Slovak (`sk`) translation and fixed missing strings across all locales Source: llm_adapter@2026-07-16 Confidence: high	—
Feature	Low	Rendered offline payment instruction tokens Rendered offline payment instruction tokens Source: llm_adapter@2026-07-16 Confidence: high	—
Feature	Low	Prefilled public checkout from URL query params (name, email, optional locking) Prefilled public checkout from URL query params (name, email, optional locking) Source: llm_adapter@2026-07-16 Confidence: high	—
Feature	Low	Exposed SMTP TLS controls for local relays Exposed SMTP TLS controls for local relays Source: llm_adapter@2026-07-16 Confidence: high	—
Bugfix	Medium	Prevented purchase of hidden products via public checkout Prevented purchase of hidden products via public checkout Source: llm_adapter@2026-07-16 Confidence: low	—

Full changelog

What's Changed

🌍 Translations & Localization

Added Slovak (sk) translation and fixed missing strings across all locales by @pipozzz in https://github.com/HiEventsDev/Hi.Events/pull/1210
Improved French translation by @lionep in https://github.com/HiEventsDev/Hi.Events/pull/1240

🎟️ Ticketing & Checkout

Prevented purchase of hidden products via public checkout by @daveearley in https://github.com/HiEventsDev/Hi.Events/pull/1259 (Thanks to @0xh3lix for the report.)
Rendered offline payment instruction tokens by @realicon23 in https://github.com/HiEventsDev/Hi.Events/pull/1235
Prefilled public checkout from URL query params, including name, email, and optional locking by @skvost in https://github.com/HiEventsDev/Hi.Events/pull/1234

🔐 Security & Privacy

Prevented XSS via event titles in inline script contexts by @daveearley in https://github.com/HiEventsDev/Hi.Events/pull/1260 (Thanks to @0xh3lix for the report.)

⚙️ Configuration & Infrastructure

Exposed SMTP TLS controls for local relays by @realicon23 in https://github.com/HiEventsDev/Hi.Events/pull/1244

New Contributors

@pipozzz made their first contribution in https://github.com/HiEventsDev/Hi.Events/pull/1210
@lionep made their first contribution in https://github.com/HiEventsDev/Hi.Events/pull/1240
@skvost made their first contribution in https://github.com/HiEventsDev/Hi.Events/pull/1234

Full Changelog: https://github.com/HiEventsDev/Hi.Events/compare/v.1.10.0-beta...v.1.11.0-beta

Security Fixes

Prevented XSS via event titles in inline script contexts

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Hi.Events

Get notified when new releases ship.

About Hi.Events

Open-source event management and ticket selling platform — perfect for concerts, conferences, and everything in between If you find this project helpful, please consider giving us a star ⭐

All releases →