Skip to content

OpenCATS v0.12.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Oct 14:05
· 1 commit to master since this release
v0.12.0
a37909b

OpenCATS v0.12.0 brings in the first step of a substantial interface refresh, replaces several ageing components, and strengthens security across existing recruitment workflows.

The emphasis has been on modernising OpenCATS while retaining its familiar functionality and reusing the existing models, permissions, DataGrids and shared helpers.

Highlights

  • Bootstrap 5.3 interface refresh. The main application screens—including Candidates, Companies, Contacts, Job Orders, Calendar, Activities, Lists, Reports, Settings and Home—have been updated, alongside the login, installer and public Career Portal. Forms, navigation, tables and dialogs now have more consistent styling and layouts.

  • Chart.js replaces Artichow. The obsolete server-side graphing library has been removed. Hiring Overview, job-order pipeline and EEO charts now use locally bundled Chart.js, with accessible tables providing the underlying values. The recruiting-summary PDF retains its figures as a compact numeric summary.

  • SunEditor replaces CKEditor. Rich-text editing now uses locally bundled SunEditor. Existing template, preview and email workflows are retained, with regression coverage for formatting, source editing and saved content.

  • Stronger permission checks. Additional checks protect tag administration, attachment deletion, hidden candidates in pipelines, email/phone lookup endpoints, and activity and pipeline updates. Candidate exports now require Site Administrator access. These changes reuse OpenCATS existing authorisation mechanisms.

  • Security and authentication fixes. Stored cross-site scripting in the Recent list has been corrected, mandatory default administrator password changes restored, and an obsolete third-party HTTP JavaScript dependency removed from Mass Import. Career Portal authentication now requires CAPTCHA verification and keeps candidate identity server-side, replacing the previous persistent authentication cookies.

  • ISO date support. YYYY-MM-DD (the ISO International Date Format) is now available alongside the existing US and UK date formats, with corresponding updates to calendar inputs, Activities and date handling. Existing installations retain their selected format.

  • Performance and maintenance. New candidate/job-order status-history indexes support reporting queries. The release also includes UTF-8 sanitiser fixes, shared-dialog positioning corrections, dependency updates and expanded automated coverage.

Security and CVEs

The Career Portal changes address the authentication path referenced by CVE-2026-111874. Deployment guidance covers web-server or reverse-proxy throttling; application-level rate limiting has not been introduced.

The Docker test images have been updated to PHP 8.4.27 and PHP 8.5.12, incorporating the upstream PHP security releases from 21 October 26. OpenCATS Operators must also update PHP on their deployed servers—upgrading OpenCATS alone does not patch the PHP runtime.

Testing and upgrading

The local regression suites pass on PHP 8.4.27 and PHP 8.5.12, including database integration, functional and security scenarios.

Take a complete database and attachments backup before upgrading, and follow the normal installer/upgrade process. Review customised templates and extensions: Bootstrap markup has changed, and extensions manipulating Artichow graph objects will need adapting to the new structured chart data.

Thanks to everyone who contributed fixes, reported issues and helped test this release.

[Full changes since v0.11.1](v0.11.1...a37909b)

Problems?

If you encounter any operational problems or upgrade failures, please [open a GitHub issue](https://github.com/opencats/OpenCATS/issues). Include your OpenCATS and PHP versions, the version you upgraded from, and any relevant error messages or steps needed to reproduce the problem.

Assets 4
Loading