Kaleta 3.4.2 (security)

Kaleta 3.4.2 is a security release. It fixes what an audit of the 3.4 community contributions found on 8 October 2026. Sites install it by themselves.

Fixes

• Open redirect (medium). The preferred URL form setting from 3.4.0 (without a trailing slash, with one, or .html) could send a visitor to another website: a link to your-site//a//other-site/x/ redirected to the other site. A path starting with two slashes or holding a backslash is now never redirected, and Kaleta never sends a redirect that leaves the site this way. Every URL form setting was affected, including the default.
• Claude's guardrail (low). Confirming a booking request and proposing other times both e-mail the customer. With "deleting and discarding" switched off for Claude, they now stop at that guardrail, like declining a request already did.
• Proposed times (info). When a customer chooses a proposed time twice (a double click, or back and resend), they no longer get a second confirmation that makes the links in the first one stop working.

Updating

Sites with automatic security updates (the default) install it by themselves. You can also update from Settings → Backups and updates. No database changes.