HiEventsDev/Hi.Events v1.11.3-beta

on GitHub

Security fixes for 1.x. We recommend upgrading to v2.0.0; this release is for installs that need to stay on 1.x for now.

Upgrade note: rotate JWT_SECRET if you used the example value

Earlier versions shipped a fixed JWT_SECRET in backend/.env.example. If your install still uses that value (most likely if you set it up without Docker), anyone could forge login sessions for it. From this release, the backend refuses every request with a 503 while that value is configured, and logs why.

Generate a new secret before or right after upgrading:

php artisan jwt:secret --force

This signs everyone out. Docker installs that set their own JWT_SECRET (as the Docker instructions describe) are not affected.

Fixes

• Organizer pages escape organizer-provided text in their structured data correctly.
• backend/.env.example no longer ships an example JWT_SECRET or APP_KEY; the setup scripts and install guide now generate them.
• Public check-in only accepts tickets for the check-in list's own event. Scanning another event's ticket now returns "Invalid attendee code detected" instead of naming the attendee.