rt-6.0.3

RT 6.0.3 -- 2026-05-20

RT 6.0.3 is now available for general use. This release addresses
several security issues and it is recommended that all users upgrade
as soon as possible. See below for details.

In addition to the security updates, this release includes many new
features and updates. Saved searches on dashboards now support pagination
and sorting. Statuses can be assigned colors in the lifecycle configuration.
Accessibility is improved, especially with keyboard menu navigation.
The default custom field display is now multi-column, making it more
dense, showing more information above the fold. And there are many more
updates, improvements, and optimizations.

https://download.bestpractical.com/pub/rt/release/rt-6.0.3.tar.gz
https://download.bestpractical.com/pub/rt/release/rt-6.0.3.tar.gz.asc

SHA-256 sums

117b53e7a46e82ade662050d98920f1255865ca873d6bec80036085b17dd3dc6 rt-6.0.3.tar.gz
551d62dc23a2b3a7f06b97f6fd09bd0ecc617a1b8949697b166c0865ffc45348 rt-6.0.3.tar.gz.asc

Note: Missed Patch for TSV Export Header Injection

After the release of RT 6.0.3, we discovered that a fix for spreadsheet injection via
TSV export headers was included in RT 5.0.10 but inadvertently left out of RT 6.0.3.
The patch below completes the mitigation for CVE-2026-41073. We recommend all RT 6.0.3
users apply the following patch, which will be included in RT 6.0.4:

https://github.com/bestpractical/rt/commit/525547751b76cc422015960bae3056f4e8d4351f.patch

Security

The following security issues are fixed in this release.

• RT 6.0 is vulnerable to privilege escalation and information
  disclosure via the REST 2.0 user collection endpoint. A Privileged RT
  user can obtain authentication credentials belonging to other users,
  including administrators, and use those credentials to read data via
  RT's RSS and iCal feed endpoints. The same request that exposes the
  credentials also rotates them, which invalidates previously-distributed
  feed URLs across the instance. This vulnerability is assigned
  CVE-2026-44231. Thanks to Jeroen Gui for reporting this finding.

• RT 6.0 is vulnerable to SQL injection via the entry_aggregator
  parameter in JSON search. An authenticated user can craft input that is
  incorporated into database queries without proper validation,
  potentially allowing them to read or modify data in the RT database.
  This vulnerability is assigned CVE-2026-41075.

• RT 6.0 is vulnerable to an LDAP authentication bypass when RT is
  configured to authenticate users against an LDAP or Active Directory
  server. Under certain LDAP server configurations, an attacker may be
  able to authenticate as any LDAP-backed RT user without supplying valid
  credentials. This vulnerability is assigned CVE-2026-41076.

• RT 6.0 is vulnerable to Cross-Site Request Forgery (CSRF) for
  authenticated users. An attacker who can induce a logged-in RT user to
  visit a malicious web page can trigger arbitrary state-changing actions
  in RT on that user's behalf. This vulnerability is assigned
  CVE-2026-41074.

• RT 6.0 is vulnerable to stored cross-site scripting via insufficient
  escaping in templates. This vulnerability is assigned CVE-2026-44228.

• RT 6.0 is vulnerable to reflected cross-site scripting via the search
  "Page" URL parameter. This vulnerability is assigned CVE-2026-6841.
  Thanks to Aleksander Iwicki and CERT Polska for reporting this finding.

• RT 6.0 is vulnerable to reflected cross-site scripting via additional
  URL parameters on search pages. This vulnerability is assigned
  CVE-2026-44227.

• RT 6.0 is vulnerable to reflected cross-site scripting on
  search-results chart pages. This vulnerability is assigned
  CVE-2026-44230.

• RT 6.0 is vulnerable to cross-site scripting via uploaded content
  that is served inline rather than as an attachment. This vulnerability
  is assigned CVE-2026-44229.

• RT 6.0 is vulnerable to spreadsheet (CSV/formula) injection via
  ticket values that are exported to a spreadsheet from search results.
  User-controlled data is not sanitized before being written to the
  output file, which can cause spreadsheet applications such as Microsoft
  Excel to interpret crafted values as formulas or macros when the file
  is opened. This vulnerability is assigned CVE-2026-41073.

General user features

• Add style to allow resizing CKEditor height
• Restore new as default status for cloned tickets
• Escape calendar headers
• Fix the empty encryption error message on ticket search result page
• Support showing TicketStatus in transaction searches
• Process ticket date fields consistently on transaction searches
• Respect HideUnsetFieldsOnDisplay user preference in page layouts
• Support showing a search from an RT shortener code
• Use saved search Rows setting when showing portlets
• Add support for ticket time fields in transaction searches
• Support keyboard navigation in main and page menus
• Move skip navigation link to top of page
• Update menu timers to avoid closing menus unexpectedly
• Keep dynamic modal forms open if submission fails
• Reset inline editing row if Reply/Comment/Description submission fails
• Reset inline edit row if request succeeded without data changes
• Emphasize correct parentheses for mixed AND/OR queries
• Do not reset category select after adding a value
• Add a new type of article to display a list of links
• Support rendering links type articles in dashboards
• Focus on main content area after navigation
• Add a keyboard shortcut to jump to the page navigation
• Add a keyboard shortcut to jump to the main navigation
• Update keyboard shortcut modal content and layout
• Avoid double tab on tom-select dropdown input elements
• Show an error message when articles can't be changed to Links type
• Support user overrides for saved searches
• Display pagination on dashboard saved searches
• Support sorting by column in dashboard saved searches
• Scroll to the top of the portlet when loading a new page
• Do not render pagination and sorting links in dashboard emails
• The title link of ShowSearch only works for privileged users
• Make Calendar work with shortener code
• Support Calendar for unprivileged users
• Support using saved search Rows setting in dashboard emails
• Respect subscription settings only for dashboard emails
• Support other search types in ShowSearch
• Support reload for self service searches
• Improve spacing for stacked asset buttons
• Make AutoSubmit in SelectArticleAutocomplete consistent with SelectArticle
• Refine asset autocomplete to honor $AssetSearchFields for multi-field
  search
• Link RT logo to the official requesttracker.com domain
• Treat multiple term Simple Search input as phrase search
• Refresh inline Times form on display page
• Migrate SelfService ticket and asset pages to page layouts
• Keep autocomplete custom field dropdowns visible during search in
  inline edit
• Support various formats of date fields for calendar display mode
• Make "Jump to Unread" links work with paginated history
• Tweak the behavior of "Jump to Unread" links for clicked history
• Make "Jump to Unread" links work with scrolled history
• Support searching user custom fields in TicketSQL/AssetSQL
• Add user custom fields to query builder criteria
• Tweak role member's "NULL" searches
• Support positive group custom field criteria for role member searches
• Support grouping by user/watcher custom fields for charts
• Move Unlink action into the Actions menu
• Convert accordion show and hide to a caret control
• Position the asset Actions on the right like tickets
• Display asset values with a newspaper style layout
• Remove extra space above Name element in asset portlet
• Move ticket listing label above list of related tickets
• Make Binary/Image custom field download links work with boosted
  requests
• Restrict assets autocomplete to Privileged users
• Improve the layout and style of the add asset element
• Refresh inline asset Basics form after edit
• Show disabled owners in search results and add disabled indicator
• Localize status where missing in some ticket listings
• Color events in calendars based on status
• Provide a status filter on calendar saved searches
• Create a CALENDAR modifier for Format to set start and end
• Set new CALENDAR format modifier in the query builder
• Use new status colors in update status badge style
• Retain status background color when selected
• Use viewport bounds to position calendar popups
• Fix asset id simple search for non-Pg databases
• Do not show customize for chart saved search
• Make CF column sizing configurable in page layouts
• Add red asterisk indicator to label for required custom fields
• Split transaction actions into separate buttons
• Add "Toggle contrast" transaction action for history
• Progressively generate results for unpaginated searches
• Fix checkbox label click behavior for click-activated inline edit
  widgets
• Update saved search title on manual reload
• Construct correct pagination links in linked queues

Documentation

• Update query builder and ticket metadata docs
• Update developer docs with playwright setup
• Unify developer documentation into a single document
• Document how to use the TitleBox template and spacing behavior
• Document links type articles
• Document the scheme support for ReferrerWhitelist config
• Document changes to rows and saved searches
• Document the new "page" ShowHistory mode
• Document user CF search and chart features
• Add migration docs for cored RTx::Calendar
• Document the new calendar features
• Document color status changes in UPGRADING file
• Update docs/code since CSS::Inliner is now a core dependency
• Document the shredder index for external attachments
• Update obsolete --no-users doc in rt-dump-initialdata
• Update obsolete --no-groups doc in rt-dump-initialdata
• Refere...

rt-5.0.10

RT 5.0.10 -- 2026-05-20

RT 5.0.10 is now available for general use. This release addresses
several security issues and it is recommended that all users upgrade
as soon as possible. See below for details. In addition to the security
updates, this release includes improvements to inline CSS handling in
the ticket history, balancing correct display of formatted HTML email
with reasonable processing of very large emails on the server.

https://download.bestpractical.com/pub/rt/release/rt-5.0.10.tar.gz
https://download.bestpractical.com/pub/rt/release/rt-5.0.10.tar.gz.asc

SHA-256 sums

508b8d401273da4fe1c47e642ecb6017939ef560e9cfdfeb8d18ef41e4dbc5e6 rt-5.0.10.tar.gz
0eff93782c51fdda2bbc998d313f4a8779d627e9ac6026a05673dca07c50b153 rt-5.0.10.tar.gz.asc

Security

The following security issues are fixed in this release.

• RT 5.0 is vulnerable to privilege escalation and information
  disclosure via the REST 2.0 user collection endpoint. A Privileged RT
  user can obtain authentication credentials belonging to other users,
  including administrators, and use those credentials to read data via
  RT's RSS and iCal feed endpoints. The same request that exposes the
  credentials also rotates them, which invalidates previously-distributed
  feed URLs across the instance. This vulnerability is assigned
  CVE-2026-44231. Thanks to Jeroen Gui for reporting this finding.

• RT 5.0 is vulnerable to SQL injection via the entry_aggregator
  parameter in JSON search. An authenticated user can craft input that is
  incorporated into database queries without proper validation,
  potentially allowing them to read or modify data in the RT database.
  This vulnerability is assigned CVE-2026-41075.

• RT 5.0 is vulnerable to an LDAP authentication bypass when RT is
  configured to authenticate users against an LDAP or Active Directory
  server. Under certain LDAP server configurations, an attacker may be
  able to authenticate as any LDAP-backed RT user without supplying valid
  credentials. This vulnerability is assigned CVE-2026-41076.

• RT 5.0 is vulnerable to reflected cross-site scripting via the search
  "Page" URL parameter. This vulnerability is assigned CVE-2026-6841.
  Thanks to Aleksander Iwicki and CERT Polska for reporting this finding.

• RT 5.0.4 and later are vulnerable to reflected cross-site scripting
  on search-results chart pages. This vulnerability is assigned
  CVE-2026-44230.

• RT 5.0 is vulnerable to cross-site scripting via uploaded content
  that is served inline rather than as an attachment. This vulnerability
  is assigned CVE-2026-44229.

• RT 5.0 is vulnerable to spreadsheet (CSV/formula) injection via
  ticket values that are exported to a spreadsheet from search results.
  User-controlled data is not sanitized before being written to the
  output file, which can cause spreadsheet applications such as Microsoft
  Excel to interpret crafted values as formulas or macros when the file
  is opened. This vulnerability is assigned CVE-2026-41073.

General user features

• Make TicketStatus available in transaction search results
• Process ticket date fields consistently on transaction searches
• Add support for ticket time fields in transaction searches
• Show disabled owners in search results and add disabled indicator

Documentation

• Document the scheme support for ReferrerWhitelist config

Administration

• Handle non-HTTP URI schemes in Referer header for CSRF checks
• Abstract inline CSS feature
• Support to customize INLINE_CSS_MAX_SIZE and INLINE_CSS_MAX_TAGS via env
• Ignore the pre selector when inlining CSS for incoming emails
• Skip inlining CSS for content with over 3k tags
• Shred only queue-level scrips when shredding templates

Internals

• Remove obsolete TSVExport that was for assets
• Avoid unnecessary database queries for non-existent report data
• Fully initialize RT::Configuration on RT init
• Avoid warnings for invalid user records
• Require RT::Base before _ImportOverlays in non-inheriting modules
• Ignore negative answers of equivalent object cache
• Skip Symbol::Global::Name scan during DB config reload
• Add a new backcompat-preinit hook to cover CustomRoles updates
• Add backcompat code to cover changes to CustomRoles
• Use raw content for JS squishing to avoid auto-decoding under Plack 1.0052

Testing

• Support WWW::Mechanize v2.20 (thanks andrew!)
• Test that TicketStatus shows results in transaction searches
• Test transaction searches with ticket dates like TicketResolved
• Test the scheme support for ReferrerWhitelist config
• Test shredding queues and queue-level templates
• Fix GnuPG warning test to work across GnuPG versions

A complete changelog is available from git by running:
git log rt-5.0.9..rt-5.0.10
or visiting
rt-5.0.9...rt-5.0.10

rt-6.0.2

RT 6.0.2 -- 2025-10-22

We're pleased to announce the general availability of RT 6.0.2. This
release includes significant new features including a calendar view for
saved searches, enhanced history filtering and paging, and comprehensive
memory management improvements. Details on these and other updates,
bug fixes, and enhancements are below. This release also contains
security fixes noted below.

https://download.bestpractical.com/pub/rt/release/rt-6.0.2.tar.gz
https://download.bestpractical.com/pub/rt/release/rt-6.0.2.tar.gz.asc

SHA-256 sums

f3706fcfd2a6dfbdea58f3e9c64a7d17ae39bdd5928aeac61c4767f30f6b05c4 rt-6.0.2.tar.gz
8b19db97e2f33e49c75155b8827b5c6cda9ba4e379f81a80a383d4af57638e95 rt-6.0.2.tar.gz.asc

Security

The following security issues are fixed in this release.

• RT 6.0 is vulnerable to CSV injection via ticket values with special
  characters that are exported to a TSV from search results. This
  vulnerability is assigned CVE-2025-61873. Thanks to Gareth Watkin-Jones
  from 4armed for reporting this finding.

• RT 6.0 is vulnerable to XSS via calendar invitations added to
  a ticket. This vulnerability is assigned CVE-2025-9158. Thanks to
  Mateusz Szymaniec and CERT Polska for reporting this finding.

General user features

• Remove submit blocking class on back button push
• Add user config option to disable keyboard shortcuts (thanks gibus!)
• Add autocomplete feature for article search in top menu
• Add delete column for HTML CF on bulk update
• Support article autocomplete in SelfService
• Use SimpleSearch for article searches from top menu
• Show no results message for article search page
• Refactor SelfService article search to be consistent with privileged
• Style article autocomplete to fit in the top menu
• Remove hide control from article display component
• Display lifecycle name in Queue list (thanks @tbrumm!)
• Add calendar as a new display option for saved searches
• Add grid icon for selecting saved search display mode
• Add a modal that shows all assigned calendar date colors
• Support to dynamically select view mode for saved searches
• Show popup with ticket details when hovering over calendar entries
• Display popup values based on the Format
• Expand first items for multiple-day events in each week
• Display just ticket subject in calendar day entries
• Remove redundant browser tooltip from calendar events
• Show an error message when no dates for calendar are found
• Allow for ticket to move position up on calendar
• Clean up calendar styles and make it work with dark theme
• Add ticket history search to History menu
• Add a transaction type filter to history
• Save History filter settings in page layout
• Restore link style reverse history option for other history pages
• Show filtering options only for tickets and assets
• Add paging support to asset history widget
• Set paging options via the History widget in page layouts
• Add a new paging option for displaying ticket history
• Limit page layout history options for assets
• Apply page-specific history filters from page layout config for assets
• Amend paging support of asset history widget
• Make "Reverse history order" work on selfservice asset history page
• Scroll to the top of the history window on page change
• Make history options work with history search
• Make filter form work with all history display modes
• Close the history filter menu on apply
• Respect empty type list when user deselects all transaction types
• Show search history input only if fulltext search is enabled
• Enable history search in self service
• Respect history search state when refreshing history after inline edits
• Remove the border color override and use bootstrap default
• Support to quickly correspond/comment on tickets from search results
• Show TimeTrackingDisplayCF on the user time worked report
• In articles autocomplete, page until we get max results
• Pause auto-refresh on saved searches in preview mode
• Notify the user that the display mode change is a preview
• Keep the saved search refresh button on the left
• Initialize TomSelect objects for new cloned modals in page layouts
• Determine custom role visibility based on page layout
• Hide Visibility page for asset custom roles
• Add page layout history link for queue history
• Reduce modal width for ticket/asset filters
• Use default bootstrap table styles and remove custom CSS
• Avoid the blue outline for svgs on focus
• Align tom-select input focus borders with RT inputs
• Standardize menus in titlebox headers
• Update AddWatchers for the new @hiddenroles argument

Documentation

• Don't reference specific versions in headings
• Provide guidance on starting a test server (thanks andrew!)
• Document the ModifySuggestions callback change
• Improve formatting for @EmailDashboardLanguageOrder docs
• Add docs for the new calendar display mode
• Document the new custom role visibility location

Administration

• Process Configurations before other RT objects in initialdata
• Do not exclude ___Approvals queue in dumped json file
• Support changing the name of a page layout
• Support custom roles in CreateTickets templates (thanks @bdragon300!)
• Allow From to be passed as an argument to Forward (thanks @MarkHofstetter!)
• Add support to set default value(s) at CustomField creation (thanks elacour!)
• Update deprecation warning messages
• Skip the whole dormant period for old tickets when calculating SLA Due
• Decode arguments parsed from URI for htmx internal redirects
• Update page layout config when queue name changed
• Fix syntax error in ticket search filter
• Make REST2 optional and load only for the web server
• Add Watcher transactions to the short filter list
• Add Link transactions to the short filter list
• Support AfterCustomFieldValue callback after code refactor
• Add callbacks for link editing and display (thanks zach.kelly!)
• Add EndOfPage callback on article display page (thanks zach.kelly!)
• Deprecate old HiddenForURLs methods for custom roles
• Defer loading DateTime to reduce memory at startup
• Document memory saving tips for CLI
• Provide a way to override any RT config option in CLI tools
• Ensure SQL batches stay under 256MB
• Skip CSS::Inliner for content over 1MB in size
• Log unresolved ticket failures at warning log level
• Log forwarded IP address when running behind a reverse proxy (thanks
  @wheldom01!)

Internals

• Update importer SQL to correctly interpolate groups table names
• Do not trigger any other htmx requests on parents for reload events
• Use Time::HiRes to ensure we can find Time::HiRes::time (thanks andrew!)
• Ensure changes are committed when adding CGM records without auto-commit
• Add dashboards to menu by id instead of name
• Count imported objects from cloned serialized data
• The path argument should not use loc() (thanks @mkosmach!)
• Align Articles autocomplete helper callback with other callbacks
• Don't export removed CleanEnv (thanks buehler!)
• delay is no longer the default for ShowHistory
• Dispose datepicker (tempusDominus) objects for elements to be swapped out
• Clean up obsolete hasDatepicker class that was from old jQueryUI
• Destroy TomSelect and Dropzone objects for elements to be swapped out
• Destroy CKEditor objects for elements to be swapped out
• Dispose bootstrap orphan tooltip/popover/dropdown/modal objects
• Update page layout config when queue name changed
• Eliminate redundant transaction detail click event listeners
• Migrate event listeners for menu dropdown to delegation
• Tweak js event listeners to not reference to themselves
• Avoid creating unnecessary global variables to prevent memory leaks
• Clean up js code for obsolete IE
• Drop obsolete style tweak for dropdowns in page menu
• Hide tooltips for dropdown elements in history widget header
• Use optional chaining for existing tom-select destroy
• Register dynamic modal handlers only once
• Batch updates to reduce the number of forced layouts in the browser
• Restrict day evaluation to the visible calendar month
• Reduce the blank padding around each day
• Calculate last day border width
• Ensure left and right side borders show correctly
• Ensure date selection form has correct hx-target
• Add dropup direction for TomSelect dropdowns
• Remove noisy debug log messages no longer needed
• Update tom-select build instructions to include overrides
• Refactor GetCalendarTickets to return a single data structure
• Refactor handling for multiple day calendar events
• Run a PreCheck to check for linked Assets
• Run a PreCheck for configured ProcessArticles
• Run a PreCheck for configured LinkedQueues
• Run a PreCheck step for widgets that may not display
• Apply page-specific history filters from page layout config
• Limit the asset type list to relevant types
• Adapt history changes to work with assets
• Convert history actions to htmx and retain search options
• Use TicketList for History filter
• Add a TicketList mode for abbreviated transaction list
• Create GetTransactionTypes to provide a list of valid types
• Switch to vanilla tooltip initialization method
• Remove unnecessary blessed object arguments from paged history URL

Testing

• Add selenium test for include article feature on ticket update page
• Update dashboard tests to use id instead of name
• Test article menu searches
• Test SLA Due date for long-dormant tickets
• Add a groups test to the rights inspector test
• Use different attribute search examples (thanks zach.kelly!)
• Add github actions config for rt-server tests with Oracle
• Run github actions with updated 6.0.2 docker image
• Test UTF-8 data for ticket simple search
• Test adding custom field DefaultValues on create
• Add tests for the upcoming custom role support in CreateTickets
• Add tests for running Update-Ti...

rt-5.0.9

RT 5.0.9 -- 2025-10-22

RT 5.0.9 is now available for general use. The list of changes
included with this release is below. In addition to a batch of
updates, new features, and fixes, several security issues are
addressed. See below for details.

https://download.bestpractical.com/pub/rt/release/rt-5.0.9.tar.gz
https://download.bestpractical.com/pub/rt/release/rt-5.0.9.tar.gz.asc

SHA-256 sums

913e9403ad422e0064ac9378baf2b13ba2b4c0119c891fe2cb4f2b51f3a5aeb8 rt-5.0.9.tar.gz
e357206ebcd9d1615fb6dba668963502ad1a920b3c66ac6cbcbba47fb59621d1 rt-5.0.9.tar.gz.asc

Security

The following security issues are fixed in this release.

• RT 5.0 is vulnerable to CSV injection via ticket values with special
  characters that are exported to a TSV from search results. This
  vulnerability is assigned CVE-2025-61873. Thanks to Gareth Watkin-Jones
  from 4armed for reporting this finding.

• RT 5.0.4 - 5.0.8 are vulnerable to XSS via calendar invitations added to
  a ticket. This vulnerability is assigned CVE-2025-9158. Thanks to
  Mateusz Szymaniec and CERT Polska for reporting this finding.

General user features

• Remove submit blocking class on back button click
• Remove duplicate Asset entry in the shredder objects list
• Add missing WebPath for modify scheduled process (thanks zach.kelly!)
• Default to the current class for existing articles
• Add user config option to disable keyboard shortcuts (thanks gibus!)

Documentation

• Fix typo after rt-clean-sessions link in README
• Provide guidance on starting a test server (thanks andrew!)
• Document the ModifySuggestions callback change
• Improve formatting for @EmailDashboardLanguageOrder docs

Administration

• Support to update extension configs via web UI
• Check meta IsJSON to determine if config is JSON
• Make doc_url optional for plugin config options
• Add NoReset config meta option
• Do not allow to change $SendmailPath from web UI for security
• Merge extension config meta with existing meta
• Refactor stringify code to simplify logic for config edit page
• Fix current value of DefaultQueue on config edit page when it's queue name
• Show default queue's name on configuration page and config updated messages
• Support import/export of @configuration for JSON serializer
• Process Configurations before other RT objects in initialdata
• Do not exclude ___Approvals queue in dumped json file
• Support custom roles in CreateTickets templates (thanks @bdragon300!)

Internals

• Update importer SQL to correctly interpolate groups table names
• Convert <style> blocks to inline before scrubbing the HTML
• Enable encode_entities and ignore_style_type_attr options for CSS::Inliner
• Bypass ACL cache for owner validation on ticket queue change
• Ensure changes are committed when adding CGM records without auto-commit
• Add dashboards to menu by id instead of name
• Count imported objects from cloned serialized data
• The path argument should not use loc() (thanks @mkosmach!)
• Align Articles autocomplete helper callback with other similar callbacks
• Don't export removed CleanEnv (thanks buehler!)
• Add support to set default value(s) at CustomField creation (thanks elacour!)
• Skip CSS::Inliner for content over 1MB in size
• Log unresolved ticket failures at warning log level
• In the importer, ensure SQL batches stay under 256MB

Testing

• Update docker image for tests
• Update GitHub actions/checkout to v4
• Update GitHub actions/cache to v4
• Update simple-slack-notify GitHub action
• Confirm that all of the shredder plugin pages load correctly
• Test owner updates on queue change
• Test showing incorrect class for new article
• Add tests for Configurations export/import
• Update dashboard tests to use id instead of name
• Add a groups test to the rights inspector test
• Add github actions config for rt-server tests with Oracle
• Run github actions with updated 6.0.2 docker image
• Test adding custom field DefaultValues on create
• Add tests for custom role support in CreateTickets
• Add tests for running Update-Tickets via CreateTickets template
• Add tests for SetStatus action used with rt-crontool
• Run tests against postgresql 16.10

A complete changelog is available from git by running:
git log rt-5.0.8..rt-5.0.9
or visiting
rt-5.0.8...rt-5.0.9

rt-4.4.9

RT 4.4.9 -- 2025-10-22

RT 4.4.9 is now available for general use. This release contains just
one security update.

With the release of RT 6 in May 2025, this is the last planned release
for the RT 4.4 series. Users should upgrade to RT 5 or RT 6.

https://download.bestpractical.com/pub/rt/release/rt-4.4.9.tar.gz
https://download.bestpractical.com/pub/rt/release/rt-4.4.9.tar.gz.asc

SHA-256 sums

cb7c4dffb4879e95d190e5d919bc13870926578394d3f0cd14f15b15dfedea8b rt-4.4.9.tar.gz
7c039d333e641c4a40c0dd929e24f10840a53aa89a3d698fd2e583001e191a80 rt-4.4.9.tar.gz.asc

Security

The following security issue is fixed in this release.

• RT 4.4 is vulnerable to CSV injection via ticket values with special
  characters that are exported to a TSV from search results. This
  vulnerability is assigned CVE-2025-61873. Thanks to Gareth Watkin-Jones
  from 4armed for reporting this finding.

A complete changelog is available from git by running:
git log rt-4.4.8..rt-4.4.9
or visiting
rt-4.4.8...rt-4.4.9

rt-6.0.1

RT 6.0.1 -- 2025-08-05

We're pleased to announce the general availability RT 6.0.1.
This release primarily supports running the newly released RTIR 6.0.1.
Some new features and bug fixes are also included. A detailed list of
changes is provided below.

The new version is available here:

https://download.bestpractical.com/pub/rt/release/rt-6.0.1.tar.gz

SHA-256 sums

716650ddcb5fc5e87a6422bd341c70e56f28b276e9df0d2402ff1aa24b6dd260 rt-6.0.1.tar.gz
c9be232e8b8ffc7b3ad3f0edae018a07c69ab04315c8dc8f72c9b1c97a49d621 rt-6.0.1.tar.gz.asc

General User UI

• Move inactive loading spinners to bottom of DOM to prevent blocking
  clickable elements
• Fix multiple value handling in TomSelect inputs when splitting on delimiters
• Improve visual consistency by applying Bootstrap styling to radio button
  columns
• Fix "Reset" radio button functionality for select configurations on the
  config edit page
• Convert CKEditor toolbar configuration to extended format for easier
  customization
• Default to the current class for existing articles instead of system default
• Exclude 'id' field from NOT NULL validation checks in user autocomplete
  on PostgreSQL to prevent invalid integer syntax errors
• Exclude 'id' field from NOT NULL validation checks in group autocomplete
  on PostgreSQL to prevent invalid integer syntax errors
• Preserve Description field content when changing queues on ticket
  create/update pages
• Remove duplicate div.row.mt-2 wrapper for Sign/Encrypt inputs
• Fix duplicated mt-2 CSS class for radio inputs in Boolean widget
• Improve visual consistency in dark mode by fixing prefix/suffix border
  colors for input groups
• Fix default reference links on ticket clone by using proper double-space
  delimiter
• Render all default values in TomSelect user autocomplete inputs instead of
  only the first value
• Automatically reveal history widget before jumping to anchor elements
  within it to support unread messages
• Fix "Jump to Unread" functionality in ShowHistory "click" mode
• Add clickable links from pending dependency status text to search results
• Migrate GnuPG key select inputs to use RT 6 styling
• Add support for Dates widget on ticket update page
• Update copy button for conditions and actions to use boosted links
• Remove duplicated saved search widgets on dashboard content page
• Fix visual styling of inline edit links by removing trailing spaces
• Support updating Description field on ticket Jumbo page
• Replace deprecated ShowSummary widget in SelfService Asset Display
• Add "g r" keyboard shortcut to reload main container
• Avoid using

   tags when quoting text content

• Preserve multiple spaces when rendering plain content instead of collapsing
• Remove extra newline when quoting content with CKEditor 5
• Support reverting in-use page layouts to their config file version

Administration

• Fix DefaultDashboard attribute dependency handling now that Dashboards are
  in a separate table in the database
• Remove duplicate Asset entries from shredder objects list that caused
  errors using Shredder in the web UI
• Prevent modification of $ChromePath and $SendmailPath configuration options
  in the web UI for security reasons
• Display ChromePath and SendmailPath as read-only text inputs instead of
  textareas on configuration edit page
• Refactor configuration edit page stringify logic to simplify value handling
• Fix display of current DefaultQueue value when configured using queue name
  instead of ID
• Show queue names instead of IDs on configuration pages and in update
  messages for better readability
• Improve visual alignment of reset checkboxes with their labels on
  configuration edit page
• Skip unnecessary PageLayoutMapping configuration updates when creating
  queues with default layouts
• Expand TicketSQL to support additional queue fields for searching
• Fix ShowSummary template compilation errors and add deprecation test
• Migrate old saved search and dashboard rights to new standardized names
• Set LastUpdated field only when updates succeed and values actually change
• Document the LastUpdated behavior change for ticket updates
• Document the MessageBoxRichTextInitArguments configuration change for
  CKEditor toolbar customization
• Merge extension config meta with existing meta
• Show a message when a page layout tries to use a CustomFieldGrouping and it
  can't be found
• Refresh the lifecycle cache after admin page changes to show the updated
  lifecycle

Extensions and RTIR Support

• Provide a clean interface for SavedSearch options management
• Allow extensions to add custom SavedSearch options
• Make HTMX query arguments available via callback for dynamic requests
• Add support for absolute paths in dashboard components (e.g.,
  "/RTIR/Elements/QueueSummary")
• Enable email squelching for selected roles during ticket creation
• Support merging arrays in PageLayoutMapping configuration to allow
  extensions to add custom mappings
• Support merging arrays in CustomFieldGroupings configuration for
  extensions
• Add callbacks to modify cached object items for constituency-specific
  filtering
• Support hiding attachments in Message widgets for multi-ticket creation
  forms
• Add BeforeCreate callback parameter for validation failure handling
• Set dynamic form actions based on request path for extension-specific
  endpoints
• Add BeforeShowWidgets/AfterShowWidgets callbacks for ticket creation page
  customization
• Use general arguments to set default values from cloned tickets for
  better compatibility
• Use loose SubmitTicket check on ticket create page to support multiple
  submit button scenarios
• Support input name prefixes for multi-ticket creation scenarios
• Support customizing message titles, people sections, and submit labels
  on ticket creation
• Support keeping default status values that are normally excluded due to
  permissions
• Allow limiting displayed groupings in Asset CustomFieldCustomGroupings
  widget
• Add missing WebPath for modify scheduled process functionality (thanks Zack!)
• Support limiting CustomFieldGroupings on Asset and Ticket creation pages
• Expand ticket display check to cover additional display pages
• Support refreshing process articles on ticket display pages
• Add support for absolute paths in /Views/Ticket/ endpoints
• Add BeforeActionList callback on Create page for ticket locking
  functionality
• Add BeforeAbort callback for TSV export customization

Internals

• Switch code formatting to use Perl::Critic's --perl-best-practices
  configuration
• Adopt "not cuddled else" code style for improved visual distinction between
  blocks
• Bypass ACL cache when validating owner permissions during queue changes to
  ensure accurate permission checking
• Migrate body ID attribute to .main-container element with support for
  customized CSS classes
• Clean up temporary debug code from development
• Register event handlers only for newly added DOM elements to avoid multiple
  registrations
• Migrate history loading to HTMX-powered system with boosted link support
• Update quote selection mechanism to be compatible with HTMX request
  handling
• Prevent Pragma headers from being set on cached HTTP responses
• Cache /Helpers/UserInfo endpoint for improved performance
• Avoid rebuilding top menu unnecessarily on main-container changes
• Add support for import/export of @configuration in JSON serializer
• Ensure window.RT object exists in footer to prevent JavaScript errors
• Convert more RT elements to use Labelled Value

Testing

• Confirm that all shredder plugin pages load correctly
• Update ticket_status test code for DOM changes in RT 6
• Update mechanize test content to support input name prefixes
• Add comprehensive test coverage for owner updates during queue changes
• Add test showing incorrect class selection for new articles
• Add test showing user autocomplete errors with 'id' return parameter
• Add article autocomplete test with return=id parameter to verify
  functionality
• Add test coverage for group autocomplete endpoint functionality
• Add test showing group simple search errors with 'id' return parameter
• Add test coverage for Configurations export/import functionality
• Add Selenium tests for multiple requestors on ticket creation
• Add test coverage for PageLayoutMapping updates during queue creation
• Add test coverage for quote selection functionality on ticket update
• Add Selenium test for SelfService Asset Display page
• Add test with custom fields in page layout mapping to verify functionality
• Confirm that page layout custom fields are applied before checking values

Complete Changelog

A complete changelog is available from git by running:
git log rt-6.0.0..rt-6.0.1

Or on the web at:
rt-6.0.0...rt-6.0.1

rt-6.0.0

RT 6.0.0 -- 2025-05-28

We are thrilled to announce the release of Request Tracker (RT) 6.0.0. This
major release introduces an updated user interface, new customization features,
integration of popular extensions into the core, and numerous enhancements to
improve performance, usability, and administration.

Highlights of RT 6.0.0 include:

• UI Modernization: Experience a refreshed look and feel with the upgrade to
  Bootstrap 5, new Bootstrap Icons, and updated JavaScript libraries including
  Tom-select for dropdowns and Tempus Dominus for date pickers. These changes
  bring a more consistent and contemporary user experience across RT.

• HTMX Integration: RT now extensively uses HTMX for many UI interactions. This
  results in faster, more dynamic pages with features like lazy loading of content,
  smoother inline editing for tickets and assets, and partial page updates that
  avoid full reloads, enhancing responsiveness.

• CKEditor 5: The rich text editor has been upgraded to CKEditor 5, offering an
  improved editing experience with a modern interface and enhanced features for
  composing messages and articles.

• Configurable Page Layouts: A powerful new Page Layout system allows
  administrators to customize the structure and content of key pages, including
  Ticket Display, Asset Display, Ticket Create/Update, Asset Create, and
  Dashboards. A new admin UI facilitates the management of these layouts,
  offering greater flexibility in tailoring RT to specific workflows.

• Time Tracking in Core: The widely-used TimeTracking extension is now a core
  part of RT. This brings integrated functionality for recording time worked on
  tickets, a "My Week" page for managing weekly time entries, time search
  reports, and configurable time tracking options.

• Article Templates in Core: The ArticleTemplates extension has been
  integrated into core RT, enabling the use of ticket variables in articles
  inserted in replies and comments, streamlining common communication tasks.

• User Avatars: RT now supports user avatars. Avatars can be initials-based
  or user-uploaded images, providing better visual identification of users
  throughout the interface, including ticket history and menus.

• Scrips for Articles and Assets: The robust Scrip system has been extended
  beyond tickets to now support automated actions and notifications for
  Articles and Assets. (Thanks Bradley Bell!)

• Full-Text Search Enhancements: Full-text search capabilities have been
  improved, including support for indexing custom field values,
  leading to more comprehensive search results.

• New Ticket "Description" Field: A dedicated core field has been added
  for ticket descriptions, allowing for a clear separation of the initial
  problem/request summary from subsequent updates. This field is also
  included in simple search.

• Accessibility Improvements: Various updates have been implemented
  throughout RT to improve accessibility.

• Extension Configuration via UI: Administrators can now update
  configurations for some extensions directly through the web UI,
  simplifying the management of RT plugins.

• Selenium Testing Framework: To ensure ongoing quality and stability,
  and to help test htmx interactions, RT's extensive automated testing
  framework now runs Selenium tests using a Firefox or Chromium based
  virtual browser.

You can get the new version here:

https://download.bestpractical.com/pub/rt/release/rt-6.0.0.tar.gz
https://download.bestpractical.com/pub/rt/release/rt-6.0.0.tar.gz.asc

SHA-256 sums

508f9a08f17b20ae8c96faf16da4a0b51e74a5332a69146ccfd3f4596eb5db2d rt-6.0.0.tar.gz
0d3bc45d065bf633af4837ba9cc1562870860a8e561b4e30d1408b6c8bd2dd0a rt-6.0.0.tar.gz.asc

A detailed list of changes included in this release is below.

New features

• Enable htmx for most of RT
• Implement htmx lazy loading for searches and components
• Dynamically refresh recently viewed tickets menu on hover
• Implement htmx lazy loading for dashboard rendering page
• Convert inline edit to htmx on ticket display
• Upgrade ckeditor5 to 40.2.0
• Add language support to ckeditor5
• Support to render embedded images
• Support to render embed videos added by ckeditor5
• Allow auto refresh on individual saved search portlets
• Convert Quick Create to htmx
• Support custom fields on the Quick Create portlet
• Support configurable widgets on ticket display page via WebDisplay config
• Support to customize widgets on asset display
• Convert inline edit to htmx on asset display
• Support multi-column content without a titlebox wrapper in %PageLayouts
• Support to add CSS classes to icons in titlebox menu
• Support modal toggling in titlebox menu icons
• Support Catalog in %PagelayoutMapping
• Initial version of PageLayout admin pages
• Support Queue/Catalog objects for future configurable ticket/asset create pages
• Make ticket create page configurable
• Make ticket update page configurable
• Make asset create page configurable
• Support custom field custom groupings on ticket update
• Use the structure of configurable pages for dashboards
• Enable new worker and worked date parameters on tickets
• Create new Times widget for time metadata
• Add MyWeek page for updating time on tickets
• Add the time search report from TimeTracking
• Add new One Column page layout for ticket Create and Update
• Add SavedSearches/Dashboards pages to list them on various levels
• Set up fts index for object custom field values
• Support object custom field values for ticket fulltext searches
• Add new Description core ticket field
• Support TimeWorker/TimeWorkedDate columns in transaction search results
• Display user avatars based on name initials
• Allow users to upload a picture for their avatar
• Support avatar images for unprivileged users
• Support to edit avatar image on user admin page
• Convert inline edit in search results to htmx
• Support skipping the default label for EditCustomField
• Implement dashboard advanced page
• Support scrips for articles and assets
• Support batch scrips for assets and articles
• Support to enable/disable saved searches/dashboards on list pages
• Support TicketID placeholder in envelope of outgoing emails
• Support to upload custom small logo
• Support to translate asset core roles
• Support to update extension configs via web UI

General user UI

• Add a new 'FullWidth' option to /Element/Submit
• Remove a legacy bit of form styling ensuring that all submit elements were in divs at least 2.8em high.
• Upgrade bootstrap to 5.3.1
• Tweak/Tidy bootstrap css mainly to make it be like RT 5
• Rewrite .form-row as it's been dropped in bootstrap 5
• Update css class names to migrate to bootstrap 5
• Rewrite .form-group as it's been dropped in bootstrap 5
• Rewrite .form-inline as it's been dropped in bootstrap 5
• Rewrite .custom-file as it's been dropped in bootstrap 5
• Drop obsolete div.input-group-append
• Set padding between label and value columns
• Lift the position of widget's toggle caret
• Use rem for padding/margin settings of form rows consistently
• Tweak position of radio/checkbox form rows
• Put "Load saved search" inputs the same row as the label
• Put multiple one-time-cc email checkboxes to the same line when possible
• Use .accordion-flush for its border-less style
• Set the height of .form-control buttons the same as other .form-control inputs
• Add tooltip span only if there is a tooltip to show
• Fix radio in dark mode
• Drop obsolete custom-control css rules
• Drop unnecessary border lines for fieldsets on chart page
• LabeledValue for Validation Hint
• Remove border lines among rows
• Upgrade bootstrap-select to 1.14(beta)
• Drop the obsolete div.input-group-append from bootstrap-combobox
• Drop the hardcode width of record labels
• Make filter inputs in one row for "Rights Inspector"
• Update outdated checkbox css rules for Rights page
• Show spinner for htmx boost requests
• Do not add confusing empty messages to results on cf process
• Enable scrolling to ticket history after inline edit changes for all modes
• Automatically load new ticket history after inline edit changes
• Suppress footer too when SuppressHeader is true for error page
• Migrate js/css code to ckeditor5
• Make ckeditor5 work with dark mode
• Update placeholder css rules for dark mode
• Add one more selector to message textareas to increase weight
• Grouping ckeditor5 toolbar for small textarea inputs
• Define explicit font sizes rather than default classes
• Remove the todo-list formatting option from CKEditor
• Use bootstrap's default fonts
• Remove the Inter custom font
• Migrate to bootstrap classes for table hover
• Restructure tables with multiple rows into single rows
• Convert remaining odd/even table code to bootstrap
• Migrate remaining hardcoded table accent classes to use configuration
• Hide tooltip of bookmark links on toggle
• Hide top menu on ticket timer page
• Migrate from inactive superfish to customized bootstrap menu
• Restore main menu bottom border
• Allow a little more delay on menus
• Make page edit icon(cog) be similar to ones in titlebox
• Show nav sub menus rounded bg on hover
• Drop separators among top page menus
• Dynamically highlight active top menu
• Render the page menu font in the full default size
• Auto close nav dropdown menus on click
• Align right justified elements with bootstrap card edge
• Use bootstrap standard form layout for labels and values
• If the submitted Due value is unchanged skip the message
• Do not render top menu on ShowEmailRecord page
• Resize ticket timer to remove scrollbar
• Adjust Timer size and style for Estimated time
• Dynamically resize ticket timer popup for zoomed in screens
• Align query builder inputs after label/value changes
• Convert saved search controls to labeled value format
• Support to refres...

rt-5.0.8

RT 5.0.8 -- 2025-04-29

RT 5.0.8 is now available for general use. The list of changes
included with this release is below. In addition to a batch of
updates, new features, and fixes, several security issues are
addressed. See below for details.

https://download.bestpractical.com/pub/rt/release/rt-5.0.8.tar.gz
https://download.bestpractical.com/pub/rt/release/rt-5.0.8.tar.gz.asc

SHA-256 sums

0a12419c6111c37384e912432cec872109d528657079e363bbe4ddf613e42286 rt-5.0.8.tar.gz
55852e075c068f190444a372df02dae4f324d3c7bf7a4635886849f1805b88a6 rt-5.0.8.tar.gz.asc

Security

The following issues are addressed with these security updates:

• RT 4.4 and 5.0 are vulnerable to Cross Site Scripting via injection
  of malicious parameters in a search URL. This vulnerability is assigned
  CVE-2025-30087. Thanks to Fabian Russwurm and the Siemens Red Team for
  reporting this finding.

• RT 4.4 and 5.0 use the default OpenSSL cipher, 3DES (des3), for encrypting
  SMIME email. This is an outdated cipher algorithm, so the default is changed
  to aes-128-cbc. In addition, we have made this option configurable so you
  can pick an alternate cipher now or in the future, or revert to des3 if
  needed for compatibility. This vulnerability is assigned CVE-2025-2545.
  Thanks to Ángel González Berdasco and INCIBE-CERT - Spanish National CSIRT
  for reporting this finding.

Thanks to Benjamin Vermunicht and Elias Bout of the NATO Cyber Security
Centre (NCSC) for reporting the following two findings.

• RT 5.0 is vulnerable to Cross Site Scripting via JavaScript injection in
  an Asset name. This vulnerability is assigned CVE-2025-31501.

• RT 5.0 is vulnerable to Cross Site Scripting via JavaScript injection in
  an RT permalink. This vulnerability is assigned CVE-2025-31500.

General user features

• Make all ckeditor toolbar groups the same height
• Skip recipients with deferred email delivery on encryption check
• Only store address part of emails for UpdateCc/UpdateBcc inputs
• Keep all default values for email inputs
• Disable InlineEdit/EnableJSChart for dashboard mail test via web UI
• Handle an edge case where only search Order contains multiple values
• Fix truncated labels in search filter modal
• Skip rendering filter component for unsupported collections
• Add Active/Inactive in Asset Query Builder status dropdown
• Use the same "right" position value in css and js for topactions
• Strip leading/trailing spaces from Queue name automatically on create/update
• Add Nobody to autocompletion of assets single member roles
• Show default queue name if possbile on ticket create
• Add Catalog List portlets
• Fix unbalanced divs in user anonymize modal
• Add user specific fields back for multi-member role GroupBy in search charts
• In ticket history, show scroll if needed for wide content
• Add missing Link columnmap definitions for assets
• Don't return a disabled Default Queue
• Notify the admin if they disabled the system DefaultQueue
• Add loading lazy attribute to img tags in transactions
• Allow users to delete dashboard subscriptions
• Support to specify ReverseHistoryOrderLink in history menu
• Add name attribute to Create New Ticket button
• Highlight active selectize dropdown elements in dark mode
• Highlight autocomplete dropdown items on hover in dark mode
• Fix overflow on ticket search filter modal
• Use owner name instead of id for owner dropdown in search filter
• Improve layout of user preferences page
• Remove modal class selection for creating articles
• Support PriorityAsString in search charts
• Fix main nav overlap on dark theme mobile
• Update prefs page to support single column layout
• Fix resizing quick create asset button
• Update asset simple search for single col layout
• Fix resizing quick create article button
• Update articles overview for single column layout
• Fix titlebox-title overlap on dark theme mobile
• Prevent users from untaking tickets owned by someone else
• Consistently set both $DefaultClass and $ClassObj on article create

Documentation

• Update Automating RT docs
• Fix typo in shredder pod
• Document Link filtering feature in search result Format
• Fix WithMember arguments in CreateTickets template example
• Include developer upgrade documents in static docs build
• Update RTAddressRegexp docs to align with new IsRTAddress
• Document RT's Unread Messages feature
• Update simple search instructions
• Add screenshot of approval page
• Update asset images to be consistent with other docs

Administration

• Add Scheduled Processes feature to schedule rt-crontool from the web UI
• Check thoroughly if an email is an RT address
• Internally, always pass import flag value within LDAP import
• Remove duplicate CLI options
• Show system config values instead of user overridden ones on configuration page
• Drop unnecessary and outdated version requirement of DBIx::SearchBuilder
• Migrate rt-externalize-attachments to use RT::Interface::CLI
• Skip unnecessary post actions when importing cloned serialized data
• Support to shred external contents of attachments/objectcustomfieldvalues
• Switch to WebService::Dropbox to use Dropbox API v2
• Implement Delete for Dropbox external storage
• Support updating user data from environment variables
• Set LOCAL_PLUGIN_PATH based on customplugindir in config.layout
• Cache clear output to avoid unnecessary system calls for better performance
• Fix endless loop when using --ids
• Add cgm-only mode to rt-validator
• Quote new references to the Groups table for MySQL 8
• Add REST2 /users/privileged and /users/unprivileged endpoints
• Add /Admin/Global/RightsHistory.html page
• Add menu page options for global rights changes history
• Refresh system attributes so new logo can show up right after submission
• Revert "Drop unused submit trigger in lifecycle UI" to allow saves of layout changes
• Add a Custom Role selection page to the Catalog admin pages
• Add LocalizedDate date formatter
• Make the Timezone config option a Select widget
• Add Shredder Plugin for Transactions
• Add Shredder Plugin for Assets
• Add shredder links to Asset and Transaction search
• Add quiet mode for rt-ldapimport for use in cron
• Prevent uninitialized warnings on Logout page
• Wipeout full text index records during shredding
• Quote tables names in shredder generated SQL file

Internals

• Enable SMIME tests
• Document environment variables for Crypt tests
• Update expired test revoked certs by generating them by ourselves
• Make SMIME revocation check with OSCP work with OpenSSL 3
• Test smime encryption behavior for deferred recipients without valid keys
• Test IsRTAddress with queue addresses
• Fix IsRTAddress in CanonicalizePrincipal in case User param is an object
• Test order loop on search result headers where OrderBy contains only one value
• Test config values are not overridden by user prefs on configuration page
• Check singleton before fully loading RT
• Allow user override in RightsInspector Search method
• Update tests as we added ExternalStorageDump plugin
• Test shredding external contents
• Move check for objects referencing external content
• Fix call to _EncodeLOB for ObjectCustomFieldValue records
• Update tests as we added WebRemoteUserAdditionalMapping config
• Add logging for user attribute setting during auto-creation
• Unset input name of custom field value placeholders in query builder
• Add Content arg to ReplaceContent method
• Check OwnTicket on ticket level in case the right is granted on ticket roles
• Test automatic owner change on queue change
• Test chart to group by requestor email
• Change free port detection to how PSGI binds to a port
• Drop unused CGM joins for recursive role member searches
• Do not check Content-Type.charset when guessing charset of email headers
• Pass $self to RT::Group::_AddMember to connect created txns with current object
• Pass queue info to SelectOwner in FilterTickets
• Refactor SQL of RT::Users::WhoHaveGroupRight for better performance
• Update test image with new HTML-RewriteAttributes
• Set obsolete Pragma header only if the content should not be cached
• Cache binary attachments for better performance
• Add tests for Rights Inspector
• Test REST2 /users/privileged and /users/unprivileged endpoints
• Support empty DisplayPath to indicate current URL
• Add Initial callback to /Helpers/Autocomplete/Owners
• Stop using the session to pass report info to JS Chart
• Limit LookupType in search for custom roles applied on a specified object
• Do not override passed in $Transactions in /Elements/ShowHistoryPage
• Clean up unused declared arguments in /Elements/ShowHistory
• Update tests for the deletion of article PreCreate page
• Add overlays support to most RT modules that do not have it yet
• Test overlays of RT packages
• Index Via column of CachedGroupMembers
• Implement cascaded deletion of cached group members on DB level
• Test cascaded deletion of cached group members
• Optimize TicketSQL with watcher bundling for queries without parens
• Access queue name directly when checking configuration settings
• Remove wrongly quoted formats on web config update
• Show unquoted string values on system configuration page
• Update tests for removed quotes
• Remove undesired attributes like "array(0x...)" in link autocomplete inputs

A complete changelog is available from git by running:
git log rt-5.0.7..rt-5.0.8
or visiting
rt-5.0.7...rt-5.0.8

rt-4.4.8

RT 4.4.8 -- 2025-04-29

RT 4.4.8 is now available for general use. The list of changes
included with this release is below. This release primarily provides
security updates. See below for details.

Note that with the upcoming release of RT 6.0.0, the RT 4.4 series
will soon reach end of life. Users should soon plan to upgrade to
RT 5 or RT 6.

https://download.bestpractical.com/pub/rt/release/rt-4.4.8.tar.gz
https://download.bestpractical.com/pub/rt/release/rt-4.4.8.tar.gz.asc

SHA-256 sums

b5ea3d861549f18ae144caacb37b2f1d7c231c18c0352fe657095e32af48ab4a rt-4.4.8.tar.gz
e0972fcdc43ecc5a3a2be4e4444102391cb05e20e842daaf5455ab25994e9d34 rt-4.4.8.tar.gz.asc

Security

The following security issues are fixed in this release.

• RT 4.4 is vulnerable to Cross Site Scripting via injection of malicious
  parameters in a search URL. This vulnerability is assigned CVE-2025-30087.
  Thanks to Fabian Russwurm and the Siemens Red Team for reporting this
  finding.

• RT 4.4 uses the default OpenSSL cipher, 3DES (des3), for encrypting SMIME
  email. This is an outdated cipher algorithm, so the default is changed to
  aes-128-cbc. In addition, we have made this option configurable so you can
  pick an alternate cipher now or in the future, or revert to des3 if needed
  for compatibility. This vulnerability is assigned CVE-2025-2545. Thanks
  to Ángel González Berdasco and INCIBE-CERT - Spanish National CSIRT for
  reporting this finding.

Additional Changes

• Add "all" option to rt-clean-sessions to clean all sessions
• Update tests for new warning messages in gpg 2.4+
• Drop unnecessary and outdated version requirement of DBIx::SearchBuilder

A complete changelog is available from git by running:
git log rt-4.4.7..rt-4.4.8
or visiting
rt-4.4.7...rt-4.4.8

rt-5.0.7

RT 5.0.7 -- 2024-06-05

RT 5.0.7 is now available for general use. This release addresses some
issues discovered with lifecycle changes in RT 5.0.6. See below for
details.

https://download.bestpractical.com/pub/rt/release/rt-5.0.7.tar.gz
https://download.bestpractical.com/pub/rt/release/rt-5.0.7.tar.gz.asc

SHA-256 sums

1a1a4838979f08c58e67642686e4fd980e1f4ee98e144ff8a56f870f37162cce rt-5.0.7.tar.gz
0570467be674d9fdf6d0ae0c980670d5011c063ad6d6b7c158cba14cfcc93ec7 rt-5.0.7.tar.gz.asc

Lifecycle Updates

RT 5.0.6 included some updates to RT internals to make lifecycles easier
to configure and manage. Once RT 5.0.6 was released and users started testing
with more complicated existing lifecycles, some bugs were discovered. The
following bugs are addressed in RT 5.0.7.

• Merge existing lifecycle mapping configuration on save. Previously, in some
  cases, existing mappings would be incorrectly deleted.

• Restore loading lifecycle configuration from files and add a message to
  admins to remove config files to delete. The previous change was introduced
  to allow lifecycles to be deleted, but it also impacted loading new lifecycle
  configurations from files, like when installing an extension. Now admins will be
  warned on delete if a lifecycle is being loaded from a file on disk.

Additional Updates

• On the queue admin page, warn if queue addresses are the same as a user address
• In the reports menu, retain the desired order when adding reports
• Prevent Show/Hide "quoted text"/"full description" click events from propagating
• Tweak lifecycle delete button text to make it more clear it deletes the lifecycle
• Document db configs and also the merge behavior of hash configs
• Correct POD warnings in Config docs
• Avoid reloading configs multiple times on configuration content update
• Remove duplicate CLI options
• Do not cast as decimal if using "LIKE" operator for numeric custom fields
• Update the attribute of CustomFieldView to be the same as CustomField

A complete changelog is available from git by running:
git log rt-5.0.6..rt-5.0.7
or visiting
rt-5.0.6...rt-5.0.7