Cerb (11.1.11) is a maintenance update released on September 13, 2026. It includes 9 minor features, fixes, and security patches from community feedback covering the 11.1 update. You can follow these instructions to upgrade.

Changelog

Added

[Data Queries/Tickets] In worklist.subtotals data queries, of:ticket now supports by:sender.first and by:sender.last. These keys were suggested by autocompletion but returned an "Unknown by: field" error.

Fixed

[Data Queries] Fixed an issue with worklist.subtotals data queries when grouping time-series data by @quarter or @quarterofyear against a 'date' custom field.
[Mailboxes] Fixed an issue with mailboxes where consecutive failure counts could exceed the field range of (0-127).

Security

[Security/Dependencies] Upgraded guzzlehttp/guzzle to 7.15.3 in response to a security advisory.
[Security/Dependencies] Upgraded smarty/smarty to 4.5.7 in response to a security advisory.
[Security/Dependencies] Upgraded league/commonmark to 2.10.0 in response to a security advisory.
[OAuth Apps/Security] The OAuth2 authorization flow now returns to the hostname in APP_HOSTNAME after a worker signs in or grants consent. On instances where the server sees a different hostname than workers browse, clients no longer get bounced to that other address partway through the flow.
[OAuth/Security] OAuth2 consent is now bound to the app and scopes it was granted for. An approval left behind by an abandoned authorization flow can no longer approve a different app in the same browser session.
[Support Center/Security] Confirmation codes for password recovery, registration, and adding an email address now expire in sync with the rate-limit window. Thanks to kta1kri for the report.