Cerb

11.1.9

Wed, 13 May 2026 07:00:00 +0000

Cerb (11.1.9) is a maintenance update released on May 13, 2026. It includes 11 minor features and fixes from community feedback covering the 11.1 update. You can follow these instructions to upgrade.

Changelog

Changed

[Records/Logs/Mailboxes] Mailbox creation is now recorded in the activity log.
[Profiles/Widgets] Added support for manually specifying a ticket ID in the 'Ticket Conversation' profile widget, with fallback to auto-detection for tickets, drafts, and messages.
[Profiles/Tickets] Added the Cc: header to forwarded messages when replying to tickets.
[Mail/UX] Included Bcc: headers in outgoing email headers for SMTP and null mail transports.
[Worklists/UX] Improved row selection behavior with text selection handling in worklists. It's now possible to select and copy text again.

Fixed

[Records/Roles/UX] Workers without the comment create permission on a record type no longer see the 'Comment' button on profile pages. [#1020]
[Workflows/Builder] Fixed an issue in the workflow builder where a KATA parse error (e.g. having both version: and version@date: as sibling keys) silently produced an empty workflow template. [#1873]

Security

[Security] Hardened the random number generator used for security-sensitive secrets. CerberusApplication::generatePassword() and _DevblocksMultiFactorAuthService::generateMultiFactorOtpSeed() now use random_int() (CSPRNG-backed) instead of mt_rand() + str_shuffle(). This affects the session CSRF token, password recovery codes, worker invitation codes, support center contact recovery/captcha codes/password salts, and TOTP/MFA shared secrets.
[Security] Equalized response timing on the worker login form to mitigate user enumeration. Previously, when the submitted email didn't match a worker, the request short-circuited before any bcrypt work — letting an attacker time the response to learn whether an email is registered. The "no such worker" branch now runs password_verify($password, $dummy_hash) against a precomputed PASSWORD_DEFAULT bcrypt hash before redirecting, so the response time matches the "wrong password" path. The hash's plaintext is random and discarded, so the verify always returns false. Empty email/password still fails fast (not an enumeration vector).
[Security] Replaced the legacy == password-hash comparison in DAO_Worker::login() with hash_equals(). The modern (method=1) path already uses constant-time password_verify(); this closes the last byte-by-byte string compare on the legacy SHA1(salt+MD5) path that pre-9.4 worker auth hashes use until they auto-upgrade on next successful login.
[Security] Improved validation in the Support Center history view.

11.1.8

Thu, 16 Apr 2026 07:00:00 +0000

Cerb (11.1.8) is a maintenance update released on April 16, 2026. It includes 6 minor features and fixes from community feedback covering the 11.1 update. You can follow these instructions to upgrade.

Changelog

Changed

[Automations/Behaviors] On events where automations and legacy bot behaviors are both triggered, automations with priorities 0-127 run before behaviors, and automations with priorities 128-255 run after behaviors. Previously automations always ran first. This affects the events: mail.received, mail.sent, and record.viewed.
[Performance/Worklists/Export] Optimized bulk-loading of custom fields in worklist exports for better performance.
[Profiles/UX] Added a more description 'Access Denied' error to profile pages when a worker lacks permission to view a record.

Fixed

[Devblocks/Platform] Suppressed repeated errors within a single request in the error handler.

Security

[Security/Dependencies] In response to security advisories, updated robrichards/xmlseclibs to 3.1.5+, phpseclib to 3.0.50+, and league/commonmark to 2.8.2+.
[Security/Dependencies] In response to a security advisory, updated phpseclib to 3.0.51+.

11.1.7

Fri, 06 Mar 2026 07:00:00 +0000

Cerb (11.1.7) is a maintenance update released on March 06, 2026. It includes 14 minor features and fixes from community feedback covering the 11.1 update. You can follow these instructions to upgrade.

Changelog

Added

[Automations/Scripting] Added an |xml_encode(format) filter to automation scripting. This converts dictionaries and arrays to XML format. Special @tag and @attributes keys allow for redundant XML tag names and attribute key/value pairs.

Changed

[Records/Search] Improved autocompletion for record search queries on card widgets, connected services, and profile widgets.
[Mail/Routing] In mail routing KATA, the 'body' filter can match linefeed characters with wildcards. Previously this only matched the first line.
[Records/Messages] On message worklists, the id column is now available for display and sorting.
[Records/Orgs] In organization record dictionaries, added the aliases field to make that data available to functionality like sheets and automations.
[Sheets] In sheets, added the ability to disable link underlines on interaction columns.
[Automations/LLM] Updated the LLM model autocompletion for modern AWS Bedrock and Anthropic models in llm.agent: and llm.chat: commands.

Fixed

[Automations/LLM] In the llm.agent automation command, fixed an issue with models that invoke multiple tools in parallel (Claude Sonnet 4.6).
[Automations/LLM] In the llm.agent and llm.chat automation commands, increased the maximum length of the system prompt parameter. Previously this could be truncated.
[Snippets/UX] Fixed an issue with inserting placeholders in the snippet editor. They were always being inserted at the beginning of the content rather than at the cursor.
[Snippets/UX] Fixed an issue where multiple snippet editors couldn't be previewed at the same time.
[Sheets] Fixed an issue in slider sheet columns when the min: and max: produce a zero-length range.

Security

[Security/Dependencies] Upgraded the phpunit library to v9.6.33 in response to a security advisory. This would have not affected production instances, as they don't include development-only dependencies.
[Composer/Dependencies] Updated thephpleague/commonmark to v2.8.1 in response to a security advisory.

11.1.6

Fri, 09 Jan 2026 07:00:00 +0000

Cerb (11.1.6) is a maintenance update released on January 09, 2026. It includes 11 minor features and fixes from community feedback covering the 11.1 update. You can follow these instructions to upgrade.

Changelog

Added

[LLM/Agents] In the OpenAI LLM provider, the reasoning_effort parameter for reasoning models may now be set to: none, low, medium, high, xhigh.
[LLM/Agents] In the Gemini LLM provider, the thinking_level parameter for reasoning models may now be set to: minimal, low, medium, high.
[LLM/Agents] In the Gemini LLM provider, the thinking_include parameter may be enabled to return thinking content.

Changed

[Search/Fulltext] Added a APP_OPT_FULLTEXT_ALLOW_WILDCARDS option to allow wildcards in fulltext search terms. Since 10.4 this is disabled by default for comments and messages.
[Developers/Database/Schema] Added the llm_agent_session and llm_agent_message tables to the database schema reference.
[LLM/Agents] In the Anthropic LLM provider, updated the list of available models.
[LLM/Agents] In the AWS Bedrock LLM provider, updated the list of available models.
[LLM/Agents] In the Gemini LLM provider, updated the list of available models.
[LLM/Agents] In the OpenAI LLM provider, updated the list of available models.
[Records/Comments/UX] On record profiles, comments now display the 'Date:' header consistent with email messages with an absolute and relative date. Previously this was only a relative date.
[Records/Drafts] On draft records, an org_id can be provided instead of org_name when there are duplicates.

11.1.5

Tue, 30 Sep 2025 07:00:00 +0000

Cerb (11.1.5) is a maintenance update released on September 30, 2025. It includes 14 minor features and fixes from community feedback covering the 11.1 update. You can follow these instructions to upgrade.

Changelog

Added

[Mail/HTML/Images] Added an image external URL allowlist to HTML email message security. When a pattern matches an image is displayed by default while others remain blocked.

Changed

[Platform/Stats/Performance] When comparing vectors, cosine similarity now uses pure PHP rather than bcmath since the latter is much slower.

Fixed

[Records/Validation] Fixed an issue where validating a set of email addresses uppercased them rather than lowercasing. This was only used in the cerb.email.relay automation API command.
[Automations/Email/Relay] Fixed an issue in the cerb.email.relay automation API command that prevented relayed messages from sending.
[Email] Fixed a PHP notice in the 'Re:' subject line tagging for non-reply message types (e.g. transactional).
[Mail/Comments] Fixed a rendering issue with comments in ticket threads. Comments are now converted from Markdown to HTML as untrusted and partial tags are escaped.
[Mail/HTML] Fixed an issue in sent HTML messages. The de-duplication SHA-1 content was not being saved, which impacted the ability to download those files from the Support Center. [#1820]
[Portals/Support Center] In the Support Center, when displaying a conversation, attachments without an SHA-1 content hash are omitted as download links.
[Worklists/Behaviors] Fixed an issue with "Record worklist rendered" behaviors where modified worklists didn't contain a notice and links back to the behaviors.
[Mail/Parser] Fixed an issue in the inbound email parser when a message contains multiple 'Message-Id:' headers.
[Mail/Parser] Fixed an issue in the inbound email parser when a message contains multiple 'In-Reply-To:' or 'References:' headers.
[Resources] Added more error reporting when uploading resource files larger than the configured limits.
[Widgets/Charts] In 'Chart KATA' widgets, fixed an issue where tooltips didn't display for negative y-values.

Security

[Security/Composer] Updated the enshrined/svg-sanitize dependency from 0.15.4 to 0.22.0 in response to a security advisory.

11.1.4

Mon, 04 Aug 2025 07:00:00 +0000

Cerb (11.1.4) is a maintenance update released on August 04, 2025. It includes 11 minor features and fixes from community feedback covering the 11.1 update. You can follow these instructions to upgrade.

Changelog

Changed

[Records/Snippet] Snippet dictionaries now include a prompts key with structured data on the defined placeholder prompts.
[Email/SMTP] In the SMTP mail transport, added support for the 'PLAIN' authenticator in addition to 'LOGIN' and 'XOAUTH2'.

Fixed

[Worklists/Search] Fixed an issue with search query optimization (APP_OPT_SQL_SUBQUERY_TO_IDS) on record filters where 0 is a valid value (e.g. worker.id:). Empty result sets were converted to a zero value which unexpectedly matched unlinked records.
[Worklists/Search] Fixed an issue with APP_OPT_SQL_SUBQUERY_TO_IDS query optimization with negated filters.
[Records/Merge] Fixed a display issue when merging records with 'Decimal' custom fields. The fields displayed without a floating point indicator.
[Records/Merge] Fixed an issue with merging currency and decimal custom fields.
[KATA/Automations] Fixed an issue in KATA parsing when using the @kata annotation. The value now properly evaluates its own annotations and placeholders.
[Email/HTML] Fixed an issue with secure links in HTML email messages where the content was wrapped in an inline-block which added scroll bars to elements like code blocks. Thanks to KnownHost for the bug report!
[Email/Automations/UX] Fixed an issue where 'Re:' was prepended to the subject of ticket.reply drafts created on empty tickets. The 'Re:' tag is only added if a conversation has at least one message and the subject line doesn't already contain 'Re:'.
[Email/UX] Fixed an issue in plaintext email messages where the 'Expand quoted text' button didn't display the quoted text in some situations.
[Database/Update] Fixed several issues with database migrations from 9.x versions. Thanks to Sn0wCrack for the contribution!

11.1.3

Tue, 17 Jun 2025 19:00:00 +0000

Cerb (11.1.3) is a maintenance update released on June 17, 2025. It includes 9 minor features and fixes from community feedback covering the 11.1 update. You can follow these instructions to upgrade.

Changelog

Added

[Automations/LLMs] In automations, added a new llm.chat: command for single-turn chat completions without transcripts, memory, or tools. For instance, this is useful for text classification or summarization tasks.
[Connected Services/Packages] In the package library, added a connected service for Google Gemini. This prompts for an API key to access AI APIs.
[Platform/LLMs] Added a 'docker' LLM provider. This uses local model containers in Docker Model Runner.
[Platform/LLMs] Added a gemini LLM provider. This uses Google's Gemini AI models.
[Records/Card Widgets] On card widget worklists, added a filter for record: type.

Changed

[Profiles/Widgets] On profile widgets, added more practical examples for the hidden@bool: option.
[Plugins/UX] Updated several plugin icons for consistent styling.

Fixed

[Toolbars/Interactions] Fixed an issue on draft.read toolbars where interactions didn't trigger the common actions upon completion (e.g. alert, clipboard, search, snippet).
[Toolbars/Interactions] Fixed an issue on mail.read toolbars where interactions didn't trigger the common actions upon completion (e.g. alert, clipboard, search, snippet).

11.1.2

Sat, 31 May 2025 19:00:00 +0000

Cerb (11.1.2) is a maintenance update released on May 31, 2025. It includes 12 minor features and fixes from community feedback covering the 11.1 update. You can follow these instructions to upgrade.

Changelog

Added

[Automations/LLM] In automations, the llm.agent: command can now conditionally disable individual tools:. This allows per-worker tool permissions and dynamic tool selection based on context.
[Data Queries] Added a new record.filters data query type for returning data about the available search filters on a given record type.
[Messages/Search] On message records, the X-Cerberus-Mailbox email header is now indexed for searching with the new header.cerbMailbox: filter. This improves reporting by inbound mailbox.

Changed

[Automations/LLM] In the llm.agent: automation command, added Anthropic Claude 4 models to anthropic and aws_bedrock.
[Automations/LLM] In automations, the llm.agent: command now includes the updated model list for the OpenAI LLM provider.
[Records/Merge/UX] When merging records from a worklist or profile, an error message is displayed earlier when a worker doesn't have write permission on all records involved. Previously, this error message was displayed after time was wasted configuring the merge field mapping.
[Automations/Scripting] In automation scripting, added an autocompletion example for using a comparator function in the |sort filter.
[Automations/LLM/UX] In automations, the llm.agent: command now autocompletes the full inputs:messages: node.

Fixed

[Search/Interactions] In the search menu, global.search toolbar worker interactions now properly run return actions (e.g. alert:, search:).
[Automations/LLM] On llm.tool automations, the return:content: key is now properly suggested in autocompletion.
[Reminders] On reminder records, fixed the worker: search filter. This wasn't filtering based on worker fields.
[Automations/LLM] In automations, fixed an issue with the llm.agent: command when a tool had no arguments. This affected Anthropic and Ollama model providers.

11.1.1

Fri, 09 May 2025 07:00:00 +0000

Cerb (11.1.1) is a maintenance update released on May 09, 2025. It includes 11 minor features and fixes from community feedback covering the 11.1 update. You can follow these instructions to upgrade.

Changelog

Added

[Automations/Scripting] Added |qp_encode and |qp_decode filters to automation scripting for encoding and decoding quoted-printable. This is particularly useful when creating tickets using email.parse:.
[Mail/POP3] Added full support for XOAUTH2 authentication on POP3 mailboxes.
[Interactions/Worker/Editor] In interaction.worker automations, editor: form elements with Markdown syntax can now optionally enable pasting images from the clipboard. This automatically uploads images and pastes an internal URL. The URLs can be post-processed to access the underlying automation resources by token. Thanks to ChargeOver for the feature request!

Changed

[Workflows] In the cerb.auto_responder workflow, added a new "Save a copy of the auto-reply on the ticket" option. This defaults to enabled but can be disabled to send auto-replies without saving a copy in the ticket conversation.
[Setup/Mail/Import] In Setup » Mail » Incoming » Import, added a new example message source for 'Quoted-printable with emoji.'

Fixed

[Behaviors/Mail] Fixed an issue in bot behaviors using the 'Send email to recipients' action. In most cases this worked fine by inheriting the 'Participants' list from the ticket when the draft was sent. However, in some environments, automations on the 'mail.send' event could modify the 'To:' header and the original participants would no longer be included as expected. The participants are now added to the draft when it is created rather than when it is sent.
[Mail] Fixed an obscure threading issue with tickets created from an automation where the first message was a ticket.reply draft.
[Mail/UI] Fixed an issue in email and comments with formatting where Markdown headings used the Cerb stylesheet. These are now properly reset.
[Automations/UI] Fixed an issue on the /ui/image/ endpoint for previewing automation resource images. An error was returned for images between 512KB and 1MB, or less than 1MB with dimensions greater than 1000x1000.

Security

[Security/Dependencies] Updated the league/commonmark library from 2.6.x to 2.7.0 based on a vulnerability advisory.
[Portals/Support Center/Security] In the legacy Support Center portal, added a URL whitelist for external images. Previously, these images were being blocked by the Content-Security-Policy. For instance, logo images, knowledgebase article images, CDNs, etc.

11.1

Thu, 24 Apr 2025 19:00:00 +0000

Cerb (11.1) is a feature upgrade released on April 24, 2025. It includes more than 41 new features and improvements from community feedback.

Important Release Notes
- Added
- Changed

To check if you qualify for this release as a free update, view Setup » Configure » License. If your software updates expire on or after March 31, 2025 then you can upgrade without renewing your license. Cerb Cloud subscribers will be upgraded automatically.

Important Release Notes

Always make a backup before upgrading!
Cerb 11.1 requires PHP 8.2+ and MySQL 8.0+ (or MariaDB 10.5+).
To upgrade your installation, follow these instructions.

Added

[Automations/LLM] In automations, added an llm.agent: command to simplify integrations with generative large language models (LLMs). The agent automatically manages history and tool use. Tools can be created using llm.tool automations with automatic documentation based on inputs:. The llm.agent: command will automatically invoke tools and return their output to the model. Integration is included for Anthropic, AWS Bedrock, OpenAI, Groq, Ollama, and Together.ai.
[Automations/LLM] In the llm.agent: automation command, non-automation tools: can be defined as type tool: with a description and parameters. When these tools are used by a model, the on_tool: event is triggered with custom logic and a __tool placeholder object with keys id, name, and parameters. A result must be returned using the tool.return: command. For example, this can use await:interaction: to delegate to any interaction, or to implement "human in the loop" manual approval workflows.
[Automations/LLM] In automations, the llm.agent: command now returns a session_id to its output key. This can be used with the llmTranscript form element to render the chat history.
[Automations/LLM] In automations, refactored the llm.agent: command so all tool use (including automations) executes the on_tool: branch. The same __tool placeholders are available as for custom tools. This allows real-time updates to be returned to the user during tool use; resetting the 30-second HTTP request time limit. Long-running deep research is now possible.
[Automations/LLM] Added an llm.tool automation trigger. A collection of these tools can be provided to an llm.agent: using a large language model (LLM) that supports function calling (tool use). The inputs of an llm.tool automation are used to automatically generate the JSON Schema expected by common models. For instance, tools can provide access to Cerb data or integrate with third party APIs.
[Interactions/Worker] In interaction.worker automations, added a new llmTranscript: form element. In two lines of code, this automatically handles rendering a chat history from an LLM session ID, with copy-to-clipboard, thumbs up/down ratings, etc. Previously, this had to be tediously implemented using a sheet element.
[Interactions/Worker] In interaction.worker automations, the llmTranscript: form element allows custom labels per tool. For instance, rather than Tool: docs_search the response can be "Searching documentation using 'query'". Tool use callouts are visually distinct from chat responses.
[Interactions/Website] In interaction.website automations, added a new llmTranscript: form element. In two lines of code, this automatically handles rendering a chat history from an LLM session ID, with copy-to-clipboard, thumbs up/down ratings, etc. Previously, this had to be tediously implemented using a sheet element.
[Interactions/Website] In interaction.website automations, the llmTranscript: form element allows custom labels per tool. For instance, rather than Tool: docs_search the response can be "Searching documentation using 'query'". Tool use callouts are visually distinct from chat responses.
[Devblocks/Platform/LLM] Added an LLM service to the Devblocks platform. This interfaces with Large Language Model APIs for generative text (e.g. Q&A, summarization, classification, report generation, email drafts).
[Platform/LLM/Ollama] Added an ollama provider to the LLM service. This can connect to locally hosted open-source large language models through the Ollama API.
[Platform/LLM/OpenAI] Added an openai provider to the LLM service. This can connect to hosted large language models through the OpenAI API (e.g. gpt-4o). A customizable api_endpoint_url also allows the use of other compatible services.
[Platform/LLM/OpenAI] In the llm.agent: automation command, llm:openai:api_endpoint_url: now includes an endpoint example for Docker Model Runner.
[Platform/LLM/Groq] Added a groq provider to the LLM service. This connects to fast, hosted, open-source large language models through the Groq API.
[Platform/LLM/Anthropic] Added an anthropic provider to the LLM service. This connects to hosted large language models through the Anthropic API (e.g. claude-3-5-sonnet-20241022).
[Platform/LLM/Bedrock] Added an aws_bedrock provider to the LLM service. This connects to hosted large language models through the Amazon Bedrock API (e.g. anthropic.claude-3-haiku-20240307-v1:0). This is ideal when hosting Cerb within AWS services since inference remains private within the same region.
[Platform/LLM/HuggingFace] Added a huggingface provider to the LLM service. This uses the Serverless Inference API by default, but Inference Endpoints are also supported.
[Platform/LLM/TogetherAI] Added a together provider to the LLM service. This uses the together.ai inference cloud service.
[Platform/LLM/Pinecone] Added a pinecone provider to the LLM service. This uses the Pinecone text embedding API.
[Platform/LLM/VoyageAI] Added a voyage provider to the LLM service. This uses the Voyage AI text embedding API.
[Automations/LLM] Added an llm.embed: command to automations. This uses LLM providers that support the 'Embedding' interface to produce vector embeddings for blocks of text (e.g. OpenAI, Ollama, Hugging Face). For instance, embedding knowledgebase articles and FAQs for semantic search.
[Automations/Inputs] In automations, each input can now set an optional description: key. This is used for documentation, autocompletion, and JSON Schema in LLM tool use.
[Automations/Inputs] In automations, text: inputs can now set an optional allowed_values: key to create picklists. This is used for documentation, autocompletion, and JSON Schema in LLM tool use.
[Devblocks/Platform/LLM] Added a 'DatabaseHistory' memory module to the LLM service for managing large language model chat history + context.
[Automations/LLM] In automations, llm.agent: transcripts are now viewable in Setup » Developers » LLM Agent Transcripts. Transcripts can be marked read or deleted. When an agent uses a tool, its parameters and results are shown in the transcript. This makes debugging and compliance much easier. It also provides valuable feedback for improving agents based on past user interactions.
[Automations/LLM] In LLM Transcripts, a 'Permalink' button provides a direct link for sharing transcripts.
[Automations/LLM] When viewing LLM agent chat transcripts, metadata is displayed at the top (e.g. provider, user, client IP, automation, and automation node).
[Automations/LLM] When viewing LLM agent chat transcripts, added a 'Copy' button to copy the plaintext (Markdown) content from a message to the browser clipboard.
[Interactions/Website] In interaction.website automations, submit: form elements can now specify the width size: of each button: whole, half, third, and quarter.
[Interactions/Website] In interaction.website automations, say: form elements can now specify several styles: options: text-center, text-large, text-left, text-right, or text-small.
[Worklists/Search/Performance] Improved the performance of many complex search queries by running some subqueries independently and merging by IDs. This is enabled by default and can be disabled from the APP_OPT_SQL_SUBQUERY_TO_IDS configuration option.
[Interactions/Website] In website interactions, the submit: form element has a new is_automatic@bool: option. When true, the form is automatically submitted after it is rendered. This is particularly useful before a time-intensive operation like LLM text generation, which will instantly transition to a waiting spinner.
[Interactions/Worker] In worker interactions, the submit: form element has a new is_automatic@bool: option. This is now preferred to await:duration: since it can render other form elements during the wait (e.g. say, sheet, LLM transcript).

Changed

[Portals/Interactions] In 'Website Interaction' portals and on external websites, interactions now start in 'full' mode and use a blur overlay on the underlying website. The previous 'popup' default style was difficult to see on some website themes.
[Worklists/Fieldsets] In worklists, improved the performance of the fieldset: filter.
[Interactions/Website] In interaction.website automations, the sheet: form element now applies styling to code blocks in markdown columns.
[Setup/Plugins] In the setup page, moved 'Plugins' from its own menu into the 'Configure' menu. This menu had a single item, and we can use the space for something else.
[Platform/Markdown] In Devblocks, changed the Markdown parsing library from Parsedown to League\CommonMark. Parsedown has some rendering issues and appears to have been abandoned since 2019.
[Interactions/Worker] In interaction.worker automations, continuing no longer hides the current step and only hides the submit button. The spinner is displayed in its place. This allows the auto-submit functionality to show progress messages.
[Portals/Website] In 'Website Interactions' portals, the popup now sets an explicit text color. Previously, this inherited from the website theme, which caused issues in dark mode.
[Workflows/Tutorial] Added a 'Contribute' section to the tutorial workflow 'Welcome' tab. This includes links to help promote Cerb.
[Mail/Outgoing] When sending email through an SMTP mail transport, the hostname of the server is now explicitly set. This is used for HELO/EHLO when connecting to an SMTP server. Previously, the default hostname was [127.0.0.1], which is increasingly blocked by email providers like Gmail proxies.