Release 4.3.5

23.10.2026

Stored cross-site scripting in Kudos and file uploads – user content could run as script in another user’s browser; it is now rendered safely
Content Security Policy for the application – the single-page application now sends Content-Security-Policy, X-Content-Type-Options, X-Frame-Options and Referrer-Policy headers
Single sign-on hardening – OAuth, OpenID Connect and SAML integrations validate tokens, signatures and identities more strictly (SSO is disabled by default)
Stricter validation of report fields – field definitions are checked against an allowlist before saving, as defense-in-depth follow-up to [GHSA-2x7c-c259-w6wg]

Elasticsearch administration – new screen to configure and manage Elasticsearch
System Settings – available in the new interface, including the system logo
Language Packs – lists installed packs and lets administrators change the default system language
Schedulers – moved to the new interface; view job status and intervals, create and edit function-based and class-based jobs
Accessible field descriptions – aria-label, aria-description and name attributes generated for fields in all modules, supporting WCAG compliance
Interface updates – “Edit details” renamed to “Edit”; the “Standard” group type removed
Faster employee photos – served as cached WebP thumbnails, so lists such as the Kudos recipient picker load faster

Module switcher ignored spaces – modules with multi-word names could not be found in “Find module”
Terms of Employment record did not open – a record without an end date returned an Internal Server Error
Masquerade did not work for some roles – e.g. General Recruitment
Markdown field – now supports dark mode and uses normal line spacing