LoginSign Up
← Back to all sparks
O

OpenCATS

HR
Velocity6.3

Open-source applicant tracking system (ATS)

www.opencats.org ↗

OpenCATS ships PHP 8.4/8.5 compatibility, utf8mb4 migration, and country support in its most significant release in years.

atsphp8security-hardeningopen-sourcehr-recruiting
◆Current state
OpenCATS delivered two major releases in quick succession: v0.11.0 brought the long-deferred PHP 8 compatibility overhaul, utf8mb4 database migration, full country support across candidates/contacts/companies/job orders, CAPTCHA for career portal applications, and the replacement of the old Google ZIP lookup with OpenStreetMap Nominatim. v0.11.1 followed with a focused security hardening pass — SQL input validation, CSV import field mapping, mass-import file handling — plus Career Portal fixes and expanded contributor documentation.
◆Where it's heading
OpenCATS is undergoing a systematic modernization of its technical foundation: InnoDB migration (v0.10.0), PHP 8 + utf8mb4 (v0.11.0), security hardening (v0.11.1). The project is not adding net-new capability so much as making what exists maintainable and secure enough to run in modern environments. The expanded contributing documentation and automated legacy database testing signal that maintainers are investing in the contributor pipeline.
◆Prediction
After the modernization sprint, the next likely move is a modern email/rich text editor replacement (CKEditor 4 was pinned at the final open-source release as a placeholder) and further security audit work on endpoints that haven't been touched since the v0.9 era.

◆Recent moves

  1. 12d ago

    OpenCATS v0.11.1

    v0.11.1 is a focused security and quality pass: CSV import field validation, mass-import file deletion hardening, candidate merge SQL injection fixes, installer timezone input validation, and advanced search output escaping — all targeted at closing specific attack surfaces without adding functionality.

    View source ↗
  2. 19d ago

    OpenCATS v0.11.0

    ⚡ SPARK

    v0.11.0 delivered the foundational modernization OpenCATS needed: PHP 8.4/8.5 compatibility, utf8mb4 migration, country fields across all record types, OpenStreetMap geocoding, CAPTCHA for career portal, Candidate Declined pipeline status, and CSRF protection — turning an aging PHP 5-era system into something safely runnable on current infrastructure.

    View source ↗
  3. 2mo ago

    OpenCATS v0.10.0

    ⚡ SPARK

    v0.10.0 landed the security and architecture foundations for the v0.11 work: CSRF protection for state-changing requests, XSS hardening, InnoDB migration, password storage switched to password_hash(), baseline security headers, and a substantially revamped activity system — the largest single-version commit count in the project's recent history.

    View source ↗
  4. 2y ago

    v 0.9.7.4 Bugfixes and Security fixes

    v0.9.7.4 is a maintenance release from April 2024 — dependency updates, a cookie SameSite/HttpOnly flag, and minor file utility fixes while the PHP 8 work was in progress.

    View source ↗
  5. 2y ago

    0.9.7.3: RussH patch cookies (#641)

    v0.9.7.3 added SameSite and HttpOnly cookie options to session configuration — a minor security hardening that preceded the larger v0.10.0 security work.

    View source ↗
  6. 2y ago

    Security release v0.9.7.2

    v0.9.7.2 applied controls to internal pages to restrict authenticated XSS vulnerabilities — an early security patch that predates the systematic hardening in v0.10.0.

    View source ↗