LoginSign Up
← Back to all sparks
H

Hi.Events

E-COMM
Velocity6.3

Self-hosted event management and ticketing platform

hi.events ↗

Hi.Events 2.0 rc.3 adds paid Enterprise features: reserved seating and a box office.

event-ticketingopen-coreself-hostedbox-officesecurity-patch
◆Current state
Hi.Events v2.0.0-rc.3 adds reserved seating with a visual seat-map designer and a browser-based box office with Stripe Terminal card readers, both marked Enterprise and requiring a licence in production. It also adds a per-product purchases view, refunds on manual orders and grouped ticket emails. On 1.x, v1.11.3 refuses to run while the example JWT_SECRET that earlier versions shipped is still configured, since anyone could forge sessions with it, and v1.11.2 rebuilt on patched PHP.
◆Where it's heading
The 2.0 cycle has gone from structural changes (recurring occurrences, embedded checkout, an API) to venue-grade features, and now to an open-core split between free self-hosting and licensed Enterprise features. The 1.x line is in security-only mode, with users pushed toward 2.0.
◆Prediction
Expect a 2.0.0 final soon after rc.3, with the Enterprise licence terms spelled out, and 1.x limited to security fixes.

◆Recent moves

  1. 5d ago

    v1.11.3: blocks the forgeable example JWT secret

    A security release for installs staying on 1.x: the backend now returns 503 while the shipped example JWT_SECRET is in use, because it let anyone forge logins, and check-in no longer accepts or names tickets from other events. It shows 1.x getting fixes only, while 2.0 gets the features.

    View source ↗
  2. 5d ago

    2.0 rc.3: reserved seating and box office (Enterprise)

    ⚡ SPARK

    After rc.1's structural break and rc.2's fill-in, rc.3 adds the features venues pay for, and puts them behind an Enterprise licence. It is the moment the 2.0 platform takes on an open-core business model.

    View source ↗
  3. 7d ago

    v1.11.2: rebuild on patched PHP for two CVEs

    A rebuild of 1.11.1 on patched PHP for CVE-2026-109618 and CVE-2026-109619, with no application changes.

    View source ↗
  4. 27d ago

    2.0 rc.2: per-date tickets, tier sequencing, AI moderation

    Adds per-date ticket quantities for recurring events, sequential tier release, AI event moderation and a GDPR cookie banner. It fills in the recurring-event model rc.1 introduced and adds tools for running a hosted service.

    View source ↗
  5. 2mo ago

    2.0 rc.1: recurring events, embedded checkout and a REST API

    ⚡ SPARK

    rc.1 is the break between the 1.x ticketing tool and the 2.0 platform: events become occurrences, checkout moves onto organisers' own sites, and a public API opens the data. Every later release in the series builds on this model.

    View source ↗
  6. 2mo ago

    1.11.1: webhook SSRF and export injection fixes

    A security release that re-validates webhook targets on every redirect, writes buyer-supplied export values as text, and closes an order-completion race. It's the hardening that preceded opening up the 2.0 API and embedded checkout.

    View source ↗