Releasing pretalx v2026.2.0

We're happy to announce pretalx v2026.2.0!

As always, users of pretalx.com don't need to take any action: You're always using the latest pretalx version. Administrators of self-hosted instances and developers of pretalx customizations and plugins should check the detailed release notes for any relevant changes. This release also contains several security fixes, so we strongly encourage administrators of self-hosted instances to upgrade (see below).

Thanks go to the pretalx community for their contributions to this release: to everyone who reported issues, translated strings, sent pull requests, and kept telling us about the features they needed. This was a shorter release cycle than the last one, but there's still plenty to talk about.

Session sign-ups

Some sessions have limited space: hands-on workshops, mentoring rounds, guided tours, a shared dinner. Until now, organisers had to reach for external tools or manual sign-up sheets. No more: you can now mark a session as requiring sign-up and give it a capacity. Attendees reserve their seat right from the session page with a single click, and add the session directly to their calendar. The list of attendees is shown to the session's speakers as well as to the organisers, so everyone knows who to expect.

Print any table

The organiser area is full of tables (and in truth, the tool most people use before switching to pretalx is either Excel or Google Sheets). Proposals, speakers, reviews, feedback: there is so much data, and sometimes you just need it on paper. You might want a check-in sheet for the front desk, a room list for a volunteer, a list of speakers with dietary restrictions for the caterer.

Every table in the organiser backend now has a Print button. It respects your current column selection and filters, and it turns pagination off for the print view, so the printed document contains all of your data, laid out exactly the way you set the table up on screen. (You can even change your column selection just for the printed version.)

A smarter colour picker

Picking event colours that stay legible can be fiddly. Organising an event is a lot of work on a hundred small different things at once, so it's no surprise that important matters like accessibility sometimes are forgotten. The new pretalx colour picker now checks your chosen colours against light and dark backgrounds, highlights the suitable colour range directly in the picker, and shows a live preview of your colour with text on a light and a dark background. (And of course, the random colour suggested to you when you create a new track is also chosen to fall inside accessibility ranges.)

This is part of a broader accessibility pass this release: we improved colours and contrast on badge elements and added several invisible improvements that make pretalx easier to navigate for screen readers.

Other Features

As always, there are a lot of smaller quality-of-life improvements worth mentioning:

• API v2 is here. As promised when we set up the new versioned API scheme, we will increase API versions often, and for tightly scoped changes. You can upgrade your API tokens to use the new version, or test it out first. As the new API has been received well, we're happy to note that the legacy API (used by tokens created before v2025.1.0) will be removed in the next release.
• Editable API token scopes: You can now change which events an API token applies to after creating it, and you can set a token to cover all events you have access to, including events you haven't created yet, so you no longer have to rotate your tokens every time you set up a new event.
• A safety net before sending emails immediately: Sending emails directly (skipping the outbox) now asks for an extra confirmation that restates how many emails are about to go out, since those can't be reviewed or recalled.
• Tidier navigation: The "My proposals" link is now only shown to users who actually have a proposal (including drafts) for the event, so attendees without submissions aren't sent to an empty page.
• Password managers can now reliably associate your account's email with the new password when you set one via a reset or speaker-invite link.
• Friendlier error pages: Error pages now offer a link back into the event and keep the event's custom styling, so branded events stay on-brand even on a 404.
• Schedule widget polish: The embedded widget now shows the session language in the session popup (for multi-language events) and renders titles, tracks, rooms and language names in the locale it was configured with.

And a lot more – the full list is in the changelog.

Security fixes

This release fixes several security issues. None have been exploited in the wild to our knowledge, but we strongly encourage administrators of self-hosted instances to upgrade. pretalx.com users are already running the fixed version, including fixes for

• A stored XSS exploit in the Markdown preview of a proposal (CVE pending, an open attack vector for submitters targeting organisers),
• More cross-site scripting issues in a custom field's help text in the CfP editor, and in an organiser email address shown in the CfP settings (only open for organisers targeting other organisers),
• A rate-limit bypass on login and registration via a spoofed X-Forwarded-For header,
• An API token restricted to specific events could still read and modify organiser-wide team data for other events of the same organiser; such tokens are now refused on organiser-level endpoints, and
• File uploads and proposal attachments are now restricted to a safe set of file types.

Given the rapid growth in AI-based security research, we (like many other open source projects) have been dealing with a lot of reports in the past months, and we urge administrators of self-hosted pretalx instance to update their pretalx instance and to carefully read our release notes (which include updates to recommendations on web server settings). We thank the security researchers at Aikido Security (aikido.dev) for their detailed and substantiated report.

Upcoming

We're continuing to make pretalx a better home for speakers across events: support for different speaker name schemes (first/last, titles, and so on) and speaker roles are both still on the roadmap for later in 2026. We're also planning to improve our permission system, which has long been too simple for the needs of larger events.

To get updates on pretalx, follow us on Mastodon, LinkedIn, or Twitter. If you'd like to contribute or commission features, get in touch.