Release 2026.4.0 of pretix

Today, we are releasing pretix 2026.4.0. This release includes mostly maintenance work while we prepare new features behind the scenes.

Big thanks go out to CVZ-es, Hijiri Umemoto, Kian Cross, Mie Frydensbjerg, Nikolai, Renne Rocha, Ruud Hendrickx, Sandra Rial Pérez, Tim, and Yasunobu YesNo Kawaguchi, who contributed to this release. ❤️

pretix 2026.4.0 is now available for installation via pip. The new Docker images will appear on Docker Hub over the next few hours. All customers of pretix Hosted are already using the new version and do not need to take any action.

Smaller changes and bugfixes

Ticket shop and widget

• Waiting list: Product choices are now grouped by category.

• Widget: A bug preventing to click "Continue" in Mobile Safari has been fixed.

• Widget: The pretix button supports a new keep-cart parameter.

• A bug has been fixed that caused a session cookie to be generated on the first visit of the shop, leading to unnecessary storage space required for unused sessions.

• Customer account creation now imposes limits to length and valid contents of a name to combat simplistic spam signups.

• The customer account password reset form now opens in a new tab to prevent issues with the widget.

• PDF files, such as invoices and tickets, are no longer force-downloaded by the browser.

• Invoices no longer show information about payments that have already been canceled or have already failed.

Ticketing backend and configuration

• For newly created events, order confirmation emails are sent to attendees by default as soon as attendee email addresses are collected.

• When changing meta data values of an event, changes are now correctly logged and webhooks sent.

• When bulk-creating new dates in an event series, you can now opt to skip any date that would conflict with an existing date.

• When changing the products in an order, you can now add the same product multiple times in one go.

• The global navigation menu now allows searching for the custom domain name used for a shop instead of the event short form.

• When exporting a check-in list, the selection of lists is now sorted by date in an event series.

• The payment and refund exports now lists related invoice numbers.

• The mechanism that asks you if you really want to discard unsaved changes now properly works with dynamically added fields, such as when creating a new product variation.

• You can now configure invoices to include the total and tax value in Polish Złoty using the conversion rates published by the National Bank of Poland, as required by Polish VAT law.

• A new PDF variable "List of checked-in add-ons" has been added which is useful for certificates of attendance.

Updates to official plugins and tools

• The Computop plugin has been released in version 1.3.1 to rebrand iDEAL to "iDEAL | Wero".

• The Mollie plugin has been released in version 2.5.4 to implement API and exporter support for payment IDs.

• The Resellers plugin has been released in version 3.2.0 to convert the reporting feature into a regular export that can be scheduled.

• The eos.ticketingSuite KombiTicket plugin has been released in version 2.0.0 to support the new Third Party API service by eos as well with a new bundled plugin.

Runtime and server environment

• The default docker image is now based on Python 3.13.

• custom_smtp_allow_private_networks is now enforced at send time after the DNS lookup instead of only at config time, hardening the protection against circumvention through DNS rebinding.

• A protection against SSRF has been added and is on by default. If you require pretix to reach HTTP targets on the local network (such as for webhooks, payment APIs, etc.), set the new allow_http_to_private_networks=on config flag before updating.

Plugin API changes

• The BaseExporter class now exposes a permission_holder attribute with the user, token, or device running the export. All of them implement the new pretix.base.models.auth.PermissionHolder protocol.

REST API changes

• The APIs for gift cards and reusable media now perform a stricter permission check if you use the expand query parameter. If you are not allowed to see the expanded object, you will receive a nested object containing only the id field.

• When downloading invoices and tickets, an invalid character in the file name has been removed.