What Happened
Quarto 1.11 was released early with Deno 2.9.8, which rejects certificate chains containing compromised eMudhra and emSign keys. The fix will not be backported to Quarto 1.10; version 1.10.20 is its final patch. Quarto 1.11 requires macOS 12 or later [1].
The release also improves keyboard and screen-reader navigation, focus visibility, and presentation controls. It preserves alt text for Mermaid and Graphviz diagrams and adds figure alt-text support in Word output. Typst gains lists of figures and tables, theorem-style frames, and cross-references. Julia execution gains directory and notebook-retention options, alongside caching fixes. Metadata fixes cover website previews and Google Scholar citations [1].
Why It Matters to Businesses
Teams using Quarto for reports, documentation, or published analysis should treat this as a security-driven upgrade, not just a formatting release. The accessibility changes can reduce barriers for readers, but they do not replace testing the rendered output. Citation and preview-metadata fixes also matter when published material must be discoverable and correctly attributed [1].
These notes establish a Quarto release, not new releases for Posit, Streamlit, Jupyter, Shiny, Gradio, Chainlit, Modal, or Replicate. Those tools may sit elsewhere in the same application stack, but their versions and changes should be evaluated separately.
Kimbodo Engineering Perspective
Quarto is a strong fit for reproducible, reviewable publishing; it is not a substitute for an interactive application. We would choose Streamlit, Shiny, Gradio, or Chainlit according to the interaction and workflow required, then decide separately whether services such as Modal or Replicate belong behind the application. Keeping publishing, user interaction, and model execution as distinct concerns makes upgrades and security reviews easier to manage.
The main trade-off in Quarto 1.11 is upgrade urgency versus compatibility: teams need the certificate fix, but must check macOS support and any custom HTML themes that use Bootstrap focus-ring or button-focus variables. Quarto now uses its own focus-ring variables for custom themes [1].
How We Would Implement It
- Inventory Quarto versions across developer machines, CI, and publishing jobs; identify hosts below macOS 12 and plan their replacement or migration [1].
- Upgrade a test pipeline to Quarto 1.11 and render representative HTML, Word, Typst, and Julia-backed documents before promoting the change [1].
- Test keyboard focus, screen-reader navigation, diagram alt text, citations, and social preview metadata in the rendered artifacts—not just in source files [1].
- Keep Jupyter notebooks and interactive apps in their existing workflows where appropriate, with Quarto consuming reviewed outputs for publication rather than silently changing application runtimes.
Risks, Costs and Security
Remaining on Quarto 1.10 means missing the Deno certificate-chain fix because it will not be backported. Upgrading may require macOS changes, theme adjustments, and regression testing for document formats and Julia caching. Budget for those checks, especially where reports are customer-facing or subject to accessibility requirements [1].
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our AI Application Development practice, or Estimate My AI Application.
Sources
- [1] Quarto 1.11
