MidVision RapidDeploy

Release 5.2.3 – 2026-09-04

Type Changes By Fixed the REST endpoint that returns a job log (GET /ws/deployment/showlog/job/<id>), which failed with an HTTP 500 internal error on every request instead of returning the log. The endpoint passed the servlet layer a raw input stream, a form for which there has been no writer since the REST tier moved from JAX-RS to Spring MVC in 5.2.0; it now returns a streamed resource, so the log is sent without being buffered into memory. This endpoint is used by the rd command-line client to retrieve job logs. development Azure SDK identity library updated from azure-identity 1.18.3 to 1.18.6 (latest stable), picking up the interim patch releases. The Azure and Microsoft Teams task plugins use this library; msal4j is unchanged at 1.23.1 and azure-resourcemanager remains at 2.63.0, already the latest release. development Platform stack uplift to the current long-term supported line: Spring Framework 7.0 and Spring Security 7.1 (Spring Framework 6.2 reached end of open-source support in June 2026), Hibernate ORM 7.4 (Jakarta Persistence 3.2), bundled Apache Tomcat 11.0 (Jakarta Servlet 6.1) and springdoc-openapi 3.1 for the REST API documentation. The REST API wire format (XML and JSON), endpoint URLs and authentication are unchanged; the rd command-line client is unaffected. Upgrading is recommended for all installations to remain on security-supported framework versions. development Database dialect names updated for Hibernate ORM 7: installations configuring rapiddeploy.datasource.dialect for Oracle or SQL Server should use org.hibernate.dialect.OracleDialect and org.hibernate.dialect.SQLServerDialect (the versioned Oracle10gDialect / SQLServer2008Dialect / SQLServer2012Dialect names no longer exist). Embedded HSQLDB and DB2 dialect names are unchanged. development The repository persistence test suite was migrated from JUnit 4 to JUnit Jupiter with Spring's SpringExtension. development Security: job-log masking of command lines hardened. The "Running Local Script" / "Running OS Command" job-log lines that echo a command and its arguments are now masked at the point of logging, on every agent topology: values following password-like flags or keys (password, passwd, pwd, secret, token, credential, passphrase, API / access keys) are replaced by ******** in both the space-separated and inline (name=value, /name:value) forms, and registered data-dictionary secrets are scrubbed wherever else they appear in the line. Flags that reference a file or path location rather than the secret itself (e.g. a master password file) remain visible for diagnostics. The same masking now also covers the diagnostic (debug-level) lines that echo individual command arguments, the command environment and captured error output, so a secret supplied as a task argument or an environment variable is not written to the log by those paths either. Upgrading is recommended for all installations. development Security: hardened access control on the job-artifact download endpoints under /ws/streamer (deployment-package archives and environment-snapshot downloads), completing the hardening begun for the job-log endpoints. Downloading now requires an authenticated caller — a logged-in UI session or a WebServiceEncrypter API token — together with the appropriate authorisation: package downloads require the relevant per-project package permissions and snapshot downloads the snapshot-compare permission (the same permissions already enforced in the UI). Other requests are refused. The rd command-line client is unaffected. Upgrading is recommended for all installations. development Fixed broken images on the environment edit/promote title bar and the Extensions Manager page. Under PrimeFaces 12 / Faces 4, p:graphicImage with value="#{resource[...]}" doubles the context path in the rendered src (/MidVision/MidVision/...) because the resource EL already returns a context-relative URL and the PrimeFaces renderer prepends the context path again via ViewHandler.getResourceURL. All such usages now use the PrimeFaces resource attribute (name="app/images/...") instead; the same correction was applied to the #{themeFolder}/#{localeFolder}-based p:graphicImage usages in the (currently unreferenced) theme switcher and the ui:remove'd locale chooser so they are safe if re-enabled. The Playwright menu smoke test (MenuSmokeIT) now also fails on any image that was requested but did not load, catching this class of regression on every menu-reachable page. development Security: hardened access control on the job-log web-service endpoints (job and deployment logs under /ws/streamer). Retrieving a job log now requires an authenticated caller — a logged-in UI session or a WebServiceEncrypter API token — together with authorisation for the specific job (its owner, a super user, or a user holding the View/Download Job Logs permission for the job's project / environment-type); other requests are refused. The rd command-line client is unaffected. Upgrading is recommended for all installations. development Security: values logged from the process environment during job initialisation are now masked when the variable name indicates a secret (passwords, tokens, API / access keys, passphrases, private-key / PEM file paths), so such values are no longer written to job logs. Masking is by key name (KEY and PEM are matched only as whole words, so names such as KEYSTORE_PATH are unaffected); non-secret variables are logged unchanged. Where such a variable holds a file or directory location rather than a secret, the location is masked in that one line but is no longer treated as a value to scrub elsewhere, and the shell's own working-directory variables (PWD, OLDPWD) are not masked at all. Previously a directory value could hide every path beneath it, removing deployment artefact and script paths from the job log. Recommended for all installations. development The Web Services help page's browser-tab title read "About MidVision" (copy-pasted ui:define from about-midvision.xhtml); it now reads "Web Services Help". New Playwright regression test WebServicesHelpIT verifies the embedded Swagger UI iframe actually loads the RapidDeploy OpenAPI spec (not the webjar's petstore default or an error view) and renders at least one operation with no uncaught JS errors. development Removed the dead custom CheckboxRenderer (and its faces-config.xml registration for component-family jakarta.faces.SelectBoolean / renderer-type jakarta.faces.Checkbox). Nothing renders through it: every checkbox in the application is a PrimeFaces p:selectBooleanCheckbox (its own renderer type), there is no h:selectBooleanCheckbox in any view and no programmatic HtmlSelectBooleanCheckbox/UISelectBoolean creation. The class depended on non-API com.sun.faces renderkit internals and had to be re-ported on Mojarra upgrades (most recently for 4.0.22) purely to keep compiling. The custom FormRenderer remains - it is live for every h:form. development Security: Mojarra Faces implementation upgraded 4.0.5 to 4.0.22 for CVE-2026-46581 (CVSS 7.5) - DefaultFaceletFactory did not restrict absolute/remote Facelet URLs (path traversal / remote inclusion; fixed upstream in 4.0.22 and 4.1.13, released 2026-08-04). The custom CheckboxRenderer was ported to the reworked 4.0.22 renderkit internals: the renderSelectOnclick/behaviors-map overloads are gone, replaced by renderPassThruAttributes(context, writer, component, domElementId, incExec, attributes, domEvent, componentEvent) plus flushPendingBehaviorEventListeners; the listener binds to the visible checkbox element (clientId + "_checkbox") while the behavior postback source remains the component clientId, preserving pre-upgrade behaviour. A dependency-check suppression pinned to exactly 4.0.22 documents that NVD's applicability range (2.3.0 <= v <= 4.1.13, versionEndINCLUDING) wrongly sweeps in the fixed releases; remove it when NVD corrects the range. development REST: the five /ws/streamer image endpoints (resource/image, jarfile/thumbnail, jarfile/thumbnailOrFile, thumbnail/plugin, icon/plugin) no longer return HTTP 500 to non-browser clients. The Jersey-era produces="image/*" wildcard survived the Spring MVC migration, but Spring cannot select a wildcard response media type (only */* and application/* are concretized during content negotiation), so byte[] bodies had no message converter for any request with Accept: */*, Accept: image/*, or no Accept header at all. Browsers were unaffected only because their img Accept header offers concrete image types - although the response was then mislabelled (e.g. Content-Type: image/avif for a PNG) and rendered only thanks to browser content sniffing. All bundled thumbnails and icons are PNGs, so the endpoints now declare produces="image/png", restoring 200 for every client and a correct Content-Type. development The Operations view no longer logs an ERROR with a stack trace for a project that simply has no packages built yet. buildExpectedDependenciesArcView resolves each job's package version on a best-effort basis and carries on past any failure, logging the two expected empty-state exceptions (EmptyResultDataAccessException, PackageNoFoundException) at WARN. The "no packages in build store" / "no packages in promotion store" case is the same kind of empty state, but was raised as a plain RapidDeployException and so fell through to the catch-all ERROR branch - putting a red stack trace in the log on an ordinary path, which is exactly what makes real errors easy to miss. Those two throws now raise a new NoPackagesInStoreException, caught alongside the others at WARN. It extends RapidDeployException and so remains unchecked: no method signature changes, and callers that catch RapidDeployException are unaffected. Behaviour is otherwise unchanged - the loop already swallowed this exception and continued; only the log level moved. development Bundled Apache Tomcat updated from 10.1.57 to 10.1.59 (all platform packages). tomcat-catalina.version and tomcat-dist.version move together so the bundled distribution stays matched to the compile-time Catalina API. Note that Apache never released 10.1.58, so 10.1.59 is the first available release above 10.1.57. The bundled Temurin JRE is unchanged at 21.0.12+8, still the latest 21 release. development Security: the temporary dependency-check suppression for Tomcat CVE-2026-66299 documented in 5.2.2 has been removed, as planned, now that the bundled Tomcat has moved past the affected range (10.1.24 to 10.1.57). No suppression is needed any more: the fixed Tomcat is shipped, so the finding no longer occurs. development Bundled RD command-line client (rdcli) updated from 1.14 to 1.15, rebuilt on the Go 1.27.0 toolchain (1.14 shipped was built on Go 1.26.5). The client is a prebuilt binary produced by its own repository and build job; rdcli.version here is the pin on that published binary, and all five platform variants (macOS, Linux 64/32, Windows 64/32) move together. Go releases routinely carry security fixes in the runtime and standard library that are compiled into the binary, so keeping the toolchain current is part of keeping the shipped client current - a version bump alone would not have achieved it. No change to client behaviour or command-line interface. development Security: Swagger UI webjar updated 5.32.11 to 5.32.14, which moves the DOMPurify copy bundled inside swagger-ui-bundle.js / swagger-ui-es-bundle.js from 3.4.12 to 3.4.13, fixing GHSA-55q2-fjhq-7xh7 (during IN_PLACE sanitization a hook that removes an element could leave detached descendants executable, allowing XSS; rated Medium, below the build's High gate). DOMPurify is bundled rather than declared, so it could not be updated independently of the Swagger UI release - this bump is the only route to the fix, and the accepted-risk suppression that documented the wait has been removed. As before, the version literal in the web-app's <mvc:resources> mapping was updated in step with the property: Spring does not resolve Maven properties there, so the two must move together or Swagger UI 404s. development Dependency patch updates: Netty 4.2.16 to 4.2.17 (all eight modules in lockstep), Jackson 2.22.1 to 2.22.2 (databind, core and the dataformat / datatype modules; annotations stays on its own cadence at 2.22), Hibernate 6.6.55 to 6.6.56 (runtime and the jpamodelgen annotation processor together), JSch 2.28.6 to 2.28.7, lz4-java 1.11.1 to 1.11.2 and azure-core-http-okhttp 1.13.5 to 1.13.6. Bouncy Castle is deliberately held at 1.85: 1.85.2 is a bcprov-only release and bcpkix, which shares the same version property, has no matching build, so the pair cannot move together yet. No vulnerability is currently reported against the shipped version. development AWS Java SDK v2 updated 2.50.2 to 2.54.2. The SDK is consumed as an imported BOM, so a single property moves the managed versions of the whole SDK; the artifacts actually depended on are ec2, iam and auth (EC2 cloud provisioning and credentials), plus their transitives. The force-override that pins Apache HttpClient 5 ahead of what the SDK's apache5-client would otherwise pull is unaffected - a direct dependencyManagement entry still wins over the imported BOM, and the shipped assemblies were checked to confirm the intended HttpClient 5 version is still the one packaged. development Minor dependency updates, each reviewed individually: Playwright 1.49.0 to 1.62.0 (test scope only - the UI test suite - and never shipped), okio 3.5.0 to 3.18.1 (the floor pin overriding what OkHttp pulls into the Kubernetes plugin; ships as okio-jvm), Apache Commons Logging 1.3.6 to 1.4.0, Commons Collections4 4.5.0 to 4.6.0, Plexus Utils 4.0.3 to 4.1.0, Plexus XML 4.1.1 to 4.2.0 and Eclipse EMF Ecore 2.42.0 to 2.43.0. None of these changes behaviour: Commons Logging 1.4.0 adds only a Jakarta servlet helper class and leaves LogFactory discovery untouched, so it does not affect which commons-logging provider wins a classpath - the shipped assemblies were re-checked to confirm each still carries exactly one provider and one SLF4J binding. Commons Collections4, Plexus Utils and Plexus XML are version floors for transitive dependencies with no direct use in the product code. EMF Ecore is the only one compiled against, and moves a single minor step. development Dependency-check suppression hygiene. Three suppressions that no longer match anything have been removed: the two Apache HttpComponents Core entries (a shared-identifier mismatch against the 5.x line, which upstream data has since corrected), the Mojarra entry pinned to the exact release that already carried the fix, and the Prometheus simpleclient set. In each case the finding was a misattribution rather than a real exposure, and the affected artifacts are still analysed and now report clean, so the entries were pure dead weight. Two further entries that the scanner also reports as unused were KEPT deliberately and annotated to say why: the legacy JBoss Remoting and XNIO entries record accepted risk with no compatible fix, and those libraries are still shipped, so the lapse is in detection rather than in the exposure. The notes now state that explicitly so the reasoning is not lost to a future tidy-up and so a return of matching does not fail a build unexplained. development Eclipse EMF XMI support moved off a legacy artifact coordinate. The build was pulling org.eclipse.emf:ecore-xmi 2.4.1 - a 2008-era build that is not published on Maven Central at all (it resolved from a third-party repository), carries no dependency or licence metadata of its own, and shipped in every platform and agent package. It is now org.eclipse.emf:org.eclipse.emf.ecore.xmi 2.41.0, from Maven Central, which declares the exact EMF Ecore version the product already ships and is published under EPL-2.0, so the licence summary no longer has a gap for it. The two version numbers are not meant to match: EMF releases Ecore and its XMI support on independent version streams, and 2.41.0 is the counterpart built against the Ecore in use. Same Java packages, so this is a change of coordinate rather than of API. Nothing in the product calls XMI directly; the library is required because EMF's own standalone start-up loads one of its classes by name when reading model resources, and that path is now served by a current implementation matched to the Ecore release instead of one eighteen years older. The reasoning is recorded next to the version property. development Security: documented suppression for two Spring Framework advisories rated Critical that are not exploitable in what RapidDeploy ships, and for which no open-source fix exists. Both require conditions this product does not create: one needs the functional web framework serving Server-Sent Events, whereas the web-service tier is entirely annotation-based and uses neither; the other needs a restricted expression-evaluation context combined with the expression compiler switched on, and neither the product nor its dependencies use that context, with the compiler left at its default of off. The Spring 6.2 line reached the end of its open-source support in June 2026, so the corrected 6.2 release is available only to commercial subscribers and will not appear in the public repositories; the only openly available fix is the next major Spring line, which is a separate piece of work. The suppression is pinned to the exact version in use so that any future Spring change is assessed afresh rather than silently inheriting it. A third, low-severity advisory from the same set is deliberately left visible in the report. Upgrading is not required for these. development The upgrade documentation now states explicitly that a new release must not be unzipped on top of an existing installation. Both supported procedures already replace the installation directory and restore only data directories, so the new release's libraries are the only ones present; unzipping over an existing installation instead leaves the previous release's libraries behind, because RapidDeploy adds the libraries a release needs but does not delete ones it no longer uses. Where a library has been renamed or replaced between releases - as the Eclipse EMF XMI library has in this release - both copies would then sit on the runtime classpath, and which is used is not predictable. The note covers the downloadable agent installation as well, and describes how to check an existing installation that was upgraded this way. No product change; guidance only. development

Release 5.2.2 – 2026-08-06

Type Changes By Bundled Apache Tomcat updated from 10.1.56 to 10.1.57 and bundled Temurin JRE updated from 21.0.11+10 to 21.0.12+8 (all platform packages). tomcat-catalina.version and tomcat-dist.version move together so the bundled distribution stays matched to the compile-time Catalina API. development Security: documented, temporary dependency-check suppression for Tomcat CVE-2026-66299, which has no available fix and is not exploitable in what we ship. The flaw is an unbounded undelivered-message buffer in the WebSocket chat EXAMPLE, in the examples web application; the ASF rates it Low and states that deployments which removed that web application are unaffected. NVD scores it 7.5, which trips the High gate. The bundled distribution ships tomcat/webapps/ as an empty directory - the examples web application is not in the package, and the deployed tomcat/webapps holds only MidVision.war - and neither flagged artifact contains any of the affected code (tomcat-api is connector interfaces, tomcat-catalina-ant the Ant deploy tasks); both match on the shared cpe:2.3:a:apache:tomcat:10.1.57 version CPE alone. The affected range is 10.1.24 to 10.1.57 and the fix is 10.1.58, unreleased at the time of writing. Suppression will be removed when the bundled Tomcat moves to 10.1.58; check-versions.sh (hence /rd-check-updates) now lists suppressions awaiting a newer Tomcat whenever it detects one, so the entry is retired as part of that upgrade. development Security: jackson updated 2.22.0 - 2.22.1, fixing jackson-core GHSA-r7wm-3cxj-wff9 (async parser maxNumberLength bypass, High) and CVE-2026-54515 (case-insensitive deserialization bypass) - the published line fix the earlier temporary suppression was waiting on; that suppression is now removed. jackson-annotations stays on its own cadence at 2.22. development Security: Netty updated 4.2.15.Final - 4.2.16.Final (8-artifact lockstep), fixing CVE-2026-59901 (netty-codec-compression) and CVE-2026-55831 (netty-codec-http), both High. development Security: PostgreSQL JDBC driver pin updated 42.7.11 - 42.7.13, fixing CVE-2026-54291 (High; fixed as of 42.7.12). development Swagger UI webjar updated 5.32.8 - 5.32.11 (the version literal in the web-app applicationContext.xml mvc:resources mapping is kept in sync). development Security: log4j2 API + log4j-to-slf4j bridge updated 2.26.0 - 2.26.1, fixing CVE-2026-49844 (Medium: MapMessage.asJson() emits invalid JSON for NaN/Infinity values). Only the API and bridge jars are shipped - the logging backend remains reload4j and log4j-core is not on any classpath. development RD Client (rdcli) updated 1.10 - 1.14, via 1.11, 1.12 and 1.13. The CLI is built from the separate MidVision/rd Git repo; 1.11 recompiled it with Go 1.26.5 (was 1.26.4), picking up the Go patch-release security fixes in the binary that ships as bin/rd in the platform package. 1.13 and 1.14 are fix releases on that same toolchain. Verified by introspecting the shipped artifact: all five platform binaries, and bin/rd inside the assembled package, report go1.26.5 and "rd version 1.14". development A first startup no longer logs a spurious ERROR with a stack trace for the missing resource and blackout files. A fresh install has no resources/rd_resources.xml or resources/blackout_periods.xml yet - that is the normal initial state, and the services already bootstrap an empty list - but both logged "Unable to read file [...], it does not exist." at ERROR with a full stack trace, made visible on every clean boot by the automatic plugin-data upgrade introduced in 5.2.0. ResourceServiceImpl and BlackoutServiceImpl now distinguish an absent file (INFO, bootstrap quietly) from a file that exists but cannot be read (unchanged: ERROR with stack trace plus the timestamped .ERROR_ backup before replacing it). The related "File [X] does not exist. Defaulting to: X" warning - which named the same path twice, because the configured location IS the default - is now only logged when the fallback is genuinely a different path. A clean first startup now reports zero ERROR lines. development Security: raw Facelets template source is no longer served over HTTP. The Faces Servlet is prefix-mapped at /ui/*, so a *.xhtml URL outside /ui/ was handled by the container's default servlet, which returned the template file verbatim - unevaluated EL, bean and property names, layout internals - with no authentication. Two web.xml security-constraints now fix this, relying on url-pattern precedence: /ui/* is explicitly unconstrained (rendered views, whose URLs also end in .xhtml, keep working and stay governed by Spring Security) while *.xhtml denies everyone. Verified: raw paths return 403 with no source, authenticated views and the license pages still render, UI smoke passes. development Web Services help page: the embedded Swagger UI failed to load behind a TLS-terminating proxy (e.g. https://demo.midvision.com) - browsers blocked the iframe as mixed active content because its src was built with getAppUrl(), which reflects the scheme Tomcat saw (http behind the proxy). The iframe src is now context-relative, which can never be mixed content. Deployments behind a TLS proxy should additionally configure Tomcat's RemoteIpValve (protocolHeader=x-forwarded-proto) so other generated absolute URLs use the correct scheme. development Maintenance dependency updates. Patches: lz4-java 1.11.1, jsch 2.28.6, nimbus-jose-jwt 10.9.1, commons-codec 1.22.1, kubernetes client-java 26.0.1, joda-time 2.14.3, cargo 1.10.28, jettison 1.5.7, hibernate-core / hibernate-jpamodelgen 6.6.55.Final, threetenbp 1.7.4. Minor bumps: BouncyCastle 1.85, commons-validator 1.11.0, tyrus-standalone-client 2.2.2, azure-resourcemanager 2.63.0. AWS SDK BOM 2.45.0 - 2.50.2 (whole family via the single aws.java.sdk.version property). development Security: data dictionary password values are no longer disclosed in job logs when referenced from another, non-password dictionary item. Masking now propagates through nested @@KEY@@ resolution in all three dictionary replacement steps (job runner, initialisation task and orchestration-file preparation): a password/encrypted entry is still logged as ValueMasked, while an entry that merely embeds one stays readable with just the secret portion hidden - e.g. [Using user [admin] with credentials [********]]. In addition, the captured job log is scrubbed of any known masked dictionary value as defence in depth: the values of password/encrypted entries are registered with a new LogMasker when the dictionary is loaded, and the job-log capture layout replaces them with ******** on every logged line - this also covers task output that echoes fully resolved values with no dictionary context, such as LocalCommandRunnerTask's "Running Command and Args" line. development

Release 5.2.1 – 2026-07-02

Type Changes By AWS EC2 plugin: the instance-type list is now retrieved dynamically from the AWS API per region (EC2 describeInstanceTypeOfferings) instead of a hard-coded static list, mirroring the existing Azure VM-size behaviour. A new InstanceTypeSelectionParameterType autocomplete parameter type backs the "Create an EC2 instance in AWS" task's instanceType field (populated once the Access Key, Secret Key and Region are set), and the Cloud Provisioning plugin fills the instance-type drop-down at Synchronize time. New instance types offered by AWS now appear without a product update. Existing projects are unaffected and the backward-compatibility mapping for legacy instance-type names is retained. development Bundled Apache Tomcat updated from 10.1.55 to 10.1.56. tomcat-catalina.version and tomcat-dist.version are moved together so the bundled distribution stays matched to the compile-time Catalina API. development Security: jackson-databind updated 2.19.4 - 2.22.0, fixing the two High (CVSS 8.1) CVEs CVE-2026-54512 and CVE-2026-54513 (data-binding security bypass / arbitrary code execution). The related Medium CVE-2026-54515 (case-insensitive deserialization bypass, CVSS 5.3) is NOT yet fixed in 2.22.0 - NVD explicitly lists 2.22.0 as affected and the line fixes (2.21.5 / 2.22.1) are not yet on Maven Central - so it is documented/suppressed (below the High gate; see dependency-check-suppression.xml) pending an available fix. jackson-annotations is pinned separately at 2.22 because it dropped the patch-version segment at 2.20 and ships on its own cadence (the same split the upstream jackson-bom uses); the remaining jackson modules move to 2.22.0. development Security: the transitively-resolved PostgreSQL JDBC driver is now pinned to 42.7.11 via dependency management. The previously resolved 42.3.1 carried CVE-2024-1597 (CRITICAL - SQL injection when PreferQueryMode=SIMPLE) together with several High-rated CVEs (CVE-2022-21724, CVE-2022-31197, CVE-2026-42198). development Security: SVNKit's transitive lz4-java compression library - the abandoned org.lz4:lz4-java 1.4.1 (CVE-2025-12183, CVE-2025-66566) - is replaced by the maintained at.yawk.lz4:lz4-java fork 1.11.0, which carries the fixes. SVNKit itself remains license-pinned at 1.10.11; only its excluded compression transitive is swapped (identical net.jpountz.lz4 packages). development Security: Swagger UI webjar updated 5.32.6 - 5.32.8, which bundles DOMPurify 3.4.11 instead of the vulnerable 3.4.0 - clearing the XSS / config-pollution CVEs (CVE-2026-49458, CVE-2026-49459, CVE-2026-49978 and the DOMPurify hook-pollution set) that dependency-check flagged inside swagger-ui-bundle.js. The version literal in the web-app applicationContext.xml <mvc:resources> mapping is kept in sync with the swagger-ui.version property. development Security: documented, justified dependency-check / Trivy suppressions. Three CVEs have no compatible upstream fix and are outside the default install footprint: net.sf.sojo:sojo CVE-2023-34613 (abandoned library, 1.1.1 is the latest), org.jboss.remoting:jboss-remoting 2.5.4 CVE-2020-35510 (legacy 2.x used only as a custom bisocket transport; the vulnerable EJB-server path is not reachable, and the fix exists only in the incompatible 5.x API generation), and org.jboss.xnio:xnio 3.0.17 CVE-2023-5685 (pinned to the legacy JBoss AS 7.1.2 / remoting3 3.2.7 stack in the opt-in Red Hat plugin). Additionally CVE-2026-57282 is suppressed on com.offbytwo.jenkins:jenkins-client as a CPE false positive - it is a Jenkins Git Client *plugin* issue (cpe:jenkins:git_client) mis-matched to the unrelated REST-client library by its shared 0.3.8 version. Two further CVEs are TEMPORARILY suppressed (both below the High gate, no available fix yet): jackson-databind CVE-2026-54515 (Medium; NVD still flags 2.22.0, line fixes 2.21.5 / 2.22.1 unpublished) and kotlin-stdlib CVE-2026-53914 (a Kotlin build-cache issue not reachable via the runtime stdlib, transitive through the opt-in Azure SDK; fixed in Kotlin 2.4.20, only 2.4.20-Beta1 published so far). development Security: task parameter and entry values whose name contains "secret" (case-insensitive) are now masked in the job logs, alongside the existing "password" masking. This prevents credentials such as the Microsoft Azure "secretKey" from being written to the job logs in plain text. The name-based check is centralised in AbstractTask.isSensitiveParameterName(...) and applied across every place a parameter value is logged: the parameter/entry "Reading parameter ..." lines emitted during task initialisation in AbstractTask.initTask (previously only masked when the value happened to be a password-format environment property in the PasswordMaskingLogger dictionary), every parameter log line in AbstractMidVisionTask, and AbstractTaskPipelineStep - where the step short-info summary no longer prints secret values and the parameter editor field is rendered as a masked secret input. development Microsoft Azure: the "Stop a VM instance" task now deallocates a virtual machine that is merely STOPPED. A VM powered off from inside the OS reports PowerState.STOPPED - it stays allocated and is still billed for compute - whereas the Stop task is meant to deallocate it. AzureUtils.shutdownInstance() previously deallocated only a RUNNING VM, and StopVirtualMachineTask routed a STOPPED VM into a no-op "already Stopped" branch (isStopped() is true for both STOPPED and DEALLOCATED). shutdownInstance() now deallocates unless the VM is already DEALLOCATED (also fixing the Azure.stopInstance() API path), and the task checks the new AzureInstanceDao.isDeallocated() before isStopped() so a STOPPED-but-allocated VM is deallocated rather than skipped. The symmetric start-side gap is fixed too: AzureUtils.startInstance() now starts a VM that is STOPPED or DEALLOCATED (previously DEALLOCATED only), which transparently corrects the Start and Restart VM tasks and start-on-deployment. Fixes 4452. development Microsoft Azure: new "Wait For Virtual Machine State" task. It retrieves the virtual-machine instance information and polls Azure until the VM reaches the power state selected on the task (Running, Stopped, Deallocated, Starting, Stopping or Deallocating). An optional "timeout" parameter (in seconds) bounds the wait - when left empty the task waits indefinitely; when set, the task fails if the desired state is not reached within the timeout. Based on the existing Restart Virtual Machine task and reusing AzureUtils.getCloudInstance(...) for each poll. development Microsoft Azure: the three "Create a VM instance" tasks (from Cloud Offer, from Custom Image and from Gallery Image) now also accept an optional "customData" parameter (a multi-line TextArea). The supplied text is Base64-encoded and passed to Azure on virtual-machine creation via withCustomData(...); unlike user data it is processed by the VM provisioning agent at first boot (cloud-init on Linux, written to %SYSTEMDRIVE%\AzureData\CustomData.bin on Windows) and can only be set at creation time. The parameter is optional, so existing orchestrations are unaffected. Fixes 4452. development Microsoft Azure: the three "Create a VM instance" tasks (from Cloud Offer, from Custom Image and from Gallery Image) now accept an optional "userData" parameter (a multi-line TextArea). The supplied text is Base64-encoded and passed to Azure on virtual-machine creation via withUserData(...), so it is made available to the running instance through the Azure Instance Metadata Service (IMDS). The parameter is optional, so existing orchestrations are unaffected. Fixes 4452. development Root-cause fix for the Faces 4 empty-field regression behind several issues (e.g. #4444, #4445): the context-param jakarta.faces.INTERPRET_EMPTY_STRING_SUBMITTED_VALUES_AS_NULL is set back to false in web.xml, so an empty input field is again submitted to the backing bean as "" (empty string) rather than null - matching the pre-Jakarta behaviour. This prevents blank optional fields from being persisted as null into NOT NULL columns and from tripping null checks in validators. To keep blank list/table filters meaning "ignore this criterion" (the original reason the param had been set to true), the paginated filter query builders in JpaBaseImpl now skip empty-string filter values as well as null. The per-entity null-to-"" guards added for #4444/#4445 are retained as defensive safety nets. development Resource/plugin dynamic field validation no longer throws a NullPointerException when an empty input field is submitted. Under the Mojarra 4 / Faces 4 lifecycle an empty field submits a null value (the Faces 2.x stack passed an empty string), which caused DynamicField.validate(...) to NPE on the first value.toString() during the Process Validations phase - for example on the Settings tab of the Resource Editor when clicking "Check Resource" or "Delete" with empty fields. Null submitted values are now normalised to an empty string. Fixes 4444. development Fixed numeric maximum-value validation for dynamic plugin fields. The Integer/Long/Double "maximum value" checks in DynamicField.validate(...) compared the input against the configured minimum value instead of the maximum, so an over-maximum value was not rejected (and a maximum configured without a minimum reported a misleading "is not a number" error). They now compare against the configured maximum value. Fixes 4444. development Hardened DynamicField.setEntries(...) (the ENTRIES_TABLE data-dictionary field type) against a null entry list and null entry keys, matching the existing null-handling in setChoices/setChoicesSelected; previously a null list or a null entry key would throw a NullPointerException. Fixes 4444. development Saving a job plan with an empty description no longer fails with a database integrity-constraint violation. The DEPLOYMENT_PLAN.DESCRIPTION column is NOT NULL, and under the Faces 4 lifecycle an empty description field submits a null value (the 5.1.x stack passed an empty string), so JobPlan.save raised an SQLIntegrityConstraintViolationException. JobPlan now normalises a null description to an empty string in its setter and constructor. Fixes 4445. development Updates to mitigate security vulnerabilities: - Spring Framework 6.2.18 to 6.2.19, resolving CVE-2026-41842, CVE-2026-41850 and CVE-2026-41851 (CVSS 7.5) plus CVE-2026-41840, CVE-2026-41841 and CVE-2026-41843 in spring-core. - Spring Security 6.5.10 to 6.5.11. - Hibernate ORM 6.6.51.Final to 6.6.53.Final (core and jpamodelgen). - Netty 4.2.14.Final to 4.2.15.Final. - JSch (com.github.mwiede) 2.28.2 to 2.28.3. - Azure Core OkHttp HTTP client 1.13.4 to 1.13.5. development

Release 5.2.0 – 2026-06-03

Type Changes By Stack uplift to Jakarta EE 10: namespace migration from javax.* to jakarta.* across the codebase. Spring Framework upgraded to 6.x (from 5.3.x), Spring Security to 6.x, Hibernate to 6.x (from 5.x), Mojarra Faces to 4.x (from 2.x), PrimeFaces to 12.x. Weld CDI 5.x added as the Mojarra 4 CDI runtime under Tomcat (which does not ship CDI). JSF/CDI beans previously declared with @Named/@ViewScoped migrated to Spring @Component with the equivalent Spring scope annotations. development Minimum Java runtime for 5.2 is now JDK 21 (build/webapp/aspectj target unified to build.jdk.version=21; Temurin 21.0.11+10 is the bundled distribution). development Bundled runtime bumps: Tomcat 10.1.55 (Tomcat-catalina from 10.1.34; Tomcat-dist switched from 9.0.117 so the distribution matches the compile-time API), bundled JRE 21.0.10+7 to 21.0.11+10, Netty 4.2.12.Final to 4.2.13.Final, Angus Mail 2.0.3 to 2.0.5. development Database schema update (script update.027.sql, applied automatically on first start of 5.2.0): - Adds HIBERNATE_SEQUENCE to the embedded HSQLDB schema for Hibernate 6 compatibility (Hibernate 6 expects an identifier-generator sequence to exist at startup). - Drops 7 unused sequences left over from previous releases. development Automatic plugin-data upgrade on web-app startup. After an in-place upgrade, existing servers/projects/resources whose stored plugin data references an older plugin version are now migrated automatically the first time the upgraded web-app starts, instead of requiring an administrator to log in and run "Update Plugin Data" from the Plugin Manager page. A new PluginDataUpgrader bean runs the same MigrationService.upgradeAllPlugins migration the UI invokes (purging superseded plugin-data versions; safe because the supported upgrade path takes a rollback backup beforehand), gated by a DB-agnostic per-OS-user marker file at $MV_HOME/users/<os-user>/.plugin-data-version (scoped the same way as the embedded HSQLDB data). The gate compares the full product version (WAR manifest Implementation-Version) so point releases that ship plugin updates re-trigger it; the marker is advanced only on a clean run (so a partial failure is retried on the next start rather than silently skipped). The manual Plugin Manager action is unchanged. development Removed Bitronix Transaction Manager dependency. Switched JDBC connection pool from Bitronix PoolingDataSource to HikariCP 5.1.0, and transaction management from Spring JtaTransactionManager (wrapping Bitronix) to Spring JpaTransactionManager. Single-datasource RapidDeploy never required XA; this is a strict simplification. Persistence unit changed from JTA to RESOURCE_LOCAL. development Bitronix-removal upgrade UX: existing rapiddeploy.properties files from 5.1.x referencing XA datasource classnames (oracle.jdbc.xa.client.OracleXADataSource, com.ibm.db2.jcc.DB2XADataSource, org.hsqldb.jdbc.pool.JDBCXADataSource) are auto-converted on upgrade. mvcloud-update.sh rewrites the on-disk file with a timestamped backup, and an in-app safety net in BootstrapPropertyPlaceholderConfigurer also corrects the value at startup (logging a WARN) if the script did not run. No manual edit required on the supported upgrade path. development REST web services tier rebuilt on Spring MVC, replacing Jersey 2.x which has no Jakarta EE 10 compatible release. /ws/* endpoints preserve their 5.1 wire format (XML and JSON) byte-for-byte via JAXB wrapper classes; @RequestBody and @RequestParam semantics match the 5.1 JAX-RS @QueryParam (optional) and entity-binding behaviour. Removed the JAX-RS dependency. Swagger UI 5.32.5 replaces the previous Jersey-generated WADL endpoint and is served at /ws/swagger-ui/index.html, backed by springdoc-openapi 2.8.x. development All shipped plugins bumped from 5.1.x to 5.2.0 (IPluginFunction.RELEASE_VERSION constant plus each plugin's ui-plugin.xml; 65 plugin descriptors updated). Customer projects using these plugins will reflect the new version after the first project edit; no re-import is required. development Apache MINA SSHD bumped from 2.9.2 to ≥ 2.12.0 to incorporate the Terrapin (CVE-2023-48795) mitigation. Affects the remoting transport path. development Added Spring Boot 3.5.14 autoconfigure and starter-validation as runtime support for springdoc-openapi 2.8.x (the project remains non-Boot Spring MVC; springdoc 2.8+ relies on Boot's @ConditionalOn* autoconfig infrastructure). Added the log4j-to-slf4j 2.26.0 bridge. development Corrected hibernate-jpamodelgen groupId from org.hibernate to org.hibernate.orm (canonical groupId since Hibernate 6+). development dependency-check-suppression.xml: temporary suppression added for CVE-2026-33117 (Azure SDK for Java, CVSS 9.1, disclosed May 2026 Patch Tuesday). No stable upstream patch on Maven Central at release time; the Azure plugin is opt-in and not in the default install footprint. Suppression will be removed when azure-identity ≥ 1.19.0 stable ships. development Unified the JRE install/deploy scripts: jre_install.sh and jre_install_all.sh merged into a single jre_install.sh with an OS_TYPE=ALL mode that recursively handles all platforms; same for jre_deploy.sh. Fixed a cross-wiring bug in the former *_all wrappers. development Removed HeaderWriterFilterEagerPostProcessor. The CVE-2026-22732 mitigation it implemented was specific to the older Spring Security version on the 5.1.x line; the vulnerability is resolved upstream in the Spring Security release now shipped with 5.2. development

Release 5.1.22 – TBC

Type Changes By Updates to mitigate security vulnerabilities: - Code migration from commons-httpclient 3.x to Apache HttpClient 4.x. - Code migration of Maven Resolver from maven3 to maven4. - Removal of JLine framework as dependecy due to interactive console is not required. - Removal of SSO SAML Auth features due to security vulnerabilities with critical severity. - CVE-2026-22732 mitigated via HeaderWriterFilterEagerPostProcessor. - Upgrade of API frameworks dependencies to LATEST available version. - Apache Tomcat to 9.0.117 - Provided JRE version to 21.0.10+7 development

Release 5.1.21 – 2026-02-06

Type Changes By Updates to mitigate security vulnerabilities: - Upgrade of API frameworks dependencies to LATEST available version. - Apache Tomcat to 9.0.115 development

Release 5.1.20 – 2025-11-14

Type Changes By Updates to mitigate security vulnerabilities: - Upgrade of API frameworks dependencies to LATEST available version. - Quartz framework update from 1.8.3 to 2.5.1 (DATABASE UPDATES). - Provided JRE version to 21.0.9+10 - Apache Tomcat to 9.0.112 - Removal of provided Subversion plug-in in distribution package. - Removal of provided Jenkins plug-in in distribution package. - Removal of provided Red Hat JBoss plug-ins in distribution package. - Removal of provided Oracle WebLogic plug-ins in distribution package. - Removal of SPNEGO/Kerberos Auth features due to security vulnerabilities with critical severity. development Delete contents of tmp directory: - Fix the "WebSphereDeploymentTask" and the "WebSphereGenericDeploymentTask" to cleanup properly all the files in the temporary folder. Fixes 4245. development

Release 5.1.19 – 2025-08-22

Type Changes By Updates to mitigate security vulnerabilities: - Upgrade of API frameworks dependencies to LATEST available version. - Provided JRE version to 21.0.8+9 - Apache Tomcat to 9.0.108 development Updated Azure Cloud provider plugin. Security Type and SSH Public Key Name new parameters on VM instance creation. Azure Cloud provider plugin version have changed to 5.1.3 All projects based on this plugin will require upgrading. Please see upgrade documentation for further instructions (http://docs.midvision.com/LATEST/install/upgrade.html). Fixes 4300. development Internal code refactoring for migration for apache commons lang2 to lang3. Fixes 4298. development

Release 5.1.18 – 2025-05-15

Type Changes By Updates to mitigate security vulnerabilities: - Upgrade of API frameworks dependencies to LATEST available version. - Provided JRE version to 21.0.7+6 - Apache Tomcat to 9.0.105 development

Release 5.1.17 – 2025-03-27

Type Changes By Updates to mitigate security vulnerabilities: - Upgrade of API frameworks dependencies to LATEST available version. - Provided JRE version to 21.0.6+7 - Apache Tomcat to 9.0.102 development

Release 5.1.16 – 2024-12-16

Type Changes By Updates to mitigate security vulnerabilities: - Upgrade of API frameworks dependencies to LATEST available version. - Provided JRE version to 21.0.5+11 - Apache Tomcat to 9.0.97 development New features for Data Dictionary resource management. Fixes 4238. development Blueprints projects auto update. Fixes 4235. development

Release 5.1.15 – 2024-08-22

Type Changes By Updates to mitigate security vulnerabilities: - Upgrade of API frameworks dependencies to LATEST available version. - Provided JRE version to 21.0.4+7 - Apache Tomcat to 9.0.93 development Improve of feature for RapidDeploy global Proxy settings in rapiddeploy.properties. Fixes 4216. development Display package size on row expansion in project package list and project package details page. Fixes 4207. development

Release 5.1.14 – 2024-06-26

Type Changes By Updates to mitigate security vulnerabilities: - Upgrade of API frameworks dependencies to LATEST available version. - Provided JRE version to 21.0.3+9 - Apache Tomcat to 9.0.90 development New features for blueprints projects and job plans, MidVisionCloud license and RD command line. Fixes 4201. development Removal of orphan external libraries when plugin is uninstalled. Fixes 4196. development

Release 5.1.13 – 2024-04-24

Type Changes By Updates to mitigate security vulnerabilities: - Upgrade of API frameworks dependencies to LATEST available version. - Provided JRE version to 21.0.3+9 - Apache Tomcat to 9.0.88 development

Release 5.1.12 – 2024-01-26

Type Changes By Updates to mitigate security vulnerabilities: - Upgrade of API frameworks dependencies to LATEST available version. - Provided JRE version to 21.0.2+13 - Apache Tomcat to 9.0.85 development

Release 5.1.11 – 2023-10-02

Type Changes By Upgrade of internal frameworks, provided JRE version 17 and Tomcat to LATEST available version in order to mitigate security vulnerabilities. development

Release 5.1.10 – 2023-06-22

Type Changes By JSch framework upgrade to support rsa-sha2-256 and rsa-sha2-512 in SSH authentication. Fixes 4091. development

Release 5.1.9 – 2023-06-16

Type Changes By Ability to enable or disable TLS for SMTP authentication. Fixes 4081. development Allow a committer comment when using the Git SCM (manual sync). Fixes 3192. development

Release 5.1.8 – 2023-03-07

Type Changes By New feature in project packages view to compare any package with the current project version. New ability to revert changes from existing packages into project files. Fixes 3991. development APIs and Implementation frameworks upgrade for J2EE 8 specification compliant. UI framework upgraded to latest version 12. Updated provided JRE to version 17. Fixes 3875. development

Release 5.1.7 – 2020-12-07

Type Changes By Java 11 migration for RapidDeploy, Plugins and Remote Agent. Fixes 4008. development Storage Account Endpoint values usage. Fixes 4003. development New version-info script for product installation report. Fixes 4001. development IBM product plugins tasks clean up. Fixes 4000. development MS Teams plugin improvement and MS Graph APIs upgrade. Fixes 3996. development Scripts improvements to user always the provided JRE. Fixes 3994. development

Release 5.1.6 – 2022-07-30

Type Changes By Previous jobs filtering on job selection. Fixes 3987. development File uploading feature in project resources, project packages and feedback attachments. Fixes 3980. development Schedule UI panel issue in recurrent feature settings. Fixes 3979. development Project packages information management improvement. Fixes 3973. development New skip step feature for pipeline jobs. Fixes 3970. development Data dictionary UI issue in project details page. Fixes 3966. development WEB Service API for project creation by copying. Fixes 3965. development Remoting agent windows service script and binaries update version from 1.0.5 to 1.3.1. Fixes 3963. development Running project from project with additional parameters. Fixes 3950. development UI bug between orchestration tasks and data dictionary on project edition page. Fixes 3930. development

Release 5.1.5 – 2022-05-11

Type Changes By Upgrade Spring framework to latest version to fix CVE-2022-22965 vulnerability. Fixes 3931. development Update RD property from "ldap.security.principle.pattern" to "ldap.security.principal.pattern". Fixes 3906. development

Release 5.1.3 – 2022-04-19

Type Changes By New feature for tab view session state in resources edition page. Fixes 3933. development Amend previous job listing page. Fixes 3932. development Upgrade Tomcat to version 9.0.62 to provide a mitigation for CVE-2022-22965 a Spring Framework vulnerability. Fixes 3931. development Secure channel connection for Azure Storage accounts. Fixes 3925. development

Release 5.1.2 – 2022-03-28

Type Changes By Improved UI filtering management in data dictionary entries tables. Fixes 3921. development Amended UI issue on data dictionary entries edition. Fixes 3919. development Amended validation service for undiscovered targets in project edition. Fixes 3917. development

Release 5.1.1 – 2022-03-21

Type Changes By Move unsupported Apache Log 4J version 1.X to Simple Logging Facade 4J (CVE-2021-44228). Fixes 3900. development Hide menu context links to project configuration when job project element is empty in job plan edition page. Fixes 3892. development Updated File Based Repository artifact plugin. Enable or disable the removal of all project packages on project deletion. File Based Repository artifact plugin version have changed to 5.1.2 All projects based on this plugin will require upgrading. Please see upgrade documentation for further instructions (http://docs.midvision.com/LATEST/install/upgrade.html). Fixes 3883. development New feature for uploading project class path files in project edition page. Fixes 3870. development Updated primefaces UI framework from 6.1 to 11.0. Fixes 3865. development New version available notification displayed in page footer. Fixes 3589. development

Release 5.1.0 – 2021-12-10

Type Changes By New functionality in the AWS plugin: - New task to assign an IAM role to an EC2 instance. - New task to increase the EBM volume of an EC2 instance. - The key pair task parameter field is now dynamic. - New task to execute a generic AWS CLI command. - New task parameter "User Data" for the "Create an EC2 instance" task. Fixes 3771. development Orchestration and task improvements. Backward compatible. Fixes 3869. development

Release 5.0.31 – 2021-11-03

Type Changes By Add the option to set the VPC and subnet when creating a new EC2 instance in the AWS plugin. Fixes 3859. development Data Dictionary entry string value size up to 10,000 characters. Fixes 3860. development Run Job Plan element feature in Job Plan edition page. Fixes 3848. development New Microsoft Teams plugin based on latest APIs and MS graph services. Fixes 3789. development New version available information displayed in system management page. Fixes 3589. development

Release 5.0.29 – 2021-08-23

Type Changes By Project target data dictionary value deletion feature. Fixes 3837. development Data Dictionary discovery feature in project edition page. Fixes 3834. development Bitronix transaction log appender patch. Fixes 3832. development Project data dictionary key renaming feature. Fixes 3831. development Local File artifact plugin regex feature for package name validation. Fixes 3828. development Add Job Plan feature improvement. Fixes 3773. development

Release 5.0.28 – 2021-07-16

Type Changes By Project import with different name from original. Fixes 3819. development Command output verification with success string logic in Command Run Step, Command Runner and Command Runner With Response tasks. Fixes 3807. development Project orchestration edition UX. Fixes 3806. development Data dictionary entries discovering in resource edition page. Fixes 3796. development Job Plan edition features to set continue on failure in pipelines for batch execution policy. New field in job plan form to set the execution policy as part of the job plan persisted data. Fixes 3790. development Job Plan edition feature to include existing job plans components as part of the job plan. New multiple selection feature to copy, cut and remove diagram elements. Fixes 3773. development Data Dictionary entries merging functionality between resource and project scopes. Fixes 3784. development Resume job operation in manual step execution. Fixes 3780. development Late Configuration settings for Live targets in Job Plan edition page. Fixes 3777. development Job Edition dialog in Job Plan edition page. Fixes 3774. development Project copy functionality in project list and copy pages. Fixes 3769. development Project package creation in resource edition page. Fixes 3738. development Project import process for SCM plugins based on non file systems. Fixes 3726. development Job Plan failure pipeline removal. Fixes 3713. development Target specific value definition on data dictionary resources. Fixes 3688. development

Release 5.0.27 – 2021-02-26

Type Changes By Show running version in remote agent start up and project jobs execution via ssh in remote target. Fixes 3728. development SQL Server data type conversion syntax. Fixes 3726. development Problems with Git repository cloning task. Fixes 3719. development Kubernetes plugin features Extension to handle Deployment resources type. Fixes 3712. development References management between projects and resources. Fixes 3682. development Display entry help text on Late Config panel in Job Plan edition page. Fixes 3673. development Issue with Cron Scheduled jobs feature. Fixes 3653. development New Microsoft Teams plugin including send team message task and step. Fixes 3639. development Jenkins plugin improvement to be able to invoke Jenkins Jobs with parameters. Fixes 3631. development

Release 5.0.26 – 2020-12-29

Type Changes By Data dictionary files inclusion pattern. Fixes 3684. development Data Dictionary populated values. Fixes 3682. development Upgrading AWS APIs to latest version 1.11. Fixes 3676. development Supports HTTPS protocol for Maven repository connectivity. Fixes 3672. development Task enable/disable UX issue in project edition page. Fixes 3669. development Jobs logging improvement. Fixes 3662. development Late properties update in Job Plan edition page. Fixes 3644. development Previous jobs and job plan edition pages improvement. Fixes 3643. development New Helm plugin including new tasks. Fixes 2882. development

Release 5.0.25 – 2020-10-23

Type Changes By Move embedded JRE to OpenJDK. Fixes 3651. development

Release 5.0.24 – 2020-10-13

Type Changes By Job execution with build store path name containing white spaces. Fixes 3649. development Error messages in Job Plan edition dialogs. Fixes 3648. development Resume job execution in task halt. Fixes 3645. development Resource data dictionary entries edition. Fixes 3629. development Execution job for live environments in job plans. Fixes 3624. development Editable help text in Data Dictionary entries. Fixes 3619. development Pin and unpin task details panel in project edition page. Fixes 3607. development Orchestration tasks panel resizing in project edition page. Task resource edition dialog for long text inputs. Fixes 3598. development Improve multi selection of projects to projects groups in dashboard filter panel. Fixes 3576. development New built-in variables JOB_ID and JOB_USER available in deployment time. Fixes 3574. development Target entries comparison in project details page. Fixes 3453. development New Kubernetes (k8s) cloud provider plugin including new tasks. Fixes 2882. development

Release 5.0.23 – 2020-08-11

Type Changes By Built-in database files handlers in Windows. Fixes 3613. development

Release 5.0.22 – 2020-08-05

Type Changes By Active nodes reduction based on current number licensed. Fixes 3600. development Project details page when entity does not exist. Fixes 3597. development Link to view data dictionaries resources in project details page. Fixes 3596. development Plugin loading service. Fixes 3595. development Job Plan execution via web services. Fixes 3594. development Update End-User License Agreement. Fixes 3593. development UI issue in Job Plan edition. Fixes 3592. development Allowed nodes validation in server update operation. Fixes 3591. development Welcome page chats UX response improvement. Fixes 3590. development Schedule calendar client time zone. Fixes 3588. development Export and import of job plans and servers from job plan step definitions. Fixes 3584. development Server selection drop-down list in remote file/directory resource configuration. Fixes 3583. development Approval step pipeline new feature in job plan definition. Fixes 3577. development Multi selection of projects and environment is dashboard filter panel. Fixes 3576. development Complete re-engineering of the Jenkins plugin to invoke Jenkins from RapidDeploy. A new Java client API has been integrated (https://github.com/jenkinsci/java-client-api). Fixes 3569. development Improvement in Remote Resource checksum file in job package creation. Fixes 3558. development A new resource was added to the 'WebSphereGenericDeploymentTask' to be able to append any extra parameter to the 'wsadmin' command. Fixes 3499. development

Release 5.0.21 – 2020-07-03

Type Changes By Manual Execution jobs new feature for Job Plans. Fixes 3580. development Cloning Environment Variables in server copy operation. Fixes 3575. development Environment management page. Fixes 3559. development Remote Resource checksum file in job package creation. Fixes 3558. development Hostnames management for cloud server instances. Fixes 3546. development Project dictionary entries update in multiple dictionary resources scenario. Fixes 3543. development Text Area for project description. Fixes 3541. development Multiple selection of items for deletion. Fixes 3537. development Notification message field in Job Plan Manual Step. Fixes 3533. development Performance in running jobs page. Fixes 3527. development Cancel Jobs operation improved and simplified. Fixes 3526. development Go to Job Plan and Go to Server links in Job Plan steps. Fixes 3525. development Update project name in plugin value references when it is changed in project creation, copy and import. Fixes 3523. development

Release 5.0.20 – 2020-06-01

Type Changes By Target cloning on project details page. Fixes 3557. development Install and uninstall plugins in Plugin Manager page. Fixes 3555. development Package creation when resources are invalid. Fixes 3553. development Update some incorrect tab and dialog titles. Fixes 3550. development Data Dictionary resources data update on package creation. Fixes 3549. development Server test connection confirmation dialog. Fixes 3544. development Include Transport and Cloud Provider Plugin Data resources into project export and import feature. Fixes 3540. development Default top-left menu layout. Fixes 3539. development Update the button 'Export Cloud Provider Plugin Data' and 'Export Transport Plugin Data'. Fixes 3538. development Running a linked Job fails. Fixes 3536. development Remote File Resource configuration for Data Dictionary, Transport Plugin and Cloud Provider Plugin formats. Fixes 3535. development Improvement of Transport and Cloud Provider Plugin Data resources management. Fixes 3534. development AWS EC2 instance data view feature. Fixes 3530. development Project Data Dictionary resources management. Fixes 3528. development Resource editon UX improvement. Fixes 3524. development Plan configured for NEW PACKAGE doesn't run. Fixes 3522. development Resources references when a project is copied. Fixes 3521. development Workflow execution for batched pipeline jobs. Fixes 3514. development Because of the MSNP24 deprecation we have decided to remove the Skype plugin. Fixes 3513. development UI issues on orchestration editon. Fixes 3512. development Project Dictionary object returned by WebServices. Fixes 3509. development Remove selected resources in available list on project details page. Fixes 3508. development Handle invalid number format on steps forms. Fixes 3504. development Pending Approval and Approved emails have environment, application, version which does not match targets. Fixes 3497. development Utility fix in entry package content reading. Fixes 3487. development

Release 5.0.19 – 2020-04-21

Type Changes By Amended WADL JAXB generation issue. Fixes 3480. development Improved UX on running jobs and infrastructure pages. Fixes 3476. development Fixed DB queries issues detected against MS SQL Server. Fixes 3473. development

Release 5.0.18 – 2020-04-03

Type Changes By Upgrade of distributed tomcat to 9.0.33. Fixes 3462. development Fixed bug on retried pipeline job execution. Fixes 3460. development Solved bug with artifacts plugins to get promoted packages. Fixes 3456. development UX improvements: - Update Libraries UI texts to Resources. - System menu reorganisation and improvement. - Renamed "Select Task" to "New Task" in context menu on project orchestration edition. - New remove feature in edition pages for projects, servers, installations and job plans. - Validation of target definition within job package in project job execution request. - Improvement on Packages tab in project edition page. - My Job Plans tab on server and installation edition pages. - New Project filter in infrastructure page. - Installation projects listing in infrastructure page. Fixes 3453. development Fixed and improved Jobs Visualization on project details page. Fixes 3452. development Amended bug when project root directory is changed in SCM plugin form. Fixes 3451. development Removed 1000 chars limitation on MOTD message. Fixes 3450. development

Release 5.0.17 – 2020-03-10

Type Changes By UX improvements: - Table filters persisted on user session. - Main tabs selection persisted on user session. - New additional action buttons in top panel of CRUD pages. - New orchestration diagram preview on project list row expansion details. - New targets list preview on project list row expansion details. - New job plan diagram preview on job plan list row expansion details. - New orchestration/pipeline diagram preview on future jobs row expansion details. - Data dictionary discovery process shows in which project files are found and warns if they are not found. Fixes 3344. development Added missing RapidDeploy Connector library into RD dependencies. Fixes 3438. development

Release 5.0.16 – 2020-02-14

Type Changes By Missing end characters on files following DataPower deployment. Fixes 3432. development WMQ files not being deployed. Some MQSC files are omitted. Fixes 3410. development Upgraded HSQL DB from 2.4.1 to 2.5.0 and Bitronix Transaction Manager from 2.1.0 to 2.1.4. Fixes 3413. development Fix the "View Approvals History" filter by date. Fixes 3401. development New migration plugin feature for projects on project import including a new plugin for RD 3.4 projects migration to RD 5.0. Fixes 3377. development Latest Java SE version 13 is supported. Fixes 3376. development

Release 5.0.14 – 2019-11-06

Type Changes By New optional parent job field in Run Job Plan dialog, enabling RD to run a job plans depending on a previous one. Fixes 3382. development The PDF which contains a complete list of possible settings in a page has truncated examples. Fixes 3358. development Deploy fails with cannot create ObjectName when using modifyEntAppConfig="true". Fixes 3328. development Amended minor UI issues on Job Plan Edition. Fixes 3380. development Solved bug to allow RD to include custom jars to project class path loaded from MV_HOME/lib directory. Fixes 3373. development

Release 5.0.13 – 2019-09-12

Type Changes By Fixed bug on Remote Directory Library Plugin. Fixes 3366. development Fixed bug on Git SCM plugin. Fixes 3362. development Solved issue on package list tab in project details page. Fixes 3360. development Improved "Command Runner" task from "Command and Script Execution" category. It was added a new optional task parameter for script base directory path. Fixes 3356. development Amended issue with Job Plan run and late job configuration validation. Fixes 3354. development Removed GNU utils on distribution packages and scripts for windows. Fixes 3343. development Improved Job Plan edition page. Fixes 3338. development Internal RD refactoring in order to handle dependencies separately from plugins code. Fixes 3309. development

Release 5.0.12 – 2019-07-11

Type Changes By Fixed issues on security pages: roles, project groups and environments. Fixes 3334. development Updated plugins icons and thumbnails. Fixes 3331. development Added auto classpath update feature on remote agent for new plugins not available on target. Fixes 3324. development Improvement on Job Plan edition page loading. Fixes 3317. development Updated File Based Repository artifact plugin. Added Regular Expression feature for file searching File Based Repository artifact plugin versions have changed to 5.0.1 All projects based on this plugin will require upgrading. Please see upgrade documentation for further instructions (http://docs.midvision.com/LATEST/install/upgrade.html). Fixes 3308. development Amended task jar paths dependency auto detection for project classpath. Fixes 3306. development Include the option to set minimum and maximum pool size for the DB2 datasource. Fixes 3298. development Strange error creating a cluster on WAS ND 7.0.0.41 on Windows. Fixes 3244. development New Transport and Cloud Provider plugin data libraries to be used in infrastructure configuration as a centralised way to manage credentials and common settings. Fixes 3227. development

Release 5.0.11 – 2019-04-08

Type Changes By Fixed project job log level loading on remote agent execution. Fixes 3288. development New auto refresh interval setting on user preferences for running jobs page. Fixes 3274. development Solved issue on project generation failure to rollback created files and directories. Fixes 3272. development Solved issue on target promotion feature. Also improved UX. Fixes 3270. development Changed project export operation to include hidden files. Fixes 3264. development Improved way to persist RD XML config files to allow use of symlink. Fixes 3265. development Improved project files panel in project details page. Fixes 3263. development Amended sensible info masking on project job log when the resources task are loaded. Fixes 3262. development Added new validation to avoid loading duplicated tasks found from different libs. Fixes 3260. development New SSH tasks to get files via SCP to the remote server from another server. Fixes 3259. development Improved performance on previous job page. Fixes 3251. development Creating DSN loop runs into ArrayOutofBounds. Fixes 3249. development New cut feature on orchestration edition. Fixes 3248. development New feature to enable user to save and user of late properties on Job Plans. Fixes 3247. development Upgraded HSQL built-in DB instance and libraries dependencies from 2.3.4 to 2.4.1. Fixes 3235. development Amended issue for dictionary entry value removal on target scope. Fixes 3231. development Removed plugins version history (Internal Feature) on persisted data. Fixes 3226. development ${approval.serverName} not rendered in approval email. Fixes 3225. development Fixed minor UI issue on project details page when SCM plugin operation buttons is pressed. Fixes 3220. development Amended issues on new Remote Directory Library. Fixes 3203. development New output counter param as result in tasks: - Category File - Operations: List Fileset, Move a Fileset, Copy a Fileset, Delete a Fileset, List Files, Simple Copy and Simple Delete - Category String: Split String. Fixes 3201. development New buttons spacer to identify better the remove button among other buttons in every table row actions. Fixes 3184. development

Release 5.0.10 – 2018-11-23

Type Changes By Amended UI issue to change password for super user when LDAP authentication is enabled. Fixes 3222. development New Remote Directory Library. Fixes 3203. development Fixed job plan description length validation. Fixes 3189. development Improved Running Jobs page. Fixes 3178. development Amended bug on DD target entries promotion operation. Fixes 3173. development Amended bugs on library resources backup and restore operations. Fixes 3172. development Updated Microsoft Azure cloud plugin based on latest APIs version 1.15.0. Added new Azure tasks. Azure cloud provider plugin versions have changed to 5.0.1 All target servers defined in infrastructure based on this plugin will require upgrading and reconfiguring. Please see upgrade documentation for further instructions (http://docs.midvision.com/LATEST/install/upgrade.html). Fixes 3151. development New failure branch feature for pipeline steps. Fixes 3117. development

Release 5.0.9 – 2018-07-18

Type Changes By Amended bug detected on setting and displaying job plan notes. Fixes 3141. development Improved framework license management. Fixes 3133. development Amended bugs on Active Directory authentication provider. Fixes 3131. development New Job Plan Variables features, including new tasks to set and get values into job plan variables. Fixes 3123. development

Release 5.0.7 – 2018-06-28

Type Changes By Improved build-in HSQLDB application to avoid DB shutdown issues when RD is running on a cloud instance. Fixes 3130. development Improvements on ROLLBACK package management during job execution. Fixes 3127. development Remove Working Directory from Orchestration settings. Fixes 3121. development Amended UI bugs on Plugin Manager page. Fixes 3122. development Amended lib dependencies on JBoss plugin. Fixes 3116. development Plugin update hangs from project panel. Fixes 3114. development Implement the "executeCommandOnTarget" method for the Remote Agent transport plugin. Fixes 3110. development New permission view table on security user details page. Fixes 3108. development New System Backup and Restore Features. Fixes 3107. development Updated all plugins versions to match with the framework one. REQUIRED ACTION: In order to update all your plugins configuration data to the latest one, please navigate to Help -> Plugin Manager. You can call the update operations from there using the Update Plugin Data button (spanner icon). Fixes 3106. development SendMailTask from orchestration when not using SMTP authentication not working. Fixes 3102. development 'mqsiapplybaroverride' is not working for applications. Fixes 3101. development Server restart step. Fixes 3094. development Added new files extensions and max file size to exclude on Data Dictionary entries discovery process. Fixes 3093. development Amended issues with targets values when the key of a Data Dictionary entry has changed. Fixes 3092. development Fixed bug on Telemetry rejection validation. Fixes 3084. development Solved issue in Condition Task context when the task is set within a Loop Task thread. Fixes 3083. development New features to support target auto discovering when the project files are shared between multiple projects. Fixes 3081. development New configuration validation for invalid targets on project edition. Fixes 3080. development Updated IIS plugins to support latest IIS versions, added new Windows Tasks for DSIM and AppCmd command-line tools. Fixes 3078. development New WebSphere Application Server 9.0 plugin. Fixes 3077. development Solved issues for TFS Library managing in Windows. Added new TFS SCM plugin. Improved management of TEE dependencies and upgraded to version 14.134.0. Fixes 3014. development

Release 5.0.5 – 2018-01-12

Type Changes By Improved UX regarding user session time out. Fixes 3041. development Updated MidVision EULA terms. Fixes 3040. development Fixed bug on DataPowerGenericSoapTask. Fixes 3038. development Fixed bug on new package creation service. Fixes 3032. development Amended bug on Job Plan edition when a referenced target was removed from a project. Fixes 3029. development Added new dedicated authentication provider for Active Directory and improvements on all authentication mechanisms. Updated LDAP authentication documentation. Fixes 3028. development Install WebSphere resource environment provider with multiple referenceables. Fixes 3023. development

Release 5.0.4 – 2017-11-14

Type Changes By Solved functional bug on pipeline execution. Fixes 3015. development The buttons for a manual SCM plugin are not shown. Fixes 3013. development Add support for SQL Server as the RapidDeploy database. Fixes 3009. development Improved built-in DB application to avoid data lost on unexpected shutdown. Fixes 3006. development Reorganisation of libraries dependencies for remoting plugin and orchestration core library. Fixes 2990. development Fixed UX issues on Dictionary Resources management. Fixes 2989. development Amended issue on pipeline retry operation when a failed job is part of a sequence of jobs within a step. Fixes 2985. development Amended UX issue on Server creation page. Fixes 2984. development New Java binaries deployment and Remoting Agent deployment/start pipeline steps as part of a Job Plan. Fixes 2979. development Job Plan and orchestration diagrams edition pages were improved avoiding scrolling issues. Fixes 2976. development Fixed target validations on InitialisationTask when latest config is set. Fixes 2972. development New Project Job Plans list on project details page. Fixes 2966. development NameError: exportFile exception when running WebSphereConfigPropertiesExportTask (8.5.5). Bug in 'AbstractConfigPropertiesTask' class. Fixes 2965. development

Release 5.0.3 – 2017-09-11

Type Changes By New plugin for Codehaus Cargo. Fixes 2881. development QuerySyntaxException thrown when trying to navigate to a job via the packages tab - fixed. Fixes 2959. development Implement a new dynamic resource type to handle maps for task resources. Fixes 2958. development Amended UI bug on task floating panel in project details page. Fixes 2951. development Added new Data Dictionary Resource Library format to be managed by projects as external source for data dictionary entries. Fixes 2863. development New Helix Perforce Repository external library. Fixes 2943. development New feature for orchestration diagram navigation and management through keyboard. Fixes 2775. development

Release 5.0.2 – 2017-08-02

Type Changes By Added new internal feature for pipeline backward compatibility. Fixes 2944. development Tooltip for the hostname in the server details has a typo Addresse should be Address. Fixes 2941. development Minor UX issue on server creation was fixed. Fixes 2937. development Adding schema task resource to Flyway tasks and using this new feature in RapidDeploy database initial scripts. Fixes 2936. development Added version 1.1 of RapidDeploy CLI to the assembly. Fixes 2925. development Additional tutorial content added: RapidDeploy Command Line, Import Export. Fixes 2886. development Running jobs UX improvement was added. Fixes 2773. development New filters on Operations View page. Fixes 2737. development Improve the RunRDDeploymentTask and the CreateRDDeploymentPackageTask to call calling instance by default. Fixes 2701. development

Release 5.0.1 – 2017-07-20

Type Changes By Query to database fixed in order to meet DB2 limitation. Fixes 2933. development Improved login time response. Fixes 2935. development New RapidDeploy tutorial notification message and wizard dialog. Current tutorial content available: Overview, Resources, Infrastructure, Projects and Job Plans. Fixes 2886. development

Release 5.0.0 – 2017-07-11

Type Changes By Service installation script for Remote Agent supports spaces in the installation path. Fixes 2929. development Amended bug when definitions files transfer has same source and target path. Fixes 2928. development Fixed UI bug on Resource Libraries page. Fixes 2927. development Previous Jobs page improvement. Fixes 2924. development Added job execution improvement. New latest config feature on one-click run target job. Fixes 2922. development Primefaces upgraded to 6.1. Fixes 2920. development Libraries model simplified, target link was removed. Fixes 2919. development New improvements on Resource Libraries management. Fixes 2918. development New Infrastructure list page merging Server and Installation (Environments) list pages both in one. Fixes 2915. development New feature enabling the ability to manage multiple jobs on each Job Plan step flow. Fixes 2914. development Incorrect AWS locations fixed. Fixes 2913. development Fix for issue detected when project and job plan uploading shares same FS locations. Fixes 2912. development New host name validation on project job request operation. Fixes 2911. development Late Configuration setup UI Fix on Job Plan Edition page. Fixes 2910. development Amended bug on build-in variable replacement for DD entries. Fixes 2903. development New RapidDeploy Command Line Interface. Fixes 2890. development Amended Composite variables replacing for DD entries. Fixes 2831. development Liquibase plugin. Fixes 2761. development Deprecate Oracle, MySql and MsSql specific database plugins - These are replaced with the newer DBMaestro, Flyway and Liquibase plugins for all Database operations. Fixes 2923. development