Release Notes 24.09.08

home / Download /Release Notes 24.09.08

Apache OFBiz® 24.09.08, released in November 2026, is the eighth release of the 24.09 series, which has been feature-frozen since September 2024, receiving only bug fixes.

Security fixes

Backport pr 1502 - Fixed: Add validation for product image file names in renameImage to prevent path traversal in #1505
Backport PR 1512 - Improved: hardens validation of screen location in #1528
Improved: Authorization enforcement for HumanRes category tree data access (#1637) in #1640
Tighten how suffix-selected views resolve against their owning request map in #1645
Improved: Enhance RequestHandler view state persistence and screen location resolution (#1624) in #1653
Restrict widget resource locations to component:// or an explicit allowlist (#1650) in #1654
Improved: Validate tenant ID before creating a per-tenant delegator in #1663
Improved: Add validation and permission check to replaceImageToExistImage service in #1672
Improved: Add permission check and path validation to imageCrop and imageRotate services in #1676
Improved: Add missing permission and path checks across ImageManagementServices methods in #1680
Improved: Check path containment before invoking SecuredUpload.isValidFileName in isValidProductImageFileName in #1685
Improved input handling and access control around the invoice email-aending flow in #1706
Improved webtools data file viewer URL handling (#1707) in #1708
Improved externalLoginKey handling for cross-application navigation (…#1710) in #1713
Improved: escape link parameter values in MacroScreenRenderer.renderLink (#1711) in #1715
Improved: add permission and path checks to XmlDsDump.groovy (#1712) in #1714
Introducing upper bound for rowCount in MultiForm-Requests (#1691) in #1716
Improved: authorization checks on Catalog and Order Manager helper routes (#1717) in #1728
Improved: Align survey template location resolution with other widget/template loaders (#1730) in #1732
Improved: Build an explicit DocumentBuilder for XML-typed content rendering in ContentWorker (#1731) in #1733
Improved: Anchor content role-creation permission checks to the target content (#1734) in #1737
Improved: Reuse existing catalog permission checks for search-result bulk actions (#1735) in #1738
Improved: Anchor catalog quick-admin write events to their permission tier (#1739) in #1740
Improved: bind EntityFunction literal values as SQL parameters instead of inlining them (#1729) in #1742
Fixed: updateLayout authorizing under CONTENT_CREATE then updating unrelated records unchecked (#1745) in #1746
Fixed: CMS use-when expressions still templated into string literals in #1789
Fixed: arbitrary service execution via Content.serviceName in ContentWorker in #1791
Improved: Align tenant resolution between LoginWorker and ContextFilter (#1835) in #1841
Fixed: externalLoginKey enable flag never checked, cannot be changed live (OFBIZ-13519) in #1848
Improved: Route the layout-image events through the permission-checked content services and tighten data resource template rendering (#1846) in #1857
Improved: Bind externalLoginKey to its intended destination webapps instead of validating against any webapp on the server (OFBIZ-13522) in #1856
Fixed: AdminServer no longer starts without a configured admin key in #2067
Fixed: ViewFile no longer discloses arbitrary properties or xml files in #2080
Improved: moveContentJson lets a caller without UPDATE permission re-parent content associations in #2065
Fixed: createReturnItem() does not cap returnPrice to returnablePrice for non-privileged callers in #2083
Improved: deleteContentJson lets a caller without DELETE permission detach content and cascade-delete its alias subtree in #2100
Fixed: quickReturnFromOrder() permission guard is a no-op due to an operator-precedence error in #2102
Improved: added a rotateSecretKeys Gradle task to unconditionally replace an already-set JWT/password secret key in #2091
Fix: Adds missing CREATE and UPDATE accounting permissions in #2211
Fixed: Hardens security by adding missing permission check in #2218
Fixed: Enforces order-update authorization in updateOrderPaymentPreference in #2258
Fixed: createReturnItem() does not verify OrderItem ownership before attaching it to a ReturnHeader in #2271
Fixed: Missing permission checks on FinAccount create/update/delete services in #2266
Improved: Scope password-reset JWTs to their purpose, confined to the password-change flow in #2277
Fixed: Missing permission checks on FinAccount GL-reconciliation services (OFBIZ-13683) in #2302
Fixed: Encode the source URL of screen image widgets in #2360
Fixed: Enforces order-update authorization in updateShipGroupShipInfo and addItemToApprovedOrder in #2362
Fixed: Require the ORDERMGR_UPDATE permission in the updateTrackingNumber service in #2364
Fixed: Check the owner of the shopping list in checkShoppingListSecurity in #2377
Fixed: Check that the dataResourceId belongs to the contentId in SimpleContentViewHandler in #2379
Implemented: Remove Janrain matches from SpotBugs exclude.xml in #2383
Fixed: ModelApiReader resolved omitted auth/publish attributes to false, opposite of rest-api.xsd's declared default in #408
Implemented: Remove Janrain integration in #454

Security hardening

Backport pr 1388: Improved: Simplify handling of hidden fields in order search form in #1389
Fixed: unrestricted file destination in DataServices createFile/updateFile in #1748
Improved: Validate the InventoryItem and the issued quantity in the issueInventoryItemToShipment service in #2238
Improved: Validate the FTP connection target hostname in sendContentToFtp before connecting in #2275

Bug fixes

Fixed: duplicate QuoteRole insertion error in copyQuote service (OFBIZ-13436) in #1347
Backport PR #1360: 'Fixed: Disable Quick Receive and Receive buttons on the Order View page when a PO has multiple ship groups (OFBIZ-13442)' in #1361
Backport pr 1393 - Fixed: Fix various display issues in the Order View and Receive Inventory screens for Purchase Orders in #1402
Fixed: EntityExpr no longer hardcodes the "default" delegator when validating condition types (OFBIZ-5100) in #1420
Fixed: E-commerce search and product detail no longer leak products across catalogs (OFBIZ-4755) in #1500
Fixed: Gift card purchase copyMe (BCC purchaser) can never work (OFBIZ-13464) in #1504
Fixed: OFBizTestCase-based integration tests never run on release24.09 (OFBIZ-13469) in #1513
Fixed: Gradle build failure in a linked git worktree (OFBIZ-13470) in #1518
Fixed: Reject shipments mixing ship groups with different destinations (OFBIZ-5346) (backport to release24.09) in #1509
Fixed: PAssed setIfEmpty True on updating Invoice header and Invoice … in #1536
Fixed : Child communication event sorting. (OFBIZ-8152) in #1538
Fixed: MissingMethodException thrown during the execution of the updateProductStore service when attempting to expire existing facilities. (OFBIZ-13472) in #1539
Fixed: PDF upload accepted embedded attachments when ZUGFeRD upload was disabled (OFBIZ-13485) (backport to release24.09) in #1574
Fixed: URLConnector.openUntrustedConnection(...) public overloads silently performed trusted SSL connections (OFBIZ-13484) in #1570
Fixed: Remove HOSTCERT_MIN_CHECK from SSLUtil (OFBIZ-13482) (backport to release24.09) in #1560
Fixed: Broken javamail-container sample in ofbiz-component.xml in #1551
Fixed: sendFailureNotification NPEs on default sendFrom, masking the original SMTP error (OFBIZ-13477) in #1549
Fixed: MultiTrustManager doing flat cert-equality checks instead of real X.509 chain validation (OFBIZ-13476) in #1546
Fixed: isExecutable() mime-type comparisons never matched Tika's actual types (OFBIZ-13486) in #1585
Fixed: isExecutable() missed Tika's ELF sub-types, letting real Linux binaries through the check (OFBIZ-13486) in #1601
Fixed: HashMaps are not properly rendered in FTL with current FTL integration (OFBIZ-13164) in #1616
Fixed: noWebshellInMetadata NPEs when readMetadata can't parse the file in #1623
Fixed: distTar/distZip ships unused Node.js runtime caches, bloating the distribution archive (OFBIZ-13491) in #1631
Fixed: ControlFilter's FreeMarker-interpolation guard was unreachable due to fail-open security check (OFBIZ-13492) in #1642
Fix webtools Run Suite/Run Case: missing prerequisites and shared ambient transaction (#1655) in #1656
Fixed: TaxAuthority lookup allows selecting parties without the TaxAuthority role (OFBIZ-12374) in #1697
Fix content visibility check in help screens (#1703) in #1705
Fixed: jQuery 4.0 migration broke legacy API usage in common-theme (OFBIZ-13510) in #1830
Fixed: jGrowl toast messages use wrong readmore-js option (OFBIZ-13512) in #1832
Fixed: Legacy jQuery.noConflict() in imagemanagement templates breaks common-theme JS (OFBIZ-13513) in #1834
Fixed: Service dispatcher local context race causes intermittent NullPointerException (OFBIZ-13508) in #1822
Fixed: EntityEcaUtil cache-rebuild race under concurrent Delegator construction (OFBIZ-13517) in #1840
Fixed: addOrderShipmentToShipment/getQuantityForShipment broken since the minilang-to-Groovy conversion (OFBIZ-13521) in #1854
Fixed: createOrderShipmentPlan leaks order items across ship groups (OFBIZ-13520) in #1853
Fixed: CategoryContentServicesScript related-URL, SEO, and download-update regressions (OFBIZ-13548) in #1863
Fixed: createInvoiceItemPayrol crashes on Deduction/Tax amount entry (OFBIZ-13561) in #1865
Fixed: checkContentOperationSecurity crashes when content has a purpose assigned (OFBIZ-13535) in #1867
Fixed: ProductServices group-order, discontinuation, and review regressions (OFBIZ-13537) in #1869
Fixed: quickShipEntireOrder calls undefined errorMessage() instead of error() (OFBIZ-13564) in #1872
Fixed: ContentServices status-transition and content-creation regressions (OFBIZ-13540) in #1873
Fixed: CommunicationEventServices sender/recipient and status regressions (OFBIZ-13542) in #1880
Fixed: CheckoutServices anonymous-checkout party reattachment and createUpdatePerson new-party-id regressions (OFBIZ-13544) in #1882
Fixed: updateBlogEntry checks the wrong field for existing article text (OFBIZ-13545) in #1884
Fixed: updatePartyInvitation crashes when auto-deriving the invitee name (OFBIZ-13553) in #1886
Fixed: createUpdateCustomerAndShippingAddress leaves shipToAddressCtx.partyId stale after a new party is created (OFBIZ-13565) in #1890
Fixed: TaxAuthorityServices tax-ID validation and update regressions (OFBIZ-13555) in #1888
Fixed: voidPayment throws on a non-invoice payment application (OFBIZ-13560) in #1894
Fixed: lookupParty crashes on empty search criteria (OFBIZ-13556) in #1892
Fixed: DataServices content-upload and data-resource regressions (OFBIZ-13562) in #1898
Fixed: duplicateCategoryEntities throws GroovyCastException (OFBIZ-13563) in #1901
Fixed: createQuoteFromCart duplicates QuoteAdjustment records (OFBIZ-13525) in #1904
Fixed: Quote service permission checks don't match original design (OFBIZ-13526) in #1906
Fixed: productPriceGenericPermission ignores its own sub-check result (OFBIZ-13538) in #1908
Fixed: Party permission-check helper methods use incorrect logic (OFBIZ-13541) in #1911
Fixed: straightLineDepreciation uses wrong field for elapsed years (OFBIZ-13524) in #1913
Fixed: findCustomTimePeriods thruDate boundary and exclude flag (OFBIZ-13527) in #1915
Fixed: getFXConversion fails instead of defaulting to 1 when no rate configured (OFBIZ-13531) in #1917
Fixed: hasValidStateProvince returns String but declared Map (OFBIZ-13533) in #1919
Fixed: PartyServices contact-lookup and role-hierarchy regressions (OFBIZ-13534) in #1922
Fixed: Correct portlet sequence drag and drop boundaries and calculation (OFBIZ-13528) in #1924
Fixed: convertUom custom parameters and rounding regressions (OFBIZ-13530) in #1932
Fixed: filterRateAmountList sequential filtering and fallback behavior (OFBIZ-13543) in #1934
Fixed: createMissingCategoryAndProductAltUrls default parameter handling (OFBIZ-13539) in #1936
Fixed: createLead person creation guard for company-only leads (OFBIZ-13549) in #1938
Fixed: getProductRouting virtual product variant date filtering (OFBIZ-13550) in #1940
Fixed: getSystemInfoStatus open communication events condition (OFBIZ-13551) in #1942
Fixed: sendOrderDeliveryScheduleNotification malformed from address (OFBIZ-13552) in #1944
Fixed: applyFeatureToProductFromTypeAndCode sequenceNum mutation (OFBIZ-13554) in #1947
Fixed: updateBudgetStatus silent success on invalid status transitions (OFBIZ-13558) in #1949
Fixed: copyAgreement silent success when agreement does not exist (OFBIZ-13559) in #1951
Fixed: createFacilityLocation locationSeqId collision fallback regression (OFBIZ-13557) in #1953
Fixed: PortalPageMethods portlet attribute saving and page copying regressions (OFBIZ-13568) in #1955
Fixed: Mini-lang to Groovy regressions in InvoiceServicesScript (OFBIZ-13569) in #1957
Fixed: Mini-lang to Groovy regressions in CommonServicesScript (OFBIZ-13570) in #1959
Fixed: error in creating category image content. (OFBIZ-12011) in #1695
Fixed: Mini-lang to Groovy regressions in QuoteServicesScript (OFBIZ-13571) in #1961
Fixed: MiniLang to Groovy conversion issues in ContactMechServicesScript (OFBIZ-13572) in #1964
Fixed: Mini-lang to Groovy regressions in InvoiceServicesScript (OFBIZ-13575) in #1970
Fixed: updateBudgetStatus invalid-transition error omits the requested status (OFBIZ-13558) in #1972
Fixed: Mini-lang to Groovy regressions in ProductStoreServices (OFBIZ-13576) in #1975
Fixed: Mini-lang to Groovy regressions in InventoryIssueServices (OFBIZ-13577) in #1977
Fixed: Mini-lang to Groovy regressions in ShoppingListServicesScript (OFBIZ-13579) in #1979
Fixed: Mini-lang to Groovy regressions in PortalPageServices (OFBIZ-13580) in #1981
Fixed: Mini-lang to Groovy regressions in EmailServicesScript (OFBIZ-13581) in #1983
Fixed: Timing-dependent deadlock-retry test in service engine (OFBIZ-13585) in #1989
Fixed: updateContentPermission grants UPDATE via ancestor ownership without an ownership change request (OFBIZ-13592) in #1997
Fixed: Six regressions in the minilang-to-Groovy conversion of PaymentServices.groovy (OFBIZ-13596) in #1999
Fixed: createEmailAddress and updateEmailAddress accept blank email addresses (OFBIZ-13582) in #2002
Fixed: Two regressions in the minilang-to-Groovy conversion of CommonServicesScript.groovy (OFBIZ-13583) in #2004
Fixed: createUpdateBillingAddressAndPaymentMethod throws NPE for anonymous checkout (OFBIZ-13584) in #2007
Fixed: updatePartyRate does not persist expiry of the previous rate (OFBIZ-13590) in #2013
Fixed: Two regressions in the minilang-to-Groovy conversion of ContentServicesScript.groovy (OFBIZ-13589) in #2009
Fixed: setCommEventRoleToRead and setCommunicationEventRoleStatus throw NPE when no role exists (OFBIZ-13591) in #2016
Fixed: Four regressions in the minilang-to-Groovy conversion of PartyServicesScript.groovy (OFBIZ-13593) in #2019
Fixed: getLastSystemInfoNote off-by-one on note 2 and note 3 thresholds (OFBIZ-13586) in #2021
Fixed: checkInvoiceStatusInProgress loses its specific error messages (OFBIZ-13587) in #2023
Fixed: setPortalPortletAttributes doesn't clean up blank attribute values (OFBIZ-13588) in #2027
Fixed: updatePartyInvitation silently no-ops on a nonexistent record (OFBIZ-13594) in #2030
Fixed: accAndDecPartyInvitationPermissionCheck shows the wrong error message on an identity mismatch (OFBIZ-13595) in #2032
Fixed: Two regressions in saveExtFileDataResource's handling of a missing DataResource (OFBIZ-13597) in #2034
Fixed: Three regressions in the minilang-to-Groovy conversion of PaymentServices.groovy (OFBIZ-13600) in #2052
Fixed: Multiple regressions and one pre-existing bug in WorkEffortServicesScript.groovy (OFBIZ-13601) in #2054
Fixed: visualThemePermissionCheck() checks a permission ID that doesn't exist (OFBIZ-13602) in #2057
Fixed: createFuturePeriod() crashes with NullPointerException when CustomTimePeriod SystemProperty config is missing (OFBIZ-13604) in #2061
Fixed: PBKDF2 password verification always fails in HashCrypt.doComparePbkdf2 (OFBIZ-13609) in #2104
Fixed: Two regressions in the minilang-to-Groovy conversion of CommonServicesScript.groovy (OFBIZ-13610) in #2106
Fixed: Three regressions in the minilang-to-Groovy conversion of PortalPageServices.groovy (OFBIZ-13611) in #2108
Fixed: HashCrypt compares non-PBKDF2 password hashes with variable-time String.equals() (OFBIZ-13615) in #2110
Fixed: Regression in the minilang-to-Groovy conversion of ProductStoreServices.groovy (OFBIZ-13613) in #2114
Fixed: Regression in the minilang-to-Groovy conversion of ContactMechServicesScript.groovy (OFBIZ-13612) in #2112
Fixed: Regression in the minilang-to-Groovy conversion of InventoryIssueServices.groovy (OFBIZ-13614) in #2116
Fixed: Two regressions in the minilang-to-Groovy conversion of PriceServicesScript.groovy (OFBIZ-13616) in #2118
Fixed: DELETE statements built from EntityCondition inlined values as SQL literals instead of binding them (OFBIZ-13620) in #2120
Fixed: Three regressions in the minilang-to-Groovy conversion of CostServices.groovy (OFBIZ-13617) in #2122
Fixed: Two regressions in the minilang-to-Groovy conversion of ProductionRunServicesScript.groovy (OFBIZ-13618) in #2124
Fixed: Regressions in the minilang-to-Groovy conversion of OrderReturnServicesScript.groovy (OFBIZ-13619) in #2126
Backport pr 2062 - Fix path interpretation for windows machines (#2062) in #2127
Fixed: Six regressions in the minilang-to-Groovy conversion of ProductServicesScript.groovy (OFBIZ-13621) in #2144
Fixed: Two regressions in the minilang-to-Groovy conversion of ContentServicesScript.groovy (OFBIZ-13622) in #2146
Fixed: Two missing null-guards in CommunicationEventServicesScript.groovy (OFBIZ-13623) in #2152
Fixed: getBlogEntry() only returns templateDataResourceId for posts with an image (OFBIZ-13624) in #2154
Fixed: uploadProductImages() silently drops every image after the first populated slot (OFBIZ-13625) in #2156
Fixed: viewContentPermission() never propagates roleEntity/roleEntityField (OFBIZ-13626) in #2158
Fixed: followPartyRelationshipsInline() silently returns zero relationships instead of unrestricted (OFBIZ-13627) in #2160
Backport: Fix webtools ProgramExport, Cache Maintenance and Thread List; normalise the ProgramExport pattern list (#1845) in #2175
Fixed: Do not evaluate the expand/collapse link of tree widgets as an expression (OFBIZ-13639) in #2192
Fixed: Do not evaluate a request parameter as an expression in the return-user-message from-field (OFBIZ-13640) in #2194
Fixed: Do not evaluate the Ajax update area string of forms twice as an expression (OFBIZ-13641) in #2196
Fixed: Do not evaluate the values of the callback token of forms as expressions (OFBIZ-13642) in #2199
Fixed: Do not evaluate the area id and target of the Ajax update areas of forms twice as an expression (OFBIZ-13643) in #2201
Fixed: Keep the redirection of a path alias to its aliasTo on the web site (OFBIZ-13645) in #2205
Fixed: Enforce the allowed types of the XStream deserialization in UtilXml (OFBIZ-13647) in #2209
Fixed: Escape the backslash and the braces in the macro strings of the menu, tree and form renderers (OFBIZ-13649) in #2220
Fixed: Reject untrusted certificates in MultiTrustManager when the all-trusted properties are missing or empty (OFBIZ-13654) in #2230
Fixed: Navigate Accounts fails with a NullPointerException when no glAccountId is given (OFBIZ-13651) in #2227
Fixed: Call to non-existing method in production run PDF reports (OFBIZ-13504) [release24.09] in #1828
Fixed: Do not request the non-existent jquery-validation messages_en.js on every page (OFBIZ-13652) in #2228
Fixed: Remove the unused viewprofile request of the accounting webapp, which fails with an error page (OFBIZ-13653) in #2229
Fixed: The phone extension entered when creating an SFA account or lead is silently dropped (OFBIZ-13657) in #2234
Fixed: Converted Groovy scripts read configuration with UtilProperties, ignoring SystemProperty overrides the original mini-lang honoured (OFBIZ-13655) in #2236
Fixed: Regressions in CategoryServicesScript.groovy introduced by the mini-lang conversion (OFBIZ-13659) in #2242
Fixed: Regressions in ShipmentServices.groovy introduced by the mini-lang conversion (OFBIZ-13661) in #2246
Fixed: Regressions in QuoteServicesScript.groovy introduced by the mini-lang conversion (OFBIZ-13660) in #2244
Fixed: Regressions in ShoppingListServicesScript.groovy introduced by the mini-lang conversion (OFBIZ-13662) in #2250
Fixed: getOrderedSummaryInformation ignores explicit fromDate and thruDate (OFBIZ-13664) in #2254
Fixed: Promo conditions PPIP_ORST_YEAR and PPIP_ORST_LAST_YEAR read the order sub-total from the wrong map (OFBIZ-13667) in #2256
Fixed: Anonymous ecommerce checkout accepts an arbitrary partyId and lets it be used to overwrite another party's name and attach caller-supplied contact and payment data to that party (OFBIZ-13669) in #2264
Fixed: Payment method create services accept a caller-supplied paymentMethodId without verifying it belongs to the authorized party (OFBIZ-13671) in #2269
Fixed: updateContactList does not enforce marketing UPDATE permission (OFBIZ-13672) in #2273
Fixed: Use of externally-controlled format string in Debug logging utility (backport) in #2280
Fixed: URL.getFile() used as a filesystem path breaks OFBiz when the install directory contains a space (OFBIZ-13687) in #2317
Fixed: Allow the content upload directory in the default LOCAL_FILE allow-list (OFBIZ-13689) in #2327
Fixed: PDF survey services fail to store answers and throw a NullPointerException when no PDF is given (OFBIZ-13688) in #2329
Fixed: Preserve Webtools theme when editing entities (OFBIZ-12072) in #2261
Fixed: Survey PDF services read any server file named in the pdfFileNameIn parameter (OFBIZ-13690) in #2332
Fixed: Survey PDF services throw a NullPointerException when contentId matches no Content (OFBIZ-13692) in #2342
Fixed: cleanAll deletes the version-controlled package-lock.json files (OFBIZ-13695) in #2344
Fixed: PDF files with a ZUGFeRD invoice are always rejected on upload in #2350
Fixed: Encode the source URL of menu, tree and form images in #2366
Fixed: CodeQL workflow fails while printing debug logs in #2370
Fixed: Encode the sort links of list forms and check every URL parameter in ControlFilter in #2368
Fixed: init-gradle-wrapper installs a wrapper jar that does not match the published checksum (OFBIZ-13699) in #2375
Fixed: Check ownership of the order, payment method and shipping address used by shopping lists (OFBIZ-13701) in #2385
Fixed: Shopping list permission services check the wrong permission action (OFBIZ-13702) in #2389
Fixed: First Data config form non-functional and Java integration quality issues (OFBIZ-11837) in #313
Added: Demo copyMe survey question for gift card purchase (OFBIZ-13464) in #343
Fixed: myportal login view-map missing auth="false" (OFBIZ-13511) in #388
Fixed: ProjectServices regressions in date combining and project scheduling (OFBIZ-13529) in #397
Fixed: FactServices child invoice item filtering and order lookup regressions (OFBIZ-13536) in #399
Fixed: Multiple regressions in the minilang-to-Groovy conversion of ProjectServicesScript.groovy (OFBIZ-13607) in #416
Improved: Generate a longer password for the users created by the LinkedIn and GitHub login of the passport plugin (OFBIZ-13658) in #428
Fixed: Vulnerable source-map-js in example/vite-react-app flagged by Dependabot security alert in #433
[release24.09] Fixed: Administrator profile on ecommerce shows FTL error (OFBIZ-13475) in #434
Fixed: Plugin demo DataResources of type LOCAL_FILE are rejected by the LOCAL_FILE allow-list (OFBIZ-13691) in #443
Fixed: A database error while indexing deletes the product or content from the Lucene index (OFBIZ-13698) in #450
Fixed: A database error while indexing adds an incomplete product or content document to the Lucene index (OFBIZ-13700) in #452

Improvements

Improved: Replace commons-imaging with metadata-extractor + TwelveMonkeys ImageIO TIFF plugin (OFBIZ-13507) in #1821
Improved: Allow testIntegration to run with --portoffset for concurrent test runs (OFBIZ-13518) in #1843
Improved: javadoc no longer depends on docs.groovy-lang.org at build time (OFBIZ-13566) in #1896
Improved: Resolve component: locations with ComponentLocationResolver in CommonEvents.openSourceFile and make ComponentConfig.getComponentConfig(String) lookup-only (OFBIZ-13629) in #2165
Improved: Remove the unused FoPrintServerEvents (OFBIZ-13631) in #2170
Improved: Build Java explicitly with Gradle in the CodeQL workflow in #2174
Improved: Return the validated file from SecurityUtil.checkOfbizFileAllowList and use it for the file access (OFBIZ-13632) in #2172
Improved: Always protect FileUtil.unzipFileToFolder against zip slip (OFBIZ-13633) in #2181
Improved: Remove the accept-all hostname verifier option from SSLUtil and HttpClient (OFBIZ-13634) in #2183
Improved: Remove the unused UtilHttp.getAllowAllHttpClient (OFBIZ-13635) in #2185
Improved: Use SecureRandom to generate promo codes, captcha codes and generated IDs (OFBIZ-13636) in #2187
Improved: SafeObjectInputStream allowList matches class names as substrings and ships with unescaped dots (OFBIZ-13637) in #2189
Improved: Keep the area id and target of the update areas of forms as expressions (OFBIZ-13644) in #2203
Improved: Grant the packages write permission of the docker image workflow to its job (OFBIZ-13646) in #2207
Improved: Strip the control characters from the Location header of the redirects of RequestHandler and of the SEO forward filters (OFBIZ-13650) in #2222
Improved: GL-posting and order-completion invoicing commit-ECAs lack run-as-user="system" (OFBIZ-13673) in #2279
Improved: Bump github/codeql-action/init and analyze from 4.38.2 to 4.38.3 in #2304
Improved: Label pull requests titled "Bump ..." as dependencies so that the release notes leave them out (OFBIZ-13696) in #2348
Improved: Set the release_branch label of pull requests automatically (OFBIZ-13696) in #2352
Improved: Group the security fixes and security hardening in the release notes (OFBIZ-13696) in #2387

New features

Implemented: Generate release notes with GitHub and label pull requests by type from their title prefix (OFBIZ-13696) in #2346

Other changes

OFBIZ-13402 Move test sources from src/main/groovy to src/test/groovy (release24.09) in #1353
Fixed: Add permission checks to WebAnalyticsConfig services in #2308