Compatible bundle & technology package versions

Bundles:document enhancer: 0.23.2document conversion: 1.17.2email conversion: 0.39.2image conversion: 1.16.2anno migrator: 1.14.2archive migrator: 0.15.2web toolkit addon: 1.18.2Technologiepakete:tesseract (ocr): 1.32.3pdf persmissions: 1.17.3virus scan: 0.12.3html conversion: 1.17.3decompress: 1.15.7ms word: 0.20.1ms excel: 0.20.1ms powerpoint: 0.20.1

Task

Fixed CVEs

• CVE-2026-5598 in Bouncy Castle Provider (bcprov-jdk18on:1.83): fixed by update to 1.84
• CVE-2026-22753, CVE-2026-22754 in Spring Security: fixed by update to 7.0.5
• CVE-2026-42198 in PostgreSQL: fixed by update to 42.7.11
• CVE-2026-42577, CVE-2026-42579, CVE-2026-42582, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587 in Netty: fixed by update to 4.2.13.Final
• CVE-2026-40972, CVE-2026-40973, CVE-2026-40976 in Spring Boot: fixed by update to 4.0.6
• CVE-2026-40682, CVE-2026-42027 and CVE-2026-42440 in Apache OpenNLP: fixed by removing the dependency

Task

Compatible bundle & technology package versions

Bundles:document enhancer: 0.22.1document conversion: 1.16.1email conversion: 0.38.1image conversion: 1.15.1anno migrator: 1.13.1archive migrator: 0.14.1web toolkit addon: 1.17.1Technologiepakete:tesseract (ocr): 1.31.0pdf persmissions: 1.16.0virus scan: 0.11.5html conversion: 1.16.4decompress: 1.16.5ms word: 0.19.4ms excel: 0.19.4ms powerpoint: 0.19.5

Task

CVE-2026-39304

Because of CVE-2026-39304 in activemq-client Version 6.1.8, we updated activemq-client to the fixed Version 6.2.4.

Sub-task

CVE-2026-29129, CVE-2026-29145, CVE-2026-29146, CVE-2026-24880, CVE-2026-34486, CVE-2026-34487, CVE-2026-34483

Because of CVE-2026-29129, CVE-2026-29145, CVE-2026-29146, CVE-2026-24880, CVE-2026-34487, CVE-2026-34483 and CVE-2026-34486 in tomcat-embed-core version 11.0.18 and 11.0.20, we updated tomcat-embed-core to the fixed Version 11.0.21.

Sub-task

GHSA-2m67-wjpj-xhg9

Because of GHSA-2m67-wjpj-xhg9 in jackson-core Version 3.1.0, we updated jackson-core to the fixed Version 3.1.2.

Sub-task

LibreOffice 26.2

We updated Libreoffice for the worker-libreoffice to the version 26.02.

Story

Compatible bundle & technology package versions

Bundles:document enhancer: 0.21.1document conversion: 1.15.1email conversion: 0.37.1image conversion: 1.14.1anno migrator: 1.12.1archive migrator: 0.13.1web toolkit addon: 1.16.1Technologiepakete:tesseract (ocr): 1.30.3pdf persmissions: 1.15.4virus scan: 0.11.4html conversion: 1.16.3decompress: 1.16.4ms word: 0.19.4ms excel: 0.19.4ms powerpoint: 0.19.4

Task

make management port configurable

Now the management port for the Controller is configurable in the Helm Chart.

Task

CVE-2026-22732

Because of CVE-2026-22732 in spring-security-web Version 6.5.8, we updated spring-security-web to the fixed Version 7.0.4.

Sub-Task

CVE-2026-22731 & CVE-2026-22733

Because of CVE-2026-22731 and CVE-2026-22733 in spring-boot-starter-actuator Version 3.5.11, we updated spring-boot-starter-actuator to the fixed Version 4.0.4.

Sub-Task

CVE-2026-33871

Because of CVE-2026-33871 in netty-codec-http2 Version 4.2.10.Final, we updated netty-codec-http2 to the fixed Version 4.2.12.Final.

Sub-Task

CVE-2026-33870

Because of CVE-2026-33870 in netty-codec-http Version 4.1.131.Final, we updated netty-codec-http to the fixed Version 4.2.12.Final.

Sub-Task

CVE-2026-0861

Because of CVE-2026-0861 we updated our base image distroless/java25-debian13:nonroot to the fixed version.

Sub-Task

flow Client & DocumentProcessor: Spring Boot 4 and Java Update

DocumentProcessor: Customers with a custom DocumentProcessor in worker-topdf have to update and build the DocumentProcessor Implementation with Spring Boot 4 and Java 25.flow Client: We also update the controller-client to Java 17. The controller-client-spring , the client with a spring dependency, we updated also to Spring Boot 4. Please ensure that this is considered in your client application code.

Story

Data Images read as CID and put into StreamDescriptor

In some cases, we read and interpret the complete base64-encoded data image Strings as the “CID” of the image and put it into the StreamDescriptor. Persisting the StreamDescriptor then fails, because it is to large. Now we handle CIDs starting with data: different.

Bug

Compatible bundle & technology package versions

Bundles:document enhancer: 0.20.4document conversion: 1.14.4email conversion: 0.36.4image conversion: 1.13.4anno migrator: 1.11.4archive migrator: 0.12.4web toolkit addon: 1.15.4Technologiepakete:tesseract (ocr): 1.29.7pdf persmissions: 1.13.4virus scan: 0.10.7html conversion: 1.14.9decompress: 1.15.7ms word: 0.18.3ms excel: 0.18.3ms powerpoint: 0.18.3

Task

worker-imagemagick + worker-libreoffice: Change RemotePartProcessor to RemoteItemProcessor

In the workers worker-imagemagick and worker-libreoffice we changed the RemotePartProcessor to a RemoteItemProcessor. An update in the workers.yaml file was necessary when not using auto discovery.

Task

No error message when the upload fails in the UI

Flow UI - CreateItemDialog: In UploadPanel the files are directly transferred to the storage before closing the dialog. Error message can be seen as Notification and Upload could be retried. What is seen in the list, has been successfully uploaded to storage.This makes sure that closing the dialog with OK does not result in an Item with enexpected parts (if upload had errors).

Task

CVE-2026-24515

Because of CVE-2026-24515 we updated our base image distroless/java25-debian13:nonroot to the fixed version.

Sub-task

CVE-2026-22801

Because of CVE-2026-22801 we updated our base image distroless/java25-debian13:nonroot to the fixed version.

Sub-task

CVE-2026-22695

Because of CVE-2026-22695 we updated our base image distroless/java25-debian13:nonroot to the fixed version.

Sub-task

Unlock Liquibase Tables

Controller can unlock liquibase Tables on startup to clean up failed instances. Configurable via application.yml, e.g.: jadice-flow.db-changelock-timeout: 15m (0 = disabled check)

Story

Add document titel for PDFs

A default title can be configured for PDFs that do not contain a title. It’s possible to confige this in the worker-topdf step in the jobtemplate e.g.:

          parameters:
            - name: "metadataSettings"
              type: "com.jadice.flow.worker.topdf.settings.MetadataSettingsDTO"
              subTypes: null
              value: "{\"enabled\":true,\"fallbackTitle\":\"Unknown Title\",\"keepTitle\":true}"
              description: "Modify document metadata."

Story

Compatible bundle & technology package versions

Bundles:document enhancer: 0.20.0document conversion: 1.14.0email conversion: 0.36.0image conversion: 1.13.0anno migrator: 1.11.0archive migrator: 0.12.0web toolkit addon: 1.15.0Technologiepakete:tesseract (ocr): 1.29.4pdf persmissions: 1.13.2virus scan: 0.10.4html conversion: 1.14.6decompress: 1.15.6ms word: 0.16.0ms excel: 0.16.0ms powerpoint: 0.16.0

Task

Stricter storage configuration

UrlResolver disabled

The generic UrlResolver and the FusionUrlResolver are now disabled by default. They can be enabled with these application properties:

• resolver.url.enabled=true
• resolver.fusion.enabled=true

Eureka allows different base URLs

If the external URL of eureka is different from the internal URL, a reverse-proxy config in the jf-controller was required. The default setting of eureka in the flow workers now allows for differing base URLs. For example externelURL=https://eureka.acme.com and internalURL=http://eureka which makes the reverse-proxy config unnecessary.
The strict host validation can be enabled again with resolver.eureka.host-validation-enabled=true.

Validation of publisher.* application properties

The following constraints now apply to the publisher configuration:

• publisher.eureka.endpoint must not be blank
• publisher.eureka.username length between 4 and 256 characters
• publisher.eureka.password length between 8 and 256 characters
• publisher.s3.endpoint must not be blank
• publisher.s3.bucket must not be blank
• publisher.s3.accessKey length between 16 and 128 characters
• publisher.s3.secretKey length of 40 characters
• jadice.output.amountOfParallelUploads between 1 and 256
• publisher.webdav.endpoint must not be blank
• publisher.webdav.outputPath must not be blank
• publisher.webdav.username length between 4 and 256 characters
• publisher.webdav.password length between 8 and 256 characters
• publisher.azure-blob-storage.storageAccountName must not be blank
• publisher.azure-blob-storage.containerName must not be blank

Bug