Viewer renders adaptively by default (device-pixel-ratio)

The viewer now always adapts its rendering resolution to the user's screen. On standard displays, high-resolution (HiDPI / Retina) displays, and at higher browser zoom levels alike, documents are shown sharp out of the box — no configuration required.
The viewer.qualityEnhancement setting has therefore been removed.
See:
https://levigo.github.io/dossier-organizer-documentation/installation/deployment/#jadice-web-viewer-viewer

Task

Add HPA Support

Components can now scale automatically based on configured resource utilization thresholds. See https://levigo.github.io/dossier-organizer-documentation/installation/scaling

Task

k8s gateway API for Fusion

Added the possibility to setup a Gateway API `HTTPRoute`https://levigo.github.io/dossier-organizer-documentation/installation/installation/#gateway-api-httproute

Story

GHSA-r7wm-3cxj-wff9

Fixed.

CVE

CVE-2026-69151

Fixed.

CVE

CVE-2026-68945

Fixed.

CVE

CVE-2026-59901

Fixed.

CVE

CVE-2026-56819

Fixed.

CVE

CVE-2026-56816

Fixed.

CVE

CVE-2026-56745

Fixed.

CVE

CVE-2026-55833

Fixed.

CVE

CVE-2026-55831

Fixed.

CVE

CVE-2026-54513

Fixed.

CVE

CVE-2026-54512

Fixed.

CVE

CVE-2026-54291

Fixed.

CVE

CVE-2026-54268

Fixed

CVE

CVE-2026-54267

Fixed

CVE

CVE-2026-54266

Fixed

CVE

CVE-2026-50010

Fixed.

CVE

CVE-2026-48748

Fixed.

CVE

CVE-2026-47691

Fixed.

CVE

CVE-2026-45674

Fixed.

CVE

CVE-2026-45416

Fixed.

CVE

CVE-2026-44894

Fixed.

CVE

CVE-2026-44892

Fixed.

CVE

CVE-2026-44249

Fixed.

CVE

CVE-2026-41850 / NVD High 7,5

Fixed

CVE

CVE-2026-41007 / NVD High 7.5

Fixed

CVE

CVE-2026-40984 / NVD High 7,5

Fixed

CVE

CVE-2026-40983 / NVD High 7,5

Fixed

CVE

CVE-2025-59375

Fixed.

CVE

Transaction problems with flow preprocessing

Decoupled the database transaction from the request scope which includes the long running preprossessing jobs.

Bug

Policy rule evaluation ignores DENY precedence for core actions

Policy evaluation for actions now correctly applies DENY precedence, ensuring that a matching DENY rule overrides any ALLOW rule regardless of rule order. Please ensure that your defined rules are not affected by this change.

Bug

Missing session ID check on tile URLs

Restored functionality to check the session ID before serving document tile images.

Bug

Text annotations are rotated after export

Text annotation rotation property was added to the default annotation profile and should now be properly applied to the export result.

Bug

Sometimes no documents available after loading historic version

Viewer display the next available document when loading a collection from the history.

Bug

Latest updated element can’t be marked as unseen

An error with calculating the modification date was fixed, that occurred when saving the collection during a session and changing the seen status manually afterwards.

Bug

History dialogs "own" filter fails in some cases

Made the filter for own versions in the history dialog more robust.

Bug

Exporting fails when tree is empty

Export button gets disabled when there are no documents available to export.

Bug

"100% Zoom" does not match real size

Default resolution was set to 96 DPI instead of 72 DPI to better match the original size.

Bug

Support user token claims in conditions

Added functionality to the Access Policies that allow the integrator to define claim specific conditions.
For this the prefix `principal.claim:` can be used to extract information from the authentication token. The syntax is the same as the already existing claim selector in the subject field of access policies and defines a path in the token data.See https://levigo.github.io/dossier-organizer-documentation/model/conditions/

Task

PVC File Storage Cleanup

Files left after export will be automatically deleted.
See: https://levigo.github.io/dossier-organizer-documentation/operations/housekeeping/automated-deletion

Task

Irritating message when opening collection without "update" rights

Collection.UPDATE is respected by the application and reflects the state of the collection

Task

Authenticated download for export result

When authentication is enabled the export result link is protected by the configured authentication.Because of this many of the options included in the export UI dialog were not usable without technical knowledge and are now only available when the authentication is disabled.To compensate for this, we added a new option to download the document with the current user authentication.

Task

First applied rule overrules all following definitions in Access Policies on Client Side

Fixed a client side problem for disabling or enabling UI elements based on Access Policies.

Bug

Some custom translations not working any more

Fixed a path collision that was causing customized translations to be overwritten

Bug

True and False conditions have wrong syntax in documentation

Fixed documentation for true and false conditions.

Bug

global.extraEnvVars does not affect viewer deployment

Added missing {{extraEnvVars}}to viewer deployment. Configuration via {{global.extraEnvVars}}now work properly for the {{organizer }}and {{viewer }}pods, as described in the documentation.

Bug

Export Notification message in DO documentation is wrong

The export notification format was updated:
https://levigo.github.io/dossier-organizer-documentation/integration/export-notifications

Bug

Changed default config on EH-Cache

Reversed accidentally changed default option for the Helm Value storage.ehcache.enabled to false.

Bug

CVE-2026-43512

Fixed.

CVE

CVE-2026-41293

Fixed.

CVE

CVE-2026-43513

Fixed.

CVE

CVE-2026-42587

Fixed.

CVE

CVE-2026-42584

Fixed.

CVE

CVE-2026-42583

Fixed.

CVE

CVE-2026-42582

Fixed.

CVE

CVE-2026-42579

Fixed.

CVE

CVE-2026-42577

Fixed.

CVE

CVE-2026-42498

Fixed.

CVE

CVE-2026-41284

Fixed.

CVE

CVE-2026-41254

Fixed.

CVE

CVE-2026-40973

Fixed.

CVE

Skip export notification if no URL is provided

Prevent an Error if no notification URL is configured while notifications are enabled.

Bug

Rotation & gradation are lost on view change in combined view

Page rotation and gradation are preserved when changing views.

Bug

Delete pages with hotkey is possible for combined view

Deletion of the pages with the hotkey DEL is no more possible in case deletion is not permitted. Affects only combined view.

Bug

PVC as export storage solution

Added PVC as an alternative to S3 as a production storages solution.Documentation can be found here:
https://levigo.github.io/dossier-organizer-documentation/installation/storage

Task

Support ca-Certs with password

Password support on the ca-Certs was addedSee: https://levigo.github.io/dossier-organizer-documentation/installation/additional-configuration/

Task

Prevent "createdBy" from being set manually via REST

createdBy is now always set to the principal provided by the current user authentication and can not be overwritten.

Task

Documentation improvements

Various improvements to the documentation.

Task

Extensions for Access Policies (Auth comparison and list check)

New functionality for conditions added:

• Comparison Conditions now allow you to use Specifiers on the right hand side, which allows you to compare to specifier values.
• New In- and Any-Conditions allows comparison with lists.

For more information the documentation can be found here:
https://levigo.github.io/dossier-organizer-documentation/model/conditions/

Story

OAuth authentication settings have no effect on document up- and download API endpoints

Endpoints below the API prefix api/v1/documents/* were not affected by authentication configuration settings in Helm (organizer.oauth.enabled: true).This Endpoint is used to upload local documents and download them. The Download requires knowledge about a generated UUID and can not be listed or easily guessed.Export results are also provided using this API and external users or systems now require valid authentication.If enabled the user oAuth authentication is now active for all endpoints.

Bug

Export notification with global config is not working

The export notification is working properly again.

Bug

Missing storage configuration

New article about S3 storage configuration:
https://levigo.github.io/dossier-organizer-documentation/installation/storage

Bug

Deleting the active document does not reset the viewer

After document deletion, viewer is cleared.

Bug

Add bookmark button inactive on first page of a single page document

‘Add bookmark’ button is correctly activated when opening the document

Bug

GHSA-2m67-wjpj-xhg9

Fixed.

Bug

CVE-2026-5598

Fixed.

Bug

CVE-2026-42198

Fixed.

Bug

CVE-2026-40478

Fixed.

Bug

CVE-2026-40477

Fixed.

Bug

CVE-2026-34487

Fixed.

Bug

CVE-2026-34486

Fixed.

Bug

CVE-2026-34483

Fixed.

Bug

Different optional management port

Configuring the management endpoint port is now possible:

<service>: # Service can be organizer, viewer, controller or worker-topdf
  managementPort: 8081

Task

Support Common Labels for Organizer and Viewer

Added support for <service>.commonLabels in organizer and viewer Helm charts, aligning with controller & worker-topdf

Task

Angular 21 Update

Angular updated to version 21

Task

Improve documentation for Access Policies

Enhanced the access policies documentation to improve clarity and usability, introducing structured step-by-step setup guidance along with enriched examples covering multiple use cases. https://levigo.github.io/dossier-organizer-documentation/integration/access-policies

Task

Redo merging a document after undo is broken

Fixed a bug that caused an error when undoing merge operations.

Bug

Merging documents is broken

Solved a race condition causing merging issues

Bug

Generated PDFs are larger than before

Resolved an issue that caused exported document sizes to grow excessively, ensuring stable and predictable output file sizes.

Bug

Port of Prometheus for Worker-ToPDF is wrong

The port of Prometheus is set to Management Port instead of Container Port

Bug

Metadata bulk change dialog not opening with nested collections

Metadata change dialog is opened correctly for nested elements

Bug