PostgreSQL driver regression

Rolled back to org.postgresql:postgresql:42.7.12.

Bug

k8s gateway API for Fusion

Added the possibility to setup a Gateway API `HTTPRoute`https://levigo.github.io/output-organizer-documentation/installation/installation/#gateway-api-httproute

Story

GHSA-r7wm-3cxj-wff9

Fixed.

CVE

CVE-2026-69151

Fixed.

CVE

CVE-2026-68945

Fixed.

CVE

CVE-2026-59901

Fixed.

CVE

CVE-2026-56819

Fixed.

CVE

CVE-2026-56816

Fixed.

CVE

CVE-2026-56745

Fixed.

CVE

CVE-2026-55833

Fixed.

CVE

CVE-2026-55831

Fixed.

CVE

CVE-2026-54513

Fixed.

CVE

CVE-2026-54512

Fixed.

CVE

CVE-2026-54291

Fixed.

CVE

CVE-2026-50010

Fixed.

CVE

CVE-2026-48748

Fixed.

CVE

CVE-2026-47691

Fixed.

CVE

CVE-2026-45674

Fixed.

CVE

CVE-2026-45416

Fixed.

CVE

CVE-2026-44894

Fixed.

CVE

CVE-2026-44892

Fixed.

CVE

CVE-2026-44249

Fixed.

CVE

CVE-2025-59375

Fixed.

CVE

Transaction problems with flow preprocessing

Decoupled the database transaction from the request scope which includes the long running preprossessing jobs.

Bug

Policy rule evaluation ignores DENY precedence for core actions

Policy evaluation for actions now correctly applies DENY precedence, ensuring that a matching DENY rule overrides any ALLOW rule regardless of rule order. Please ensure that your defined rules are not affected by this change.

Bug

Missing session ID check on tile URLs

Restored functionality to check the session ID before serving document tile images.

Bug

Text annotations are rotated after export

Text annotation rotation property was added to the default annotation profile and should now be properly applied to the export result.

Bug

Signature dropdown is not adjusting when resizing

Make Signature Panel sticky to annotation sidebar.

Bug

Signature button is enabled even if collection is closed

Disable signature popup button when no annotations can be added.

Bug

Latest updated element can’t be marked as unseen

An error with calculating the modification date was fixed, that occurred when saving the collection during a session and changing the seen status manually afterwards.

Bug

"100% Zoom" does not match real size

Default resolution was set to 96 DPI instead of 72 DPI to better match the original size.

Bug

Viewer renders adaptively by default (device-pixel-ratio)

The viewer now always adapts its rendering resolution to the user's screen. On standard displays, high-resolution (HiDPI / Retina) displays, and at higher browser zoom levels alike, documents are shown sharp out of the box — no configuration required.
The viewer.qualityEnhancement setting has therefore been removed.
See:
https://levigo.github.io/output-organizer-documentation/installation/deployment#jadice-web-viewer-viewer

Task

Add HPA Support

Components can now scale automatically based on configured resource utilization thresholds. See https://levigo.github.io/output-organizer-documentation/installation/scaling

Task

Signature annotations

New feature signature annotations. Predefined signatures can be set per collection and used to export signed documents.
For more information, see https://levigo.github.io/output-organizer-documentation/customizing/signature-stamps/

Story

"Redact all" feature for text selections

• A new feature has been added that allows you to redact all instances of the selected text in the document using a pop-up button after selecting the text.
• Added Annotation list sidebar to monitor the list of annotations belonging to a document and easy navigation between them.




See: https://levigo.github.io/output-organizer-documentation/installation/deployment/#jadice-web-viewer-viewer

Story

CVE-2026-54268

Fixed

CVE

CVE-2026-54267

Fixed

CVE

CVE-2026-54266

Fixed

CVE

CVE-2026-41850 / NVD High 7,5

Fixed

CVE

CVE-2026-41007 / NVD High 7.5

Fixed

CVE

CVE-2026-40984 / NVD High 7,5

Fixed

CVE

CVE-2026-40983 / NVD High 7,5

Fixed

CVE

Support user token claims in conditions

Added functionality to the Access Policies that allow the integrator to define claim specific conditions.
For this the prefix `principal.claim:` can be used to extract information from the authentication token. The syntax is the same as the already existing claim selector in the subject field of access policies and defines a path in the token data.See https://levigo.github.io/dossier-organizer-documentation/model/conditions/

Task

Authenticated download for export result

When authentication is enabled the export result link is protected by the configured authentication.Because of this many of the options included in the export UI dialog were not usable without technical knowledge and are now only available when the authentication is disabled.To compensate for this, we added a new option to download the document with the current user authentication.

Task

First applied rule overrules all following definitions in Access Policies on Client Side

Fixed a client side problem for disabling or enabling UI elements based on Access Policies.

Bug

Some custom translations not working any more

Fixed a path collision that was causing customized translations to be overwritten

Bug

True and False conditions have wrong syntax in documentation

Fixed documentation for true and false conditions.

Bug

global.extraEnvVars does not affect viewer deployment

Added missing {{extraEnvVars}}to viewer deployment. Configuration via {{global.extraEnvVars}}now work properly for the {{organizer }}and {{viewer }}pods, as described in the documentation.

Bug

Changed default config on EH-Cache

Reversed accidentally changed default option for the Helm Value storage.ehcache.enabled to false.

Bug

CVE-2026-43512

Fixed.

CVE

CVE-2026-41293

Fixed.

CVE

CVE-2026-43513

Fixed.

CVE

CVE-2026-42587

Fixed.

CVE

CVE-2026-42584

Fixed.

CVE

CVE-2026-42583

Fixed.

CVE

CVE-2026-42582

Fixed.

CVE

CVE-2026-42579

Fixed.

CVE

CVE-2026-42577

Fixed.

CVE

CVE-2026-42498

Fixed.

CVE

CVE-2026-41284

Fixed.

CVE

CVE-2026-41254

Fixed.

CVE

CVE-2026-40973

Fixed.

CVE

Skip export notification if no URL is provided

Prevent an Error if no notification URL is configured while notifications are enabled.

Bug

Duplicate text search popup

Prevented opening multiple popup windows when using the ctrl+F shortcut.

Bug