LDP Release 26.4.0

LDP-8534

Every installation now includes a set of predefined roles:

• Integration Manager

• Automation Manager

• Business User

• System Monitoring

They are created automatically when the system starts; no manual setup or database changes are required.

• Each release ships the current version of the templates. Existing templates are updated in place — never duplicated — and roles you created yourself are never modified.

• In a cluster the import runs on the Node Controller only.

LDP-8439

A deserialization vulnerability in a third-party library has been remediated, preventing potential remote class injection attacks.

LDP-8106

A menu item for the Platform Portal is now available in the Module selector.

LDP-7748

Remote Interface: A new setting emptyWhiteListDenyAll (message.xml) makes the Remote Interface refuse all incoming connections when neither an allowlist nor a blocklist is configured. New installations have it switched on; the other systems of the cluster are added to the allowlist automatically.

LDP-9109

A single Working Node or DMZ server running an older version than the node controller can now be updated to the node controller's version without restarting the entire cluster. To do so, download the update to that system and then restart it with the update, either in the Control Center (System view) or via the REST API (POST /system/update/node, POST /system/restart/node). The system must run version 26.4.0 or later and, for the restart with update, run under the Lobster Application Wrapper.

LDP-7627

AMQP 1.0 integrations can now connect to Microsoft Azure Service Bus using Claim-Based Security (CBS). This enables secure, standards-based authentication for Azure Service Bus scenarios and makes it easier to exchange messages with Azure-hosted queues and topics.

LDP-7683

API Manager: Saving a REST endpoint or MCP tool without an action event now shows a notification that the endpoint only becomes available once an action has been added. Such endpoints continue to return HTTP 404 at runtime.

LDP-8009

Pathfinder has been added to the JsonPath Plugins view.

LDP-8012

Pathfinder has been added to the XPath Plugins view.

LDP-7765

Pathfinder can now translate Profile descriptions.

LDP-8330

Pathfinder now generates Custom Type Definitions.

LDP-8719

The Kafka OAUTHBEARER callback handler now supports the JAAS configuration parameters oauth.scope and oauth.audience, enabling token authentication against Microsoft Entra ID v2.0 endpoints. Failed token requests are now also logged with more detailed diagnostic information.

LDP-6585

Administrators can now restart the entire platform and install an already downloaded update in a single step, either in the System view or via the REST API (POST /system/restart with updatePlatform=true). The restart with update only starts if all nodes and DMZs hold the same update. Otherwise, it is refused and the affected systems are listed.

LDP-8529

Pathfinder buttons, labels, and badges now have a consistent visual style.

LDP-6200

Logging: All log file headers now follow a consistent format. Each header includes key system information to support log analysis.

LDP-8183

Auto-Mapping: The search bar is now located next to the mapping structure labels instead of in the grid. This frees up space and makes searches easier to access.

LDP-7557

ETL and Bridge: HTTP-triggered ETL profiles can now delegate execution to a remote Lobster Bridge while preserving the incoming HTTP request body and profile variables end-to-end. The payload is transferred from the Lobster Data Platform to the Bridge as a multipart request (metadata and body) and passed directly to the ETL event queue on the Bridge. Previously, the Bridge fell back to reading a configured test file.

New optional Bridge system properties:

• bridge.multipart.maxFileSize: Maximum size of a single part in a Bridge multipart request. Default: 500 MiB.

• bridge.multipart.maxRequestSize: Maximum size of the entire multipart request. Default: 512 MiB.

• bridge.multipart.fileSizeThreshold: Size above which a part is written to the OS temp directory instead of being buffered in memory. Default: 1 MiB.

 IMPORTANT: The Lobster Data Platform and Lobster Bridge must be upgraded together. Because the transport between them has changed, partial rollouts fail with a parse error on the receiving side.

ETL and Bridge: HTTP-triggered ETL profiles can now delegate execution to a remote Lobster Bridge while preserving the incoming HTTP request body and profile variables end-to-end. The payload is transported from Data-Wizard to the Bridge as a multipart request (metadata + body) and fed directly into the ETL event queue on the Bridge side, replacing the previous behavior that fell back to reading a configured test file.

LDP-8403

Case Bridge: The Case Bridge now sends email notifications when jobs fail. If the configured mail channel is not valid, a warning is logged and the default channel is used.

LDP-9154

The layout of the “Working state” form has been optimized.

LDP-8687

Invoice PDF exports now declare PDF/A-3 conformance level B (pdfaid:conformance = B instead of A). The generated files remain fully compliant with the PDF/A-3, ZUGFeRD, and Factur-X standards.

LDP-7828

MessageService: Data received from peers is now filtered more strictly to prevent potential misuse of deserialization.

LDP-8300

One system of a cluster, a working node, the node controller or a DMZ, can now be restarted on its own while the rest of the cluster keeps running. The action is available in the Control Center and through the REST API.

• POST /system/restart/node takes the host and port that GET /system/health reports for the system, plus an optional gracePeriodInMinute and reason. It requires the ADM_SYS_RESTART permission.

• The grace period defines how long a node can continue running jobs before it shuts down. DMZs have no jobs and ignore this setting.

• Without updatePlatform, the system restarts on the same version. With updatePlatform=true, a working node or DMZ that runs an older version installs the node controller's version it has downloaded. This is never allowed for the node controller itself. Updating the whole cluster remains POST /system/restart with updatePlatform=true.

• The address is resolved against the cluster health snapshot. If no system in the cluster listens on that address, it is reported as unknown, and no command is sent.

• A restart is refused while another restart or shutdown is in progress, and for systems that are offline or do not run under the Lobster Application Wrapper.

• The reason is recorded in the lifecycle log together with the restarted system.

LDP-8182

Pathfinder Auto-Mapping: When you hover over an item, the detail view now appears on the left instead of the bottom, making navigation easier.

LDP-7565

Pathfinder now corrects spelling and grammar in profile descriptions.

LDP-8286

Pathfinder: Error messages returned by an agent are now fully displayed in the chat window. Previously, only a generic error title was shown.

LDP-8825

Permissions: Each plugin now has its own permission under Plugins, replacing the single Basic plugins permission. As a result, the SQL console can be granted without granting access to other plugins. The SQL console buttons in the ETL/ELT editor require the SQL console permission and are disabled without it. Basic plugins and Integration > SQL console are no longer available in the permission tree. Existing roles are migrated automatically and keep access to the plugins they could previously open.

LDP-8824

Permissions: The Control Center, “Configuration > Connections”, and “Administration > Base settings > System” screens no longer depend on the “Integration > Administrator” permission. Each screen now has its own View and Update permissions. Without Update, the screen opens read-only. The AMQPv2 and Google PubSub permissions have moved from “System preferences” to “Configuration > Connections”. Existing roles are migrated automatically.

LDP-8700

Permissions: The Update Center no longer depends on the “Integration > Administrator” permission. It now has its own View and Update permissions under “Administration > System > Update center”. Without Update, the Update Center opens read-only. Existing roles are migrated automatically.

LDP-7567

Profile descriptions are now available via the context menu and tooltips.

LDP-8475

Removed the Migrated Email configuration sections from the startup.xml template for new installations.

LDP-7456

Logs: Several misleading context menu items in Control Center > Logs > Errors were renamed to improve clarity.

LDP-8928

The AS2 Bridge Service:

• Invalid rules in Bridge Inbound no longer cause stability issues. When a rule becomes invalid, it is now ignored automatically until it is valid again.

• Error tooltips for service-related issues have also been enhanced to include the date and time the error occurred, making it easier to identify when the problem last happened.

• Visibility into File Routing errors has been improved. Inbound and outbound rules with problems now show a red error icon directly on the File Routing screen.

LDP-6937

The DMZ handling in clustered environments has been reworked to improve consistency, failover behavior, and internal synchronization:

• DMZ session ownership and primary selection are now centralized in DmzManagerService.

• The node controller is now the single authority for DMZ login state and current primary DMZ.

• DMZ sessions are now synchronized authoritatively across cluster nodes.

• A new reachability matrix shows per-node DMZ connectivity.

• Failover logic now prefers DMZs that are reachable by the cluster.

• If no DMZ is reachable by all nodes, fallback behavior applies.

• The legacy load-balancing-based DMZ messaging paths have been removed.

• DMZ admission checks now use the synchronized DMZ session state.

• Tunnel lifecycle handling and retry behavior have been improved.

• DMZ tunnel client instances are now reused instead of being recreated in each cycle.

LDP-7879

Database connections via Lobster Bridge can now use the new Avatica JDBC driver as an alternative to the Tunnel driver.

LDP-8981

The channel selector in the System E-Mail settings now shows active channels only.

LDP-9455

Update Center: To keep clusters stable during updates, “Upload Patch” now checks the file size before uploading. Patches distributed to the other systems of a cluster can be up to 100 MB. For larger patches, the Update Center shows alternative installation methods, either via the download function or by copying the patch to each system.

LDP-8117

The Auto-Mapping button got a new AI label and refreshed icon styling for improved clarity.

LDP-6554

User interface: Certificate icons have been unified and improved.

LDP-147

Users can now open a profile directly from the Statistics Overview via the right-click context menu.

LDP-9106

XMLNoTemplateUnit: The unit can now be configured to produce XAdES-compliant XML signatures.

LDP-8490

Number ranges: Number ranges can now be assigned directly at the point of number assignment, without an intermediate assignment criterion. This simplifies the configuration of 1:1 assignments and avoids unnecessary criteria evaluation in large environments.

LDP-8473

OPC UA: The request timeout of a connection now honors the alias's requestTimeout in etc/iotclient.xml instead of a hardcoded 5 s, which raises the effective default to 30 s.

LDP-9148

Orchestration test mode: The input object editor now has an auto input format. Strings can be inserted directly. It also automatically switches from JSON to XML according to the content format.

LDP-9185

Permissions: Actions that so far required Integration > Administrator now have rights of their own: unlocking profiles, deleting certificates, deleting and force-unlocking errors, opening trace files, Server logs, sensitive profile data, viewing stored passwords, and resetting statistics sums. Further actions in Active workflows, Profiles, Partner channels, and the TestCase Manager now follow the existing rights of their module. Integration > Administrator keeps working in 26.4. Existing roles holding it are migrated automatically; removing it from a role later does not remove the migrated rights.

LDP-8957

SignXMLPostExecutor: The post-executor can now be configured to create XAdES-compliant XML signatures.

LDP-9283

Community: The Lobster Community platform can now be opened directly from the main module selector.

LDP-8805

Updater: The updater now checks the Java version and aborts the update with an error message if the version is not supported.

LDP-6274

Vaadin: Upgraded the Vaadin framework from version 23 to 25.

LDP-9017

XML Import: A warning now appears when a profile uses an unsupported core:mode value.

SCE-1107

E-invoicing templates: A validator for XRechnung 3.0.2 e-invoices is now available as a template.

SCE-1108

E-invoicing templates: A validator for ZUGFeRD 2.5 e-invoices is now available as a template.

SCE-1109

E-invoicing templates: A validator for BIS Billing 3.0.21 e-invoices is now available as a template, so you can validate these e-invoices locally.

LDP-8782

Fixed DMZ forward dropping the session cookie, which caused "Cookies disabled" in web UIs accessed via the DMZ.

LDP-8524

Fixed a login failure in high-availability setups: with CSRF protection enabled, logins served by a non-owning cluster node could fail with an internal error. Sessions now hand off correctly between nodes.

LDP-7938

Auto-Mapping: Fixed an issue where accepting a mapping suggestion on a pre-mapped field incorrectly updated the source field icon instead of only updating the target field icon.

LDP-7929

Auto-Mapping: Fixed an issue where deselecting a suggested row mapping incorrectly marked the related tree node as pre-mapped and where refreshing the mapping test caused destination nodes to appear as mapped despite not being part of the current mapping selection.

LDP-7926

AzureBlobStorage Input Agent: Fixed an issue where the Azure Blob Storage cron input agent fetched files from subdirectories even when the "Include sub directories" option was disabled.

LDP-7927

AzureBlobStorage Input Agent: Fixed an issue where the Azure Blob Storage cron input agent incorrectly fetched files from folders with similar name prefixes (e.g., "IRP2") when only a specific folder path (e.g., "/IRP") was configured.

LDP-6241

Improved error count reporting in the Monitoring API to resolve potential out-of-memory issues.

LDP-9209

HTTP Cron: Each last-run placeholder in a request body now uses its own date template.

LDP-9414

Profiles: The profile lock is now released correctly when you rename a profile and close it with "Save, Backup & Close". When you reopen the profile, the message "Entry appears to be already opened in another tab" no longer appears.

LDP-9306

SSH: Fixed a bug that made about 1 in 256 of all user-created EC-based SSH keys unusable.

LDP-7982

A processing error that occurred when fetching messages from an X.400 mailbox has been resolved. Profiles using X.400 inbound connections now retrieve messages reliably without unexpected failures.

LDP-7642

A security vulnerability has been closed. We recommend upgrading to this release immediately.

LDP-9034

AMQP 1.0: Fixed a certain case of thread exhaustion leading to an unresponsive GUI.

LDP-7438

API Manager: JSON request bodies are now passed to the called profile unchanged — anonymous arrays are no longer converted into named arrays, so payloads again match the profile's JSON source structure.

LDP-8546

API Manager: query parameters read by an API endpoint now appear in its generated OpenAPI definition and in Swagger UI, including parameters that are read inside a called action block. Previously such operations were shown without any parameters.

LDP-9041

AS2 sending now names the affected partner when its partner address is missing, so you can see straight from the log which channel to fix.

LDP-9037

AS4 via DMZ: AS4 channels that are created, changed or deleted on the Integration Server are now applied on the DMZ immediately. In addition, AS4 on the DMZ now starts reliably after a restart of the DMZ.

LDP-7699

Activity feed: Input forms are now also listed in the activity feed.

LDP-8308

Activity feed: Roles, custom subroutines and free components are now also displayed.

LDP-7822

Activity feed: Only profiles of the current company/client are listed.

LDP-9089

Monitoring: Connections to Grafana Cloud via OTLP no longer fail. A new monitoring type "OTLP (Grafana Cloud)" with Basic authentication is available. The existing OTLP type is now called "OTLP (New Relic)".

LDP-7643

SSH/SFTP: The JSch logger can now be configured per instance, and ETM MAC algorithms can optionally be enabled.

LDP-7733

Added support for EC-based certificates in TLS client authentication for HTTP/AS2 channels.

LDP-9020

Adds java.security.manager=allow to platform.json to enable securitymanager for Java 21.

LDP-9028

Admin console – SQL Monitor: The Export button in the SQL Monitor and in the DB Info window led to a 404 error when the Admin Console was opened through the Platform (/adminConsole). These buttons have been removed. Query results can still be exported with the Export button in the result grid's footer.

LDP-8695

DMZ Load balancing: Form-urlencoded HTTP requests forwarded to a profile through the DMZ load balancer now keep all form parameters.

LDP-8040

An issue that blocked certificate data from being exchanged between internal and DMZ systems during ACME certificate renewal has been resolved. Certificate synchronization now works correctly without requiring changes to the security filter configuration.

LDP-8891

An issue was found allowing path traversal attacks when uploading files. This has been fixed.

LDP-9363

Database settings: The database password is no longer returned to the browser. When changing the connection URL or user, the password must be entered again.

LDP-8991

An update of Windows 11 led to problems creating the emergency license with the potential to leave systems shut down if there is a problem during the license check. This has been fixed.

LDP-7886

Authentication: Fixed an issue where the "Credential-based Auth" tab was no longer displayed after using the recovery mechanism.

LDP-8551

Auto-Mapping: Requests are no longer sent before the connection to the Pathfinder gateway is established. Before, the first auto-mapping attempt could fail.

LDP-8766

Basic Auth requests are now properly rejected when OAuth2 is enforced.

LDP-9291

Bridge database connections ("Via Bridge – standard"): Binary columns read with the option "Blob fields are Base64 encoded" are now transferred correctly. Previously, these values could arrive empty without an error being reported.

LDP-9134

Bridge database connections ("Via Bridge – standard"): Large results with wide rows or BLOB/CLOB values are now read reliably. The error Buffering capacity 2097152 exceeded and the need to tune the fetch size are gone. BLOB/CLOB values can now be written, including in batches, and database errors are reported with their original message. Responses are limited to 64MB by default. You can change the limit with the system property -Dde.lobster.remoteJdbc.maxResponseBytes.

LDP-7347

CSVWithoutQuotesIU: fixed wrong initial configuration values for "use normalized header names" and "suppress header creation" if not configured (e.g., after migrating from a 4.6 installation where these settings didn't exist).

LDP-9314

Cleaning up expired GUI sessions no longer blocks other parts of the system. Before this fix, a long cleanup pass with slow database access could hold the shared session lock for minutes.

LDP-4283

Client Handling: Fixed a bug where the profile list didn't refresh after switching clients, so it kept showing profiles from the previous one. Profiles now update correctly to match the client of the current session.

LDP-7590

Security: Closed a security vulnerability in the third-party dependency rollup.

LDP-8306

CloudStorage: Fixed an issue where creating a new Azure Blob channel incorrectly displayed the Tenant field as mandatory for the preselected SHAREDKEY authentication method.

LDP-8274

Communication services could remain stopped after a restart. After restarting the service, the local communication endpoints (AS2, FTP, SMTP, OFTP, SSH, and the SAP request servers) could briefly start and then be stopped again, staying offline when the platform started in emergency-halt mode. These services now reliably come up once startup has completed and emergency-halt mode is released.

LDP-4059

Cron:FTP tried to download directories if set up incorrectly when doing SFTP. This is now fixed.

LDP-8411

DMZ: A custom wait.time set in the DMZ's etc/forward.properties is now applied immediately after DMZ start/restart and consistently across all forward destinations.

LDP-7388

DataCockpit Logs: Direct links to specific logs are now supported via guest-user login tokens.

LDP-6476

DataCockpit: For profiles with "Allow upload of data only", files selected in the automatically opened upload dialog are now uploaded and passed to the profile.

LDP-8892

Database Migration: Fixed an issue where the migration of role permissions could stop with a duplicate key error, leaving later database changes unapplied and logins failing. Affected systems complete the migration automatically on the next start.

LDP-7872

Database (PostgreSQL): Systems created on PostgreSQL 11 or older got TEXT instead of JSONB columns for some settings tables. After upgrading the database server to PostgreSQL 12 or later, writes to these columns failed. Such columns are now detected and converted automatically at startup.

LDP-9224

Monitoring: Creating a Datadog connection no longer fails validation with a valid API key.

LDP-5593

Deleting an enum now also removes the enum class to avoid issues with reusing the name in a Custom Type.

LDP-8205

ETL/ELT: LAST_RUN is now scoped per ETL entry. It now returns only the last run time of its own ETL entry, the same way profiles work.

LDP-6691

Emergency Halt: Fixed an issue where a misleading notice stating "Your license does not allow the creation of more profiles" was displayed when the Emergency Stop was active, so users now see a clear warning indicating the Emergency Stop is active.

LDP-8802

Resolved performance degradation in the Config Files view (Administration > Config files) when browsing directories with large numbers of files or subfolders (especially noticeable on network shares and cluster-shared volumes). Eliminated redundant disk I/O calls during tree population and sorting by batch-reading and caching file attributes during directory scans.

LDP-7905

Fixed an error in the server logs view when the user clicks on a folder or a file that is not on disk anymore.

LDP-8634

Fix full file path preservation in VAR_SYS_FILE_PATH for FTP input agent.

LDP-8271

Fixed a bug in SalesForceBulkIUV2 leading to ClassCastExceptions when handling nested nodes (that aren't supported).

LDP-7989

Fixed a bug where double-clicking a backup file in the Mapping Test dialog did not start the test.

LDP-7729

UpdateCenter: Fixed a bug where an outdated update-strategy setting from older versions prevented new GA versions from being shown.

LDP-7141

Fixed a bug where profiles remained locked after renaming and using "Save + Backup + Close", preventing users from deleting or cloning the profile.

LDP-7882

Fixed a bug where the columns "Max Size" and "Min Size" were switched in the database connector view.

LDP-7724

Fixed a bug where the target structure could disappear in the mapping editor due to an invalid or stale mapping entry.

LDP-9046

Fixed a bug, where the thread generating the sql schema for Pathfinder did not shutdown correctly.

LDP-8126

Fixed an issue in HA/load-balanced setups where triggering another profile via a Phase 6 Message Response failed (sync) or stayed in the queue (async). Deserialization subclass filtering for inter-node message calls now only logs violations by default (system property hub.message.onlylogsubclassfiltering).

LDP-8492

Fixed a display issue in the number range preview where capacity load was displayed as a raw fraction alongside a percent symbol (e.g., 0.9% instead of 90%).

LDP-8255

Fixed a memory leak in the BSH Library.

LDP-9360

Fixed a path traversal vulnerability in the /system/web endpoint that allowed reading files outside the web resource directory.

LDP-9395

Fixed a rare race in DMZ/proxy forwarding that could break very fast backend responses and cause sporadic resource load failures.

LDP-6160

Fixed an error that occurred when loading the Lobster Data Platform client in an inactive browser tab or window.

LDP-7824

Fixed an error where calling a profile during event handling could fail when the target structure contained an unresolvable node reference.

LDP-7736

Fixed an error caused by an association criterion referencing a deleted dynamic enum, that prevented login even in safe mode.

LDP-8643

Fixed an issue in DMZ AS2 message buffering where persistent incoming messages could be deleted if the inner system was unavailable.

LDP-7937

Fixed an issue when reloading the client after an update to 26.3. The client could not automatically login in some cases.

LDP-7243

AS4: Fixed an issue where inbound AS4 messages could be rejected because the platform-generated P-Modes contained Service/Action restrictions. A new setting lets inbound P-Modes be generated without these restrictions, and another option keeps P-Mode files across restarts so manual adjustments persist.

LDP-7813

Fixed an issue where OPC/UA value-reading functions returned corrupted data when handling arrays.

LDP-8774

ZUGFeRD: Fixed an issue where the plugin jar of the Mustang integration was extracted to the tmpIO directory on every job and never cleaned up, which filled disk storage.

LDP-8382

Fixed an issue where menu item names in the main navigation were cut off prematurely by adjacent action buttons. Menu titles are now fully visible, improving readability and navigation across the interface.

LDP-9496

Fixed an issue where queued jobs were not restored on startup.

LDP-8451

Fixed an issue where the Get HTTP Generic access token function returned null instead of fetching a new token when the existing access token had expired.

LDP-8266

OPC UA: New system property -Dhub.datawizard.iot.opcua.browser.expand.children=false makes selecting a node in the OPC UA browser select only that node instead of loading its whole subtree, which reduces load on large address spaces. The default true keeps the previous behavior. Also fixed errors when re-editing existing node selections.

LDP-9144

Fixed an issue, where in the new user form the password placeholder indicated there was a password, even if the new user has no password as it’s never saved yet.

LDP-8803

Fixed an issue, where the certificate id in the database url in Bridge-related database connection items was not updated when the platform certificate of the bridge connection was updated.

LDP-8808

Fixed database connections via the Standard Bridge driver failing with a "Protocol message end-group tag did not match" error. Aliases whose name contains a space now connect correctly, and an unreachable alias now reports a clear HTTP status (e.g., 404) instead of the misleading protobuf message.

LDP-8994

Icons in the profile creation wizard now display correctly.

LDP-8953

Fixed general layout issues related to the positioning of overlay elements.

LDP-8890

SFTP server: cd ~ and paths starting with ~/ now resolve to the user's own home directory.

LDP-8484

Pathfinder: Chat messages now show their original date and time instead of the current one. The fix was made on the Pathfinder service and applies to all platform versions.

LDP-9033

Fixed issue related to minimized/maximized layout of the Pathfinder chat.

LDP-8908

User interface: Fixed an issue where right-clicking an empty area of a grid caused an invalid selection, so context-menu and ribbon commands were wrongly disabled.

LDP-9266

Fixed issue with using keyboard events inside overlay elements.

LDP-348

Security: Replaced the third-party dependency "angular-shepherd" with an internal implementation to close a known security vulnerability.

LDP-8757

Fixed stacking issue with overlays in the profile creation wizard.

LDP-8344

Fixed the color of the inactive profile overview items.

LDP-8576

Fixed the issue when generating a Profile QuickReport caused a NullPointerException if a communication channel (such as an AS2 response) had an empty or missing URL.

LDP-8530

Fixes incorrect embedding of the LucidaSans-Typewriter font during ZUGFeRD/PDF-A3 generation via Aspose.

LDP-7680

Fixes to the Storage path benchmark: mounts of the same underlying share via different paths now show separately, network-mounted paths load faster, each device displays its mount point in the header, and folder paths display consistently — relative to the server home when configured so, absolute otherwise.

LDP-9232

Function BasicSetWebMonitorRole is now deprecated like the getter already was.

LDP-8282

Holodeck / AS4: Routine dependency updates and library maintenance.

LDP-9061

IDoc-Templates loaded via file structure analysis were loaded without variables leading to mapping errors. This is now fixed.

LDP-9052

Improved AS4 message handling so that when the node controller is unavailable but the DMZ remains reachable, messages are queued in the DMZ and delivered automatically once the node controller is back online.

LDP-8910

Improved icon for "Show description" in profile context menu.

LDP-8391

Improved performance on resolving permissions and classes.

LDP-7807

Increased the SSO login timeout from 2 minutes to 10 minutes, preventing session expiry for customers using multi-factor authentication flows.

LDP-8356

IoT Client Configuration: Fixed an issue where the Certificate Search Term, Application URI, and Application Name were not persisted to the iotclient.xml configuration file.

LDP-7187

JSON Splitter Chunk Size Parameter: Removed unsupported Context Menu Items for constants and variables.

LDP-8474

Jasper Reports: Fixed an issue where printing failed when the report file name contained spaces.

LDP-8061

Jetty 12: Class names in etc/webdefault.xml are now migrated automatically at startup. Other customizations of this file are no longer supported.

LDP-6630

Live dashboard: Fixed an issue where the list of active nodes was not refreshed after restarting a working node.

LDP-9313

Live Dashboard: The "Show Stack Traces" button in the "Server Threads" tab opens the stack traces of the selected threads again.

LDP-7602

Lobster Bridge HTTP requests are now accepted from the Lobster Data Platform regardless of which partner is used for the Lobster Bridge.

LDP-7534

Lobster Bridge: Fixed an issue where ETL tasks on a Bridge failed when functions were used in conditions. The Bridge now ships the required filter definitions.

LDP-8477

Lobster Bridge: Added support for creating inbound and outbound folders with umlauts for AS2 settings.

LDP-8281

Logs/Errors: Fixed an issue where assigning a user to a failed profile did not display the assigned user in the "Locked" column.

LDP-9252

Maintenance: an emptied allowed user list now lets all users log in during a maintenance, as described in the UI.

LDP-8131

E-invoicing templates: The missing ZUGFeRD 2.5 Factur-X 1.09 templates were added.

LDP-9014

Nested constants are now resolved recursively with automatic cycles and depth limits.

LDP-9094

News Center: News updates now reach all subscribed users reliably when the news feed refreshes in the background.

LDP-8192

OAuth: Fixed an issue where the token endpoint /oauth/token answered protocol errors such as an unsupported grant type with HTTP 200 instead of HTTP 400 as required by RFC 6749. The authorization-server metadata at /.well-known/oauth-authorization-server now lists the grant types and the client authentication method the endpoint actually accepts, and the Platform API's OpenAPI definition states that this metadata describes the MCP surface and not the Platform API's own token endpoint at /dw/register/oauth/token.

LDP-9119

OFTP / Communication Channels: Fixed an issue where replacing an existing Partner Certificate in an OFTP channel could have caused subsequent TLS connections to fail.

LDP-8163

Object to JSON and JSON to Object conversion no longer returns null when round-tripping custom type objects.

LDP-7910

OftpService: The TLS protocol versions offered by the OFTP server are now restricted to the same versions used for client connections (default TLSv1, TLSv1.1, TLSv1.2). The protocol list for client and server can be overridden with com.ebd.hub.oftp.tls.protocols (comma-separated, e.g., TLSv1.2,TLSv1.3).

Set the system property com.ebd.hub.oftp.server.skipprotsetting to true to turn this restriction off.

LDP-7645

OpenAPI viewer: The viewer now only loads endpoints whose host:port is listed in the new system property hub.datawizard.api.viewer.whitelist (format host:port;host2:port2). If the property is not set, no endpoint can be loaded through the viewer.

LDP-9444

OpenAPI/Swagger: The "Authorize" dialog now opens fully, and OAuth2 authentication can be completed when access control is set to "OAUTH2 / OPENID".

LDP-7246

OpenAPI/Swagger: The YAML links on the internal REST API Swagger page now open the API specification correctly. They no longer show a "you are offline" page.

LDP-8405

OpenAPI: Fixed an "Access Denied" error when opening the Swagger UI from Phase 1. Add the platform's own host:port (as called by the browser) to hub.datawizard.api.viewer.whitelist to allow this.

LDP-7985

PDF Processing: Fixed an issue where Aspose PDF classes could consume almost 6 GB of Heap memory when loading fonts in message consumer threads.

LDP-8463

PDF Processing: Fixed an issue where the “PDFCreator” and “MultiPDFCreator” integration units were incorrectly displayed as deprecated in Phase 5.

LDP-8605

Pathfinder SQL Assistant: Fixed an issue where the assistant received an empty database schema and asked for table and column names instead of generating a query.

• Schema reads now accept both table types drivers use for ordinary tables, “TABLE” and “BASE TABLE”. Aliases on drivers that report “BASE TABLE” previously resolved to no tables at all, without any error. Views, temporary and system tables are still excluded, and aliases on drivers reporting “TABLE” behave exactly as before.

• A schema that resolves to no tables although the database contains columns is now logged as a warning, including the requested and the driver-reported table types — previously the empty schema was passed on silently.

• Databases whose engine does not support foreign-key metadata no longer fail the schema read; the foreign-key information is omitted and a warning is logged.

LDP-9155

Permissions: Additional IDs and LogPool aliases no longer depend on the Integration > Administrator right, and Partner statistics, Certificates and Certificate exchange no longer depend on Partner management administration. Each screen now has its own permission under Integration > Verwalten > Partner management (LogPool aliases directly under Integration > Verwalten): View and Update, Partner statistics View only; without Update, the screen opens read-only. Existing roles are migrated automatically.

LDP-8500

Print Documents: Fixed an issue where printing failed after removing the preprocessor profile from a print document.

LDP-7687

Process map: Fixed performance issues that could negatively impact the UI responsiveness.

LDP-6984

Process map: The “back to overview” button did not work when navigating to a profile from the process map.

LDP-7148

Profile export: XML files are properly formatted (pretty print) again.

LDP-7321

Profile: Uploaded files in the "Start Profile" dialog are now displayed immediately after upload without requiring the view to be reopened.

LDP-5547

Profiles: Fixed an issue where Preparser and postexecutor config file paths were stored as absolute paths, causing export/import failures between systems.

LDP-7367

Profiles: Fixed an issue where variables VAR_CONTENT_TYPE and VAR_RESPONSE_FILENAME could not have their default value overwritten in Phase 3.

LDP-9464

Mail: Received S/MIME mails that use AuthEnvelopedData encryption, such as AES-GCM, can now be decrypted.

LDP-7825

Reduced browser console error messages about web socket push messages.

LDP-8332

Regex Plugin: Fixed an issue where valid regular expressions were not recognized, causing incorrect "No match" results.

LDP-8985

Releasing a profile to the Transport Manager now depends solely on the "TransportManager: mark as ready" permission and is enforced consistently in the profile overview, the profile editor and the DataFlow views. Roles behave exactly as configured. Note that "TransportManager > Access" alone no longer grants this right — assign "TransportManager: mark as ready" to roles that need it.

LDP-8188

Reports: Fixed an issue where generating a PDF report for a selected profile failed because internal template files could not be found.

LDP-8590

Resolved a bug in HA (High Availability) environments where standard OAuth2 POST requests (such as client_credentials grants sent to /dw/register/oauth/token) failed with 400 Bad Request: "No value defined for grant_type".

LDP-9131

Resolved a race condition where temporary files downloaded via HTTP connections (ETLHttpConnect) could be prematurely deleted by the HttpClient finalizer before being processed if garbage collection triggered under heap pressure.

LDP-8022

Profiles (Phase 3): "Open all nodes", "Close all nodes" and scrolling in the structure tree now work when a strict Content-Security-Policy without 'unsafe-eval' is configured.

LDP-8209

Resolved an issue where literal <password> and <user> tags in HTTP channel token request bodies (such as XML/SOAP envelopes) were inadvertently truncated during placeholder replacement. Substitution is now restricted to non-empty values, ensuring the request body remains intact.

LDP-9453

Logging: DataWizard file logs are written again on systems where an earlier update had switched file logging off. A one-time repair at startup restores missing log settings from startup.xml and switches file logging back on, unless startup.xml disables it. No manual action is needed. If you had switched file logging off on purpose, switch it off again after the update. In a cluster, each node applies it at its next restart. Affected versions: 26.3.x.

LDP-9251

OpenAPI/Swagger: Behind a DMZ, the OpenAPI/Swagger UI of a profile opened from Phase 1 no longer fails with "403 Forbidden" when the server is listed in hub.datawizard.api.viewer.whitelist.

LDP-8713

SAP Integration: Fixed an issue where using the SapCheckArfcsState input agent in Phase 1 resulted in an HTTP 511 error and a StringIndexOutOfBoundsException.

LDP-7769

SMB mounts: The default Linux mount command now uses username= instead of user=, which newer mount.cifs/Samba versions require. Existing unix.mount settings in smbmount.properties are not changed.

LDP-9197

SSO: Aliases are now unique regardless of case on all databases; a duplicate is rejected on save. Existing duplicates must be renamed or deleted manually.

LDP-8268

Salesforce Integration: Fixed an issue where SalesForceBulkIUV2 failed with "No connection found for alias" when the target structure contained multiple nodes.

LDP-7984

Saving a profile no longer resets the mapping test state; "Repeat last mapping test" remains available after saving.

LDP-8207

Saxon: Updated the Saxon library to version 12 to support e-invoicing Schematron rules.

LDP-9367

Security: /system/productInfo and /system/version now only answer authenticated users; anonymous access can be enabled with -Dhub.datawizard.enableAnonymousVersionInfo=true.

LDP-8421

Mail settings: Fixed cases where mail settings migrated from the XML configuration were not applied correctly. Affected configurations are repaired automatically, and saving mail settings now updates all cluster nodes consistently. The mail settings UI was also improved.

LDP-9021

DirectoryToPdfContainerPostExecuter: Source files are now deleted after merging PDFs when deleteSource is true.

LDP-8736

SSH server: Fixed public-key authentication failures for about 1 in 256 ECDSA P-384 keys.

LDP-9104

Storage info widget now supports bigger units than GB, respecting file systems with infinite available storage.

LDP-6771

StorageService: There has been an issue leading to the shutdown of the system if something is saved to a MySQL/MariaDB in the last second before a summer change takes place. This issue is now resolved.

LDP-9125

Style Designer: Fixed empty token selection list in expert settings.

LDP-8504

System benchmark: storage folders on the same network share are now grouped as one device, even when reached via symlinks or multiple mounts, instead of being listed as separate devices.

LDP-7832

System boot now shows progress of the database init.

LDP-7781

System info widget: The used memory value is now showing the correct value instead of always 0.

LDP-9381

Sessions: The technical session of the Self-Service Portal (shown as "Hidden Guest User" or "System") is no longer listed in the Sessions view or the Active user sessions widget.

LDP-9280

HTTP channels: The OAuth2 "Refresh Access Token" test now sends a refresh request and reports the provider's result. Before, it could report "OK!" without contacting the token endpoint.

LDP-8010

The SCP inbound agent no longer generates an error when it connects successfully to a partner server but finds no files to retrieve. This aligns its behavior with the SFTP inbound agent and eliminates false-alarm alerts for customers using time-controlled polling.

LDP-9115

The TPM internal system user is now hidden from the user overview, and the TPM role is set to visible (read-only) with unnecessary permissions (Basic Plugins) removed.

LDP-8704

The connection test for system e-mails now displays the correct name of the tested channel.

LDP-8568

encode punycode() / decode punycode(): For email addresses, only the domain part is converted and the local part stays unchanged. Addresses such as ".name@example.com" no longer cause an error.

LDP-9074

The icon of the menu item for the Platform Portal is now displayed correctly in the Module selector.

LDP-9284

Logging: When log settings are migrated from startup.xml to the database, the error message in error.log now shows the reason for a validation failure, e.g., a value out of range.

LDP-8187

System emails: After an update, the mail channel migrated from startup.xml is now used and shown in the System Emails settings.

LDP-8252

Constants: The usage report now also finds constants used in the HTTP headers of an HTTP response unit.

LDP-8903

Logging: The retention time of the Standard log alias is now updated when "Time until log statistics are deleted" is changed in the General log settings.

LDP-7848

Tracking State: A Tracking State Transformation Matrix shared with a company is now available to that company's users right away, also after its owner was changed.

LDP-8348

Transport Manager: Fixed an issue where the Blob Type of Cloud Storage response paths changed from “Block” to “Append” after transport.

LDP-3826

UI: Color themes in the login screen are now remembered for future visits.

LDP-7912

UI: Fixed low contrast font colors for some inactive elements (e.g., Form editor: fields that are already in use)

LDP-7831

UI: Fixed number of the error bubble in multi-client setups.

LDP-7932

UI: Fixed tooltip on how to switch open views via keyboard shortcut on Mac.

LDP-8076

UI: Icons of SSO providers are now again displayed correctly in the login window.

LDP-8415

User interface: Ribbon buttons without a label no longer show a generated label when activated.

LDP-8103

Update Center: Fixed an issue where the interface could overflow when displaying numerous newer versions while using an older product version.

LDP-8067

Update-Center: Fixed an issue where the autoLoadPatches option was still active in the backend, causing unwanted automatic patch downloads despite the option no longer being configurable in the interface.

LDP-7391

Updated Font Awesome to version 7.

LDP-8011

Updated the login pages for improved accessibility and design consistency.

LDP-7582

Netty: Updated the Netty library from 4.1.127.Final to 4.1.135.Final to close known security vulnerabilities.

LDP-7588

OAuth: Updated the google-oauth-client library from 1.25.0 to 1.31.0 to close a known security vulnerability.

LDP-5901

User Settings: removed the obsolete option "Double click opens module entries in a new browser tab" that already had no function anymore.

LDP-9325

Visually aligned modal dialogs for improved consistency.

LDP-8302

API Manager: Association criteria are now enforced for MCP endpoints. Callers who do not match are refused when invoking a tool, in line with REST endpoints.

LDP-8456

Lobster Bridge: With the Jetty 12 upgrade, the name of the Bridge Vaadin session cookie now comes from serviceName in bin/wrapper.json. For deployments launched without the service wrapper, the new JVM option -Dlobster.bridge.session.cookie.name=<name> overrides the name.

LDP-7026

XML configuration processing: XML Configuration Files that declare encoding="UTF8" instead of "UTF-8" are accepted again.

LDP-7686

ZUGFeRD Mustang [plugin] suffix now works correctly on Windows.

LDP-9121

Profile templates: Deleting a profile template no longer writes a NullPointerException to the error log.

LDP-8472

• Fixed an issue where, in some cases, email settings were not reflected in the application.

• Added additional validation for customer-defined email channels to ensure they exist before use.

• Fixed an issue where the internal channel was not retrieved from the database in some cases.

LDP-8342

• Improved System Emails configuration to properly support multiple recipient email addresses separated by semicolons.

LDP-8277

• Improved the Email connection type drop-down so selections are now saved correctly when switching to the SMTP option.

LDP-8570

• The sender in Email Settings is now migrated successfully from XML configuration.

• The currently selected Manual Email Settings or Mail Channel is now consistently reflected in the application.

• Enhanced channel duplication logic to ensure manual settings are migrated correctly.

LDP-7702

• Logging in file now defaults to true when it is not explicitly provided in XML or application configuration.

• If logging configuration is missing, the system automatically enables file-based logging.

• In scenarios where migration of settings to the database fails, the system falls back to file-based logging to ensure logs continue to be captured.

LDP-9142

Kafka: ETL jobs that send data to Kafka now pick up the broker hosts and properties from the Kafka connection alias.

LDP-9476

Custom entity: History now also works for singular attributes.

LDP-7827

OPC UA: OPC UA aliases (IoT clients) now store all their parameters. The settings minSize, maxSize and allowGrowing are now always written to the configuration, even when left at their defaults.

LDP-9365

Logging: Session tokens are no longer written to log files.

LDP-7589

Security: Removed a vulnerable third-party dependency.

LDP-8822

AMQP: The RabbitMQ client library was upgraded to 5.35.0 to close known security vulnerabilities. Connections with SSL and a configured pass phrase or certificate now check that the broker certificate matches the configured host name. If it does not match, the connection fails.

LDP-8821

Netty: Updated the Netty library from 4.1.135.Final to 4.1.137.Final to close known security vulnerabilities.

LDP-7587

Azure Key Vault: Updated the azure-security-keyvault-keys library to version 4.10.6 to close a known security vulnerability.

LDP-9531

AMQP: Updated the RabbitMQ client library (com.rabbitmq:amqp-client) to 5.35.0 to close known security vulnerabilities.

LDP-8841

Jackson: Updated the Jackson JSON library to version 2.21.7 to address multiple security vulnerabilities.

LDP-8842

Kafka: Updated the Kafka client library to close two security vulnerabilities, including a bug that could misdeliver messages to the wrong topic.

LDP-8845

Micrometer: Updated the Micrometer library to close two security vulnerabilities.

LDP-8846

Spring Data: Updated the Spring Data library to close four security vulnerabilities.

LDP-8844

LZ4: Updated the lz4-java library (at.yawk.lz4) to close known security vulnerabilities.