Changelog
Version 10.12.2
Released at 12.09.2026
- Fixed a potential race-condition when handing of AttachmentKey (svenkubia)
Version 10.12.1
Released at 12.09.2026
- Fixed incorrect handling of SSE connections (svenkubiak)
- Query parameters can no longer override a route parameter of the same name (svenkubiak)
- Added Request#getPathParameter, Request#getQueryParameter and Request#hasPathParameter to tell route parameters and client input apart (svenkubiak)
- Added application.parameter.strict to reject requests whose query parameter collides with a route parameter (svenkubiak)
- Messages are now resolved per request and no longer leak the locale of one request into concurrent requests (svenkubiak)
- Resolving a message bundle no longer modifies the JVM default locale (svenkubiak)
- Fixed incorrect cookie handling in /@admin dashboard (svenkubiak)
Version 10.12.0
Released at 12.09.2026
- CORS responses now send Vary: Origin to prevent cache poisoning by shared caches (svenkubiak)
- The origin parameter on authentication redirects is now URL encoded, keeps the query string and can no longer be protocol-relative (svenkubiak)
- Multiple query and request parameter with same values are now rejected (svenkubiak)
- Cookie settings for prod config are now secure=true by default (svenkubiak)
- Removed SSE Auth (svenkubiak)
- Successful login now resets lock counter (svenkubiak)
- Version bumps (svenkubiak)
- fory-core 1.7.1 -> 1.7.2
Version 10.11.6
Released at 11.09.2026
- Various security hardenings (svenkubia)
- Fixed an issue in the BinaryHandler that overwrote headers from a controller (svenkubiak)
- Version bumps (svenkubiak)
- oopentelemetry-semconv 1.43.0 -> 1.44.0
- opentelemetry 1.65.0 -> 1.66.0
- mongodb-driver-sync 5.11.0 -> 5.11.1
- bouncy-castle 1.85 -> 1.86
Version 10.11.5
Released at 08.09.2026
- Fixed an issue that prevented mvn mangooio:run from starting (svenkubiak)
- Changed behaviour of error propagation in JsonUtils (svenkubiak)
- Doucmentation update (svenkubiak)
- Version bumps (svenkubiak)
- classgraph 4.8.194 -> 4.8.195
Version 10.11.4
Released at 06.09.2026
- Added additional documentation updates (svenkubiak)
Version 10.11.3
Released at 06.09.2026
- Update @admin dashboad to bulma 1.0.4 (svenkubiak)
- Fixed an issue in vault creation and value parsing (svenkubiak)
- Added additional method to datastore to retrieve the MongoClient (svenkubiak)
- Version bumps (svenkubiak)
- fory-core 1.7.0 -> 1.7.1
Version 10.11.2
Released at 01.09.2026
- Added additional documentation updates (svenkubiak)
Version 10.11.1
Released at 01.09.2026
- Added additional query options for MongoDB (svenkubiak)
- Added method for generating UUIDv7 in CommonUtils (svenkubiak)
- Fixed incorrect handling of getAuthenticationCookieKey (svenkubiak)
- Fixed incorrect handling of getApplicationVaultPath (svenkubiak)
- Switched to new Apache Fory library and refactoring usage of Fory (svenkubiak)
- Updated documentation (svenkubiak)
- Version bumps (svenkubiak)
- greenmail-standalone 2.1.11 -> 2.1.13
- classgraph 4.8.186 -> 4.8.194
- junit 6.1.2 -> 6.1.3
- mongo-driver-sync 5.9.1 -> 5.9.2
- bouncy-castle 1.85 -> 1.85.2
- jackson 2.22.1 -> 2.22.2
- guava 33.6.0-jre -> 33.7.1-jre
- undertow 2.4.2.Final -> 2.4.3.Final
- tika-core 3.3.2 -> 4.0.0
- freemarker 2.3.34 -> 2.3.35
- mongo-driver-sync 5.9.2 -> 5.11.0
- snakeyaml 2.6 -> 2.7
Version 10.10.0
Released at 03.08.2026
- Set MongoDB version to v7.0 in Embedded MongoDB (svenkubiak)
- Version bumps (svenkubiak)
- greenmail 2.1.9 -> 2.1.11
- open-telemetry 1.63.0 -> 1.64.0
- undertow-core 2.4.1.Final -> 2.4.2.Final
- junit 6.1.1 -> 6.1.2
- bouncy-castle 1.84 -> 1.85
- zt-exec 1.12 -> 1.13.0
- tika-core 3.3.1 -> 3.3.2
- classgraph 4.8.184 -> 4.8.186
- mongodb-driver-sync 5.9.0 -> 5.9.1
- hibernate-validator 9.1.2.Final -> 9.1.3.Final
- cactoos 0.61.0 -> 0.61.1
- commons-codec 1.22.0 -> 1.22.1
- commons-validator 1.10.1 -> 1.11.0
Version 10.9.0
Released at 14.07.2026
- Version bumps (svenkubiak)
- commons-logging 1.3.6 -> 1.4.0
- hibernate-validator 9.1.0.Final -> 9.1.2.Final
- log4j 2.26.0 -> 2.26.1
- otp-java 2.1.0 -> 2.2.0
- mongodb-driver-sync 5.8.0 -> 5.9.0
- jackson 2.22.0 -> 2.22.1
- undertow 2.4.0.RC4 -> 2.4.1.Final
Version 10.8.6
Released at 12.06.2026
- Updated release script to avoid release issues (svenkubiak)
Version 10.8.5
Released at 12.06.2026
- Fixed build issue (svenkubiak)
Version 10.8.4
Released at 12.06.2026
- Fixed build issue (svenkubiak)
Version 10.8.3
Released at 12.06.2026
- Fixed an issue when setting session cookie (svenkubiak)
- Version bumps (svenkubiak)
- mongo-driver-sync 5.7.0 -> 5.8.0
- jackson 2.21.3 -> 2.22.0
- nimbus-jose-jwt 10.9 -> 10.9.1
- open-telemetry 1.62.0 -> 1.63.0
Version 10.8.2
Released at 17.05.2026
- Fixed dependency issue (svenkubiak)
Version 10.8.1
Released at 17.05.2026
- Fixed dependency issue (svenkubiak)
Version 10.8.0
Released at 17.05.2026
- Flushing SSE connection on first connect (svenkubiak)
- Version bumps (svenkubiak)
- jackson 2.21.1 -> 2.21.3
- opentelemetry-semconv 1.40.0 -> 1.41.1
- opentelemetry 1.61.0 -> 1.62.0
- mongo-driver-sync 5.6.5 -> 5.7.0
- caffeine 3.2.3 -> 3.2.4
- log4j 2.25.4 -> 2.26.0
Version 10.7.0
Released at 27.04.2026
- Added Log4j configuration check on application start (svenkubiak)
- Sonar refactorings (svenkubiak)
- Version bumps (svenkubiak)
- opentelemetry 1.60.1 -> 1.61.0
- guava-jre 33.5.0-jre -> 33.6.0-jre
- bouncy-castle 1.83 -> 1.84
- commons-codec 1.21.0 -> 1.22.0
- commons-io 2.21.0 -> 2.22.0
- cactoos 0.59.0 -> 0.60.0
Version 10.6.1
Released at 10.04.2026
- Version bumps (svenkubiak)
- mongo-driver-sync 5.6.4 -> 5.6.5
- undertow-core 2.3.24.Final -> 2.4.0.RC4
Version 10.6.0
Released at 09.04.2026
- Added healthcheck method to datastore (svenkubiak)
- Hardened Form parsing (svenkubiak)
- Sonar refactorings (svenkubiak)
- Refactorings and improvements (svenkubiak)
- Version bumps (svenkubiak)
- snake-yaml 2.5 -> 2.6
- mockito-core 5.21.0 -> 5.22.0
- opentelemetry 1.59.0 -> 1.60.1
- undertow-core 2.3.23.Final -> 2.3.24.Final
- jackson 2.21.1 -> 2.21.2
- nimbus-jose-jwt 10.8 -> 10.9
- log4j 2.25.3 -> 2.25.4
Version 10.5.0
Released at 27.02.2026
- Added timezone support to application configuration (svenkubiak)
- Added timezone handling of POJO-mapped MongoDB entities (svenkubiak)
- Version bumps (svenkubiak)
- mongo-driver-sync 5.6.2 -> 5.6.3
- opentelemetry 1.58.0 -> 1.59.0
- undertow-core 2.3.22.Final -> 2.3.23.Final
- nimbus-jose-jwt 10.7 -> 10.8
- jackson-databind 2.21.0 -> 2.21.1
Version 10.4.2
Released at 07.02.2026
- Fixed an issue when creating indices
Version 10.4.1
Released at 03.02.2026
- Fixed a dependency conflict
Version 10.4.0
Released at 09.02.2026
- Added option to passthrough JSR 380 validation errors (svenkubiak)
- Added better handling of unparsable JSON and entities (svenkubiak)
- Version bumps (svenkubiak)
- opentelemetry-semconv 1.37 -> 1.39
- commons-codec 1.20.0 -> 1.21.0
Version 10.3.1
Released at 19.01.2026
- Version bumps (svenkubiak)
- undertow-core 2.3.21.Final -> 2.3.22.Final
- jackson-databind 2.20.1 -> 2.21.0
Version 10.3.0
Released at 15.01.2026
- Argument Utils now have an additional null-check (svenkubiak)
- Authentication-, Session- and Flash-Cookie don't invalidate if parsing fails (svenkubiak)
- CSRF-Filter now returns default Forbidden-Body (svenkubiak)
- Sonar refactorings (svenkubiak)
- Version bumps (svenkubiak)
- undertow-core 2.3.20.Final -> 2.3.21.Final
- otp 1.57 -> 1.58
- nimbus-jose-jwt 10.6 -> 10.7
Version 10.2.0
Released at 17.12.2025
- Version bumps (svenkubiak)
- mongo-driver-sync 5.6.1 -> 5.6.2
- otp 1.56 -> 1.57
- java-uuid-generator 5.1.1 -> 5.2.0
- greenmail 2.1.7 -> 2.1.8
- log4j 2.25.2 -> 2.25.31
Version 10.1.0
Released at 01.12.2025
- Version bumps (svenkubiak)
- jackson 2.20.0 -> 2.20.1
- commons-codec 1.19.0 -> 1.20.0
- nimbus-jose-jwt 10.5 -> 10.6
- commons-io 2.20.0 -> 2.21.0
- commons-lang3 3.19.0 -> 3.20.0
- hibernate-validator 9.0.1.Final -> 9.1.0.Final
- commons-validator 1.10.0 -> 1.10.1
- bouncy-castle 1.82 -> 1.83
Version 10.0.0
Released at 03.11.2025
- Added Support for Open Telemetry (svenkubiak)
- Added Support for Jakarta Validation API for methods parameters (svenkubiak)
- Added new vault functionality for storing secrets based on Java Keystore (svenkubiak)
- Added HTTPS connector (svenkubiak)
- Removed cryptex{} from configuration in favor of new vault (svenkubiak)
- Removed all deprecated methods and classed (svenkubiak)
- Removed AJP connector (svenkubiak)
- Replaced internal TOTP implementation with external library (svenkubiak)
- Switched from Paseto to JWT (svenkubiak)
- MongoDB index are now case-insensitive when they are unique (svenkubiak)
- Upgraded to Java 25 (svenkubiak)
- Sonar refactorings (svenkubiak)
- Version bumps (svenkubiak)
Version 9.10.1
Released at 23.09.2025
- Version bumps (svenkubiak)
- log4j 2.25.1 -> 2.25.2
Version 9.10.0
Released at 23.09.2025
- Reduced unnecessary cache size (svenkubiak)
- Version bumps (svenkubiak)
- guava 33.4.8-jre -> 33.5.0-jre
- tika-core 3.2.2 -> 3.2.3
- bouncy-castle 1.81 -> 1.82
Version 9.9.0
Released at 18.08.2025
- Version bumps (svenkubiak)
- mockito-core 3.2.1 -> 3.2.2
- undertow-core 2.3.18.Final -> 2.3.19.Final
- guava 33.4.8-jre -> 33.5.0-jre
- tika-core 3.2.2 -> 3.2.3
- bouncy-castle 1.81 -> 1.82
Version 9.8.0
Released at 15.08.2025
- Paseto token and cookie have now the same expire date (svenkubiak)
- Added OriginFilter for checking the Origin-Header (svenkubiak)
- Added CsrfFilter and corresponding methods for CSRF checks (svenkubiak)
- Version bumps (svenkubiak)
- tika-core 3.2.1 -> 3.2.2
- greenmail-standalone 2.1.4 -> 2.1.5
Version 9.7.0
Released at 05.08.2025
- LocalDateTime/LocalDate is now serialized as ISO-8601 string (svenkubiak)
- Version bumps (svenkubiak)
- tika-core 3.2.0 -> 3.2.1
- commons-lang3 3.17.0 -> 3.18.0
- commons-validator 1.9.0 -> 1.10.0
- log4j 2.25.0 -> 2.25.1
- jackson 2.19.1 -> 2.19.2
- commons-codec 1.18.0 -> 1.19.0
- greenmail 2.1.3 -> 2.1.4
- classgraph 4.8.180 -> 4.8.181
- commons-io 2.19.0 -> 2.20.0
- caffeine 3.2.1 -> 3.2.2
Version 9.6.0
Released at 27.06.2025
- Sonar refactorings (svenkubiak)
- Version bumps (svenkubiak)
- caffeine 3.2.0 -> 3.2.1
- mongo-driver-sync 5.5.0 -> 5.5.1
- freemarker-java8 3.0.1 -> 3.0.3
- log4j 2.24.3 -> 2.25.0
- classgraph 4.8.179 -> 4.8.180
- Added new response method to return a binary stream (svenkubiak)
- Added option to directly access the mongodatabase (svenkubiak)
- Refactored uuid generation methods (svenkubiak)
- Sonar refactorings (svenkubiak)
- Version bumps (svenkubiak)
- fury-core 0.10.2 -> 0.10.3
- bouncy-castle 1.80 -> 1.81
Version 9.5.0
Released at 20.05.2025
- Sonar refactorings (svenkubiak)
- Version bumps (svenkubiak)
- guava 33.4.7-jre -> 33.4.8-jre
- fury-core 0.10.0 -> 0.10.2
- mongo-driver-sync 5.4.0 -> 5.5.0
Version 9.4.0
Released at 14.04.2025
- Sonar refactorings (svenkubiak)
- Version bumps (svenkubiak)
- junit 5.12.0 -> 5.12.1
- mockito-core 5.16.0 -> 5.17.0
- cactoos 0.56.1 -> 0.57.0
- guava 33.4.0-jre -> 33.4.7-jre
- mongo-driver-sync 5.3.1 -> 5.4.0
- commons-io 2.18.0 -> 2.19.0
Version 9.3.0
Released at 06.03.2025
- Added utility method to retrieve all configured translations / resource bundles (svenkubiak)
- All new and optimized documentation based on MkDocs Material (svenkubiak)
- Version bumps (svenkubiak)
- snakeyaml 2.3 -> 2.4
- fury-core 0.9.0 -> 0.10.0
- jackson 2.18.2 -> 2.18.3
- mockito-core 5.15.2 -> 5.16.0
Version 9.2.0
Released at 11.02.2025
- Added parsing of a default value from an arg{} config value (svenkubiak)
- Added cleaner handling of authentication when using mfa (svenkubiak)
- Added .notModified() to Response class (svenkubiak)
- Fixed an issue where the default messages.properties was not loaded (svenkubiak)
- Version bumps (svenkubiak)
- bouncy-castle 1.79 -> 1.80
- caffeine 3.1.8 -> 3.2.0
- mongo-driver-sync 5.3.0 -> 5.3.1
- commons-codec 1.17.2 -> 1.18.0
Version 9.1.0
Released at 13.01.2025
- Added handling of boolean request and URL parameter (svenkubiak)
- Fixed bug in CodecUtils that generated the same uuid (svenkubiak)
- Fixed bug that did not send the correct cookie when rememberMe was 'true' (svenkubiak)
- Fixed bug that send the authentication cookie on every request after valid authentication (svenkubiak)
- Fixed potential NPE in LocaleHandler (svenkubiak)
- Version bumps (svenkubiak)
- log4j 2.24.2 -> 2.24.3
- freemarker-java8 3.0.0 -> 3.0.1
- freemarker 2.3.33 -> 2.3.34
- junit 5.11.3 -> 5.11.4
- guava 33.3.1-jre -> 33.4.0-jre
- commons-codec 1.17.1 -> 1.17.2
- re2j 1.7 -> 1.8
- mongo-driver-sync 5.2.1 -> 5.3.0
Version 9.0.0
Released at 10.12.2024
- #601 Removed Basic HTTP authentication (svenkubiak)
- #591 Refactored Response class (svenkubiak)
- #588 Removed @admin/health endpoint (svenkubiak)
- #576 Removed all deprecated classes and methods (svenkubiak)
- Switched from props based configuration yaml based configuration (svenkubiak)
- Added copy-to-clipboard function to @admin dashboard (svenkubiak)
- Upgraded SHA hashing to SHA3-512 (svenkubiak)
- Increase iterations, memory, and parallelism of Argon2 hashing (svenkubiak)
- Switched to new Paseto library and upgraded to Paseto v4 (svenkubiak)
- Removed searchbar and table sorter from @admin dashboard (svenkubiak)
- Added new PasetoFilter and APIFilter to handle easy API authentication (svenkubiak)
- Version bumps (svenkubiak)
- mongodb-driver-sync 5.2.0 -> 5.2.1
- fury-core 0.8.0 -> 0.9.0
- classgraph 4.8.177 -> 4.8.179
- greenmail 2.1.0 -> 2.1.2
- commons-io 2.17.0 -> 2.18.0
- log4j 2.24.1 -> 2.24.2
Version 8.11.0
Released at 04.11.2024
- Added option to make an index unique via @Indexed annotation (svenkubiak)
- Version bumps (svenkubiak)
- undertow-core 2.3.17.Final -> 2.3.18.Final
- junit 5.11.1 -> 5.11.3
- fury-core 0.7.1 -> 0.8.0
- jackson-databind 2.18.0 -> 2.18.1
- cactoos 0.56.0 -> 0.56.1
- bouncy-castle 1.78.1 -> 1.79
Version 8.10.0
Released at 04.10.2024
- Fixed issue with multiple ServerSentEvent connections (svenkubiak)
- Removed external (web) dependency for generating 2FA QR code in @admin (svenkubiak)
- Version bumps (svenkubiak)
- log4j 2.23.1 -> 2.24.0
- fury-core 0.7.0 -> 0.7.1
- classgraph 4.8.175 -> 4.8.177
- commons-io 2.16.1 -> 2.17.0
- guava 33.3.0-jre -> 33.3.1-jre
- mongodb-driver-sync 5.1.4 -> 5.2.0
- junit 5.11.0 -> 5.11.1
Version 8.9.0
Released at 02.09.2024
- Added sanity checks on application startup for multiple mappings with the same URL (svenkubiak)
- Added new JSON error response method (svenkubiak)
- Added additional response methods for default templates without rendering (svenkubiak)
- Added an option to pass an auth origin parameter to the default /login redirect (svenkubiak)
- Added a method for dropping all indexes of all collections in the connected database (svenkubiak)
- Version bumps (svenkubiak)
- fury-core 0.6.0 -> 0.7.0
- guava 33.2.1-jre -> 33.3.0-jre
- commons-compress 1.26.2 -> 1.27.0
- commons-lang 3.15.0 -> 3.17.0
- mongodb-driver-sync 5.1.2 -> 5.1.3
- awaitility 4.2.1 -> 4.2.2
- commons-compress 1.27.0 -> 1.27.1
- classgraph 4.8.174 -> 4.8.175
- undertow-core 2.3.15.Final -> 2.3.17.Final
- freemarker-java8 2.1.0 -> 3.0.0
Version 8.8.0
Released at 29.07.2024
- Added utils method to generate a UUIDv5 in CodecUtils (svenkubiak)
- Version bumps (svenkubiak)
- pretty-time 5.0.8.Final -> 5.0.9.Final
- jackson 2.17.1 -> 2.17.2
- commons-codec 1.17.0 -> 1.17.1
- undertow-core 2.3.14.Final -> 2.3.15.Final
- commons-lang3 3.14.0 -> 3.15.0
- fury-core 0.4.1 -> 0.6.0
Version 8.7.0
Released at 21.06.2024
- Updated design of default error pages (svenkubiak)
- Version bumps (svenkubiak)
- commons-validator 1.8.0 -> 1.9.0
- guava 33.2.0-jre -> 33.2.1-jre
- freemarker 2.3.32 -> 2.3.33
- mongodb-driver-sync 5.1.0 -> 5.1.1
- classgraph 4.8.173 -> 4.8.174
- undertow-core 2.3.13.Final -> 2.3.14.Final
Version 8.6.0
Released at 27.05.2024
- Added scheduler overview page in @admin area (svenkubiak)
- Removed logger overview page in @admin area (svenkubiak)
- Refactored Response Entity for a more convenience usage (svenkubiak)
- Sonar refactorings (svenkubiak)
- Version bumps (svenkubiak)
- mongodb-driver-sync 5.0.1 -> 5.1.0
- guava-jre 33.1.0-jre -> 33.2.0-jre
- jackson 2.17.0 -> 2.17.1
- pretty-time 5.0.7.Final -> 5.0.8.Final
- mockito-core 5.11.0 -> 5.12.0
- common-logging 1.3.1 -> 1.3.2
Version 8.5.0
Released at 28.04.2024
- Reduced start-up time by around 50% (svenkubiak)
- Added additional methods for database quering (svenkubiak)
- Added additional failsafe when task is scheduled (svenkubiak)
- Added @Indexed annotation for field indexing (svenkubiak)
- Updated admin dashboard to latest version of bulma (svenkubiak)
- Fix bug that set the wrong cache value when using expiry (svenkubiak)
- Sonar refactorings (svenkubiak)
- Version bumps (svenkubiak)
- mongodb-driver-sync 5.0.0 -> 5.0.1
- classgraph 4.8.168 -> 4.8.172
- bouncycastle 1.77 -> 1.78.1
- undertow-core 2.3.12.Final -> 2.3.13.Final
Version 8.4.0
Released at 02.04.2024
- Sonar refactorings (svenkubiak)
- Added config option to disable persistence (svenkubiak)
- Version bumps (svenkubiak)
- mongodb-driver-sync 4.11.1 -> 5.0.0
- commons-compress 1.26.0 -> 1.26.1
- log4j 2.23.0 -> 2.23.1
- guava 33.0.0-jre -> 33.1.0-jre
- commons-io 2.15.1 -> 2.16.0
Version 8.3.0
Released at 25.02.2024
- Sonar refactorings (svenkubiak)
- Version bumps (svenkubiak)
- mockito-core 5.9.0 -> 5.10.0
- junit 5.10.1 -> 5.10.2
- commons-codec 1.16.0 -> 1.16.1
- undertow-core 2.3.10.Final -> 2.3.12.Final
- log4j 2.22.1 -> 2.23.0
Version 8.2.0
Released at 22.01.2024
- Sonar refactorings (svenkubiak)
- Replaced Guava event bus with new event bus based on reactive streams (svenkubiak)
- Version bumps (svenkubiak)
- log4j 2.22.0 -> 2.22.1
- jackson 2.16.0 -> 2.16.1
- mockito-core 5.8.0 -> 5.9.0
Version 8.1.0
Released at 19.12.2023
- Added additional cache statistics to /@admin (svenkubiak)
- Added additional cache retrieval method with fallback option (svenkubiak)
- Switched scheduler execution to virtual threads (svenkubiak)
- Switched cache handling from Guava to Caffeine (svenkubiak)
- Version bumps (svenkubiak)
- commons-io 2.15.0 -> 2.16.0
- fury-core 0.3.1 -> 0.4.1
- mockito-core 5.7.0 -> 5.8.0
- commons-validator 1.7 -> 1.8
- guava 32.1.3-jre -> 33.0.0-jre
Version 8.0.0
Released at 28.11.2023
- Removed Morphia in favour of a direct MongoDB integration (svenkubiak)
- Removed all deprecated methods and classes (svenkubiak)
- Updated to Java 21
- Sonar refactorings (svenkubiak)
- Version bumps (svenkubiak)
- commons-lang3 3.13.0 -> 3.14.0
- fury-core 0.3.0 -> 0.3.1