OFBiz Monthly Digest — May 2026

--000000000000012778065448e734
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi all,

A quick recap of what the OFBiz community got done in May 2026.

24.09.06
<https://www.google.com/url?q=3Dhttps://lists.apache.org/thread/vsnvbbbfbdl=
j1vgp9kz7s7yxqmn9ngpm&source=3Dgmail&ust=3D1781607323083000&sa=3DE>
is out and a batch of 17+ CVEs is patched=E2=80=94please upgrade.

118 issues touched =C2=B7 27 opened =C2=B7 80 resolved =C2=B7 1 release =C2=
=B7 17+ CVEs
Shipped

   - 24.09.06 released (May 19), carrying a coordinated 17+ CVE disclosure
   (SSTI=E2=86=92RCE, JWT forgery, path traversal, SSRF). Treat as an upgra=
de-now item.
   - OFBIZ-13407
   <https://www.google.com/url?q=3Dhttps://issues.apache.org/jira/browse/OF=
BIZ-13407&source=3Dgmail&ust=3D1781607323083000&sa=3DE>
   =E2=80=94 patched several Apache Tomcat CVEs via dependency update.
   - OFBIZ-9205
   <https://www.google.com/url?q=3Dhttps://issues.apache.org/jira/browse/OF=
BIZ-9205&source=3Dgmail&ust=3D1781607323083000&sa=3DE>
   =E2=80=94 fixed a long-standing accounting bug where cancelling a taxed =
order
   created wrong OrderAdjustments (lands in 24.09.07).
   - OFBIZ-13425
   <https://www.google.com/url?q=3Dhttps://issues.apache.org/jira/browse/OF=
BIZ-13425&source=3Dgmail&ust=3D1781607323083000&sa=3DE>
   =E2=80=94 PO shipments are now correctly marked received when receipts c=
ontain
   rejected units (24.09.07).
   - OFBIZ-13412
   <https://www.google.com/url?q=3Dhttps://issues.apache.org/jira/browse/OF=
BIZ-13412&source=3Dgmail&ust=3D1781607323083000&sa=3DE>
   =E2=80=94 added H2 database support to trunk, replacing retired Derby.
   - OFBIZ-13138
   <https://www.google.com/url?q=3Dhttps://issues.apache.org/jira/browse/OF=
BIZ-13138&source=3Dgmail&ust=3D1781607323083000&sa=3DE>
   =E2=80=94 JUnit 5 unit testing enabled framework-wide (4.13.x =E2=86=92 =
6.1.x migration
   <https://www.google.com/url?q=3Dhttps://lists.apache.org/thread/ssh1m7s3=
qyn3126qm0q7d7n6shrvmcw2&source=3Dgmail&ust=3D1781607323083000&sa=3DE>
   ).
   - OFBIZ-13426
   <https://www.google.com/url?q=3Dhttps://issues.apache.org/jira/browse/OF=
BIZ-13426&source=3Dgmail&ust=3D1781607323083000&sa=3DE>
   =E2=80=94 dedicated SECURITY_PWD_UPDATE permission for cross-user passwo=
rd
   resets.

In progress

   - OFBIZ-13262
   <https://www.google.com/url?q=3Dhttps://issues.apache.org/jira/browse/OF=
BIZ-13262&source=3Dgmail&ust=3D1781607323083000&sa=3DE>
   =E2=80=94 inventory reservation flow for manufacturing work orders; firs=
t changes
   in trunk, feature still being built out.
   - Headless plugins =E2=80=94 Headless Commerce plugin
   <https://www.google.com/url?q=3Dhttps://issues.apache.org/jira/browse/OF=
BIZ-13410&source=3Dgmail&ust=3D1781607323083000&sa=3DE>
   plus a headless, API-first manufacturing proposal.
   - OFBIZ-13398
   <https://www.google.com/url?q=3Dhttps://issues.apache.org/jira/browse/OF=
BIZ-13398&source=3Dgmail&ust=3D1781607323083000&sa=3DE>
   =E2=80=94 PWA Picking Application as a new plugin (PR + demo posted
   <https://youtu.be/9ByUvnGx5ws>).
   - Framework decoupling =E2=80=94 removing application dependencies from
   framework code
   <https://www.google.com/url?q=3Dhttps://issues.apache.org/jira/browse/OF=
BIZ-13418&source=3Dgmail&ust=3D1781607323083000&sa=3DE>;
   sub-tasks for UserLogin.userFullName
   <https://www.google.com/url?q=3Dhttps://issues.apache.org/jira/browse/OF=
BIZ-13392&source=3Dgmail&ust=3D1781607323083000&sa=3DE>
   and EntityPermissionChecker
   <https://www.google.com/url?q=3Dhttps://issues.apache.org/jira/browse/OF=
BIZ-13393&source=3Dgmail&ust=3D1781607323083000&sa=3DE>
are
   already done.
   - Proposals on the dev list =E2=80=94 move the REST-API plugin into the
   framework; backport Tomcat 10 / Jakarta to release24.09.

Also worth knowing

   - Apache Derby retired =E2=80=94 H2 is the path forward (see OFBIZ-13412=
 above).
   - Business Advisory Committee =E2=80=94 proposal to add a business-side
   governance body as OFBiz expands into enterprise automation.

Thanks to everyone who pitched in: Jacopo Cappellato (release manager),
Mridul Pathak, Ashish Vijaywargiya, Deepak Dixit, Anil K Patel, Jacques Le
Roux, Divesh Dutta, Arun Patidar, and many more.

Best,
Aditi Patel
HotWax Commerce
[email protected]

--000000000000012778065448e734--