Re: OFBiz Monthly Digest — May 2026

Hi Aditi,

Thanks for the recap.

Just a quick clarification: release 24.09.07 has already been
published and addresses two additional CVEs. Therefore, I would advise
upgrading to release 24.09.07, instead of 24.09.06.

Regards,
Anahita

Il giorno lun 15 giu 2026 alle ore 13:12 Aditi Patel
<[email protected]> ha scritto:
>
> Hi all,
>
> A quick recap of what the OFBiz community got done in May 2026.
>
> 24.09.06
> <https://www.google.com/url?q=3Dhttps://lists.apache.org/thread/vsnvbbbfb=
dlj1vgp9kz7s7yxqmn9ngpm&source=3Dgmail&ust=3D1781607323083000&sa=3DE>
> is out and a batch of 17+ CVEs is patched=E2=80=94please upgrade.
>
> 118 issues touched =C2=B7 27 opened =C2=B7 80 resolved =C2=B7 1 release =
=C2=B7 17+ CVEs
> Shipped
>
>    - 24.09.06 released (May 19), carrying a coordinated 17+ CVE disclosur=
e
>    (SSTI=E2=86=92RCE, JWT forgery, path traversal, SSRF). Treat as an upg=
rade-now item.
>    - OFBIZ-13407
>    <https://www.google.com/url?q=3Dhttps://issues.apache.org/jira/browse/=
OFBIZ-13407&source=3Dgmail&ust=3D1781607323083000&sa=3DE>
>    =E2=80=94 patched several Apache Tomcat CVEs via dependency update.
>    - OFBIZ-9205
>    <https://www.google.com/url?q=3Dhttps://issues.apache.org/jira/browse/=
OFBIZ-9205&source=3Dgmail&ust=3D1781607323083000&sa=3DE>
>    =E2=80=94 fixed a long-standing accounting bug where cancelling a taxe=
d order
>    created wrong OrderAdjustments (lands in 24.09.07).
>    - OFBIZ-13425
>    <https://www.google.com/url?q=3Dhttps://issues.apache.org/jira/browse/=
OFBIZ-13425&source=3Dgmail&ust=3D1781607323083000&sa=3DE>
>    =E2=80=94 PO shipments are now correctly marked received when receipts=
 contain
>    rejected units (24.09.07).
>    - OFBIZ-13412
>    <https://www.google.com/url?q=3Dhttps://issues.apache.org/jira/browse/=
OFBIZ-13412&source=3Dgmail&ust=3D1781607323083000&sa=3DE>
>    =E2=80=94 added H2 database support to trunk, replacing retired Derby.
>    - OFBIZ-13138
>    <https://www.google.com/url?q=3Dhttps://issues.apache.org/jira/browse/=
OFBIZ-13138&source=3Dgmail&ust=3D1781607323083000&sa=3DE>
>    =E2=80=94 JUnit 5 unit testing enabled framework-wide (4.13.x =E2=86=
=92 6.1.x migration
>    <https://www.google.com/url?q=3Dhttps://lists.apache.org/thread/ssh1m7=
s3qyn3126qm0q7d7n6shrvmcw2&source=3Dgmail&ust=3D1781607323083000&sa=3DE>
>    ).
>    - OFBIZ-13426
>    <https://www.google.com/url?q=3Dhttps://issues.apache.org/jira/browse/=
OFBIZ-13426&source=3Dgmail&ust=3D1781607323083000&sa=3DE>
>    =E2=80=94 dedicated SECURITY_PWD_UPDATE permission for cross-user pass=
word
>    resets.
>
> In progress
>
>    - OFBIZ-13262
>    <https://www.google.com/url?q=3Dhttps://issues.apache.org/jira/browse/=
OFBIZ-13262&source=3Dgmail&ust=3D1781607323083000&sa=3DE>
>    =E2=80=94 inventory reservation flow for manufacturing work orders; fi=
rst changes
>    in trunk, feature still being built out.
>    - Headless plugins =E2=80=94 Headless Commerce plugin
>    <https://www.google.com/url?q=3Dhttps://issues.apache.org/jira/browse/=
OFBIZ-13410&source=3Dgmail&ust=3D1781607323083000&sa=3DE>
>    plus a headless, API-first manufacturing proposal.
>    - OFBIZ-13398
>    <https://www.google.com/url?q=3Dhttps://issues.apache.org/jira/browse/=
OFBIZ-13398&source=3Dgmail&ust=3D1781607323083000&sa=3DE>
>    =E2=80=94 PWA Picking Application as a new plugin (PR + demo posted
>    <https://youtu.be/9ByUvnGx5ws>).
>    - Framework decoupling =E2=80=94 removing application dependencies fro=
m
>    framework code
>    <https://www.google.com/url?q=3Dhttps://issues.apache.org/jira/browse/=
OFBIZ-13418&source=3Dgmail&ust=3D1781607323083000&sa=3DE>;
>    sub-tasks for UserLogin.userFullName
>    <https://www.google.com/url?q=3Dhttps://issues.apache.org/jira/browse/=
OFBIZ-13392&source=3Dgmail&ust=3D1781607323083000&sa=3DE>
>    and EntityPermissionChecker
>    <https://www.google.com/url?q=3Dhttps://issues.apache.org/jira/browse/=
OFBIZ-13393&source=3Dgmail&ust=3D1781607323083000&sa=3DE>
> are
>    already done.
>    - Proposals on the dev list =E2=80=94 move the REST-API plugin into th=
e
>    framework; backport Tomcat 10 / Jakarta to release24.09.
>
> Also worth knowing
>
>    - Apache Derby retired =E2=80=94 H2 is the path forward (see OFBIZ-134=
12 above).
>    - Business Advisory Committee =E2=80=94 proposal to add a business-sid=
e
>    governance body as OFBiz expands into enterprise automation.
>
> Thanks to everyone who pitched in: Jacopo Cappellato (release manager),
> Mridul Pathak, Ashish Vijaywargiya, Deepak Dixit, Anil K Patel, Jacques L=
e
> Roux, Divesh Dutta, Arun Patidar, and many more.
>
> Best,
> Aditi Patel
> HotWax Commerce
> [email protected]