Version 9.1.2

Version Highlights

Release Date: 19 October 2026
Editions: All Editions, Enterprise & Cloud Editions
Focus Areas: Security upgrades, tenant isolation, database & cache optimization, UI/UX consistency, builder & theme enhancements, and bug fixes

What's New

• Label Align Top Option in Theme Builder: The Theme Builder has a new Label Align Top option in the form component styling. It sets whether a top-positioned field label sits at the start or the end of the field. The same change fixes the DX 9 Builder Theme, where "Top" labels appeared on the wrong side. They now sit on the start side by default: left in left-to-right layouts, right in right-to-left layouts. This applies whether the position is set on the field or on its section, and field styles take priority. Joget DX 9 only.
• Removable Column in Manage Plugins: Settings > Manage Plugins has a new Removable column. It marks each plugin as one you can uninstall or one that is a protected platform plugin. The checkboxes for protected plugins are disabled, and Select All skips them. Previously, uninstalling a platform-bundled plugin such as the AI Agent Builder showed a success message while the plugin stayed installed. DX 9, Cloud edition.

Core Enhancements

Improvements to Joget's core features, including Builders, APIs, clustered deployments, and overall platform performance.

• Query Cache Invalidation: Data changed by custom SQL or BeanShell code could appear unchanged in lists until Ignite cache was cleared. Added clearQueryCache() in JdbcUtil to invalidate stale in-memory query-cache entries for a database table after custom SQL writes.
• Schema Update & Database Indexing: Pinned JDBC metadata extraction to operate individually so schema updates no longer scan the entire database catalog, reducing SQL Server startup times from 36.4s to 14.1s. Indexed app_form.tableName and wf_setup.property across install, sample, and empty database schemas to make form mapping loading significantly faster.
• Hash Variable Security & Escaping: Introduced default escaping for user-supplied hash variables in plugin properties, BeanShell, SQL, and chart properties to prevent injection vulnerabilities. Variable values can retain unescaped behavior using the ?noescape suffix.
• Dependency & Navigation Tracking: Added dependency scanning for elements within page components, allowing links to open directly to referencing pages in the builder and handling missing forms gracefully without crashing the UI.
• Clustered Deployment Sync: Form definitions and table mappings are now dynamically checked and refreshed across cluster nodes on the very first request after an app import, eliminating blank reads and cache inconsistency delays.
• Plugin Thread Cleanup: Thread resources from background plugin operations are now guaranteed to be released upon completion, preventing heap memory growth and thread accumulation on DX 9 servers.

Theme-Specific Fixes

Updates and fixes related to themes, ensuring better UI consistency and user experience.

• DX 9 Builder Theme: Top field labels now sit on the start side by default. Derived dark-sidebar header background dynamically from --theme-header using CSS color-mix instead of a hardcoded white overlay. Fixed multi-paged form alignment under RTL view.
• Builder Theme & Component Styling: Fixed grid action button color contrast in dark mode. Fixed field label alignment when positioned on top in DX 9 Builder Theme.
• XAdmin Theme: Fixed print button alignment, moving it to the right side in right-to-left (RTL) mode.
• Universal, Janux & Progressive Themes: Resolved text wrapping issues on mobile breakpoints and fixed tab label truncation/overflow across multi-paged forms.

Plugin Improvements

Enhancements to plugins, plugin management, and plugin development for greater flexibility and stability.

• JasperReports Security Sandbox: Added Groovy sandbox and idiom whitelisting for JasperReports Menu to allow secure Groovy report rendering and precompiled subreport execution while blocking reflection and execution calls.
• Git & Plugin Sync: Refreshed Git plugin directory sync logic by content comparison and fingerprint cache invalidation. Prevented older plugin files in Git sync folders from silently downgrading newly uploaded versions.
• SQL & Nonce Validation: Improved SQL parameter binding, nonce generation, and security token validation across enterprise plugins.
• Manage Plugins Governance: Added a Removable column and disabled checkboxes for non-removable core plugins to prevent unauthorized selection or uninstallation.

Bug Fixes and Improvements

List of bugs resolved in this release, along with general performance and stability improvements.

• Code Editors (CodeMirror 6): Restored standard line spacing to display more lines. Fixed Tab and Shift+Tab handling so they indent and outdent code instead of moving focus out of the field. Honored check_syntax properties to toggle linting appropriately.
• Grid & Repeater Components: Enabled horizontal scrolling on Grid components embedded inside forms to prevent cramped columns or layout overflow. Fixed missing expand/collapse buttons in Process Builder.
• PDF Export Optimization: Fixed unbounded static font-list growth and recursive calls triggered by emojis/invisible characters, resolving intermittent StackOverflowError HTTP 500 issues over extended server uptime.
• Form & Date Controls: Validated manually typed Date Picker input directly against configured display formats to prevent invalid short-year entries. Fixed Native Date Picker clear button behavior on mobile devices.
• Oracle & SQL Database Integration: Fixed invalid column type 16 errors when launching processes on Oracle databases and resolved index name collisions by appending table names.
• Builder Navigation & Editing: Fixed pasting over selected text in builders to replace cleanly without duplication. Prevented process test runs from prematurely closing the builder tab. Enabled quick creation of new Lists/UIs from Generate App, and smoothed app deletion flows.

Build & Dependencies

Updated components and dependencies within Joget, including third-party libraries and internal modules.

• Upgraded Apache Tomcat to version 11.0.26 on DX 9 (and 9.0.122 on DX 8) to address security vulnerabilities.
• Upgraded jsoup to 1.23.2, Jackson to 2.21.6, BouncyCastle to 1.86, and FreeMarker to 2.3.35.
• Upgraded the SweetAlert2 UI library from 11.22.0 to 11.26.25.
• Upgraded transitive dependencies including neethi (3.2.4), lz4-java (1.11.3), zstd-jni (1.5.7-14), and kotlin-stdlib (2.4.20).

Security Updates

Critical patches and security-related improvements.

• Multitenancy & Cloud Isolation Hardening: Applied core security hardening across multitenant deployment architectures, prohibiting non-admin tenants from running system-level operations, terminating active sessions on upgrade, and requiring inclusion of custom SSO/login plugins in wflow.security.trustedProgrammaticLoginClasses.
• Cross-Site Scripting (XSS) Prevention: Validated language parameter (_lang) subtags on login and UI pages to prevent reflected and persistent XSS attacks. Sanitized Rich Text Editor content thoroughly prior to display.
• Tomcat CVE Patches: Addressed CVE-2026-77791 and CVE-2026-65182 via Apache Tomcat updates.
• Enterprise Audit Findings: Closed audit vulnerabilities including unauthenticated list column access, record-level authorization checks in Multi Paged Form, Nested Datalist Formatter, and Spreadsheet Grid, as well as template handling in MFA lists.

Enterprise & Cloud Specific

• Ignite Caching & User Employment: Fixed security exceptions occurring during Ignite cache eviction and resolved duplicate employment records created when assigning users to departments.
• Database & APM Performance: Resolved SQL syntax errors in Database Wizard when applying Group By on option fields. Fixed performance chart titles overlapping legends in APM Viewer.
• Multi-Paged Form Navigation: Added auto-scrolling to bring the active tab into view upon page navigation and fixed mobile tab label wrapping.
• Advanced Grid & Spreadsheet: Corrected column header and body misalignment when "No Empty Space Scroll" is enabled, ensured full file downloadability on copied Spreadsheet rows, fixed decimal formatting on numeric summaries, and prevented date picker popups rendering off-screen on scrolled spreadsheet columns.
• SOAP & Legacy SQL Integration: Preserved SOAP Tool response data during connection teardowns and fixed Date Range Filter queries across legacy SQL Server DATETIME columns.
• Cloud Maintenance: Separated background connection maintenance per tenant on PostgreSQL Cloud deployments to eliminate false security logs and validate idle connections properly.
• Rich Text Editor Field: Fully sanitized Rich Text Editor content to block malicious markup while allowing valid image uploads.

Known Issues

• Task Delegation Menu Confirmation: Resolved task delegation submission flow issues where confirmation messages were not displayed.
• Shutdown may still log memory-leak warnings about retained background threads. They do not prevent the server from stopping and can be safely ignored.

Full Changelogs

Bug Fixes and Improvements

All Editions

[ FIXED ]        CORE        : Security - Security hardening for multi-tenant deployment.
[ FIXED ]        UI          : UI - Upgrade sweetalert2 from 11.22.0 to 11.26.25 to address security issue.
[ FIXED ]        CORE        : Property Editor - Fixed model field label positioning in property editor CSS.
[ FIXED ]        CORE        : Process Builder - Fixed DX 9 process builder save button remain in unsaved state after redo/undo.
[ FIXED ]        CORE        : DX 8 Tensorflow Tool - Fixed input field UI issues.
[ FIXED ]        PLUGIN      : Plugin Migration - Added logging for plugin migration.
[ FIXED ]        CORE        : AppDevUtil - Refresh git plugin folder by content and invalidate plugin fingerprint cache instead of staging a no-op commit during sync.
[ FIXED ]        CORE        : LocalLocaleResolver, UserviewThemeProcesser - Validated the _lang locale parameter to accept only alphanumeric subtags and JS-escaped UI.locale, preventing reflected and session-persistent XSS.
[ FIXED ]        CORE        : Numeric Field - Disable Increment/Decrement not working on DX 9 Builder Theme.
[ FIXED ]        CORE        : Security - Upgraded Apache Tomcat to 11.0.26 to address CVE-2026-77791.
[ FIXED ]        CORE        : Security - Upgraded jsoup to 1.23.2, Jackson to 2.21.6, BouncyCastle to 1.86 and FreeMarker to 2.3.35.
[ MODIFIED ]     CORE        : builder.js - Scroll canvas to overview path element on selection. #208
[ FIXED ]        CORE        : DependenciesUtil, UserviewService - Added dependency scanning for elements in page components, with links opening directly to the referencing page. #208
[ FIXED ]        CORE        : App - Added null checks to handle missing forms and prevent NullPointerExceptions. #208
[ FIXED ]        CORE        : EmploymentDao - Fixed duplicated and stale employment cache bug.
[ FIXED ]        THEME       : BuilderTheme - Fixed grid action buttons color similarity in dark theme.
[ FIXED ]        THEME       : XAdmin Theme - Fixed print button not right-aligned in RTL view.
[ FIXED ]        THEME       : DX 9 Builder Theme - Derived dark-sidebar header background from --theme-header via color-mix instead of a hardcoded white overlay.
[ FIXED ]        CORE        : Process Builder - Updated canvas controls tooltip header (AR) and adjusted controls indicator width/stacking.
[ FIXED ]        CORE        : Process Builder - Fixed Run Process popup closing the whole builder tab unexpectedly on first run.
[ FIXED ]        CORE        : Grid - Added horizontal scrolling to Grid inside forms instead of letting them overflow the form or cramp their columns.
[ FIXED ]        CORE        : CodeMirror - Reinstated check_syntax opt-out logic in codemirror6-bundle.js.
[ FIXED ]        THEME       : DX 9 Builder Theme - Fixed multipaged under RTL misaligned.
[ FIXED ]        THEME       : Multi Paged Form - Tab label truncation issue in Progressive, X-Admin, Janux and Universal theme.
[ FIXED ]        THEME       : Universal/Janux/Progressive - Fixed text not going to the next line under mobile breakpoint.
[ FIXED ]        CORE        : Security Field - Adjusted icons position so that they don't overlap.
[ FIXED ]        CORE        : Import App - Log meaningful error when app data is missing.
[ FIXED ]        CORE        : MultiSelectBox - Added horizontal scrollbar when multiselectbox choices remove button is overlapped with fixed width input container for DX 9 Themes.
[ FIXED ]        THEME       : List - Fixed page banner and sortable icon overlap in RTL mode.
[ ADDED ]        CORE        : JdbcUtil - Added clearQueryCache() to invalidate stale in-memory query-cache entries for a table after custom SQL writes.
[ FIXED ]        CORE        : InMemoryJdbcCacheAspect - Restored the previous cache marker instead of nulling it, fixing nested self-invocation clearing the cacheable context early.
[ FIXED ]        CORE        : PDF Export - Fixed unbounded static font-list growth and unbounded recursion causing intermittent StackOverflowError over server uptime.
[ FIXED ]        CORE        : wflow-shark - Process - Fixed invalid column type: 16 when starting a process on Oracle.
[ FIXED ]        CORE        : Datepicker - Validate manually entered Date Picker values against the configured display format.
[ MODIFIED ]     CORE        : Hash variable - Introduced default escaping for hash variables in plugin properties for enhanced security.
[ FIXED ]        CORE        : Security - Upgraded Apache Tomcat to 11.0.25 to address CVE-2026-65182.
[ FIXED ]        CORE        : PluginThread - Widened run()'s try/finally to cover setup so a thrown exception still removes the thread from ACTIVE_THREADS.
[ FIXED ]        THEME       : Flexigrid - Fixed Column Selection Arrow UI Issue.
[ FIXED ]        THEME       : Flexigrid - Fixed column resize not working in RTL mode. #796
[ FIXED ]        THEME       : Flexigrid - Fixed arrow button misaligned after moving bottom scrollbar. #796
[ FIXED ]        CORE        : Process Builder - Dragged element returns to its original position when scrolling while dragging. #862
[ FIXED ]        CORE        : List Hyperlink - Fixed hyperlink redirect to 404 when using UI ID and column name parameter.
[ FIXED ]        CORE        : Admin bar - Added hover feedback on the Quick Edit toggle so it's clear the whole row is clickable.
[ FIXED ]        CORE        : Welcome Page Tutorial Video - Fixed DX 8 video link in DX 9 welcome page.
[ FIXED ]        CORE        : Login - Fixed where logged in user can still view the login page.
[ FIXED ]        CORE        : App Icon Template - Fixed can't remove all apps.
[ FIXED ]        THEME       : Marketplace Install Button - Fixed install button position in mobile view.
[ FIXED ]        THEME       : Form Component - Fixed field label displaying on the wrong side when using the top option on DX 9 builder theme.
[ FIXED ]        CORE        : Builder - Fixed translucent overlay appear and error box shown multiple times after app delete.
[ FIXED ]        CORE        : File upload and List - Fixed custom error and confirmation messages with quote cause an error.
[ FIXED ]        CORE        : Ajax Form Submission - Fixed import menu confirmation dialog not triggered in DX 9 ajax theme.
[ FIXED ]        THEME       : List - Fixed icon not rendering in template in runtime and preview.
[ FIXED ]        CORE        : Manage Plugins - Prevent selection of non-removable plugins.
[ FIXED ]        THEME       : Spreadsheet - Removed inconsistent border on dimmed handsontable listbox cells.
[ FIXED ]        CORE        : Repeater - Fixed expand/collapse button missing in Process Builder LTR issue.
[ FIXED ]        CORE        : FileUtil - Spreadsheet file upload 404 on autofill and copy-paste from shared temp files.
[ FIXED ]        THEME       : Toast message - Fixed the toast message close button do not center-aligned properly.
[ FIXED ]        CORE        : Permission & Visibility - Fixed property editor not closing after deleting a rule.
[ FIXED ]        CORE        : wflow-commons, Form column cache - Stale Hibernate mapping served across nodes, causing UnknownPathException and silently dropped values.
[ FIXED ]        CORE        : Permission - Fixed permission property panel not closing when permission is deleted.
[ ADDED ]        CORE        : Setup SQL - Index app_form.tableName and wf_setup.property in the install, empty and sample schemas.
[ FIXED ]        CORE        : Section - Fixed no regex validation for ID.
[ FIXED ]        THEME       : Form css - Fixed border display on label icon in select box.
[ MODIFIED ]     CORE        : App Version Warning - Modified the "Latest" property to "Switch to Latest" including the other i18n.
[ FIXED ]        CORE        : Property Editor - Fixed create new button doing nothing for UI/List fields outside builder pages.
[ FIXED ]        CORE        : Date Picker - Fixed Native Date Picker Clear button not removing existing date input issue.
[ FIXED ]        THEME       : Action Dropdown - Fixed action dropdown menu in mobile view.
[ FIXED ]        CORE        : Print Feature - Fixed the print feature triggers changeSystemThemeAutomatically request.
[ MODIFIED ]     CORE        : wflow-wfengine - Hibernate mappings - Updated index naming conventions for improved consistency and clarity.
[ FIXED ]        CORE        : CodeMirror 6 - Fixed Tab key moving focus to the next field instead of indenting.
[ FIXED ]        CORE        : CodeMirror 6 - Removed min-height/padding on .cm-line that was shrinking the number of visible lines in the code editor.
[ FIXED ]        THEME       : App Resource Popup - Aligned Add/Edit Resource popup layout with plugin config popup to fix double scrollbar on small screens.
[ FIXED ]        CORE        : Builder - Fixed paste not pasting text correctly after selecting existing text.
[ FIXED ]        CORE        : CodeMirror - Honored check_syntax property to disable JSON linting on code editor fields.
[ FIXED ]        CORE        : Hibernate Schema Update - Set JDBC metadata extraction to individually so schema updates no longer read the whole database catalog.

Enterprise & Cloud Editions

[ FIXED ]        CORE        : Security - Security hardening for multitenant deployment.
[ FIXED ]        PLUGIN      : RichTextEditorField - Cleaned the value after rewriting temp image URLs and only accepted stored temp files from _IMAGES, preventing reflected XSS in the read-only view.
[ FIXED ]        PLUGIN      : List generator - Fixed ClassCastException error rendering list with select box option column.
[ FIXED ]        PLUGIN      : JasperReports Menu - Added groovy-sandbox and an idiom whitelist so groovy reports render, and blocked execute()/reflection calls before dispatch.
[ FIXED ]        CORE        : Security - Upgraded Apache Tomcat to 11.0.26 to address CVE-2026-77791.
[ FIXED ]        CORE        : Security - Upgraded Jackson to 2.21.6, neethi to 3.2.4 and lz4-java to 1.11.3, pinned zstd-jni 1.5.7-14 and kotlin-stdlib 2.4.20 over their vulnerable transitives.
[ FIXED ]        PLUGIN      : AdvancedGrid - Improved warning message clarity for missing column editors. #208
[ FIXED ]        PLUGIN      : Plugins - Added null handling and warnings for missing form definitions. #208
[ FIXED ]        PLUGIN      : Sql Chart Menu - Confine ECharts tooltip within viewport to prevent chart info being cut off on mobile/tablet view.
[ FIXED ]        CORE        : EmploymentDao - Fixed ignite cache eviction security exception.
[ FIXED ]        PLUGIN      : Form Grid - Removed hardcoded inline table width so Form Grid columns can scroll horizontally instead of being cramped.
[ FIXED ]        PLUGIN      : Calendar Menu - Fixed the calendar disappear when input custom Time Display Format and added T/t option.
[ FIXED ]        PLUGIN      : Calendar Menu - Fixed the event popup start and end time to use the same eventTimeFormat config.
[ FIXED ]        PLUGIN      : Calendar Menu - Fixed the h(:mm) config have leading zero for the hours.
[ FIXED ]        PLUGIN      : Multi Paged Form - Auto scroll active tab into view after navigation.
[ FIXED ]        PLUGIN      : List - Fixed sortable icon overlap in RTL mode on Janux theme.
[ MODIFIED ]     PLUGIN      : Plugins - Improved SQL parameter binding, nonce generation and validation.
[ FIXED ]        CORE        : Security - Upgraded Apache Tomcat to 11.0.25 to address CVE-2026-65182.
[ FIXED ]        PLUGIN      : Database Wizard - Fixed SQL syntax error when using Group By with option fields.
[ FIXED ]        PLUGIN      : Spreadsheet - Fixed column summary row not displaying decimal places for numeric format when sum results are integers. #935
[ FIXED ]        CORE        : APM Viewer - Fixed dark theme highlight being applied on light theme.
[ FIXED ]        PLUGIN      : Janux Theme - Fixed dropdown getting clipped during reassignment on mobile.
[ FIXED ]        PLUGIN      : Form Component - Fixed field label displaying on the wrong side when using top option on DX 9 builder theme.
[ FIXED ]        CORE        : Information Tile - Fixed typo in chart config description.
[ FIXED ]        PLUGIN      : Soap Tool - Fixed data fails to load and triggers MalformedChunkCodingException.
[ FIXED ]        PLUGIN      : Manage Permission UI - Fixed table not being responsive in some themes on small screens.
[ FIXED ]        PLUGIN      : Grid Jquery - Checkbox not reflecting accurate selection state when using form grid and list grid.
[ FIXED ]        PLUGIN      : Image Upload - Fixed custom error and confirmation messages with quote cause an error on image upload.
[ FIXED ]        PLUGIN      : CSV Import - Fixed import menu confirmation dialog does nothing after click OK in DX 9 non-ajax theme.
[ FIXED ]        PLUGIN      : CSV Import - Fixed import menu confirmation dialog not triggered in DX 8 ajax theme.
[ FIXED ]        PLUGIN      : Rich Text Editor - Fixed basic validator not working.
[ FIXED ]        PLUGIN      : Signature Pad - Input not being saved upon color change.
[ FIXED ]        PLUGIN      : Spreadsheet - Fixed date picker popup rendering off-screen when its column is horizontally scrolled to the edge of the visible area.
[ FIXED ]        PLUGIN      : Spreadsheet - Spreadsheet file upload 404 on autofill and copy-paste.
[ ADDED ]        CORE        : cloud-install, wflow-enterprise-install - Setup SQL - Index app_form.tableName and wf_setup.property in the empty, sample and cloud schemas.
[ FIXED ]        PLUGIN      : Task Delegation Menu - Message show after complete not displayed after form submission.
[ FIXED ]        PLUGIN      : Jdbc List Data Store - Fixed date range filter fails for legacy mssql datetime columns.
[ FIXED ]        CORE        : apmviewer - Fixed chart title overlapping with legend on smaller screens.
[ FIXED ]        PLUGIN      : Advanced Grid - Header and body columns misaligned when No Empty Space Scroll is enabled.
[ FIXED ]        CORE        : Hibernate Schema Update - Pinned JDBC metadata extraction to individually so startup no longer reads the whole database catalog.
[ FIXED ]        PLUGIN      : Information Tile - Fixed list record count always limited to 5 instead of the configured value.