Hi all, Please find below the meeting minutes of the Unomi Monthly Meeting held August 13th at 09:00 CEST.
Please let me know if you have any questions or if I missed anything. Best Regards, Serge Huber. Apache Unomi Monthly Meeting — Summary Date: 13 August 2026 Context Monthly catch-up covering Unomi 3.1 product work, documentation and site updates, multi-tenant progress, and PMC governance. Per Apache PMC practice, items below are discussion outcomes and proposals only; formal decisions belong on the project mailing lists. Topics discussed Unomi 3.1 — proposed product directions Admin password at startup: propose removing the default admin password and blocking startup unless an admin password is provided (similar to OpenSearch). Merge operations: propose disallowing merges from public/context requests; allow them only from trusted backend / Unomi Kit callers. Public property exposure: propose moving from today’s denylist (with * wildcards) to a whitelist of properties that may be returned via contextJSON. Cookie priority: for 3.1, propose that profile ID / context / session resolution prefer cookies, and reject the request when values are inconsistent. Authenticated sessions (post-3.1): explore an authenticated-session flag (possibly tied to a login event) so additional properties can be exposed after a real login. Login sample rewrite Proposal to replace the old client-side JavaScript login sample (not a good practice example). Proposed approach: login servlet that issues the login event from the backend; random password generated at install time. Groovy Discussed operational risk of Groovy in multi-tenant deployments (hard to constrain safely). Proposal for the SaaS multi-tenant environment under development: disable Groovy access for tenants (individual/operator choice, not a project-wide vote in this meeting). Open question: Groovy usage in J-Experience (script generation for some actions). Multi-tenant Feature exercised internally for more than a year. Strong external demand (e.g. ~4000-client use case that today needs one VM per client). Architecture: tenant ID per item; complexity mainly in caches and the router (per-tenant configuration). Proposal that related hardening work for the multi-tenant line be handled internally. Documentation and communication Unomi 3.1 site in preparation, including a blog with several drafts already written (3.1 highlights, 2.x→3.x migration, AI integrations, etc.). Content kept concise on the marketing side; technical docs (condition structure, references, etc.) substantially expanded. security.md and llm.txt added to guide AI agents. Intent to use official Apache channels more (press release, [email protected]) to improve project visibility. Releases - 3.0.x will continue to integrate some fixes including some recently open issue - 3.1 work is reaching a stabilization phase and hopefully will release its first version soon, with minor releases planned as well.
