Hi all, June's headline: Apache OFBiz 24.09.07 is out <https://www.google.com/url?q=https://lists.apache.org/thread/r9v75g4bv8wx8wnf2jczh7vh5sqbx8tl&source=gmail&ust=1783605466763000&sa=E>, and it closes CVE-2026-47342 <https://www.google.com/url?q=https://lists.apache.org/thread/xqph4qjm163kmp0tcg9dodl6js499n75&source=gmail&ust=1783605466763000&sa=E>, a privilege escalation via an updateOrRemove authorization bypass. If you run OFBiz in production, upgrade first and read the rest of this later.
107 issues touched · 19 opened · 68 resolved · 1 release · 1 CVE · 156 dev@ messages from 31 participants Shipped - OFBiz 24.09.07 <https://www.google.com/url?q=https://lists.apache.org/thread/r9v75g4bv8wx8wnf2jczh7vh5sqbx8tl&source=gmail&ust=1783605466763000&sa=E> — security release fixing CVE-2026-47342 (privilege escalation). Upgrade. - OFBIZ-7935 <https://www.google.com/url?q=https://issues.apache.org/jira/browse/OFBIZ-7935&source=gmail&ust=1783605466763000&sa=E> / OFBIZ-13447 <https://www.google.com/url?q=https://issues.apache.org/jira/browse/OFBIZ-13447&source=gmail&ust=1783605466763000&sa=E> — the deprecated SOAP-era UPS/USPS/FedEx/DHL shipping integrations and their leftover gateway configs are gone (Upcoming Branch). Less dead code pretending to be a feature. - OFBIZ-13446 <https://www.google.com/url?q=https://issues.apache.org/jira/browse/OFBIZ-13446&source=gmail&ust=1783605466763000&sa=E> / OFBIZ-7936 <https://www.google.com/url?q=https://issues.apache.org/jira/browse/OFBIZ-7936&source=gmail&ust=1783605466763000&sa=E> — defunct third-party payment gateways and the Taxware/ZIPsales tax integrations were removed for the same reason: the upstream APIs no longer exist. - OFBIZ-13445 <https://www.google.com/url?q=https://issues.apache.org/jira/browse/OFBIZ-13445&source=gmail&ust=1783605466763000&sa=E> — the WebPOS plugin has been retired to the attic, following a dev@ proposal <https://www.google.com/url?q=https://lists.apache.org/thread/htcyf78jjghk6m5hg4hmztgc929gbz4c&source=gmail&ust=1783605466763000&sa=E> . - OFBIZ-13436 <https://www.google.com/url?q=https://issues.apache.org/jira/browse/OFBIZ-13436&source=gmail&ust=1783605466763000&sa=E> — copyQuote with copyQuoteRoles='Y' crashed the transaction on a duplicate QuoteRole primary key; fixed, lands in 24.09.08 and trunk. - OFBIZ-13366 <https://www.google.com/url?q=https://issues.apache.org/jira/browse/OFBIZ-13366&source=gmail&ust=1783605466763000&sa=E> — entity find logic refactored to use limit/offset so large result sets no longer get pulled into memory whole. Quiet change, real scalability win. In progress - Pluggable Secret Manager / Vault support <https://www.google.com/url?q=https://lists.apache.org/thread/7sj8mb8jx6l0jf4d189wqvm4gfv834oz&source=gmail&ust=1783605466763000&sa=E> — proposal on dev@ to stop keeping secrets in plain config, with six provider plugins (Vault et al.). One of the month's liveliest threads. - Moving the REST-API plugin into the framework <https://www.google.com/url?q=https://lists.apache.org/thread/1o8ghnzxfms4303ont7dl16sstdpr67t&source=gmail&ust=1783605466763000&sa=E> — proposal to make REST a first-class framework citizen; OFBIZ-13440 <https://www.google.com/url?q=https://issues.apache.org/jira/browse/OFBIZ-13440&source=gmail&ust=1783605466763000&sa=E> adds support for multiple independent REST APIs with separate credentials in one instance. - OFBIZ-13441 <https://www.google.com/url?q=https://issues.apache.org/jira/browse/OFBIZ-13441&source=gmail&ust=1783605466763000&sa=E> — new fulfillment-api plugin: a merchant-facing fulfillment REST API so 3PLs running OFBiz as a WMS can hand customers an API (discussion <https://www.google.com/url?q=https://lists.apache.org/thread/oyq1t26pr96fyy54042m3kqtk3hlp48m&source=gmail&ust=1783605466763000&sa=E> ). - AI plugin — database-backed agent definitions landed (OFBIZ-13430 <https://www.google.com/url?q=https://issues.apache.org/jira/browse/OFBIZ-13430&source=gmail&ust=1783605466763000&sa=E>); a native Anthropic/Claude adapter (OFBIZ-13431 <https://www.google.com/url?q=https://issues.apache.org/jira/browse/OFBIZ-13431&source=gmail&ust=1783605466763000&sa=E>) and typed structured output (OFBIZ-13432 <https://www.google.com/url?q=https://issues.apache.org/jira/browse/OFBIZ-13432&source=gmail&ust=1783605466763000&sa=E>) are underway. - OFBIZ-13438 <https://www.google.com/url?q=https://issues.apache.org/jira/browse/OFBIZ-13438&source=gmail&ust=1783605466763000&sa=E> — a manufacturing-demo plugin: loadable Manufacturing + MRP reference dataset so you can evaluate MRP without building demo data yourself. Also worth knowing - A VOTE to create a new release branch and set an end-of-life date for release24.09 <https://www.google.com/url?q=https://lists.apache.org/thread/1sq3to1cqybgws678p4wc6oywvm8c01c&source=gmail&ust=1783605466763000&sa=E> — the month's biggest governance thread. Plan your upgrade path accordingly. Thanks to everyone who pitched in: Mridul Pathak, Anil K Patel, Lukas Finster, Jacopo Cappellato, Ashish Vijaywargiya, Ratnesh Upadhyay, Nicolas Malin, Arun Patidar, Divesh Dutta, Jacques Le Roux, Gil Portenseigne, Michael Brohl, Devanshu Vyas — and everyone else who filed, reviewed, and replied. Aditi Patel HotWax Commerce [email protected]
