Thank you for sharing this information, Aditi. Very helpful. ๐๐ -- Thank you, Ashish Vijaywargiya https://www.linkedin.com/in/ashishvijaywargiya/
On Wed, 8 Jul 2026 at 19:35, Aditi Patel <[email protected]> wrote: > Hi all, > > June's headline: Apache OFBiz 24.09.07 is out > < > https://www.google.com/url?q=https://lists.apache.org/thread/r9v75g4bv8wx8wnf2jczh7vh5sqbx8tl&source=gmail&ust=1783605466763000&sa=E > >, > and it closes CVE-2026-47342 > < > https://www.google.com/url?q=https://lists.apache.org/thread/xqph4qjm163kmp0tcg9dodl6js499n75&source=gmail&ust=1783605466763000&sa=E > >, > a privilege escalation via an updateOrRemove authorization bypass. If you > run OFBiz in production, upgrade first and read the rest of this later. > > 107 issues touched ยท 19 opened ยท 68 resolved ยท 1 release ยท 1 CVE ยท 156 dev@ > messages from 31 participants > Shipped > > - OFBiz 24.09.07 > < > https://www.google.com/url?q=https://lists.apache.org/thread/r9v75g4bv8wx8wnf2jczh7vh5sqbx8tl&source=gmail&ust=1783605466763000&sa=E > > > โ security release fixing CVE-2026-47342 (privilege escalation). > Upgrade. > - OFBIZ-7935 > < > https://www.google.com/url?q=https://issues.apache.org/jira/browse/OFBIZ-7935&source=gmail&ust=1783605466763000&sa=E > > > / OFBIZ-13447 > < > https://www.google.com/url?q=https://issues.apache.org/jira/browse/OFBIZ-13447&source=gmail&ust=1783605466763000&sa=E > > > โ the deprecated SOAP-era UPS/USPS/FedEx/DHL shipping integrations and > their leftover gateway configs are gone (Upcoming Branch). Less dead > code > pretending to be a feature. > - OFBIZ-13446 > < > https://www.google.com/url?q=https://issues.apache.org/jira/browse/OFBIZ-13446&source=gmail&ust=1783605466763000&sa=E > > > / OFBIZ-7936 > < > https://www.google.com/url?q=https://issues.apache.org/jira/browse/OFBIZ-7936&source=gmail&ust=1783605466763000&sa=E > > > โ defunct third-party payment gateways and the Taxware/ZIPsales tax > integrations were removed for the same reason: the upstream APIs no > longer > exist. > - OFBIZ-13445 > < > https://www.google.com/url?q=https://issues.apache.org/jira/browse/OFBIZ-13445&source=gmail&ust=1783605466763000&sa=E > > > โ the WebPOS plugin has been retired to the attic, following a dev@ > proposal > < > https://www.google.com/url?q=https://lists.apache.org/thread/htcyf78jjghk6m5hg4hmztgc929gbz4c&source=gmail&ust=1783605466763000&sa=E > > > . > - OFBIZ-13436 > < > https://www.google.com/url?q=https://issues.apache.org/jira/browse/OFBIZ-13436&source=gmail&ust=1783605466763000&sa=E > > > โ copyQuote with copyQuoteRoles='Y' crashed the transaction on a > duplicate > QuoteRole primary key; fixed, lands in 24.09.08 and trunk. > - OFBIZ-13366 > < > https://www.google.com/url?q=https://issues.apache.org/jira/browse/OFBIZ-13366&source=gmail&ust=1783605466763000&sa=E > > > โ entity find logic refactored to use limit/offset so large result sets > no > longer get pulled into memory whole. Quiet change, real scalability win. > > In progress > > - Pluggable Secret Manager / Vault support > < > https://www.google.com/url?q=https://lists.apache.org/thread/7sj8mb8jx6l0jf4d189wqvm4gfv834oz&source=gmail&ust=1783605466763000&sa=E > > > โ proposal on dev@ to stop keeping secrets in plain config, with six > provider plugins (Vault et al.). One of the month's liveliest threads. > - Moving the REST-API plugin into the framework > < > https://www.google.com/url?q=https://lists.apache.org/thread/1o8ghnzxfms4303ont7dl16sstdpr67t&source=gmail&ust=1783605466763000&sa=E > > > โ proposal to make REST a first-class framework citizen; OFBIZ-13440 > < > https://www.google.com/url?q=https://issues.apache.org/jira/browse/OFBIZ-13440&source=gmail&ust=1783605466763000&sa=E > > > adds support for multiple independent REST APIs with separate > credentials > in one instance. > - OFBIZ-13441 > < > https://www.google.com/url?q=https://issues.apache.org/jira/browse/OFBIZ-13441&source=gmail&ust=1783605466763000&sa=E > > > โ new fulfillment-api plugin: a merchant-facing fulfillment REST API so > 3PLs running OFBiz as a WMS can hand customers an API (discussion > < > https://www.google.com/url?q=https://lists.apache.org/thread/oyq1t26pr96fyy54042m3kqtk3hlp48m&source=gmail&ust=1783605466763000&sa=E > > > ). > - AI plugin โ database-backed agent definitions landed (OFBIZ-13430 > < > https://www.google.com/url?q=https://issues.apache.org/jira/browse/OFBIZ-13430&source=gmail&ust=1783605466763000&sa=E > >); > a native Anthropic/Claude adapter (OFBIZ-13431 > < > https://www.google.com/url?q=https://issues.apache.org/jira/browse/OFBIZ-13431&source=gmail&ust=1783605466763000&sa=E > >) > and typed structured output (OFBIZ-13432 > < > https://www.google.com/url?q=https://issues.apache.org/jira/browse/OFBIZ-13432&source=gmail&ust=1783605466763000&sa=E > >) > are underway. > - OFBIZ-13438 > < > https://www.google.com/url?q=https://issues.apache.org/jira/browse/OFBIZ-13438&source=gmail&ust=1783605466763000&sa=E > > > โ a manufacturing-demo plugin: loadable Manufacturing + MRP reference > dataset so you can evaluate MRP without building demo data yourself. > > Also worth knowing > > - A VOTE to create a new release branch and set an end-of-life date for > release24.09 > < > https://www.google.com/url?q=https://lists.apache.org/thread/1sq3to1cqybgws678p4wc6oywvm8c01c&source=gmail&ust=1783605466763000&sa=E > > > โ the month's biggest governance thread. Plan your upgrade path > accordingly. > > Thanks to everyone who pitched in: > > Mridul Pathak, Anil K Patel, Lukas Finster, Jacopo Cappellato, Ashish > Vijaywargiya, Ratnesh Upadhyay, Nicolas Malin, Arun Patidar, Divesh Dutta, > Jacques Le Roux, Gil Portenseigne, Michael Brohl, Devanshu Vyas โ and > everyone else who filed, reviewed, and replied. > > Aditi Patel > HotWax Commerce > [email protected] >
