Die BPC Version 4.1 wird nicht mehr gewartet.

Sollten Sie diese BPC Version nutzen, empfehlen wir Ihnen eine Migration auf eine aktuelle Version. Die Dokumentation zur neusten BPC Version finden Sie hier. Sollten Sie Fragen haben, wenden Sie sich bitte an unseren Support.

Changelog

This page lists all the changes included in the releases of each version.

There are separate changelogs for administrators and developers (Administration Changelog and Developer Changelog). These are a subset of this changelog, containing entries that are relevant only to these users.

For some versions, an update to individual system components (Karaf, OpenSearch) or other parts is required. The Update Guide describes how these can be updated.

Explanations of the Changelog

Within each version, changes are grouped into different categories:

  • Breaking Changes
    Changes that alter the existing behavior of functions or that may require additional work when updating the BPC.

    Read the notes on the breaking change carefully.

    Entries in this category may also appear in one of the other categories.

  • Recommended Adjustments
    Instructions for the BPC update, as well as the consequences of following or disregarding the instructions.

    Entries in this category may also appear in one of the other categories.

  • New Features
    Features newly added in this version.

  • Improvements
    Improvements to existing features.

  • Security
    Changes that address potential IT security risks in BPC or further enhance the security level.

  • Bugs
    Fixes for various types of bugs.

  • Documentation
    Changes or additions to the product documentation.

  • Dependency Updates
    Changes to internally used components from external sources.

  • Miscellaneous
    Changes that do not fall into any other category.

For an explanation of version numbering, see the versioning guide.

BPC 4.1.28

Release Date: 2026-01-16

With this update, the following components must be updated: BPC Module | Karaf

New Features

Improvements

  • Faster Karaf startup BPC-9395

    Re: Karaf |

  • Correct display of the checkbox in bpcCheckColumn for On/Off values BPC-10224

    Related to: BPC Core |

  • Replication does not replicate records if the source table contains only future records BPC-10318

    Affects: BPC Core |

Bugs

  • Configurable monitor-export limits are unclear and are ignored during export BPC-9840

    The configured limit (max. number of records) for XLSX is now taken into account again when exporting data via the monitor. For CSV and JSON, a limit can now also be configured in the export dialog. An upper limit applies only to XLSX, not to other file formats.
    See also Configuring the Monitor Data Export
    Exporting Processes

  • The "displayField" and "displayValue" module types do not exist; instances cannot be created BPC-10005

    For GUI modules that offer types, components with types can once again be created. Translations for the name of a type no longer require a "CORE_" prefix. The schema for the translation keys is "<MODULID>_INSTANCE_TYPE_<WERT>".

    Subject: BPC Core |

  • Error in the Data Analysis Data Set Modifier BPC-10246

    Subject: BPC Core | Data Analysis |

  • Application area with ViewMode Tabbed displays navigation bar BPC-10374

    Affects: BPC Core |

  • Changes to the API Keys Editor cannot be saved BPC-10415

    Subject: BPC Core |

Documentation

Internal Dependencies / Dependency Updates

  • Update com.networknt:json-schema-validator BPC-10237

    Re: BPC Core | Forms |

  • Update froala-editor BPC-10330

    Re: BPC Core |

  • Update org.quartz-scheduler:quartz BPC-10357

    Affects: BPC Core |

  • Update apache-poi monorepo BPC-10359

    Affects: Process Monitoring |

  • Update ace-builds BPC-10361

    Re: BPC Core |

  • Update dompurify BPC-10394

    Subject: BPC Core | Forms |

  • Update org.json:json BPC-10461

    Subject: BPC Core |

  • Update nl.jqno.equalsverifier:equalsverifier BPC-10469

    Affects: OpenSearch |

  • Update de.Virtimo.BPC:nimbusLib BPC-10500

    Re: BPC Core |

  • Update ace-diff BPC-10501

    Re: BPC Core |

  • Update @vaadin/avatar BPC-10502

    Subject: BPC Core |

BPC 4.1.27

Release Date: 2025-11-17

With this update, the following components must be updated: BPC Modules | Karaf | Java

Improvements

  • BPC Log Index Cleanup: After starting Karaf, the first cleanup does not run until 60 minutes later. BPC-10168

    Index cleanups are performed 60 seconds after BPC starts, and then run at the configured interval.

    Re: BPC Core |

  • 0 Label for CustomRenderer in the Monitor BPC-10170

    It is now possible to use the value 0 in the valueMap of a Custom Renderer and to see this value as a Label in the monitor. Previously, 0 values were not displayed.

    Subject: Process Monitoring |

  • Improved Testability of Combo Boxes BPC-10196

    The values of the various options in combo boxes are no longer uniformly appended with " &nbsp;." This facilitates automated testing of user interfaces.

    Affects: BPC Core |

  • Exceptions occur when uninstalling bundles BPC-10228

    Affects: BPC Core |

Security

  • mssql-jdbc:12.6.1 | CVE-2025-59250 BPC-10266

    The driver provided via pax-jdbc-mssql is no longer included in the release.

    Make sure that the MSSQL driver you are using is at least the following version: 10.2.4, 11.2.4, 12.2.1, 12.6.5, 12.8.2, 12.10.2, 13.2.1

    If an older driver is being used, it should be replaced. Remove the old driver by deleting it from the deploy directory or by uninstalling it from pax-jdbc-mssql or the driver itself. Then install an up-to-date driver (without the " pax-jdbc-mssql" feature). See also: Databases

Bugs

  • Process launcher with "startWithContext" and "hidden" set to true loads the wrong process BPC-10261

    A bug has been fixed where the wrong process starter was displayed when exactly two process starters were configured, one of which is hidden.

  • Opensearch exception when bpcCheckColumn is of a type other than boolean BPC-9662

  • Using the local/Karaf IDP as a fallback is not working BPC-9837

    If the configured Identity Provider is unreachable, the system no longer incorrectly logs that the local Karaf Identity Provider is selected as a fallback. Instead, it indicates that this could be enabled as a fallback.

    Affects: BPC Core | Documentation |

  • UI: bpcModuleInstanceSelector - Incorrect module configuration routing for BackendConnection BPC-9975

    Affects: BPC Core |

  • Misleading button text for discarding changes BPC-10007

    Buttons that discard local changes now have clearer text labels.

    Re: BPC Core |

  • Keycloak: Modified "GET /groups" API request starting with version 26+ BPC-10149

    Retrieving subgroups has been adjusted to accommodate changes in the Keycloak API.

    Affects: BPC Core |

  • bpc.env.sh DE_VIRTIMO_BPC_DECANTER_APPENDER_OPENSEARCH_DELETEENTRIESOLDERTHAN does not work BPC-10169

    In the central configuration file (bpc.env.sh), a bug in the commented-out option DE_VIRTIMO_BPC_DECANTER_APPENDER_OPENSEARCH_DELETEENTRIESOLDERTHAN has been fixed. Previously, enabling this option did not work because the value must be enclosed in quotation marks. The Windows version was not affected.

    Re:

  • Replication incorrectly detects an infinite loop BPC-10181

    Affects: BPC Core |

  • Redirect URL upon logout contains language parameter BPC-10201

    A bug has been fixed where changing the language in the Keycloak screen had no effect when redirected from BPC to Keycloak after logging out.

    Re: BPC Core |

  • Status endpoint returns error BPC-10203

    The status endpoint returned an incorrect response when incorrectly configured loggers were set up.

    Subject: BPC Core |

Internal Dependencies / Dependency Updates

  • Karaf Update BPC-9960

    This update upgrades the Karaf version to 4.4.8. It is necessary to update the modules bpc-be-core, bpc-be-analysis, bpc-be-forms, and bpc-be-monitor.

    For BPC module developers

    With the updated Karaf, we are shipping CXF 3.6.8 instead of 3.6.7, which provides Jackson version 2.19.2.

    Please update the CXF version (3.6.8) and Jackson version (2.19.2) in your pom.xml. To do this, check whether you have an import package statement for this version. This must be added or adjusted if you use Jackson functions such as the ` ObjectMapper ` class.

    <Import-Package>
    ...
    com.fasterxml.jackson.*;version="[2.17.2,3.0.0)",
    ...
    </Import-Package>
  • Update graaljs.version BPC-10206

    Affects: Data Analysis |

  • Update org.quartz-scheduler:quartz BPC-10230

    Subject: BPC Core |

  • Update java BPC-10235

    Subject:

  • Update froala-editor BPC-10238

    Subject: BPC Core |

  • Update @vaadin/avatar BPC-10240

    Subject: BPC Core |

BPC 4.1.26

Release Date: 2025-10-13

The following components must be updated with this update: BPC Modules

Breaking Changes

You should read the descriptions in this section carefully. They may contain instructions that you must follow to perform an update.

  • HTTP proxy filters X-APIKey header BPC-10011

    HTTP calls made via an HTTP proxy or Flow connection filter out the BPC API key header (X-APIKey). Note: This could affect existing BPC configurations if, for example, an INUBIT process is triggered that, in turn, makes calls to the BPC API using the API key provided. (In this case, it would be better to store a fixed BPC API key within the INUBIT process.)

Improvements

  • Revised Dashboard Table Layout BPC-8672

    The cells in the dashboard’s table layout now make better use of their available space, and spacing between cells is maintained. Errors no longer occur when resizing cells.

  • Hide Information About OpenSearch Internal Indexes BPC-8820

    The endpoint /cxf/bpc-core/opensearch/indices/compact no longer returns OpenSearch internal indexes. These are all indexes named with a . prefix. Accordingly, these are no longer filtered in index selectors in the frontend.

    Re: BPC Core |

  • Display complex filters in the tooltip and account for the number of filters in full-text search BPC-9193

    A new filter type, json, has been added to display filtered structured data in the column header. See Filter Columns

  • Replication Editor: Expand tooltips for "Cron Pattern" expressions BPC-9396

    The tooltips for Cron patterns in replication have been updated to include a link to the Quartz Scheduler documentation.

    Affects: BPC Core | Documentation |

  • Improved display and setting of Boolean values in settings tables BPC-9968

    For Boolean values in the settings tables, a combo box is no longer displayed; instead, only the checkbox with the truth value appears. The value can be changed by clicking, pressing the spacebar, or pressing Enter.

    Re: BPC Core |

  • Classes for menu buttons to reduce arrow spacing BPC-10060

    The classes arrow-spacing-sm (small) and arrow-spacing-xs (extra small) can now be used on buttons to reduce the arrow spacing.

    Re:

  • 0 Label for CustomRenderer in the Monitor BPC-10170

    It is now possible to use the value ` 0 ` in the ` valueMap ` of a CustomRenderer and to see this value as a Label in the monitor. Previously, ` 0 ` values were not displayed.

    Subject: Process Monitoring |

  • Styling Checkbox / Radio Group BPC-9917

    The mouse pointer now appears over checkboxes and radio groups in a way that clearly indicates You can change their state by clicking.

    Subject:

  • SETTING_LICENCED_MODULES readonly BPC-9923

    The setting licencedModules can no longer be edited in the frontend. Previously, the setting could be edited, but the value was not applied.

    Affects: BPC Core |

Security

  • HTTP proxy filters X-APIKey header BPC-10011

    HTTP calls made via an HTTP proxy or Flow connection filter out the BPC API key header (X-APIKey). Note: This could affect existing BPC configurations if, for example, an INUBIT process is triggered that, in turn, makes calls to the BPC API using the API key provided. (In this case, it would be better to store a fixed BPC API key within the INUBIT process.)

    Subject: BPC Core | Documentation |

  • Default for filterSessionCookie set to true BPC-9926

    For new backend Connections of the HTTP-Proxy and Flow types, the "Filter BPC Session " option is enabled by default.

Bugs

  • Replication in an Infinite Loop BPC-10121

    Replication could get stuck in a specific time window if that window was adjacent to the present and no records were found.

    Affects: BPC Core |

  • Views from older versions are marked as modified when loaded BPC-8564

    Views are correctly marked as modified if the view object contains new values or objects. If new columns or grids have been added in additional tabs, the view is automatically saved for the user, provided the user has permission to save the view. A message is displayed indicating whether the save was successful or failed.

    In BPC 5.0.0, unsaved changes occur in views from older versions because the fields in the model have been updated. The views must then be saved once.

  • Adding Multiple Roles/Organizations Simultaneously BPC-9659

    Fixed an issue where errors could occur when creating multiple new users, roles, or permissions simultaneously while Karaf was selected as the identity provider.

    Re: BPC Core |

  • Dashboard Table Layout Broken When a Row Is Omitted Due to Rowspan BPC-9730

    The resizing of widgets in the dashboard’s table layout has been improved*,* and the likelihood of errors has been reduced.

  • Monitor Export - View Selection BPC-9970

    Affects: Process Monitoring |

  • JavaScript modifiers cannot be executed BPC-9993

    For existing Karaf installations, add the following value to KARAF/etc/custom.properties:

    # the base value is from config.properties and has been extended
    # by the packages 'jdk.internal.access' and 'jdk.internal.module'
    org.osgi.framework.bootdelegation = \
        com.sun.*, \
        javax.transaction, \
        javax.transaction.xa, \
        javax.xml.crypto, \
        javax.xml.crypto.*, \
        javax.security.cert, \
        jdk.nashorn.*, \
        sun.*, \
        jdk.internal.reflect, \
        jdk.internal.reflect.*, \
        org.apache.karaf.jaas.boot, \
        org.apache.karaf.jaas.boot.principal, \
        jdk.internal.access, \
        jdk.internal.module

    Subject: Data Analysis | Karaf |

  • Custom language entries are not taken into account during fallback BPC-10010

    When translations are called up (cxf/bpc-core/i18n/translations or in the frontend), custom entries for the fallback language are now also taken into account.

    Affects: BPC Core |

  • Missing translation text in the replication editor BPC-10175

    Affects: BPC Core |

Internal Dependencies / Dependency Updates

  • Update graalvm.version BPC-10031

  • Update com.networknt:json-schema-validator BPC-10032

    Affects: BPC Core |

  • Update org.mariadb.jdbc:mariadb-java-client BPC-10038

    Subject: BPC Core |

  • Update dompurify BPC-10086

    Subject: BPC Core | Forms |

  • Update @vaadin/avatar BPC-10158

    Subject: BPC Core |

BPC 4.1.25

Release Date: 2025-08-21

The following components must be updated with this update: BPC Modules | Karaf | Java

Improvements

  • The "version" property of a BPC module affects dependencies in the BE Core BPC-8968

    If a BPC module used a different versioning scheme than the BPC Core, the " project.version " property affected the dependencies in the BPC Core and caused problems. Dependencies within the BPC Core are no longer affected by the ` project.version ` property in the module.

    Affects: BPC Core | Forms |

  • Display in the monitor header BPC-8999

    The readability of large numbers in the number of records has been improved by adding thousands separators. The "Remove Filter" button now includes additional information about the currently applied filters.

  • Dashboard Table Layout: Enlarge Cells BPC-8669

    Moving and resizing widgets in the dashboard while the table layout is enabled has been improved.

  • Show the entire menu within the Dashboard widget BPC-9682

  • Enable grouping in the BPC Settings tables by default. BPC-9737

    The option for grouping settings is now enabled by default. It is recommended to use this view, as it displays the settings in a common context.

    Re: BPC Core |

  • Deployment cannot be performed (if source model version is lower than target) BPC-9741

    Re: BPC Core |

  • TailSync does not take the "Relative End Date:" into account in most cases BPC-9780

    Subject: BPC Core |

  • Add missing translations to the Core Status page BPC-9827

  • Images should not be stretched in the FileViewer BPC-9833

  • Include missing monitor settings in the Editor BPC-9835

  • Incorrect "licenseLists" value displayed in the LicenseGrid BPC-9841

    Re: BPC Core |

  • Line break in the tooltip of the Settings Panel BPC-9908

    Affects: BPC Core |

  • Sanitize Forms BPC-9918

    The output of the HTML component is sanitized to remove script content, for example.

    Re: Forms |

  • Process Starter: "windowWidth" and "windowHeight" for initial window BPC-9944

    The default window size for Process Starter can now be configured.

  • Tooltips for index operations in the index overview BPC-7878

  • Status Change: Automatic Preselection of the Target Status BPC-9816

    You can now configure the preselection of a value for the process status change. The preselection is controlled by the configuration preselectState in the setting function_changeStateConfig.

    "preselectState": "_first": Always selects the first available value from the dropdown. "preselectState": "<Suchwert>": Selects the first entry that contains the specified text (case-sensitive). Both raw values and display names (from Custom Renderer) can be used.

    If exactly one process is loaded and there are exactly two values to choose from, the status field automatically selects the status that does not match the current status.

    Sample configuration
    [
        {
            "dataIndex": "STATUS",
            "useDistinctValues": true,
            "preselectState": "Offen"
        },
        {
            "dataIndex": "VALID",
            "useDistinctValues": true,
            "preselectState": "no"
        },
        {
            "dataIndex": "STATUS2",
            "useRendererValues": true,
            "useDistinctValues": false,
            "preselectState": "_first"
        }
    ]

Security

  • Do not accept filenames containing paths for module and license uploads BPC-9362

    Any path information is ignored to prevent path traversal attacks.

    Affects: BPC Core |

Bugs

  • Combo box is not displayed correctly BPC-9710

    Affects: Forms |

  • Incorrect Keycloak configuration causes BPC to stop responding BPC-9753

    Affects: BPC Core |

  • ProcessStarter: "windowWidth" and "windowHeight" do not fully affect the window BPC-9943

    The ProcessStarter configuration for windowWidth and windowHeight now correctly affects the window.

    Affects: Process Monitoring |

  • gridActionColumn in the childGrid displays the process initiator BPC-9585

  • JSON data should not be automatically sorted in the Forms Repository BPC-9603

    The order of properties in JSON forms is preserved.

    Re: Forms |

  • Replication stops when gaps exceed blockDayRange BPC-9606

    Re: BPC Core |

  • Data Modifier Editor does not always save the latest changes when saving BPC-9613

    Re: BPC Core |

  • Full-text search with multiple conditions BPC-9635

    OpenSearch exceptions now also display triggers, if available. A more detailed error message is displayed in the Monitor Grid if full-text search is enabled.

    Advanced Search has been added for filtering limitations.

  • SetFormState with combo box only works the first time BPC-9650

    Affects: Forms |

  • Process Monitor: The Manage view does not save changes BPC-9660

    Subject: Process Monitoring |

  • Monitor: The record counter does not display ">=" when the limit (Monitor_DataViewLimit) is reached. BPC-9664

    Subject: Process Monitoring |

  • Incorrect condition when validating childId using encodeURIComponent BPC-9722

    File downloads are now possible in both parent and child data.

  • Disabling the dashboard refresh has no effect on analysis widgets BPC-9723

  • Dashboard shows unsaved changes even though nothing needs to be saved BPC-9731

    Related: Process Dashboard |

  • Frontend: "Show only unread" notification filter does not work for new messages. BPC-9754

    A bug was fixed where newly arriving notifications were incorrectly hidden by the "Show Only Unread."

    Re: BPC Core |

  • Automatic chart refresh resets editor state while writing BPC-9757

  • Replication is stuck in an infinite loop BPC-9796

    Subject: BPC Core |

  • Maintenance mode can be enabled via the UI but cannot be disabled again. Error: "Not allowed to set local server properties" BPC-9799

    When BPC is running in a cluster, it may not be possible to disable maintenance mode via the GUI.

    Affects: BPC Core |

  • FileViewer ObjectUrl cannot be generated (for PDF and image) BPC-9831

    Affects: Process Monitoring |

  • Error when closing or resizing displayed images in the monitor detail view BPC-9832

    Affects: Process Monitoring |

  • Tooltip for the jump via the module link is always in German BPC-9902

    Affects: BPC Core |

  • Monitor Export: No translation of MultipleGrids titles in the export selection BPC-9903

    Subject: Process Monitoring |

  • Incorrect display of the notification list when there are a large number of notifications BPC-9755

    Subject: BPC Core |

  • hasUserAnyRole - Calling with a single role as a string results in an error BPC-9784

    Affects: BPC Core |

  • Process Monitoring configuration: The value of "inubit_proxyId" is sometimes not displayed in the editor BPC-9818

    Affects: BPC Core |

Documentation

Internal Dependencies / Dependency Updates

  • Update de.Virtimo.BPC:nimbusLib BPC-9764

    Subject: BPC Core |

  • Update CXF BPC-9852

    Subject: BPC Core | Karaf |

  • Update graalvm.version BPC-9873

    Subject: Data Analysis |

  • Update com.networknt:json-schema-validator BPC-9874

    Subject: BPC Core |

  • Update com.nimbusds:oauth2-oidc-sdk BPC-9876

    Subject:

  • Update ace-builds BPC-9882

    Affects: BPC Core |

  • Update froala-editor BPC-9887

    Affects: BPC Core |

  • Update java BPC-9896

    Subject:

  • Update BPC.version BPC-9914

    Subject: BPCCore |

  • Update com.zaxxer:HikariCP BPC-9915

    Subject: BPC Core |

  • Update com.zaxxer:HikariCP BPC-9916

    Subject: BPC Core |

  • Update @vaadin/avatar BPC-9958

    Subject: BPC Core |

Miscellaneous

  • Update Froala Key BPC-9990

    In the HTML editor, "Expired copy of the Froala Editor" might have been displayed.

    Re: BPC Core |

BPC 4.1.24

Release Date: 2025-06-02

The following components must be updated with this update: BPC Modules | Java

Improvements

  • Log level set to INFO instead of WARN when an active backup job references an index that has not yet been created BPC-9579

    Affects: BPC Core |

  • Multilingual Support in the Process Launcher BPC-9582

  • Handling of Primary Keys in the Log Service UI BPC-9599

    ID columns are now set via combo boxes in the Log Service configuration interface. The configuration can only be saved if at least one ID column is defined. Additionally, the system checks whether all ID columns are included in the field configuration. If this is not the case, the form is marked as invalid and saving is prevented.

    Affects: BPC Core |

  • Adapt charts in the Analysis module to BPC language BPC-9626

    Affects: Data Analysis |

  • Forms Backend Exception due to missing JSON schema file BPC-9628

    Subject: Forms |

Security

  • Filter session cookie content from log file BPC-9533

    The logging configuration has been changed so that session tokens are masked. For new Karaf installations, this happens automatically. For existing installations, please update the configuration file [KARAF]/etc/org.ops4j.pax.logging.cfg. Replace the old line

    log4j2.maskpasswords.pattern = %replace{${log4j2.pattern}}{(password=[^\\s,]+)|(&quot;password&quot;\\s*:\\s*&quot;\\w+&quot;)}*{}*

    with the lines

    # Chained replacement patterns to mask sensitive information
    # Filter out UUIDs as these are used as session cookies (keycloak+oidc)
    log4j2.maskuuids.pattern = %replace{${log4j2.pattern}}{(?i)([a-f0-9]{4})[a-f0-9]{4}(-[a-f0-9]{4}){3}-[a-f0-9]{8}(([a-f0-9]{4}))(?-i)}{$1****-****-***`bpcMonitor_editMonitorViews` -***-*****$3*}
    # Filter out JWT tokens that might contain session IDs
    log4j2.maskjwt.pattern = %replace{${log4j2.maskuuids.pattern}}{ey[\\w-]+\\.ey[\\w-]+\\.[\\w-]+}*{(JWT)}*
    log4j2.maskunsecuredjwt.pattern = %replace{${log4j2.maskjwt.pattern}}{ey[\\w-]+\\.ey[\\w-]+\\.}*{(JWT)}*
    # Filter out 256-bit (64 hex digits) UUIDs used for Karaf session cookies and API keys
    log4j2.maskkarafsessioncookie.pattern = %replace{${log4j2.maskunsecuredjwt.pattern}}{[0-9a-fA-F]{64}}*{}*
    # Filter out passwords
    log4j2.maskpasswords.pattern = %replace{${log4j2.maskkarafsessioncookie.pattern}}{(password=[^\\s,]+)|(&quot;password&quot;\\s*:\\s*&quot;\\w+&quot;)}*{}*

    Since session tokens in Keycloak and OIDC are UUIDs that are also used elsewhere, we log the first and last four characters here.

    Affects: BPC Core | Documentation | Karaf |

Bugs

  • Timing issue with setData immediately after setFormConfig BPC-9530

    Subject: Forms |

  • Status change button in the menu is always grayed out BPC-9570

    Subject: Process Monitoring |

  • Monitor - FileViewer - Select All - does nothing BPC-8465

    Subject: Process Monitoring |

  • Tabbed navigation bar: Submenu arrow does not fit in the tab BPC-8833

    Subject: BPC Core |

  • Error processing/writing FE logs BPC-8923

    Subject: BPC Core |

  • requireComment does not display confirmationText BPC-8969

    The confirmationText of a process action is now displayed if either requireComment or requireConfirmation is true.

  • PDFs cannot be made available for download via INUBIT or for the file viewer in the process monitor BPC-9105

    If binary files were uploaded via INUBIT or another backend system, the files might have been corrupted during download or viewing.

    Subject: Process Monitoring |

  • Error in the Monitor when switching states BPC-9187

    An error that occurred when updating the tooltip while switching between states in the Monitor—which happened when multiple grids were disabled—has been fixed.

  • Monitor filters cannot be cleared via "X" if filters were set by clicking on an exported link BPC-9451

    When opening a monitor via a deep link that included filters, those filters might still be displayed in the column header even after they were removed.

    Subject: Process Monitoring |

  • Incorrect date filter in exported monitor filter link BPC-9452

    A bug was fixed where the date filter was not displayed correctly in the monitor.

    Affects: BPC Core |

  • Disabling the dashboard refresh is not taken into account BPC-9481

  • Accounting for different initial states during internal configuration migration BPC-9503

    Affects: BPC Core |

  • The gui_showFilterBar monitor does not hide the filter bar when disabled BPC-9520

    Affects: Process Monitoring |

  • Error during index migration for the audit log BPC-9543

    Affects: BPC Core |

  • Process launcher window is displayed behind the detail view window BPC-9544

    Affects: Process Monitoring |

  • Replication cannot be backed up if hyphens are used in the schema name. BPC-9566

    When replicating MSSQL tables, schema and table names masked with square brackets and quotation marks, such as [customer-abc].logging or "customer-abc".[logging], are now also supported.

    Re: BPC Core |

  • Buttons in the vertical navigation bar are right-aligned BPC-9584

    Re: BPC Core |

  • Error when modifying monitor views despite having the necessary*permissions* BPC-9620

    An error has been fixed that prevented users from editing a monitorView.

    Subject: BPC Core | Documentation |

  • Missing name displayed as null BPC-8758

    A user’s missing first or last name is no longer*displayed* as “null.”

    Affects: BPC Core |

Documentation

Internal Dependencies / Dependency Updates

  • Update apache-poi monorepo BPC-9493

  • Update graalvm.version BPC-9521

  • Update java BPC-9564

    Subject:

  • Update ace-builds BPC-9591

    Subject: BPC Core |

  • Update org.json:json BPC-9641

    Subject: BPC Core |

  • Update dompurify BPC-9643

    Subject: BPC Core | Forms |

  • Update to froala-editor BPC-9644

    Re: BPC Core |

  • Update to groovy monorepo BPC-9666

  • Update com.nimbusds:oauth2-oidc-sdk BPC-9669

    Subject:

  • Update @vaadin/avatar BPC-9676

    Subject: BPC Core |

BPC 4.1.23

Release Date: 2025-04-08

The following components must be updated with this update: BPC Modules

Breaking Changes

You should read the descriptions in this section carefully. They may contain instructions that you must follow to perform an update.

  • Restriction on the visibility of the gear icon for widget configuration in the dashboard BPC-9087

    Dashboard widgets now only display the configuration icon if the user is allowed to edit the dashboard. To do so, the user needs the " bpcDashboard_editDashboard" permission. Users without this permission can no longer edit dashboard widgets. If editing capabilities (e.g., for custom widgets) are to continue to be offered, either the corresponding permission must be granted or the configuration must be provided via alternative methods (e.g., via the widget header).

Improvements

  • CustomRenderer and the translate formatter are applied in the monitor export BPC-9100

    Subject: Process Monitoring |

  • Inclusion of all renderers in the filter selection list BPC-8112

    Subject: Process Monitoring |

  • Display the number of selected rows during status changes BPC-8673

    Subject: Process Monitoring |

  • Displaying the number of selected processes/rows BPC-8722

    In the moduleHeaderContent setting, the Parameter showSelectionCounter in the metablock can be used to control whether the number of selected records is displayed.

    [
        {
          "id": "metadata",
          "config": {
            "showFilter": false,
            "showSorter": false,
            "showSelectionCounter" : true
            }
        }
    ]
  • Forms: Value with language-dependent values, analogous to the Label BPC-9085

    Forms now correctly translate Labels for all components, including those in the state. This makes it possible to set bindings on Labels. See Multilingual Content.

    setFormState can now also correctly handle Labels in multiple languages. As part of this, a bug was fixed that caused setFormState to remove bindings, resulting in the submit after setFormState containing only data from before setFormState. In addition, all components can now be used in combination with setFormState, including combo boxes and tables.

    Re: Forms |

  • Forms: Multilingual Support Improvements BPC-9086

    The current language is now stored under /language. Date formats are now handled consistently by the date field and the table and formatted appropriately for the user based on the language.

    Re: Forms |

  • Restriction on the visibility of the gear icon for widget configuration in the dashboard BPC-9087

    Dashboard widgets now only display the configuration icon if the user is authorized to edit the dashboard. To do so, the user needs the " bpcDashboard_editDashboard" permission. Users without this permission can no longer edit dashboard widgets. If editing capabilities (e.g., for custom widgets) are to continue to be offered, either the corresponding permission must be granted or the configuration must be provided via alternative methods (e.g., via the widget header).

    Subject: Process Dashboard |

  • The BPC startup script should not wait 30 seconds each time (after OpenSearch starts and after Karaf starts) BPC-9332

    The startup script no longer waits 30 seconds after OpenSearch and Karaf have started. If problems arise where OpenSearch is not available in a timely manner, the watchdog should be used.

    Re:

  • Separate the BPC startup script from setup functions BPC-9372

    The startup script no longer makes any changes to the environment. Directories must be configured according to the installation instructions, and JAVA_HOME must also be configured correctly.

    Re:

  • User Experience During Monitor Export BPC-9397

    A loading animation is now displayed while the export is in progress. Additionally, error messages are now displayed in the event of an error.

  • Updated message for monitor widgets with no available data in the configured time period BPC-9437

  • Refactoring of the Monitor Export window BPC-9467

  • The bpcComboRenderedValue component now supports emptyText BPC-9471

    Subject: BPC Core |

  • Highlight rows in "Navigation Settings" BPC-9486

    Rows in the Navigation Settings are now highlighted in alternating colors to improve readability.

    Re: BPC Core |

  • Workaround for old Log4J vulnerability that is no longer needed has been removed BPC-9107

    Re: OpenSearch |

  • Application areas should only be allowed to be moved below the root element BPC-9368

    Affects: BPC Core |

  • Uploading modules, licenses, and DB drivers BPC-9369

    The descriptive texts for uploads have been adjusted to accommodate the different types of content (modules, licenses, and DB drivers).

    Re: BPC Core |

Bugs

  • ProcessStarter: "windowWidth" and "windowHeight" do not affect the window BPC-9042

    The ProcessStarter configuration for windowWidth and windowHeight now correctly affects the window.

    Subject: Process Monitoring |

  • Invalid Operators for Numeric Column Filters BPC-9082

    The selection of an operator for "number" filters has been restricted to the operator list. "=" is defined as the default operator, and the default operator can also be changed in the filter configuration within the column configuration. See also Configuring the Monitor Columns

  • Tabbed navigation bar: Arrow for submenu does not fit in the tab BPC-8833

    Subject: BPC Core |

  • ProcessStarter table: Error message is truncated BPC-9039

    The error message for validating entries in the ProcessStarter table is no longer truncated.

  • Form reset does not work correctly BPC-9143

    The reset function previously removed bindings. As a result, the current state could no longer be submitted after a reset. This issue has been resolved.

    Re: Forms |

  • Form Components: Combo Box and Table BPC-9152

    The Table and Combo Box components have been improved and now behave like the other components.

    Re: Forms |

  • Filtering with a global search does not limit the possible values and counts to the data that has already been filtered BPC-9262

  • The bpcMonitor_editMonitorViews permission cannot be restricted to individual module IDs BPC-9329

    The bpcMonitor_editMonitorViews permission can be set for specific instances to create and modify views in certain monitors by appending the module ID at the end.

  • FE Core: "beautifyContent: me.editor is undefined" BPC-9375

    Re: BPC Core |

  • Changes to karaf/etc/de.Virtimo.BPC.core.cfg are not applied at runtime BPC-9413

    Affects: BPC Core |

  • Spelling Correction in the User Interface BPC-9438

    Affects: BPC Core |

  • Toolbar Buttons Cut Off in Status Change Window BPC-9465

    Affects: Process Monitoring |

Documentation

Internal Dependencies / Dependency Updates

  • Update @amcharts/amcharts4 BPC-9411

    Re: BPC Core |

  • Update @vaadin/avatar BPC-9430

    Re: BPC Core |

  • Update org.apache.karaf.decanter.version BPC-9454

    Re: BPC Core |

  • Update ace-builds BPC-9457

    Subject: BPC Core |

BPC 4.1.22

Release Date: 2025-03-10

The following components must be updated with this update: BPC Module | OpenSearch | OpenSearch Plugin

You should read the descriptions in this section carefully. These are recommended actions to take when performing an update.

New Features

Improvements

  • Optimized use of OpenSearch to avoid misleading warnings BPC-9175

    The OpenSearch log contains many entries such as "QueryGroup _id can’t be null, It should be set before accessing it." This is a known OpenSearch bug that was introduced in version 2.18.0. We have reduced the output as much as we could on our end.

    Re: BPC Core |

  • Dark Theme does not invert the colors of the ACE editors BPC-9247

  • Make default charts in the Analysis module compatible with the Dark Theme BPC-9293

    To display existing charts using a dark theme without a white background, the chart background color should be set to full transparency (RGBA alpha value set to 0) under Chart Configuration → Settings → Background Color.

Security

  • net.minidev:json-smart:2.5.1 | CVE-2024-57699 BPC-9313

  • org.bouncycastle:bcprov-jdk18on:1.76 | CVE-2024-30172 BPC-9315

    Affects: Karaf |

Bugs

  • OpenSearch backups are not running BPC-9334

    Snapshots whose names do not conform to the current naming scheme have blocked the execution of backups.

    Affects: BPC Core |

  • HTTP Proxy Sets Invalid Headers When Using HTTP/2 BPC-9337

    When the HTTP proxy used an HTTP/2 connection, the pseudo-header ":status" was passed on to the client. Under a strict interpretation, this results in an error. For example, in this case, nginx reported a 502 Bad Gateway error to the client.

    Affects:

  • "Tabbed" View Mode no longer displays tabs BPC-9366

    Affects: BPC Core |

  • Plugins - Order Not Preserved BPC-8299

    Varying plugin load times resulted in an incorrect order. The order specified in the configuration is now maintained regardless of load time.

  • Deployment Error BPC-9221

    If a deployment was performed from a BPC with existing monitor views to a BPC that did not yet have any views, an error occurred.

    This error has been fixed.

    Re: BPC Core |

  • Instance-specific permission to edit HTML content BPC-9365

    A bug was fixed that prevented instance-specific HTML content editing permissions from being granted by the role htmlcontent_editor_<MODUL-ID>.

    Re: BPC Core |

  • Slow Navigation with Nested Modules BPC-9402

    If an element with subelements was created in the navigation, brief freezes could occur in the application if a subelement pointed to the same module as the parent element.

    Re: BPC Core |

Internal Dependencies / Dependency Updates

BPC 4.1.21

Release Date: 2025-02-10

The following components must be updated with this update: BPC Modules | Karaf | Java

You should read the descriptions in this section carefully. These are recommended actions that are advised during an update.

  • Updating TLS Hardening BPC-9256

    Properties have been set in the custom.java.security

    If you are not yet using an ` custom.java.security ` file via ` Central configuration file `, you should do so.

    Existing ` custom.java.security ` files should be updated with the following entry:

    jdk.tls.disabledAlgorithms=X448, secp521r1, SHA1, include jdk.disabled.namedCurves

    Re:

  • Custom Java Security Settings via BPC.env for OpenSearch BPC-9259

    The bpc.env files now also apply the security.properties settings from the file custom.java.security to OpenSearch. As a result, changes made to this file affect both Karaf and OpenSearch.

    If you are using a BPC.env file, it is recommended that you update it. If it does not already exist, the file custom.java.security To do this, add the following:

    bpc.env.sh
    export OPENSEARCH_JAVA_OPTS="$OPENSEARCH_JAVA_OPTS -Djava.security.properties=../custom.java.security"
    bpc.env.cmd
    SET OPENSEARCH_JAVA_OPTS=%OPENSEARCH_JAVA_OPTS% -Djava.security.properties=..\custom.java.security

Improvements

  • Monitor Data Filter logical AND operator between organizations, roles, …​ BPC-6456

    The "Data Filter Operator" setting can now be used to configure how different data filters (for organizations, roles, permissions, or users) are linked together.

    With OR (default), all data that meets any one of the filter settings is displayed. With AND, only data that meets all filter criteria is displayed.

  • JVM security.properties BPC-8185

    The JVM security.properties settings can now be configured (e.g., DNS cache TTL for cloud environments; see link). To do this, the entry in bpc.env.sh/BPC.env.cmd must be configured as follows:

    • Linux (bpc.env.sh)

    export EXTRA_JAVA_OPTS="-Djava.security.properties=../custom.java.security"

    • Windows (BPC.env.cmd)

     SET EXTRA_JAVA_OPTS=-Djava.security.properties=..\custom.java.security

    Additionally, the custom.java.security file must be downloaded.

    You can find the file in the download section at Download - Virtimo File Server.

    More information at: Central configuration file

    Subject: BPC Core | Documentation | Karaf |

  • Static Settings BPC-8614

    Settings can now be protected from changes via the BPC license. This will primarily be used in our cloud installations (K8s). For example, there we use the core setting 'backupRepository' to define the configuration of OpenSearch backups in an Amazon S3 bucket, and we do not want this to be changeable via the BPC frontend.

    To achieve this, when creating the license, the XML can be extended with the list element ` NON_WRITEABLE_SETTINGS `, which contains the IDs of the non-editable settings.

    Excerpt from a sample license:

    <?xml version="1.0" encoding="UTF-8" ?>
    <license>
        <bpc>
            <licenseKeys>
            ...
            </licenseKeys>
            <licenseMaps>
            ...
            </licenseMaps>
            <licenseLists>
                <NON_WRITEABLE_SETTINGS>
                    <_core_noinstance_backupRepository/>
                    <_core_noinstance_identityProviderBackendConnection/>
                </NON_WRITEABLE_SETTINGS>
            </licenseLists>
        </bpc>
    </license>

    The settings (example: _core_noinstance_backupRepository) are the same as those used in the OpenSearch index ‘BPC-configuration’.

    The structure is as follows: <ModuleId>_<InstancId>_<SettingName>

    If the setting pertains to a module and not to an instance or component, then the value noinstance must be used for the <InstanceId>. You can access the <SettingName> by displaying the "ID" column in the Settings grid in the BPC frontend.

    Example: _core_noinstance_backupRepository

    • <ModuleId> = _core

    • <InstanceId> = noinstance

    • <SettingName> = backupRepository

    Affects: BPC Core |

  • Reduce the number of shards for newly created OpenSearch indices BPC-9049

    We have reduced the number of shards to 1 in the Core_IndexTemplates setting. This is also the default setting that Elasticsearch/OpenSearch has been using for new indices for a few years now. This only affects newly created indices. Existing indices are not affected.

    Re: BPC Core |

  • Reduction of Accesses to the OpenSearch Backup API BPC-9189

    By optimizing accesses to the OpenSearch Backup API, fewer accesses are made to the data storage. This reduces the associated costs, for example, when using Amazon S3.

  • Dedicated interface for configuring the Analysis module BPC-9202

    The interface for configuring and creating Analysis components has been standardized.

  • JSON data should not be sorted automatically BPC-9227

    When saving JSON settings, attributes within objects were automatically sorted. This behavior has been disabled. This makes it possible to customize the order according to your own criteria.

    Re: BPC Core |

  • Provide font-family as a CSS variable. BPC-9232

    The currently set font can be retrieved via the CSS variable ` --font-family `.

    Re:

  • Custom Java Security Settings via BPC.env for OpenSearch BPC-9259

    The bpc.env files now also apply the security.properties settings from the file custom.java.security to OpenSearch. As a result, changes made to the file affect both Karaf and OpenSearch.

    If you are using a BPC.env file, it is recommended that you update it. If it does not already exist, the file custom.java.security be added. To do this, the following must be added.

    bpc.env.sh
    export OPENSEARCH_JAVA_OPTS="$OPENSEARCH_JAVA_OPTS -Djava.security.properties=../custom.java.security"
    bpc.env.cmd
    SET OPENSEARCH_JAVA_OPTS=%OPENSEARCH_JAVA_OPTS% -Djava.security.properties=..\custom.java.security
  • The BPC license filename should allow an additional .Virtimo file extension for joining BPC & INUBIT licenses. BPC-7813

    The license filename may now also be license.xml.virtimo. Previously, it had to be license.xml.bpc. This makes it possible to use a license that is also a valid INUBIT license file.

    Subject: BPC Core |

  • Speed up generation of the Config-JSON for the BPC frontend BPC-9263

    This change speeds up the loading of the BPC configuration in the client.

Security

  • org.apache.cxf:cxf-core:3.5.9 | CVE-2025-23184 BPC-9251

  • TLS Hardening Update BPC-9256

    Properties have been set in the custom.java.security

    If you are not yet using a ` custom.java.security ` file via Central configuration file, you should do so.

    Existing ` custom.java.security ` files should be updated with the following entry:

    jdk.tls.disabledAlgorithms=X448, secp521r1, SHA1, include jdk.disabled.namedCurves

    Affects:

  • jetty-server:9.4.54.v20240208 Affected By: CVE-2024-13009 (NVD) BPC-9607

Bugs

  • Data_Filter: No placeholder substitution for roles and use of "#" BPC-9110

    The placeholder #user.loginName# is now correctly substituted in the Data_Filter when the dynamic filter # is used.

    Subject: Process Monitoring |

  • Handling Multiple Session Cookies BPC-9164

    If the client sends multiple session cookies—possibly because multiple BPC instances are installed on the server—the appropriate session cookie is now taken into account.

    Re: BPC Core |

  • Detail View Update Problem BPC-9252

    In cases involving frequent changes to the data, errors could occur in the monitor when displaying detail views. As a result, the entire rendering of the application was disrupted, and the page had to be reloaded manually.

    Affects: Process Monitoring |

  • Monitor filter fields are suddenly highlighted with the header color BPC-9253

    Filters at the top of the monitor columns are now displayed correctly again.

    Subject: Process Monitoring |

  • Upload module causes an OOM exception BPC-9266

    Uploaded files are no longer kept entirely in memory. This reduces memory usage and prevents "OutOfMemoryException".

    Re: BPC Core |

Documentation

Internal Dependencies / Dependency Updates

  • Update dompurify BPC-9206

    Re: Forms |

  • Update com.networknt:json-schema-validator BPC-9236

    Subject: BPC Core |

  • Update org.postgresql:postgresql BPC-9237

    Subject: BPC Core |

  • Update de.Virtimo.BPC:nimbusLib BPC-9239

    Subject: BPC Core |

  • Java Update BPC-9260

    Subject:

  • Karaf, CXF, and Jackson Update BPC-9264

    This update requires updating Karaf and the modules bpc-be-core, bpc-be-analysis, bpc-be-forms, and bpc-be-monitor.

    For BPC module developers:

    In our earlier Karaf versions, we used CXF version 3.5.4. This CXF version includes Jackson version 2.14.3. We now ship Karaf with CXF 3.6.5, which includes Jackson version 2.17.2.

    Please update the CXF version (3.6.5) in your pom.xml. More importantly, you must also update the Jackson version you are using (2.17.2). To do this, check whether you have an import package statement for this version. This must be added or adjusted if you use Jackson functions such as the ` ObjectMapper ` class.

    Replace

    <Import-Package>
    ...
    com.fasterxml.jackson.*;version="[2.13.4,2.15.0)",
    ...
    </Import-Package>

    with

    <Import-Package>
    ...
    com.fasterxml.jackson.*;version="[2.17.2,3.0.0)",
    ...
    </Import-Package>
  • Update graalvm.version BPC-9270

    Subject: Data Analysis |

  • Update apache-poi BPC-9272

    Subject: Process Monitoring |

  • Update de.Virtimo.BPC:nimbusLib BPC-9278

    Subject: BPC Core |

  • Update de.Virtimo.BPC:nimbusLib BPC-9299

    Subject: BPC Core |

BPC 4.1.20

Release Date: 2025-01-13

The following components must be updated with this update: BPC Module | OpenSearch | OpenSearch Plugin

You should read the descriptions in this section carefully. These are recommended actions that are advised during an update.

New Features

  • WebSocket Messages for Changes to the Frontend Log Index BPC-8295

    New data in the "Frontend Log Monitor"are now displayed or reloaded immediately.

    Re: BPC Core |

Improvements

  • Reduced Log Level BPC-8660

    The log level for the BPC plugin in OpenSearch has been reduced from trace to info. This setting can be found in the file opensearch/config/log4j2.properties.

    Re: OpenSearch |

  • Refresh event for plugin hooks BPC-8963

    Modules can now send updates to the plugins loaded there via their hooks. See also: Developing BPC Plugins

  • Improve the Grid Header Filter BPC-8983

    Related: Process Monitoring |

  • Account for Custom IGUASU HTTP Headers BPC-9148

    Re: BPC Core |

  • Make Filters for DeepLinks via Log Service More Generic BPC-9159

    The LogService API for creating deep links to monitors can now handle various query parameters to set appropriate filters in the monitor.

    Re: BPC Core |

  • Audit Log API - Endpoint for navigating to the Audit Log monitor BPC-9160

    A deep link to the Audit Log monitor can be retrieved via the Audit Log API.

  • Commit Date Instead of Build Date in Bundle Info BPC-9174

    The bundle info, which can be accessed via the Karaf console, no longer displays the build time but rather the time of the last change to the underlying source code.

  • Forms in the detail view of the monitor receive updated data BPC-9199

    Forms in the detail view now receive updated data when the monitor reloads. To suppress this behavior—since the data changes may not be relevant to the form— you can set the option “ ignoreUpdates ” on the form in the detail configuration. See also: Configuring Monitor Detail Views

Security

  • ClientSessionManagerImpl logs the sessionId BPC-8986

    Subject: BPC Core |

Bugs

  • Adding a new DataModifier closes the browser window BPC-9184

    Subject: Data Analysis |

  • PDF cannot be displayed in the Monitor Details view BPC-9104

    Subject: Process Monitoring |

Documentation

  • Possible IGUASU HTTP Headers BPC-9195

    AuditLog and LogService API documentation updated. See: BPC API

  • Documentation of Query Parameters for Opening Monitors BPC-9196

    The available query parameters for the AuditLog and LogService APIs used to open a monitor via deep link have been added to the documentation.

    See BPC API

  • Examples for parametersEndpoint of the ProcessStarter BPC-7117

Internal Dependencies / Dependency Updates

BPC 4.1.19

Release Date: 2024-12-16

The following components must be updated with this release: BPC Module | OpenSearch Plugin

New Features

  • Update to settings for IGUASU instance type in Flow BPC-8863

    Starting with IGUASU version 3.0.6, you can now jump directly from the BPC Flow Processor overview to the IGUASU processor. “Frontend URL” and “System ID” are now available in the Flow Manager. “URL” has been renamed to “Service URL.” Username and password are no longer required. Long descriptions of the processors are displayed in abbreviated form, with the full text available in a tooltip.

    Re: BPC Core |

  • Export function for diagrams BPC-9101

    For some diagram types, it is now possible to enable an export function.

Improvements

  • Bundle-SymbolicName must be set without Parameters such as "blueprint.aries.xml-validation:=false" BPC-8482

    Module developers must ensure that no additional Parameters*are specified* in the Bundle-SymbolicName.

    Incorrect: de.Virtimo.BPC.module-id;blueprint.aries.xml-validation:=false

    Correct: de.Virtimo.BPC.module-id

    The incorrect version was included in earlier templates for BPC modules.

    Affects: BPC Core | Forms |

  • Selection of database drivers restricted to those that can be used BPC-8796

    Subject: BPC Core |

  • Consistent behavior of the validateOnBlur and validateOnChange parameters BPC-8823

    The behavior of validateOnChange has been adjusted so that validation is now triggered only when the user moves focus elsewhere.

  • OpenSearch setting for moving shards to other nodes when disk space is low BPC-9011

    If free disk space falls below defined thresholds, shards are distributed to other nodes. It may also happen that indices are set to read-only to prevent the disk from filling up.

    The value of ` cluster.routing.allocation.disk.threshold_enabled ` is now ` true`. This corresponds to the OpenSearch default value.

    Affects: OpenSearch |

  • Inappropriate styling for dark themes BPC-9061

    Re: BPC Core |

  • Mapping IGUASU-Specific Header Information BPC-9070

    If the HTTP headers system.id and instance.id are set, the values are written to a new JSON object named externalReference under the fields iguasuSystemId and iguasuInstanceId.

    Re: BPC Core |

  • Forms action setProperty BPC-9120

    The function setProperty - Setting the value of a variable is now available.

  • Fields of type "object" and "flat_object" should be displayed correctly in the monitor by default BPC-9144

    Fields containing nested JSON objects receive the following in the initial column configuration: "formatter" : "jsonStringify". This converts the contents to text and displays them in the monitor.

  • JSON Stringify Formatter BPC-9146

    This makes it easy to use in various places to convert JSON to text.

    Example as a formatter in a column configuration
    {
        "formatter": "jsonStringify",
        "dataIndex": "aFieldWithJsonValue",
        "text": "JSON Value as String"
    }
    Example in an XTemplate for a column configuration
    {
        "xtype": "templatecolumn",
        "tpl": "{aFieldWithJsonValue:jsonStringify}",
        "text": "JSON Value as String"
    }

    Re: BPC Core |

  • Monitor Editor: Fix spelling errors in tooltip text (+ Documentation) BPC-9121

Security

  • DOMPurify:2.4.0 | CVE-2024-45801 BPC-8899

Bugs

  • Printing not possible in iFrame context BPC-8417

    The print dialog can now be triggered from outside.

    Affects: Documentation | Forms |

  • New: Replication distribution within the cluster is not always triggered BPC-8504

    A bug has been fixed that caused individual replication jobs to not be distributed correctly across all available nodes when changes were made to the nodes in the BPC cluster.

    Affects: OpenSearch |

  • In Flow, a Service URL and Frontend URL must always be configured BPC-8729

    Both URL configurations must be filled in to enable the jump to the processor (e.g., in IGUASU)

  • The password for IGUASU connections must be optional BPC-8731

  • OpenSearch cannot be accessed via HTTP BPC-8800

    Although the OpenSearch connection was configured to use HTTP, attempts were made to establish the TLS context based on the configuration. However, if this configuration was incorrect, an error occurred.

    The configuration is now ignored, as it is not relevant for HTTP connections.

    Nevertheless, it is recommended to use secure connections in this context.

    Affects: BPC Core |

  • Display empty application areas in the navigation as inactive elements BPC-8907

    An application area can only be switched to if it is not empty and the user has permission to view the application area’s content

    Re: BPC Core |

  • Value of the HTML component can only be set via data binding BPC-8910

    It is now possible again to use value to set the content of HTML components.

    Affects: Forms |

  • [Logservice API] DELETE with parentFilter times out BPC-8911

    Re: BPC Core |

  • Horizontal navigation toolbar (view mode: tabbed) can be shown or hidden BPC-8938

    Affects: BPC Core |

  • Improve LocalStorage Access BPC-9027

    A dedicated prefix is now used for values in LocalStorage. This ensures that content from other applications is not deleted.

  • Monitor ChildLog data is not loaded if the record ID contains characters such as "/" BPC-9073

    Subject: Process Monitoring |

  • Replication and Tail Sync result in inconsistent data BPC-9088

    There were various issues when the time zone of the "Last Updated" column in the database table was set to UTC: - Tail Sync did not always delete all records. - Instead, it updated all records on every run. - Interaction with replication was also disrupted.

    Subject: BPC Core |

  • Frontend JSON Editor loads the wrong JSON validation schema in module settings BPC-9091

    Subject: BPC Core |

  • Not all deployments (JSON exports) are imported BPC-9098

    If multiple deployment files were stored in the karaf/deploy, not all of them were processed in some cases. The cause was the automatic backup of the existing configuration. The names of the backups are now unique down to the millisecond.

    Affects: BPC Core |

  • When switching organizations, the user’s session is logged out at the identity provider BPC-9118

    Affects: BPC Core |

  • BPC Prometheus metric bpc_module exports incorrect version information BPC-9119

    Affects: BPC Core |

  • ExtJS ComponentQuery fails when a chart with SpriteLegend is used BPC-9141

    The bug in the ExtJS framework was fixed via an override.

    Sencha is tracking the issue at EXTJS-29685.

    Re: BPC Core |

  • DynamicList filter does not work in conjunction with template columns BPC-9142

  • Validation of the Value Range for Number Variables BPC-10117

    Changes to the valid value range directly affect the validation of the default value.

  • "Required" and "Readonly" attributes bound to checkboxgroups/radiogroups have no effect. BPC-8476

    Re: Forms |

Documentation

Internal Dependencies / Dependency Updates

  • Update @vaadin/avatar BPC-9052

    Affects: BPC Core |

  • Update org.quartz-scheduler:quartz BPC-9075

    Affects: BPC Core |

  • Update org.mariadb.jdbc:mariadb-java-client BPC-9095

    Affects: BPC Core |

  • Update com.networknt:json-schema-validator BPC-9111

    Affects: BPC Core |

  • Update org.json:json BPC-9139

    Affects: BPC Core |

BPC 4.1.18

Release Date: 2024-11-18

The following components must be updated with this update: BPC Module | OpenSearch | OpenSearch Plugin | Java

Update to the internal configuration

Changes were made to the internal configuration of the BPC in this version. This affects deployments between BPC instances running different versions. Additionally, extra steps are required when downgrading the BPC.

For more information, see the page at Versioning of the Internal BPC Configuration.

You should read the descriptions in this section carefully. These are recommended actions to take when performing an update.

New Features

  • Confirmation for Process Starters and Process Actions via Window BPC-7057

    The mode for notifications regarding confirmations from process starters and actions can be set in the “Function_ProcessNotificationDisplayMode” (“function_processNotificationDisplayMode”): Toast: Brief on-screen notification PopUp: Window that requires confirmation Silent: No visual notification (notification appears in the list when you click the bell in the upper right corner) See also: Configuring Process Monitoring

    The setting applies to all processes (process starters and actions), but not for status changes. In “Function_ProcessStarterConfig,” the notificationDisplayMode can be changed for individual processes (toast, popup, or silent). (Uppercase and lowercase letters do not matter) See also: Process Starter

  • Dark Theme BPC-6813

    A dark theme is available for the BPC. It can be downloaded from the download page.

    To switch between installed themes, you can use the plugin Theme Switcher, for example.

Improvements

  • Case sensitivity removed from the Remote DynamicList filter BPC-8391

    The dynamicList filter with "queryMode": "remote" is now case-insensitive

  • When grouping in Process Monitoring, it should be possible to sort the groups in DESC order. BPC-8556

    You can now change the sorting order of the groups via the context menu in the monitor.

  • ProcessStarter table options: display "Label" instead of "key" BPC-8591

  • Unnecessary error logs with MaintenanceModeEnabledException BPC-8784

    Re: BPC Core |

  • Dashboard status filters should be persistent BPC-8865

    Affects: Process Monitoring |

  • Apply translations of instance types in the bpcPromptWindow as well BPC-9021

    Re: BPC Core |

  • API Documentation Status Codes BPC-9037

    The HTTP status codes for responses from the REST API have been documented in greater detail. See: BPC API

  • Using Bulk Operations in OpenSearch via OpenSearchService BPC-9043

    Re: BPC Core |

  • Automatic processing of managed_indices.json by Core (creating indices) BPC-9044

    Core now automatically searches for a configuration for indices that are to be created and managed.

    See also Creating Indexes

Security

  • froala:4.1.2 | CVE-2023-41592 BPC-9034

Bugs

  • Button UI for Plugin Buttons in the Module Header BPC-8137

    Some plugins in the Monitor module header were displayed with an incorrect background color.

    Re: BPC Core |

  • The left sidebar in BPC can be expanded or collapsed using the down arrow, but cannot be hidden completely. BPC-8488

    Re: BPC Core |

  • Handling paths in themes across different environments BPC-8489

    Paths in themes should now always be specified as absolute paths.

    Correct: $CompanyIcon: "/bpc-theme-customer/resources/images/favicon.png"

    Incorrect: $CompanyIcon: "../resources/images/favicon.png"

    Re: BPC Core |

  • Monitor plugins are not reloaded when switching monitors BPC-8628

  • When impersonating another*user, the impersonating user’s language is saved in the impersonated user’s profile* BPC-8864

    When impersonating other users, the language can no longer be changed in the impersonated user’s Keycloak profile. For this to work, Keycloak must be correctly configured to ensure that Impersonator information is provided via an active scope.

    Affects: BPC Core |

  • Removal of obsolete grid_showHeader configuration BPC-8912

    The configuration grid_showHeader is obsolete because it causes errors. The header’s behavior has been controlled for some time now using the Parameter moduleHeader_enabled. This setting will be automatically removed during the BPC update.

  • Error log in the client when the user language cannot be updated in Keycloak. BPC-7981

    Affects: BPC Core |

Documentation

Internal Dependencies / Dependency Updates

Miscellaneous

  • Java Update BPC-9016

    Subject:

BPC 4.1.17

Release Date: 2024-10-18

The following components must be updated with this update: BPC Modules | Java

New Features

  • LocalStorage should be automatically cleared during the BPC update BPC-6268

    When loading the BPC, the version number of the Core Common Package (Fe-Core) is determined and stored in Local Storage. If this version number differs from the one saved during the previous load, Local Storage is reset.

    Subject: BPC Core |

  • Provide a Core endpoint for sending events BPC-8472

    An endpoint for sending events has been provided See also: Event API

  • Reference in the audit log BPC-8824

    It is now possible to include references to external resources when writing audit information. For example, this allows you to reference the IGUASU instance that generated the entry.

Improvements

  • Actions in PM that specify a form as their target should not appear in the PM Grid’s context menu- BPC-8655

  • Make the frame around the navigation menu more subtle BPC-8979

    Re:

  • Notification display: Line break for the "Metadata" row BPC-8102

    Re: BPC Core |

  • Date format tooltips in charts fixed to ISO format BPC-8825

    Date format setting added. See also Monitor Widgets for the Dashboard

Bugs

  • An invalid search in full-text search on the monitors results in a loading error BPC-8101

    Subject: Process Monitoring |

  • TreeView does not load if a comment precedes the first XML node BPC-8915

    Subject: Process Monitoring |

  • Ace Editor throws an uncaught exception BPC-8970

    Subject: BPC Core |

  • When changing the language in BPC, FirstName, LastName, and Email are lost in Keycloak (>= 24) BPC-8985

    Affects: BPC Core |

Documentation

  • The navigation of the "Process Monitoring" module is now organized more clearly. BPC-8921

    The large number of subpages has now been largely divided between "Processes" and "Data View."

  • Expansion of the documentation on multilingual support BPC-8419

Internal Dependencies / Dependency Updates

  • Update de.Virtimo.BPC:nimbusLib BPC-8933

    Subject: BPC Core |

  • Update de.Virtimo.BPC:nimbusLib BPC-8978

    Subject: BPC Core |

Miscellaneous

  • Java Update BPC-8962

    Subject:

BPC 4.1.16

Release Date: 2024-09-23

The following components must be updated with this update: BPC Modules | OpenSearch Plugin

New Features

Improvements

  • Secondary buttons should better display their "pressed" state BPC-8627

    Re:

  • Labels for instance types BPC-8804

    Labels for instance types can be defined using language keys. The language key is composed as follows: "<MODULE_ID>_INSTANCE_TYPE_<INSTANCE_TYPE>" The language key for core modules is structured as follows: "_CORE__<MODULE_ID>_INSTANCE_TYPE_<INSTANCE_TYPE>" or, for example: "CORE_BACKENDCONNECTION_INSTANCE_TYPE_HTTP_PROXY": "HTTP Proxy"

    Subject: BPC Core |

  • Log Service: Improve performance when querying log data BPC-8850

    Subject: BPC Core |

  • Avatar as user menu BPC-8866

    It is now possible to replace the "User Account Menu" with an avatar. This is a circular display of the user’s initials or, if configured correctly, an image stored with the identity provider. See also User Account Menu

  • Version information as Prometheus metrics BPC-8871

  • Prometheus Metric: BPC Status (Overall status of all BPC modules) BPC-8904

  • Logservice API: Deleting Child Entries Using childQuery or childFilter BPC-8905

    Subject: BPC Core | Documentation |

  • HTML Content Module - Assign Write Permissions per Instance BPC-8699

    Instance-specific roles for editing can now be assigned for the HTML Content Module: htmlcontent_editor_<MODUL_ID> See also: HTML Content Module (User-Defined Content)

    Subject: BPC Core | Documentation |

Security

  • dompurify | CVE-2024-45801 BPC-8895

Bugs

  • [Logservice API] DELETE with parentFilter times out BPC-8794

    Affects: BPC Core |

  • OpenSearch indices are not always created in accordance with BPC BPC-8848

    Affects: BPC Core |

  • OpenSearch: BpcPlugin - ConcurrentModificationException BPC-8852

    Affects: OpenSearch |

  • Issues when comparing unknown settings BPC-8889

    Subject: BPC Core |

Documentation

Internal Dependencies / Dependency Updates

  • Update dompurify BPC-8603

    Affects: BPC Core |

  • Update com.nimbusds:oauth2-oidc-sdk BPC-8855

    Subject:

  • Update de.Virtimo.BPC:nimbusLib BPC-8857

    Subject: BPC Core |

  • Update de.Virtimo.BPC:nimbusLib BPC-8868

    Subject: BPC Core |

  • Update com.networknt:json-schema-validator BPC-8902

    Subject: BPC Core |

BPC 4.1.15

Release Date: 2024-08-26

The following components must be updated with this release: BPC Module | Karaf | OpenSearch

Improvements

  • Karaf Cluster may create our Configuration Index multiple times → BPC cannot be accessed BPC-8764

    Affects: BPC Core |

  • Custom JAAS Login Module: Move SessionToken Interface to the API BPC-8830

    Re: BPC Core |

Security

Bugs

  • cascadingDynamicListFilter displays empty values BPC-8389

    Fixed: An issue where the list of available filters was displayed as empty even though a selection should have been present.

  • Monitor views do not handle grouping correctly BPC-8393

  • A button component with a fixed width is rendered in the tab bar BPC-8500

    Subject: BPC Core |

  • Changes to the backup configuration are not applied BPC-8612

    Affects: BPC Core |

  • Karaf Startup: Jetty RewriteHandler cannot be registered BPC-8719

  • Jackson cannot serialize Java 8 date/time type BPC-8720

    Affects: BPC Core |

  • Changing the global date format causes incorrect behavior BPC-8744

    Affects: BPC Core |

  • Frontend error: "Could not load BPC configuration." BPC-8769

Documentation

Internal Dependencies / Dependency Updates

BPC 4.1.14

Release Date: 2024-07-02

The following components must be updated with this release: BPC Modules

New Features

  • Dashboard Table Layout Option BPC-5919

    The Process Dashboard has a new layout setting that allows you to switch between a column and a table layout

Improvements

  • Allow re-login in case of IP pinning issues BPC-8179

    If an IP pinning error occurs, you can now log in normally after reloading the page in your browser. The error will not be displayed again (unless the IP address changes again).

    Re: BPC Core |

  • Automatically display Split View when opening Process Monitoring. BPC-8555

    Split View in Process Monitoring can now be displayed automatically upon opening by setting DetailView_EastInitialShow to true. (DetailView_East must also be set to true) Configuring Process Monitoring

  • Organization change should take landing page configuration into account BPC-8634

    When switching organizations, you can now configure the system so that the user is redirected to their home page instead of remaining on the current page.

    Subject: BPC Core | Documentation |

Security

  • index.jsp is also delivered as an unprocessed HTML page BPC-8646

    Re: BPC Core |

Bugs

  • Missing BPC-storage-monitor-views index causes issues in various places BPC-8128

    The Storage API now returns an empty result set when querying content for stores that have not yet been created.

    See also: Storage API

    Affects: BPC Core | Documentation |

  • Number of sorts always displays 0 BPC-8624

    Affects: Process Monitoring |

  • Organization Change plugin does not display any organizations BPC-8633

    In the drop-down list for the organization change, you can now configure the system to display already active organizations as deactivated items.

  • The INUBIT Proxy cannot be selected immediately after creating a monitor BPC-8639

  • Custom Fields attributes in Settings appear in the frontend BPC-8653

    Subject: BPC Core |

  • BPC Frontend Module: Settings grid no longer refreshes automatically BPC-8666

    Related to: BPC Core |

  • Dashboard: Divider line/tab area visible even when no tabs are displayed BPC-8502

    Affects: Process Monitoring |

Documentation

  • Log Service Documentation: OpenSearch settings have incorrect names BPC-8647

    Names of configuration parameters in Log Service corrected.

BPC 4.1.13

Release Date: 2024-06-04

The following components must be updated with this update: BPC Modules

Breaking Changes

You should read the descriptions in this section carefully. They may contain instructions that you must follow to perform an update.

  • The maximum memory for Karaf is configured differently BPC-8542

    In recent Karaf versions, Karaf-specific environment variables for setting JVM memory have been removed and must be replaced with an alternative.

    Linux

    Please replace `

    # Karaf
    export EXTRA_JAVA_OPTS="$EXTRA_JAVA_OPTS -Xms128m -Xmx512m"

    ` with ` bpc.env.sh

    # Karaf
    export JAVA_MIN_MEM=128M
    export JAVA_MAX_MEM=512M

    ` and adjust the values accordingly.

    Windows

    Please replace bpc.env.cmd

    rem *** Karaf ***
    SET JAVA_MIN_MEM=128M
    SET JAVA_MAX_MEM=512M

    with

    rem *** Karaf ***
    SET EXTRA_JAVA_OPTS=%EXTRA_JAVA_OPTS% -Xms128m -Xmx512m

    in the file and adjust the values accordingly.

Improvements

  • Improved placement of icon and arrow for submenus in the navigation bar BPC-8084

    When the navigation bar is collapsed, the icon no longer shifts to the left if there is a submenu

    Re: BPC Core |

  • The maximum memory for Karaf is configured differently BPC-8542

    In current Karaf versions, Karaf-specific environment variables for setting the JVM memory have been removed and must be replaced with an alternative.

    Linux

    Please replace `

    # Karaf
    export EXTRA_JAVA_OPTS="$EXTRA_JAVA_OPTS -Xms128m -Xmx512m"

    ` with ` bpc.env.sh

    # Karaf
    export JAVA_MIN_MEM=128M
    export JAVA_MAX_MEM=512M

    ` and adjust the values accordingly.

    Windows

    Please replace bpc.env.cmd

    rem *** Karaf ***
    SET JAVA_MIN_MEM=128M
    SET JAVA_MAX_MEM=512M

    with

    rem *** Karaf ***
    SET EXTRA_JAVA_OPTS=%EXTRA_JAVA_OPTS% -Xms128m -Xmx512m

    and adjust the values accordingly.

  • Notifications: Improved implementation of the message type BPC-8467

    Added appropriate icons next to titles for various notification types Titles for notifications adjusted based on notification type

    Re: BPC Core |

Bugs

  • Selecting empty values in a combo box displays &nbsp; BPC-8543

    Empty values in a combo box are no longer displayed as

  • Index Selector in the Monitor UI throws an exception BPC-8806

    Re: BPC Core |

  • Global Application Toolbar: HTML text is no longer vertically centered BPC-8222

    Components are now automatically centered when inserted into the Application Toolbar. This affects, among other things, HTML Content Plugins that use the Global Application Toolbar left/right hook. As a result, components that have padding and margins defined on only one side are no longer centered. For these elements, padding and margins can now be set to 0.

    Re: BPC Core |

  • Frequent export requests for monitor data within a short period of time cause OpenSearch errors BPC-8458

Internal Dependencies / Dependency Updates

BPC 4.1.12

Release Date: 2024-05-06

The following components must be updated with this update: BPC Module | Karaf

New Features

  • BOM Download BPC-7987

    It is now possible to download an SBOM file for each module via the GUI or API.

    Affects: BPC Core | Documentation |

Improvements

  • Preventing Improper Use of Module Upload BPC-8449

    When uploading modules, the system now checks whether a potentially affected module can actually be updated via an upload. If this is not the case, the download is rejected.

    Additionally, the system prevents modules from being deployed multiple times simultaneously if different filenames are used during the upload.

    Affects: BPC Core |

  • Extend BPC Bundle BPC-8508

    The BPC Bundle now contains additional content. For details, see Download - Virtimo File Server

    Affects: Documentation |

Security

  • org.apache.sshd:sshd-osgi:2.11.0 | CVE-2023-48795 BPC-8411

Bugs

  • BPC.env.cmd Examples of non-numeric values are incorrect BPC-8459

    Only numeric environment variables in BPC.env.cmd may be set using SET /a. The parameter /a has been removed from the template and examples for non-numeric values.

  • "Required" and "Readonly" bound to a container have no effect. BPC-8468

    "Required" and "readOnly" can now also be bound to a container or fieldset, just like "hidden" and "disabled." See Examples.

    Affects: Forms |

  • Discrepancies in replication consistency checks BPC-8494

    Affects: BPC Core |

  • Translations for some UI components and local formats are not loaded BPC-8498

    Affects: BPC Core |

  • Bundle update error is ignored BPC-8180

    Affects: BPC Core |

Documentation

Internal Dependencies / Dependency Updates

BPC 4.1.11

Release Date: 2024-04-08

The following components must be updated with this release: BPC Module | Karaf | OpenSearch | OpenSearch Plugin

Breaking Changes

You should read the descriptions in this section carefully. They may contain instructions that you must follow to update your code.

You should read the descriptions in this section carefully. These are recommended steps to take when performing an update.

Improvements

  • Adjustment of the "About" icon BPC-8282

    Adjustment of the "About" icon (from circle to square)

    Re: BPC Core |

  • Enable storage of the truststore and TLS files outside of Karaf BPC-8309

    It is recommended to move customized keystore and truststore files out of the Karaf and OpenSearch folders.

    Subject: Documentation | Karaf |

  • Session ID Name (BPC cookie name) - configurable via setting BPC-8457

    The BPC cookie name can now be set in the [karaf]/etc/de.virtimo.bpc.core.cfg using the property de.virtimo.bpc.core.cookieName (also via bpc.env.sh). The default is still BPC_J_S.

  • Events when restoring indexes BPC-8461

    BPC modules can now respond to restored indexes via events.

  • Automatic index creation for managed indexes during write operations is prevented BPC-8462

    If a managed index was deleted during or shortly before a write operation, it was automatically recreated. However, the general index configuration was not taken into account. This behavior is now avoided.

    See also Creating Indexes

    Affects: BPC Core | Documentation | Forms |

  • Refactoring of the Monitor Export Window BPC-9467

    Affects: Process Monitoring |

Security

  • org.apache.cxf:cxf-core:3.5.7 | CVE-2024-28752 BPC-8455

  • opensearch:2.11.0 | GHSA-6g3j-p5g6-992f BPC-8410

Bugs

  • OSGI component registration via annotations prevents Core from starting as a pre-installed feature BPC-8442

    Affects: BPC Core |

  • BPC license expires too early BPC-8382

    Affects:

  • Data Binding BPC-8415

    Data binding within forms has been revised. Combining multiple data bindings now requires an operator such as +. For more information: Binding Form Component Attributes

    Subject: Documentation | Forms |

  • BPC cannot be started BPC-8441

    Due to an interaction with the PAX JDBC Feature Installer, BPC might not start correctly after a Karaf update.

    Subject: BPC Core |

  • Replacing the default passwords in users.properties causes an exception BPC-8454

    When starting Karaf with plaintext passwords in users.properties, a " java.lang.IllegalArgumentException: Detected a Non-hex character at 1 or 2 position " error could occur.

    Re: BPC Core |

Documentation

Internal Dependencies / Dependency Updates

BPC 4.1.10

Release Date: 2024-03-11

With this update, the following components must be updated: BPC Modules | Karaf | OpenSearch | Java

Update to the Internal Configuration

In this version, changes were made to the internal configuration of the BPC. This affects deployments between BPC instances running different versions. Additionally, extra steps are required when downgrading the BPC.

For more information, see the page at Versioning of the Internal BPC Configuration.

Breaking Changes

You should read the descriptions in this section carefully. They may contain instructions that you must follow to perform an update.

  • Karaf Log Monitor BPC-7550

    Karaf logs are now provided via a monitor (see also Karaf Log).

    The additional component 'Decanter' is used to write Karaf logs to the OpenSearch index bpc-logs. In a new Karaf installation, this component is already pre-installed and no action is required. If an existing Karaf installation cannot or should not be replaced, it can also be installed later via the Karaf console (Internet connection required).

    virtimo@bpc [virtimo@bpc]()> feature:repo-add decanter
    virtimo@bpc [virtimo@bpc]()> feature:install decanter-collector-log

    For configuration instructions, see Karaf Log.

  • Compilation for Java 17 BPC-8333

    As a result of this change, the use of Java 17 is now mandatory, and support for Java 11 has ended.

  • Karaf Update BPC-8353

    Karaf must be updated with this update.

    _
    _Re:
    BPC Core | Karaf |

New Features

  • BPC Watchdog BPC-8319

    A "Watchdog" module is now available at Download - Virtimo File Server. This module monitors the core application (Core module) and attempts to start it if necessary. This is only relevant in scenarios where it is possible that Karaf is started at a time when a connection to OpenSearch is not yet possible. The Core module attempts to establish a connection for approximately 90 seconds and then enters an error state from which it cannot recover on its own. The Watchdog ensures that a restart is performed regularly thereafter, or that an attempt is made to establish an OpenSearch connection.

    Affects: BPC Core | Documentation |

  • Karaf Log Monitor BPC-7550

    Karaf logs are now made available via a monitor (see also Karaf Log).

    The additional component 'Decanter' is used to write Karaf logs to the OpenSearch index bpc-logs. In a new Karaf installation, this component is already preinstalled and no action is required. If an existing Karaf installation cannot or should not be replaced, it can also be installed later via the Karaf console (internet connection required).

    virtimo@bpc [virtimo@bpc]()> feature:repo-add decanter
    virtimo@bpc [virtimo@bpc]()> feature:install decanter-collector-log

    For configuration instructions, see Karaf Log.

    Subject: BPC Core | Documentation | Karaf |

  • Health endpoint for cluster Leader BPC-7915

    New status endpoint for querying the role of individual nodes in cluster operation. This endpoint can now be used to check whether a node has the "Leader" role or not. See also BPC API /cxf/bpc-core/status/clustermaster

    _
    _Affects:
    BPC Core | Documentation |

Improvements

  • Improved error handling for WebSocket connection drops BPC-8343

    Affects: BPC Core | Documentation |

  • Redundant Values Removed from Keycloak IdP Configuration BPC-7983

  • Index Cannot Be Deployed BPC-8277

    Re: BPC Core |

  • Process starter parameter "anyMatch" for the "choice" data type BPC-8317

    A new "anyMatch" parameter allows you to filter options differently in combo boxes. See Process Starter.

  • Compilation to Java 17 BPC-8333

    As a result of this change, the use of Java 17 is now mandatory, and support for Java 11 has ended.

  • Remove Artifactory npm dependencies BPC-8334

    Relevant only for BPC module developers

    Previously, BPC modules either obtained the ExtJS framework from our own NPM repository or it had to be provided separately. Now, ExtJS can be obtained directly from Bitbucket via npm. To do this, set the dependency "@virtimo/sencha-extjs-sdk": "git+ssh://git@bitbucket.org/virtimo/sencha-extjs-sdk#c728d7e2 [git+ssh://git@bitbucket.org/virtimo/sencha-extjs-sdk#c728d7e2]" in the package.json file. Note that the part at the end, #c728d7e2 `, corresponds to a Git commit ID. This should be chosen to match the current branch or BPC version. `c728d7e2 corresponds to the current BPC 4.1 branch "support/4.1.x". Alternatively, you can also specify the branch name. However, this is not recommended, as it has been observed that npm does not take newer commits into account during an update in this case.

    After adding the dependency, the path to the ExtJS framework can be set in the file workspace.json as follows:

    ...
        "frameworks": {
            "ext": {
                "path":"node_modules/@virtimo/sencha-extjs-sdk/ext"
            }
        },
    ...

    A directory or symlink named "ext" is no longer necessary.

  • An empty string in the "rdmsTimeZone" configuration does not result in an error BPC-8356

    Re: BPC Core |

  • Improvements to the plugin for selecting active or inactive organizations BPC-8372

    Affects: BPC Core |

  • The text "Include current view" is misleading BPC-8103

    The selection options in the Export Monitor are now consistently implemented using radio groups, and the labels have been improved.

  • Automatic update even when changes are made to the lookup join data BPC-8145

    Re: BPC Core |

  • Code Bundle Watchdog: Prevent NPE in the log if the optional configuration does not exist BPC-8387

    Affects: BPC Core |

  • null values are now allowed for WebSocket messages BPC-8392

    Affects: BPC Core |

  • Better distinction between local URLs and configured URLs BPC-7476

    The status page now provides a clearer description when a configured base URL is involved.

    Re: BPC Core |

Bugs

  • Favorites view in the monitor is overwritten by local changes BPC-8386

  • Users (except BpcAdmin) cannot edit the dashboard. BPC-8395

  • The filter for licenses in "About BPC" now works BPC-8290

    The filter for licenses in "About BPC" now works

    Re: BPC Core |

  • The value object in instance settings works again BPC-8330

    Objects for values in instance settings no longer prevent existing instances from loading or new instances of a module from being created

    Subject: BPC Core |

  • HTTPS connection to OpenSearch does not work (Windows only) BPC-8376

    Subject: BPC Core | Karaf | OpenSearch |

  • Memory leaks in the backend core have been fixed BPC-8414

    Affects: BPC Core |

  • Emojis in the HTML Content module are not displayed BPC-8239

    The emojis in the Froala Editor have been removed. You can still use the emojis from your keyboard or operating system.

    Re: BPC Core |

  • Error in the Deployment API Documentation BPC-8358

    Subject: BPC Core | Documentation |

Documentation

Internal Dependencies / Dependency Updates

  • Karaf Update BPC-8353

    Karaf must be updated with this update.

    Re: BPC Core | Karaf |

  • Java Update BPC-8378

    Subject:

  • org.apache.commons Update:commons-compress BPC-8409

    Subject: Process Monitoring |

BPC 4.1.9

Release Date: 2023-12-15

The following components must be updated with this release: BPC Module | Karaf | OpenSearch | OpenSearch Plugin

Breaking Changes

You should read the descriptions in this section carefully. They may contain instructions that you must follow to perform an update.

  • Display Karaf version on status page BPC-8260

    An update of the OpenSearch plugin (os-BPC-plugin).

New Features

Improvements

  • Inclusion of X-Forwarded-For headers in session overview BPC-8224

    Re: BPC Core |

  • Display Karaf version on status page BPC-8260

    An update to the OpenSearch plugin (os-BPC-plugin) is required.

    Subject: BPC Core | OpenSearch |

  • Display of "null" values in combo box lists BPC-8278

    "null" values in combo box lists are displayed more clearly

    Re: BPC Core |

  • Dashboard module reduced to frontend BPC-8279

    In existing installations, the file bpc-be-dashboard.jar can be omitted entirely and deleted from the KARAF/deploy directory. The Dashboard module now consists solely of the file bpc-fe-dashboard.war.

  • Monitor access check as an internal Service BPC-8313

    As of de.virtimo.bpc.module.monitor.api.service.MonitorService, it is now possible to check via isAcccessible(…​) whether a user is authorized to access certain monitor functions.

  • Removed the obsolete "lastStateUpdateInUtcMilli" column from the status page under "BPC Server" BPC-8321

    Subject: BPC Core |

Security

  • org.eclipse.jetty:jetty-http:9.4.52.v20230823 | CVE-2023-36478 BPC-8245

    Re: BPC Core | Karaf |

  • org.eclipse.jetty:jetty-io:9.4.52.v20230823 | CVE-2023-44487 BPC-8261

  • Default HTTPS connection to OpenSearch BPC-7771

    Affects: BPC Core | Forms | Karaf | OpenSearch |

Bugs

  • Issue with deploying multiple modules to BPC from INUBIT BPC-8365

    Affects: BPC Core |

  • Autorefresh crashes the monitor BPC-8316

    Subject: Process Monitoring |

  • Unable to log in to BPC after KeyCloak 23 update BPC-8320

    Subject: BPC Core |

  • Navigation disappears after patch BPC-8281

    Fixed a bug where navigation was no longer displayed due to an old configuration

    Re: BPC Core |

  • Backend connection - http - does not return body BPC-8315

    Re: BPC Core |

  • URL serialization is not working properly when redirecting from Keycloak login BPC-8323

    Affects: BPC Core |

  • The Karaf Shell command: os:delete does not display any information if the index to be deleted does not exist BPC-8325

    Affects: BPC Core |

  • Deployment Dialog: Module instances are marked as different even though they are not BPC-8335

    Subject: BPC Core |

  • Handling of null values in Monitor Settings via the REST API BPC-7548

    Subject: Process Monitoring |

  • BPC Default Certificate Expired BPC-8062

    Subject: Karaf |

  • Replication Does Not Replicate All Records of a Database Table BPC-8285

    If a record’s timestamp falls exactly on the boundary of the current replication window, it may not be replicated. However, depending on the precision of the timestamp field and the size of the replication window, this is very unlikely.

    Subject: BPC Core |

Documentation

BPC 4.1.8

Release Date: 2023-11-21

The following components must be updated with this update: BPC Modules | Karaf

New Features

  • Copy plugin assignments when copying components BPC-5117

    If a component to which plugins are directly assigned is copied, a subsequent dialog allows you to choose whether to assign these plugins to the copy as well.

    Subject: BPC Core |

  • Replication Status Plugin BPC-7854

    Replication Status Plugin added

Improvements

  • Reduction of Integrated CXF Features BPC-7992

    Re: Karaf |

  • Cluster operation: Configure multiple OpenSearch nodes BPC-8000

    See also de.virtimo.bpc.core.opensearch.hosts in BPC Configuration File

    Related to: BPC Core | Documentation | Forms |

  • Mandatory role for using BPC BPC-8174

    See also ´mandatoryRoleToAccessBPC´ in Core Services

  • WebSocket messages when the performance index changes BPC-8237

    Subject: BPC Core |

  • IP pinning across different proxies BPC-8242

    See also IP pinning

  • Remove "org.json:json" BPC-8255

    Subject: Data Analysis |

  • Offer "About BPC" window via BpcCommon.Api BPC-8264

    Subject: BPC Core |

  • Organizational Change: Make Notification Disableable BPC-8272

    Removed Note About Session Refresh

    Re: BPC Core |

  • Text-type BPC settings should allow users to disable automatic HTML encoding in the admin area BPC-8298

    " text " type BPC settings can now use the disableEncoding attribute to control whether HTML encoding should be used implicitly in the admin area.

    Unless otherwise defined, HTML encoding is applied to the values of these settings in the admin area.

    Affects: BPC Core |

  • Setting data-testid via the testId attribute BPC-8304

    Affects: BPC Core |

Security

  • Replacing default passwords with strong random passwords BPC-6881

    Starting with this version, Karaf no longer ships with default passwords. When BPC starts up, random passwords are generated for the default users.

    See also: Installation

Bugs

  • Rest API cxf/BPC-core/im/roles not working with INUBIT idp BPC-8302

    Subject: BPC Core |

  • The "*Change Password" function does not work with the Karaf default* BPC-8061

    Subject: BPC Core |

  • The latest MS SQL JDBC driver is installed even though a specific version should be used BPC-8219

    Subject: Documentation |

  • Changing the plugin configuration does not work in some cases BPC-8228

    Affects: BPC Core |

  • BPC Navigation: Main menu item cannot be selected if there are submenu items BPC-8257

    Affects: BPC Core |

  • Selecting navigation elements for the landing page does not work BPC-8259

    • Fixed a bug where the setting for landing pages did not work because the configuration was not set

    Re: BPC Core |

  • Forms Editor no longer displays schema errors in the editor BPC-8269

    Subject: Forms |

  • Setting groups forced by the Core are not merged with setting groups from the module BPC-8273

    Subject: BPC Core |

  • Replication: Consistency check does not work if no data is being replicated BPC-8276

    Affects: BPC Core |

  • Password validation against a regular expression saves incorrect characters BPC-8284

    Affects: BPC Core | Documentation |

  • Core depends on the Joda DateTime library and fails to start BPC-8291

    Subject: BPC Core |

  • An empty filter in MultipleGridsConfig causes an error when loading data BPC-8300

    Subject: Process Monitoring |

  • Monitor views are marked as changed even though they haven’t been modified BPC-8301

    Affects: Process Monitoring |

  • Navigating to the admin area does not display the correct view when accessed repeatedly BPC-7726

    Affects: BPC Core |

  • Changes to LookupJoins configurations (Replication & Log Service) are not applied BPC-7785

    Affects: BPC Core |

Documentation

Internal Dependencies / Dependency Updates

BPC 4.1.7

Release Date: 2023-10-23

The following components must be updated with this update: BPC Modules | OpenSearch | OpenSearch Plugin

Breaking Changes

You should read the descriptions in this section carefully. They may contain instructions that you must follow to perform an update.

You should read the descriptions in this section carefully. These are recommended actions to take when performing an update.

New Features

Improvements

  • Display the number of shards and replicas in the index overview (FE & Karaf shell command) BPC-8045

    Subject: BPC Core | Documentation |

  • Provide an "Information" button in the Core Common package BPC-6675

    Subject: BPC Core |

  • Cannot load file "froala_style.min.css" BPC-6837

    Affects: BPC Core |

  • Remove ExtJS workaround BPC-7887

    Affects: BPC Core |

  • OpenSearch cluster operation: Optimize reindex execution BPC-8047

    Affects: BPC Core |

  • Core_IndexTemplates setting cannot be applied to all indexes BPC-8050

    Affects: BPC Core |

  • BPC-notification Index cannot be optimized for cluster operation BPC-8051

    Re: BPC Core |

  • Make the repository type for OpenSearch snapshots/backups configurable BPC-8054

  • The diff view when initiating reindexing often has trouble detecting differences BPC-8232

    Subject: BPC Core |

  • When creating OpenSearch indices, adjust the "number_of_shards" and "number_of_replicas" BPC-8212

    Subject: BPC Core | Documentation |

Security

  • net.minidev:json-smart:2.4.8 | CVE-2023-1370 BPC-8024

  • OpenSearch | CVE-2023-31419 BPC-8226

Bugs

  • JSON Responses Created with Duplicate Keys for “cxf/BPC-core/configuration" BPC-8111

    Affects: BPC Core |

  • File upload in the process starter causes an error BPC-8243

  • The selection for hidden graphs contains more than the possible graphs BPC-8171

    Subject: Process Monitoring |

  • User settings in the dashboard are no longer stateful BPC-8181

  • Monitor views are lost BPC-8207

  • Uploading modules does not work BPC-8221

    BpcCommon.Util.sanitizeHtml() validates the input. If the input is not a string, it is not processed.

    Subject: BPC Core |

  • The indices from managed_indices.json are not created correctly BPC-8233

    Subject: BPC Core |

  • OIDC/Keycloak: Comma-separated values in claims are not read correctly BPC-8244

    Subject: BPC Core |

  • Non-admin users see the password reset option in the menu, even if it is disabled on the IdP BPC-5859

    Subject: BPC Core |

Documentation

  • Embed user documentation in admin documentation BPC-7999

Internal Dependencies / Dependency Updates

BPC 4.1.6

Release Date: 2023-09-25

The following components must be updated with this update: BPC Modules | Karaf

You should read the descriptions in this section carefully. These are recommended actions that are advised during an update.

  • Karaf update BPC-8077

    Karaf must be updated with this update.

    By default, users from the users.properties are no longer allowed to log in to the Karaf console via SSH. To allow users to log in via SSH, add the role ssh to the individual user’s entry in the file KARAF/etc/users.properties, or add the role from admingroup.

    Subject: BPC Core | Karaf |

  • Remove from the BPC default public key in `keys.properties ` BPC-8210

    Entries in the file ` KARAF/etc/keys.properties` that you do not use for logging in with a public/private key can be removed.

    Re: Karaf |

New Features

Improvements

  • Instance-specific rights BPC-7937

    Component-specific rights for the Monitor, Analysis, and Dashboard modules.

  • AdditionalInformation for UserSession should also be able to set inactiveOrganizations and receive more session information BPC-8211

    Re: BPC Core |

Security

  • com.google.guava:guava:30.1-jre | CVE-2023-2976 BPC-8074

  • Apache CXF | CVE-2022-46363 + CVE-2022-46364 BPC-7545

  • org.eclipse.jetty:jetty-client:9.4.50.v20221201 | CVE-2023-26048 BPC-8011

  • org.codehaus.jettison:jettison:1.5.3 | CVE-2023-1436 BPC-8075

  • org.eclipse.jetty:jetty-client:9.4.50.v20221201 | CVE-2023-26049 BPC-8078

  • Removal of the BPC default public key from keys.properties BPC-8210

    Entries in the file KARAF/etc/keys.properties that you do not use for logging in with a public/private key can be removed.

    Subject: Karaf |

  • Preventing the addition of the bpcadmin role via AdditionalInfo BPC-8213

    If the role bpcadmin is set via the UserInfo endpoint configured on the IdP, this is ignored.

    Affects: BPC Core |

  • org.springframework:spring-core:5.3.22 | CVE-2023-20860 BPC-8022

  • org.eclipse.jetty:jetty-server:9.4.50.v20221201 | CVE-2023-26048 BPC-8076

Bugs

  • Binding to arrays returns [Object object] as the value BPC-8204

    Affects: Forms |

  • Replication does not distinguish between uppercase and lowercase letters in PostgreSQL tables BPC-7818

    Affects: BPC Core |

  • An empty number in the database is replicated as 0 BPC-7836

    Affects BPC Core |

  • Sanitizer removes table fragments if the table element is missing during rendering BPC-8189

    Affects: BPC Core |

  • BPC_PM_configureBPC workflow does not work with 4.1 BPC-8200

    BPC_PM_configureBpc - The variable var.csrfToken is now created during initialization. Additionally, case differentiation when creating HttpProxy / BackendConnections depending on the version.

Internal Dependencies / Dependency Updates

  • Update CXF BPC-8023

    Affects: BPC Core | Data Analysis | Karaf |

  • Update Karaf BPC-8077

    Karaf must be updated with this update.

    By default, users from the users.properties are no longer allowed to log in to the Karaf console via SSH. To allow users to log in via SSH, add the role ssh to the individual user’s KARAF/etc/users.properties file or add the role from admingroup.

    Subject: BPC Core | Karaf |

  • Jetty Update BPC-8209

    Subject: BPC Core |

BPC 4.1.5

Release Date: 2023-08-28

The following components must be updated with this update: BPC Modules

New Features

  • Exclude data fields from transmission to the monitor BPC-6196

    On the monitor, individual fields can be excluded from transmission to the client using the Data_ProcessExcludedFields setting (data_excludedFields). This allows, for example, unused or sensitive data to be suppressed.

Improvements

  • Set global date range as optional only for the current module BPC-6417

    The global date filter now offers a local mode. This allows a different time range to be set for a specific module. See also Global Date Filter

  • Allow alternative account pages from an external IdP (such as Keycloak) BPC-6718

    Related: BPC Core | Documentation |

  • Provide the Forms Plugin with a Configuration Template BPC-8069

    • Added default configuration for the Forms plugin

    Re: Forms |

  • Adjust mouseover text for FULL-TEXT SEARCH BPC-8089

    • Corrected operator and example for multiple words as a phrase in the mouseover text for full-text search in the Monitor

    • Note added regarding the use of backslashes in full-text search in the monitor

  • Delayed addition of plugins to hooks BPC-8188

    Re: BPC Core |

Bugs

  • Monitor Widget hides elements after data refresh BPC-8182

    Affects: Process Monitoring |

  • Changing the automatic data refresh via the user interface has no effect BPC-8183

    Subject: Process Monitoring |

Documentation

  • Analysis User Documentation BPC-5404

    Subject: Documentation |

  • Recommended System Architecture, Including Hardening BPC-5865

    Subject: Documentation |

  • Process Dashboard: Add configuration options in the administration area BPC-6983

    Subject: Documentation |

  • Active BPC Sessions BPC-7128

    Subject: Documentation |

  • Status Page BPC-7129

    Subject: Documentation |

  • Notification BPC-7131

    Subject: Documentation |

  • Displaying Numbers with Commas (e.g., Monetary Amounts) in Monitor Columns BPC-7721

    Subject: Documentation |

  • Documentation: Make Monitor Widgets Referencable in Views BPC-7731

    Subject: Documentation |

  • Do not use DynamicList filters with "source analyzed " BPC-7772

    Subject: Documentation |

  • Dynamic filter values in Data_Filter BPC-7956

    • New page on configuring the Data Filter for monitor data

  • Complete documentation of the monitor widgets BPC-7968

  • Monitor Deeplink BPC-7986

    Subject: Documentation |

  • Dev Doc Events BPC-3335

    Subject: BPC Core | Documentation |

BPC 4.1.4

Release Date: 2023-08-14

The following components must be updated with this update: BPC Modules | OpenSearch | OpenSearch Plugin | Java

Breaking Changes

You should read the descriptions in this section carefully. They may contain instructions that you must follow to perform an update.

  • OpenSearch Cluster Operation: Socket Timeouts in the os-BPC-plugin BPC-8059

    If set, remove the following os-bpc-plugin -specific settings that are no longer needed from the conf/opensearch.yml.

    • os-BPC-plugin.opensearch.basicauth.username

    • os-BPC-plugin.opensearch.basicauth.password

    • os-BPC-plugin.trust_certificates

    • os-BPC-plugin.verify_hostnames

    • os-BPC-plugin.truststore.path

    • os-BPC-plugin.truststore.type

    • os-BPC-plugin.truststore.password

    If this is not done, OpenSearch will not start and will return the error "please check that any required plugins are installed, or check the breaking changes documentation for removed settings".

    Affects: Documentation | OpenSearch |

  • Load the JSON schema from the backend and use it to validate JSON settings BPC-6607

    Affects only module developers When using the BPC JsonEditor (xtype bpcJsonField or bpcCodeEditorWindow.json), the optional JSON schema is now passed via schema and no longer via jsonSchema.

    Re: BPC Core |

  • unintended trimming during jump BPC-7961

    Previously, the content of the monitor jump column was trimmed when filtering in the target monitor (removal of leading and trailing spaces). This is no longer done, so that you can specifically filter for values with spaces at the beginning or end.
    If you use values with additional spaces in your monitor jump column (e.g., in connection with the separator) that do not match the target values in the target monitor, these may need to be removed.

New Features

  • File Upload Function BPC-5266

    A new type, filefield, is now available. This allows you to send files via the form. See also: File Field

  • Load JSON schema from the backend and use it to validate JSON settings BPC-6607

    Applies only to module developers When using the BPC JsonEditor (xtype bpcJsonField or bpcCodeEditorWindow.json), the optional JSON schema is now passed via schema and no longer via jsonSchema.

    Affects: BPC Core |

  • Deployment function as a plugin BPC-7848

    • Deployment function available via plugin at various hooks

Improvements

  • Remove circular reference in jump parameters BPC-7888

  • Improved display for items in the "Jump to" context menu BPC-7930

    It is now possible to customize the appearance of a jump column’s menu item. See also jumpMenuIconCls and jumpMenuText under “Configuration Parameters.” It is also possible to disable the jump options menu. Once disabled, only the “ Im gleichen Tab springen ” jump option is available.

  • Folder-type navigation entry and Tabbed View Mode are not selected BPC-7959

    Subject: BPC Core |

  • Implementation of the Sharing Interface BPC-7980

  • Move the "Date Format" setting in the Monitor widget to "Data" BPC-8030

    Subject: Process Monitoring |

  • Allow multiple references in the binding BPC-8037

    It is now possible to use multiple binding references in a single bind string. See also: Binding Form Component Attributes

  • Tooltip on tabs BPC-8053

  • Custom Row Limit BPC-8055

    Option to limit data/rows (Monitor_DataCountLimit and Monitor_DataViewLimit) added to instance-specific settings

  • Move the "Alignment" setting in the Monitor widget after "Data" BPC-8067

  • Removal of old polyfills BPC-8083

    Adjustments that were necessary to support Firefox 60 ESR and Internet Explorer 11 have been removed. These browsers are no longer supported by BPC and should no longer be used, as the manufacturers have already discontinued support for them.

    Affects: BPC Core |

  • Adjustment to Tooltip Display BPC-8086

    Tooltips are now displayed as long as the mouse pointer is over the relevant element. Previously, tooltips were automatically hidden after 5 seconds.

    Re: BPC Core |

  • Allow HTML in tooltips in the Settings Panel BPC-8147

    Re: BPC Core |

Bugs

  • OpenSearch cluster occasionally crashes when a Karaf instance is stopped. BPC-8020

    Affects: OpenSearch |

  • OpenSearch Cluster Operation: Socket Timeouts in the os-BPC-plugin BPC-8059

    If set, remove the following os-bpc-plugin -specific settings that are no longer needed from the conf/opensearch.yml.

    • os-BPC-plugin.opensearch.basicauth.username

    • os-BPC-plugin.opensearch.basicauth.password

    • os-BPC-plugin.trust_certificates

    • os-BPC-plugin.verify_hostnames

    • os-BPC-plugin.truststore.path

    • os-BPC-plugin.truststore.type

    • os-BPC-plugin.truststore.password

    If this is not done, OpenSearch will not start and will return the error "please check that any required plugins are installed, or check the breaking changes documentation for removed settings".

    Affects: Documentation | OpenSearch |

  • Auto-refresh of Child Monitor no longer works BPC-8090

    Affects: Process Monitoring |

  • Vertical tabs are not visible at different browser zoom levels BPC-6420

    Affects: BPC Core |

  • Unintended trimming on jump BPC-7961

    Previously, the content of the monitor jump column was trimmed when filtering in the target monitor (removal of leading and trailing spaces). This is no longer done so that you can specifically filter for values with leading or trailing spaces.
    If you use values with extra spaces in your monitor jump column (e.g., also in connection with the separator), that do not match the target values in the target monitor, these may need to be removed.

    Subject: Process Monitoring |

  • Excel Export Monitor: java.lang.NoSuchMethodError: 'void org.apache.xmlbeans.XmlCursor.close()' BPC-8060

    Subject: Process Monitoring |

  • According to the monitor interface, "Automatic Update" is enabled, but it is disabled in the configuration BPC-8071

    Subject: Process Monitoring |

  • Monitor jump labels do not work with a right-click BPC-8073

    Subject: BPC Core |

  • The loading animation is briefly missing when loading the BPC BPC-8079

    Subject: BPC Core |

  • Setting an action column does not work via the column configurator BPC-8080

    Subject: Process Monitoring |

  • Error during rendering/sizing in toolbars BPC-8082

    Affects: BPC Core |

  • Monitor widget configuration cannot be edited despite having the bpcDashboard_editDashboard permission BPC-8104

  • Refreshing the monitor widget in the dashboard no longer works BPC-8125

    Subject: Process Monitoring |

  • Cluster: BPC Monitor instances are missing in the second Karaf BPC-8126

    Affects: BPC Core |

  • Unable to select a theme BPC-8170

    Subject: BPC Core |

  • "Not default" option in the Admin Area Settings Panel is disabled after applying a filter BPC-7960

    Subject: BPC Core |

  • "Show Unread" description checkbox is inaccurate BPC-8096

    • Improved notification checkbox Label for unread messages

    Re: BPC Core |

Documentation

  • Feedback on the documentation - Update Guide BPC-6294

  • Documentation for the Core Services setting "appToolbar_globalMenuShowLogout" BPC-6180

    Subject: Documentation |

  • Monitor File Download BPC-7720

  • Use of Placeholders Instead of Environment Variables in the Win Service Default Configuration BPC-7900

    Subject: Documentation |

  • "Line Break" and Example Values in Configuration for Monitor Columns BPC-8006

    Subject: Documentation |

  • Remove Liferay as IdP BPC-8056

    Subject: Documentation |

  • Documentation on new custom data limit settings - Process Monitor BPC-8169

    Subject: Documentation |

Internal Dependencies / Dependency Updates

  • Java Update BPC-8115

    Re:

  • Update to froala-editor BPC-8117

    Affects: BPC Core |

  • Update to Java BPC-8139

    Affects:

BPC 4.1.3

Release Date: 2023-07-03

The following components must be updated with this update: BPC Modules | OpenSearch Plugin

New Features

  • Monitor Child Actions BPC-6109

    Process actions can now also be used in the grid of the detail view (Child Log).

  • Custom OpenSearch Client via BPC OS Service BPC-8036

    Re: BPC Core |

Improvements

  • Integration with Keycloak with minimal configuration effort BPC-7913

    The default values in BPC have been adjusted to match the default values in Keycloak directly. The instructions have been simplified, and a preconfigured realm is no longer offered.

  • "Share Process" in the context menu should support multiple selections BPC-7940

    Multiple monitor processes can now be shared via the context menu.

    Subject: Process Monitoring |

  • The "State Selection Menu" component is initially displayed as active. BPC-7985

    Subject: Process Monitoring |

  • Term "Instance" when duplicating module components BPC-8007

    • Terms were chosen more precisely: Instance → Component Duplicate → Copy

    Re: BPC Core |

  • API function for loading user information should rely on existing UserSessions BPC-8035

    The REST API /user/info/{accessTokenType}/token now relies on existing UserSessions and attempts to find the corresponding UserSession there. Only if no UserSession is found is a pseudo UserSession generated from the access token, which corresponds to the old behavior.

    Affects: BPC Core |

Security

Bugs

  • Monitor: Filter/sorting tooltip is out of date BPC-7868

    Bug fix: Tooltip in the module header is now updated correctly

    Affects: Process Monitoring |

  • ThemeSwitcher - custom themes not visible to regular users BPC-7890

    Affects: BPC Core |

  • Rows in the Column Configurator grid cannot be moved BPC-7982

    Affects: Process Monitoring |

  • Replication does not interpret time zones according to configuration BPC-7988

    Affects: BPC Core |

  • Error creating a new instance that is added directly to the navigation BPC-8010

    Affects: BPC Core |

  • Impersonation in Keycloak 21 fails BPC-8027

    Affects: BPC Core |

  • os-BPC-plugin: Problems with the internal model in cluster mode BPC-8032

    Subject: OpenSearch |

  • API function for loading user information using an access token results in an error BPC-8033

    Subject: BPC Core |

  • Setting a date filter in the monitor—the year cannot be selected (year not visible for selection) when zoomed in below 100% BPC-6835

  • Jumping from the column configurator to the monitor instance does not refresh the view BPC-7416

    Affects: Process Monitoring |

  • Typo in language keys BPC-7994

    Affects: Process Dashboard |

BPC 4.1.2

Release Date: 2023-06-05

The following components must be updated with this release: BPC Modules | OpenSearch | OpenSearch Plugin

You should read the descriptions in this section carefully. These are recommended actions that are advised during an update.

  • In the OpenSearch cluster, data from the os-BPC-plugin is not synchronized reliably between nodes BPC-7768

    An update to OpenSearch or the os-BPC-plugin is required.

    Related: BPC Core | OpenSearch |

Improvements

Bugs

  • After restoring a BPC-configuration index, replication jobs, etc., must be restarted BPC-7100

    Subject: BPC Core | OpenSearch |

  • In the Dashboard Monitor widget, the selected view (user-defined view) is not displayed correctly initially. BPC-7730

    Affects: Process Monitoring |

  • Dashboard: Configured title in the External Content Widget is ignored BPC-7748

  • HTTP 500 is misinterpreted BPC-7756

    Affects: BPC Core |

  • In the OpenSearch cluster, data from the os-BPC-plugin is not reliably synchronized between nodes BPC-7768

    An update to OpenSearch or the os-BPC-plugin is required.

    Affects: BPC Core | OpenSearch |

  • User logout after changing the IdentityProvider_Mappings BPC-7787

    Subject: BPC Core |

  • Migration 3.4.5→4.0.14 Data source not found BPC-7799

    Re: BPC Core |

  • Process preview widget does not use the date format configured on the monitor BPC-7862

  • IP pinning error is not displayed correctly in the frontend BPC-7863

    Affects: BPC Core |

  • Theme forces colors in the grid, so they cannot be changed BPC-7884

    Affects:

  • The custom renderer does not work in the Process Preview Monitor widget. BPC-7912

  • IP pinning error during emulation BPC-7918

    Re: BPC Core |

  • Monitor Widgets: Initial view is set multiple times BPC-7919

  • Monitor Grid without Multiple Views configuration receives incorrect Parameters BPC-7931

  • VIMON dashboard widget causes issues with the WebSocket connection BPC-7935

  • Default dashboard instance settings are missing BPC-7943

    Affects: Process Dashboard |

  • Monitor Pie Chart Widget: Clicking the "Overview" header causes an error in the console BPC-7947

    Affects: Process Monitoring |

  • Monitor Pie Chart Widget: Setting hidden graphs has no effect BPC-7948

    Affects: Process Monitoring |

  • VIMON initialParams configuration does not work BPC-7952

    Affects: Documentation |

  • BPC Navigation: In BPC 4.1, MessageKeys are not translated in the subnavigation BPC-7954

    Subject: BPC Core |

  • *search-BPC-plugin endpoint returns placeholder text "${project.version}" instead of the version number BPC-7963

    Re: OpenSearch |

  • Changes to the model are not displayed—i.e., BackendConnection module_name BPC-6767

    Re: BPC Core |

  • Status text in the details window causes an unsightly line break at certain screen resolutions BPC-7783

    Affects: Process Monitoring |

Documentation

  • BPC-7390 Update changelog to reflect use of the old encryption method BPC-7881

  • BPC Migration Documentation BPC-7932

  • Migration from ES to OpenSearch BPC-7933

  • Fix incorrect link to page: Plugin - Share BPC-7936

    Subject: Documentation |

  • Update Notification API documentation BPC-7962

    Subject: BPC Core | Documentation |

BPC 4.1.1

Release Date: 2023-05-08

With this update, the following components must be updated: BPC Module | Karaf | OpenSearch Plugin | Java

Breaking Changes

You should read the descriptions in this section carefully. They may contain instructions that you must follow to perform an update.

  • Renaming the function BpcCommon.Api.getInstanceUrl to BpcCommon.Api.getModuleUrl BPC-7902

    The name of the Common function "getInstanceUrl" (introduced with BPC 4.1.0) is being replaced by "getModuleUrl."

You should read the descriptions in this section carefully. These are recommended actions to take when performing an update.

New Features

Improvements

  • Renaming of the BpcCommon.Api.getInstanceUrl to BpcCommon.Api.getModuleUrl BPC-7902

    The name of the Common function "getInstanceUrl" (introduced with BPC 4.1.0) is being replaced with "getModuleUrl".

  • Share Process via Context Menu BPC-1104

    You now have the option to share a process in the monitor. The context menu for the currently selected process includes the option "Share Process." Selecting this option generates a URL to the current monitor, with the currently selected process in focus.

  • Jetty Configuration Outside of Karaf BPC-7780

    To centrally configure the jetty.xml, you can use the central configuration file.

  • DatePicker month selection box should not have a background color BPC-7840

    Re: BPC Core |

  • os-BPC-plugin: Replace Elasticsearch X-Pack BPC-7849

  • Dashboard - AutoUpdate - Force (also with WS) BPC-7853

    Subject: Process Dashboard |

  • BPC Notification Type "link" Also with External URL BPC-7858

    Subject: BPC Core | Documentation |

  • BPC Notification Type "link," Offer Jump Option in Pop-up Mode BPC-7859

    Subject: BPC Core |

  • Customize VIMON texts BPC-7866

    Product name in English and German, as well as widget name, customized

  • The "Share" function should only be offered if the module supports it BPC-7870

    Re: BPC Core |

  • Customize External Content Default Settings URL BPC-7875

    A new instance of the External Content module initially points to the Virtimo documentation by default

    Re: BPC Core |

Bugs

  • JSON Editor jumps to the beginning of the document when used BPC-7865

    Subject: BPC Core |

  • Scrolling in the navigation bar BPC-6672

    Subject: BPC Core |

  • Locked Grid display in the BPC theme BPC-7413

    Subject:

  • View buttons appear active even though the view is not active BPC-7725

  • Monitor (plugin) Inline view simply disappears BPC-7732

  • Deep link with login does not lead to the destination BPC-7795

    Subject: BPC Core |

  • Process Preview Widget shows that no data is available if no data is available in one of the grids BPC-7851

    Subject: Process Monitoring |

  • Monitor Widget - Clicking the "Total" row sets the value of the aggregated column to "null" BPC-7856

    Subject: Process Monitoring |

  • Background color of the info button in the Notification Center window is incorrect BPC-7860

    Subject: BPC Core |

  • In the relative date picker, years begin on December 23 at 11:00 PM BPC-7861

    Subject: BPC Core |

  • Notification via API is displayed twice in the Notification Central window BPC-7864

    Subject: BPC Core |

  • "Manage Views" does not hide the additional fields in the personal view BPC-7871

    Affects: Process Monitoring |

  • Passwords are stored unencrypted in the database when JAAS JDBC is switched to the old encryption method BPC-7880

    Subject: BPC Core | Karaf |

  • Error adding plugins if the hook has already been removed (timing issue) BPC-7889

    Affects: BPC Core |

  • Missing PluginHook adjustments BPC-7901

  • CSS & JS code field broken BPC-7905

    Affects: BPC Core |

  • Performance Issues (detected) - even though Performance Tracing is off BPC-7716

    Affects: BPC Core |

  • BPC theme sets Grid cellEditing to a fixed height BPC-7826

    Affects:

Documentation

  • Notification API - Complete list of possible "type" values BPC-7873

    Subject: Documentation |

  • Add the Form Binding documentation page to the navigation menu. BPC-7450

    Subject: Documentation |

  • Update Notification API documentation BPC-7857

    Subject: Documentation |

  • Correction to BPC documentation: Installation BPC-7882

    • Typo fixed

    • Added information on how to open the BPC locally

Internal Dependencies / Dependency Updates

BPC 4.1.0

Release Date: 2023-03-27

The following components must be updated with this update: BPC Module | Karaf | OpenSearch | Java

Update to the internal configuration

Changes were made to the internal configuration of the BPC in this version. This affects deployments between BPC instances running different versions. Additionally, extra steps are required when downgrading the BPC.

For more information, see the page at Versioning of the Internal BPC Configuration.

Breaking Changes

You should read the descriptions in this section carefully. They may contain instructions that you must follow for an update.

  • ChildLog should not use "eval" for filters and renderers BPC-5375

    To prevent scripting attacks, renderers can no longer be defined as plain text JavaScript in the columns. Custom renderer functions can be referenced as described here. Formatting functions from Ext.util.Format can be used by specifying the formatter. See also: Column configuration

  • Migration to OpenSearch BPC-5819

  • Karaf Update BPC-6709

    An update to Karaf is required for this BPC update.

    Customer themes and custom BPC modules must be adapted so that the Web-ContextPath and Webapp-Context in the manifest file must begin with /. To achieve this, you can usually edit the file build.gradle. An example can be https://bitbucket.org/Virtimo/BPC-theme-template/commits/469a13171aa82655b6f0475b38a561d2ebceee52 [be foundhttps://bitbucket.org/virtimo/bpc-theme-template/commits/469a13171aa82655b6f0475b38a561d2ebceee52][here].

    In the configuration file [karaf]/etc/org.ops4j.pax.web.cfg, Parameters have been renamed:

    org.ops4j.pax.web.ssl.password -> org.ops4j.pax.web.ssl.keystore.password
    org.ops4j.pax.web.ssl.keypassword -> org.ops4j.pax.web.ssl.key.password
  • Our Backend API as a Maven module BPC-6872

    We had to move some interfaces/classes from the package de.virtimo.bpc.core to the package de.virtimo.bpc.api.

    If you are compiling your code for 4.0.8 or 4.1 and receive errors, please adjust the Java imports. In most cases, you only need to replace .core. with .api.. Otherwise, delete the import and let the IDE find it for you.

    And please make sure you don’t have any <Import-Package> statements in your pom.xml for the following packages:

    • de.virtimo.bpc.core.exception

    • de.virtimo.bpc.auth.*

    • de.virtimo.bpc.core.es.querybuilder

  • Adjust the package of the util classes from the 'util' module BPC-6886

    If BPC Core util classes were used.

    Please adjust the Java import statements

    • ALT: de.virtimo.bpc.core.utils.*

    • NEW: de.virtimo.bpc.util.*

    And the pom.xml (<Import-Package>)

    • ALT: de.virtimo.bpc.core.utils;version="[4.0,5.0)",

    • NEW: de.virtimo.bpc.util;version="[4.0,5.0)",

  • Move BpcTrustStoreUtil to the util module BPC-6924

    If the following was used

    de.virtimo.bpc.core.utils.BpcTrustStoreUtil.setTo(…​)

    please replace it with

    de.virtimo.bpc.util.BpcTrustStore.getInstance().setTo(…​)

  • Renaming of attributes in the context of plugin hooks BPC-7379

    For BPC developers

    Plugins are passed a context when called. Two attributes in the context object have been renamed. moduleId has been changed to baseModuleId, and instanceId has been changed to moduleId.

  • Required adjustments to the backend modules when using BPC annotations: @BpcUserSessionRequired, …​ BPC-7384

    Relevant for BPC module developers / Important for BPC Developers

    This is only necessary when you use one of the following annotations in your backend modules/bundles:

    • @BpcUserSessionRequired

    • @BpcRoleRequired

    • @BpcRightRequired

    • @BpcRoleOrRightRequired

    • @BpcHardcodedBasicAuthentication

    If this is the case, please update your resources/OSGI-INF/blueprint/context.xml

    and replace

    <bean id="bpcJAXRSInvoker" class="de.Virtimo.BPC.jaxrs.BpcJAXRSInvoker"/>

    with

    <bean id="bpcJAXRSInvoker" class="de.Virtimo.BPC.jaxrs.BpcJAXRSInvoker" init-method="onStartup" destroy-method="onShutdown">     <argument ref="blueprintBundleContext"/>  </bean>

  • Strong Password Encryption BPC-7390

    With the Karaf update, a stronger algorithm is now used for hashing passwords. This affects all JAAS-based https://docs.Virtimo.net/BPC-docs/latest/core/admin/identity_provider/idp_config.html [https://docs.virtimo.net/bpc-docs/latest/core/admin/identity_provider/idp_config.html][Identity Provider] and the login to the Karaf console. All existing user passwords will no longer be valid and must be recreated!

    If you wish to continue using the old user passwords, you must continue to use the old password hashing algorithm. This is described below. If you want to use the new algorithm, you do not need to follow the steps below.

    Using weak algorithms poses a potential security risk.

    Add the following values to ` bpc.env ` to retain the old algorithm.

    export ORG_APACHE_KARAF_JAAS_ENCRYPTION_ENABLED=true
    export ORG_APACHE_KARAF_JAAS_ENCRYPTION_NAME=basic
    export ORG_APACHE_KARAF_JAAS_ENCRYPTION_ALGORITHM=SHA-512
    export ORG_APACHE_KARAF_JAAS_ENCRYPTION_ENCODING=hexadecimal

    Configuration via Karaf configuration files

    Change the following values in the configuration file ` [karaf]/etc/org.apache.karaf.jaas.cfg `. This reverts to the previous (weak) encryption.

    encryption.name = basic
    encryption.algorithm = SHA-512

    Existing JAAS JDBC

    The Virtimo JAAS JDBC implementation now uses the password encryption settings from the file: [karaf]/etc/org.apache.karaf.jaas.cfg. These do not match the settings used previously.

    Therefore, if JAAS JDBC has already been used and you wish to continue using the existing (weak) hashes are to continue being used, please create the following file: [karaf]/etc/de.virtimo.bpc.core.auth.jaas.jdbc.cfg

    The following content restores the previous (weak) configuration:

    • up to BPC 4.0.15

       encryption.enabled = true
       encryption.name = basic
       encryption.algorithm = SHA-512
       encryption.encoding = hexadecimal
       encryption.prefix = {CRYPT}
       encryption.suffix = {CRYPT}

      Unfortunately, all password hashes in the database table must then be supplemented with the prefix and suffix. Example: PasswortHash{CRYPT}PasswortHash{CRYPT}. Starting with BPC version 4.0.15, this adjustment is no longer necessary.

    • starting with BPC 4.0.15

       encryption.enabled = true
       encryption.name = basic
       encryption.algorithm = SHA-512
       encryption.encoding = hexadecimal
       encryption.prefix =
       encryption.suffix =

      This means that, as before, passwords are stored in the database table without a prefix or suffix.

    To use a more secure hashalgorithm such as argon2, all passwords must be regenerated and thus reset.

    After adjusting these settings, Karaf must be restarted.

    Affects: BPC Core | ** Documentation | Karaf |

  • Content Security Policy BPC-7443

    A Content Security Policy (CSP) is set via HTTP He This may affect your own modules, INUBIT WebApps, or integrated third-party applications. To customize the CSP, see Content Security Policy

  • Apache CXF BPC-7546

    We used CXF version 3.5.4 in our previous Karaf releases. This CXF version includes Jackson version 2.13.4. We now ship Karaf with CXF 3.5.5, which includes Jackson version 2.14.1.

    Please update the CXF version (3.5.4 → 3.5.5) in your ` pom.xml`. It is even more important to also update the version of Jackson being used. To do this, check if you have an Import-Package statement for it. This must be added or adjusted when you use Jackson functionality such as the ` ObjectMapper ` class.

    Replace ` ` [source]

    <Import-Package>
      ...
      com.fasterxml.jackson.*;version="[2.11.0,2.14.0)",
      ...
    </Import-Package>

    with ` ` [source]

    <Import-Package>
      ...
      com.fasterxml.jackson.*;version="[2.13.4,2.15.0)",
      ...
    </Import-Package>
  • Additional dashboard (widget) states should be stored locally BPC-7809

    The dashboard settings Dashboard_Responsive(ID: module_isResponsive) and Dashboard_Layout(ID: layout_config) have been removed. Dashboards are now “responsive” by default and make full use of the available space in their column. Users can now adjust the height and width of widgets. These changes are stored in the browser but can also be saved to the dashboard by authorized users. It is no longer possible to reset local changes directly on the widget; but is instead available via a button in one of the toolbars. For the button to appear, the value ` "resetUserState" ` must be added to one of the settings: ModuleHeader_Content, Toolbar_LeftContent, or Toolbar_RightContent.

  • Replace ReplicationInfoService with an endpoint BPC-7822

    Replication status information is no longer displayed on the monitor. This status information will be provided in a future release via a plugin.

  • Our 'Checker' and 'BpcService' interfaces are being moved BPC-6864

    If you have been using the following

    de.virtimo.bpc.core.utils.ServiceUtil.unregisterService(bundleContext, ServiceRegistration, Class);

    please use

    de.virtimo.bpc.api.BpcService.unregister(bundleContext, ServiceRegistration, Class);

    instead.

    Re: BPC Core |

  • Core modules such as user management do not work in navigation submenus BPC-7784

    For BPC module developers

    There was an undocumented function that reacted globally, on all components with the attribute targetModule, to the event click. In this case, the value of ` targetModule ` was passed to the method ` BpcCommon.Api.showModule , thereby triggering navigation to that module. This function has now been removed. If you have used the ` `targetModule` attribute—for example, on buttons—for navigation, you must set this up using your own handler that applies only to your components.

    Affects: BPC Core |

You should read the descriptions in this section carefully. These are recommended actions that are advised during an update.

  • Relevant Karaf configurations from the Karaf folder "drag" BPC-6681

    A big request: when updating Karaf, do not simply copy all etc files from the old installation to the new one. This may result in new Karaf options not being set, and in the worst case, Karaf may fail to start.

    And if at all possible, do not manually edit [karaf]/etc files; instead, make the adjustments via bpc.env.sh (Linux/macOS) or bpc.env.cmd (Windows). This makes Karaf updates much easier and can be used in BPC versions >= 3.4. See Central configuration file for more information.

    Most customizations can be made by overriding values from etc files without having to edit an etc file.

    For example, if you want to set a different path to the keystore and truststore files: The paths are defined in the configuration file [karaf]/etc/org.ops4j.pax.web.cfg under the options org.ops4j.pax.web.ssl.keystore and org.ops4j.pax.web.ssl.truststore.

    To set different paths for these two options, you can add two environment variables to ` bpc.env.sh `:

     export ORG_OPS4J_PAX_WEB_ORG_OPS4J_PAX_WEB_SSL_KEYSTORE=/opt/bpc.env/ssl/virtimo_keystore.jks  export ORG_OPS4J_PAX_WEB_ORG_OPS4J_PAX_WEB_SSL_TRUSTSTORE=/opt/bpc.env/ssl/virtimo_truststore.jks

    Here’s another example of how to set the ` de.virtimo.bpc.core.maintenancemode.fileSystemLimitInMB ` option in ` [karaf]/etc/de.virtimo.bpc.core.cfg `:

    export DE_VIRTIMO_BPC_CORE_DE_VIRTIMO_BPC_CORE_MAINTENANCEMODE_FILESYSTEMLIMITINMB=4096

    A limitation will be resolved with the next Karaf update. The deployment directory ([karaf]/deploy) cannot currently be set via an environment variable due to a "bug." This affects the option ` felix.fileinstall.dir ` in the configuration file ` [karaf]/etc/org.apache.felix.fileinstall-deploy.cfg`.

    Depending on usage, three files should be copied or replaced with symbolic links:

    • [karaf]/etc/users.properties

    • [karaf]/etc/org.ops4j.pax.logging.cfg

    • [karaf]/etc/de.virtimo.bpc.core.auth.jaas.jdbc.queries.cfg

    Of course, this is only necessary if these files have been modified at all. The options in the two cfg files could also be set via environment variables, but that would require setting several environment variables.

  • Karaf Update BPC-7374

    An update to Karaf is strongly recommended for security reasons.

    Re: BPC Core | Karaf |

New Features

  • BPC Sharing BPC-144

  • Provide External Applications as Plugins BPC-596

  • Adding dynamic URL Parameters to external content URLs BPC-1729

    Subject: BPC Core | Documentation |

  • BPC Storage Service BPC-3367

  • Personalized Monitor Views BPC-5331

    Monitor views created with a BPC version < 2.1.6 are no longer supported. To preserve these views, they must be opened once in the "Manage Views" dialog and saved. This process saves the views in the correct format.

  • Deeplink button BPC-6729

  • Editor for Backup Jobs BPC-6768

    Subject: BPC Core |

  • VIMON Module BPC-6936

    Subject: Documentation |

  • Setting Filter BPC-6949

    Subject: BPC Core |

  • *Automatically install pax-jdbc features via bpc.env.sh * BPC-7260

    Subject: BPC Core | Documentation | Karaf |

  • Password validation using regular expressions BPC-7440

    Subject: BPC Core | Documentation |

  • DynamicFieldLabel Plugin for Text Fields BPC-7815

    For BPC module developers

    ExtJS components that use the mixin Ext.form.Labelable —and thus the attributes labelWidth and fieldLabel —can use this plugin to dynamically set the labelWidth based on the actual text width.

    Example
         {
             xtype : "textfield",
             plugins : ["bpcDynamicFieldLabel"],
             fieldLabel: "Label"
          }

    If necessary, the additional spacing can be configured in the plugin using labelOffset:

    Example with configured labelOffset
         {
             xtype : "textfield",
             plugins: {
                 bpcDynamicFieldLabel: {
                     labelOffset: 10
                 }
             },
             fieldLabel: "Label"
          }
  • Configure the order of columns in the process preview widget BPC-2224

  • The jump column should allow users to copy a link without jumping directly to that location BPC-4152

Improvements

  • Option to disable CSRF token checks on backend connections of type httpproxy BPC-7370

  • Clean up column references BPC-2747

  • Open jumps in a new browser tab BPC-3136

  • Make monitor widgets referenceable in views BPC-5154

  • Take module permissions into account during navigation BPC-6139

    Re: BPC Core |

  • Rewrite Analysis Module widget variables and Update View BPC-6146

  • Refactoring of Report Variables Detail View BPC-6649

    Subject: Data Analysis |

  • API Key ID BPC-6666

    Subject: BPC Core | Documentation |

  • "Pull" relevant Karaf configurations from the Karaf folder BPC-6681

    A big request: when updating Karaf, please do not simply copy all etc files from the old installation to the new one. This may result in new Karaf options may not be set, and in the worst case, Karaf won’t start.

    And if at all possible, do not manually edit [karaf]/etc files; instead, make the adjustments via bpc.env.sh (Linux/macOS) or bpc.env.cmd (Windows). This makes Karaf updates much easier and can be used in BPC versions >= 3.4. See Central configuration file for more information.

    Most customizations can be made by overriding values in etc files without having to edit an etc file.

    For example, if you want to set different paths for the keystore and truststore files: The paths are specified in the configuration file [karaf]/etc/org.ops4j.pax.web.cfg under the options org.ops4j.pax.web.ssl.keystore and org.ops4j.pax.web.ssl.truststore.

    To set different paths for these two options, you can add two environment variables to ` bpc.env.sh `:

     export ORG_OPS4J_PAX_WEB_ORG_OPS4J_PAX_WEB_SSL_KEYSTORE=/opt/bpc.env/ssl/virtimo_keystore.jks  export ORG_OPS4J_PAX_WEB_ORG_OPS4J_PAX_WEB_SSL_TRUSTSTORE=/opt/bpc.env/ssl/virtimo_truststore.jks

    Here is another example of how to set the ` de.virtimo.bpc.core.maintenancemode.fileSystemLimitInMB ` option in ` [karaf]/etc/de.virtimo.bpc.core.cfg `:

    export DE_VIRTIMO_BPC_CORE_DE_VIRTIMO_BPC_CORE_MAINTENANCEMODE_FILESYSTEMLIMITINMB=4096

    A limitation will be resolved with the next Karaf update. The deployment directory ([karaf]/deploy) cannot currently be set via an environment variable due to a "bug." This affects the option ` felix.fileinstall.dir ` in the configuration file ` [karaf]/etc/org.apache.felix.fileinstall-deploy.cfg`.

    Depending on usage, three files should be copied or replaced with symbolic links:

    • [karaf]/etc/users.properties

    • [karaf]/etc/org.ops4j.pax.logging.cfg

    • [karaf]/etc/de.virtimo.bpc.core.auth.jaas.jdbc.queries.cfg

    Of course, this is only necessary if these files have been modified at all. The options in the two cfg files could also be set via environment variables, but that would require setting several environment variables.

  • Detail window in the Chart Editor does not function for tables and template charts BPC-6699

  • Initially sort backup job indexes alphabetically BPC-6844

    Subject: BPC Core |

  • User info when the navigation toolbar is hidden BPC-6852

    Subject: BPC Core |

  • Simplify Icon-Only Mode in Navigation BPC-6861

    Subject: BPC Core |

  • Our Backend API as a Maven Module BPC-6872

    We had to move some interfaces/classes from the de.virtimo.bpc.core package to the de.virtimo.bpc.api package.

    If you are compiling your code for 4.0.8 or 4.1 and encounter errors, please update your Java imports accordingly. In most cases, you only need to replace .core. with .api.. Otherwise, delete the import and let the IDE find it for you.

    And please make sure you do not have any <Import-Package> statements in your pom.xml for the following packages:

    • de.virtimo.bpc.core.exception

    • de.virtimo.bpc.auth.*

    • de.virtimo.bpc.core.es.querybuilder

  • Adjust the package of the util classes from the 'util' module BPC-6886

    If BPC Core util classes were used.

    Please update the Java import statements

    • OLD: de.virtimo.bpc.core.utils.*

    • NEW: de.virtimo.bpc.util.*

    And the pom.xml (<Import-Package>)

    • OLD: de.virtimo.bpc.core.utils;version="[4.0,5.0)",

    • NEW: de.virtimo.bpc.util;version="[4.0,5.0)",

  • Uploading licenses in the new format BPC-6921

    Subject: BPC Core |

  • Move BpcTrustStoreUtil to the util module BPC-6924

    If the following was used:

    de.virtimo.bpc.core.utils.BpcTrustStoreUtil.setTo(…​)

    , please replace it with

    de.virtimo.bpc.util.BpcTrustStore.getInstance().setTo(…​)

    Re: BPC Core |

  • Convert Module Navigator to a plugin BPC-6938

    The Module Navigator is now available as a plugin. The plugin name is: BPC Module Navigator, plugin ID: bpcModuleNavigator. Existing breadcrumb configurations are automatically migrated to a plugin configuration.

  • Remove license information from status BPC-6970

    Subject: BPC Core |

  • Backup Editor: Sorting by date does not work in the backup history BPC-6977

    Subject: BPC Core |

  • Integrate status changes into process actions BPC-7124

    The "Change Status" function has been moved to the "Actions" menu.

  • Renaming of Attributes in the Context of Plugin Hooks BPC-7379

    For BPC developers

    Plugins are passed a context when called. Two attributes in the object context have been renamed. moduleId has been changed to baseModuleId and instanceId has been changed to moduleId.

  • Create a default instance of the External Content Module with a URL to the BPC product documentation. BPC-7467

    Re: BPC Core |

  • Make the interval selector in the backup editor more robust BPC-7484

    Subject: BPC Core |

  • Adapt OIDC login redirection to CSP BPC-7552

    Subject: BPC Core |

  • IdP mapping directly to a user BPC-7792

    Subject: BPC Core | Documentation |

  • Display of name for plugin and hook instead of the ID, with support for language keys as names BPC-7805

    Subject: BPC Core |

  • Additional dashboard (widget) states should be stored locally BPC-7809

    Dashboard settings Dashboard_Responsive(ID: module_isResponsive) and Dashboard_Layout(ID: layout_config) have been removed. Dashboards are now "responsive" by default and utilize the available space within their column. Widgets can now be resized by the user in both height and width. These changes are retained in the browser but can also be saved to the dashboard by authorized users. Resetting local changes is no longer possible directly on the widget; instead, this is done via a button in one of the toolbars. To display the button, the value ` "resetUserState" ` must be added to one of the settings: ModuleHeader_Content, Toolbar_LeftContent, or Toolbar_RightContent.

  • Replace ReplicationInfoService with an endpoint BPC-7822

    Replication status information is no longer displayed on the monitor. This status information will be provided in a future release via a plugin.

  • Fields for organization, role, and permission selection should adopt the translation of values from the base class BPC-7844

  • Remove obsolete INUBIT license settings from the documentation and cfg file BPC-6728

    Subject: BPC Core | Documentation | Karaf |

  • Move our 'Checker' and 'BpcService' interfaces BPC-6864

    If you have been using the following

    de.virtimo.bpc.core.utils.ServiceUtil.unregisterService(bundleContext, ServiceRegistration, Class);

    please use

    de.virtimo.bpc.api.BpcService.unregister(bundleContext, ServiceRegistration, Class);

    instead.

    Re: BPC Core |

  • Login Monitoring - "Imitate User" - Standardize Audit Log BPC-6927

    Re: BPC Core |

  • Backup Editor: Standardize Backup History Buttons BPC-6976

    Re: BPC Core |

  • Backup Editor: Use a new button type to start a backup BPC-6978

    Subject: BPC Core |

  • Backup Editor: Display a message when no backups are available BPC-6979

    Affects: BPC Core |

  • Backup Editor: BPC reloads after restoration BPC-6980

    Affects: BPC Core |

  • Backup Editor: Lock UI during restore BPC-6981

    Subject: BPC Core |

  • License setting 'License_Overview' (ID = licencedModules) is constantly being updated BPC-7076

    Subject: BPC Core |

  • de.Virtimo.BPC.core.auth.jaas.jdbc.queries.cfg with Karaf BPC-7275

    Subject: BPC Core | Karaf |

Security

  • com.google.code.gson:gson:2.2.4 | CVE-2022-25647 BPC-6692

    Subject: Data Analysis |

  • Setting the sameSite attribute on cookies BPC-4885

    Subject: BPC Core | Karaf |

  • ChildLog Should Not Use "eval" for Filters and Renderers BPC-5375

    To prevent scripting attacks, renderers can no longer be defined in columns as plain text JavaScript. Custom renderer functions can be referenced as described here. Formatting functions from Ext.util.Format can be used by specifying the formatter. See also: Column Configuration

  • Incomplete or Missing Cache-Control Header BPC-6395

    Affects: Karaf |

  • org.ops4j.pax.logging:pax-logging-log4j2:2.0.16 | CVE-2017-5645 BPC-6714

    Re: Karaf |

  • User Session IP pinning BPC-6947

    When using a proxy, please ensure that the https://developer header is set.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For [https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For][X-Forwarded-For] Headers. This also applies to WebSockets. See also IP Pinning.

  • Strong Password Encryption BPC-7390

    The Karaf update now uses a stronger algorithm for hashing passwords. This affects all JAAS-based https://docs.Virtimo.net/BPC-docs/latest/core/admin/identity_provider/idp_config.html [https://docs.virtimo.net/bpc-docs/latest/core/admin/identity_provider/idp_config.html][Identity Provider] and the login to the Karaf console. All existing user passwords will no longer be valid and must be recreated!

    If you wish to continue using the old user passwords, you must continue to use the old password hashing algorithm. This is described below. If you wish to use the new algorithm, you do not need to follow the steps below.

    WARNINGING: Using weak algorithms poses a potential security risk.

    Add the following values to ` bpc.env ` to retain the old algorithm.

    export ORG_APACHE_KARAF_JAAS_ENCRYPTION_ENABLED=true
    export ORG_APACHE_KARAF_JAAS_ENCRYPTION_NAME=basic
    export ORG_APACHE_KARAF_JAAS_ENCRYPTION_ALGORITHM=SHA-512
    export ORG_APACHE_KARAF_JAAS_ENCRYPTION_ENCODING=hexadecimal

    Configuration via Karaf configuration files

    Change the following values in the configuration file ` [karaf]/etc/org.apache.karaf.jaas.cfg `. This will revert to using the previous (weak) encryption.

    encryption.name = basic
    encryption.algorithm = SHA-512

    Existing JAAS JDBC

    The Virtimo JAAS JDBC implementation now uses the password encryption settings from the file: [karaf]/etc/org.apache.karaf.jaas.cfg. These do not match the ones used previously.

    Therefore, if JAAS JDBC was already in use and you wish to continue using the existing (weak) hashes, please create the following file: [karaf]/etc/de.virtimo.bpc.core.auth.jaas.jdbc.cfg

    The following content restores the previous (weak) configuration:

    • up to BPC 4.0.15

       encryption.enabled = true
       encryption.name = basic
       encryption.algorithm = SHA-512
       encryption.encoding = hexadecimal
       encryption.prefix = {CRYPT}
       encryption.suffix = {CRYPT}

      Unfortunately, all password hashes in the database table must then be updated to include the prefix and suffix. Example: PasswortHash{CRYPT}PasswortHash{CRYPT}. Starting with BPC version 4.0.15, this adjustment is no longer necessary.

    • starting with BPC 4.0.15

       encryption.enabled = true
       encryption.name = basic
       encryption.algorithm = SHA-512
       encryption.encoding = hexadecimal
       encryption.prefix =
       encryption.suffix =

      This means that, as before, passwords are stored in the database table without a prefix or suffix.

    To use a more secure hashalgorithm such as argon2, all passwords must be regenerated and thus reset.

    After adjusting these settings, Karaf must be restarted.
  • Content Security Policy BPC-7443

    A Content Security Policy (CSP) is set via an HTTP header. This may affect your own modules, INUBIT WebApps, or integrated third-party applications. To customize the CSP, see Content Security Policy

  • Switch the host key algorithm to ECDSA BPC-7696

    Affects: Karaf |

  • org.apache.cxf.karaf:cxf-karaf-commands:3.5.4 | CVE-2018-11788 BPC-7265

    Re: Karaf |

  • org.springframework:spring-core:5.3.22 | CVE-2016-1000027 BPC-7266

    Affects: Karaf |

  • org.apache.activemq:activemq-broker:5.16.5 | CVE-2015-3208 BPC-7267

    Affects: Karaf |

Bugs

  • Not all bundles can be launched BPC-7268

    Subject: Karaf |

  • API keys become invalid when saved in the editor BPC-6770

    Subject: BPC Core |

  • Database connections are created without a pool BPC-6916

    Affects: BPC Core |

  • BPC: Check for expired sessions sometimes does not work correctly BPC-6512

    Affects: BPC Core |

  • Modules in "Failure" status after server reboot or Karaf restart BPC-6587

    For the BPC backend module developers. Please ensure in the src/main/resources/OSGI-INF/blueprint/context.xml (if used; do not create a new one) that the cxf:bus is set as follows:

    <!-- BPC-6587 [/browse/BPC-6587] - org.apache.cxf.BusException: No DestinationFactory was found for the namespace http://cxf.apache.org/transports/http [http://cxf.apache.org/transports/http] -→ <!-- It seems that when set it waits for CXF first. -→ <cxf:bus> </cxf:bus><!-- To get rid of the CXF loggings …​ Karaf-Konsole: log:set ERROR org.apache.cxf -→ <cxf:bus> <cxf:features> </cxf:features> <cxf:features> <cxf:logging /> </cxf:features> <cxf:features> </cxf:features></cxf:bus>

  • MariaDB driver cannot be installed on an offline server BPC-6747

    Re: Karaf |

  • Deployment from BPC 3 to BPC 4 does not work BPC-6759

    Deployment from BPC 3 to BPC 4 only works if the deployment is controlled/initiated from BPC 4.

    Re: BPC Core |

  • Under certain circumstances, text from our bundles can no longer be overwritten by third-party modules BPC-6815

    Re: BPC Core |

  • Exception on every BE-Core startup (IllegalArgumentException: duplicate element:) BPC-6818

    Affects: BPC Core |

  • Temporary indexes should not be listed in the backup editor BPC-6849

    Affects: BPC Core |

  • Keycloak: Refreshed accessToken is not being updated in userSession BPC-6883

    Subject: BPC Core |

  • Failed to update user language BPC-6922

    Affects: BPC Core |

  • Organization with JSON in BPC session causes error in DataFilter BPC-6958

    Affects: Process Monitoring |

  • Record Editor Malfunction for Non-Admin Users BPC-7111

    Affects: BPC Core |

  • Permissions Are No Longer Displayed in Identity Manager After Changing the Password BPC-7112

    Affects: BPC Core |

  • Replication creates an index without an alias BPC-7473

    Subject: BPC Core |

  • Deployment exports (e.g., API keys) are not imported when Karaf starts (if it is already running, there is no problem) BPC-7487

    Subject: BPC Core |

  • CSP header forces https to http Port BPC-7778

    Subject: Karaf |

  • Fix text when copying to the clipboard BPC-7791

  • Bottom edge of the date range picker is cut off BPC-7838

    Affects: BPC Core |

  • Default Analysis Dataset Modifier does not work BPC-7842

    Affects: Data Analysis |

  • Karaf login does not work via /bin/client -u Virtimo BPC-7414

  • Core modules such as user management do not work in navigation submenus BPC-7784

    For BPC module developers

    There was an undocumented function which responded globally to the ` click event on all components with the ` `targetModule attribute. In this process, the value of ` `targetModule ` was passed to the ` BpcCommon.Api.showModule ` method, thereby triggering navigation to that module. This functionality has now been removed. If you have used the ` targetModule` attribute, e.g., on buttons, for navigation, you must implement this using your own handler that applies only to your components.

    Affects: BPC Core |

Documentation

Internal Dependencies / Dependency Updates

  • Karaf Update BPC-6709

    An update to Karaf is required for this BPC update.

    Customer themes and custom BPC modules must be adapted so that the Web-ContextPath and Webapp-Context in the manifest file must begin with /. To achieve this, the file build.gradle can usually be modified. An example can be found https://bitbucket.org/Virtimo/BPC-theme-template/commits/469a13171aa82655b6f0475b38a561d2ebceee52 [https://bitbucket.org/virtimo/bpc-theme-template/commits/469a13171aa82655b6f0475b38a561d2ebceee52][here].

    In the configuration file [karaf]/etc/org.ops4j.pax.web.cfg, parameters have been renamed:

    org.ops4j.pax.web.ssl.password -> org.ops4j.pax.web.ssl.keystore.password
    org.ops4j.pax.web.ssl.keypassword -> org.ops4j.pax.web.ssl.key.password
  • Karaf Update BPC-7374

    An update to Karaf is strongly recommended for security reasons.

    Re: BPC Core | Karaf |

  • Java 17 Update BPC-7378

    The BPC now runs on Java 17 and Java 11. It is recommended to migrate to Java 17 as soon as possible, as official support for Java 11 is ending.

    Re: BPC Core | Karaf |

  • Pax Web Update BPC-7412

    Re: Karaf |

  • Apache CXF BPC-7546

    We used CXF version 3.5.4 in our previous Karaf releases. This CXF version includes Jackson version 2.13.4. We now ship Karaf with CXF 3.5.5, which includes Jackson version 2.14.1.

    Please update the CXF version (3.5.4 → 3.5.5) in your pom.xml. It is even more important to also update the version of Jackson you are using. To do this, check if you have an Import-Package statement for it. This must be added or adjusted if you use Jackson functionality such as the ` ObjectMapper ` class.

    Replace ` ` [source]

    <Import-Package>
      ...
      com.fasterxml.jackson.*;version="[2.11.0,2.14.0)",
      ...
    </Import-Package>

    with ` ` [source]

    <Import-Package>
      ...
      com.fasterxml.jackson.*;version="[2.13.4,2.15.0)",
      ...
    </Import-Package>
  • Update org.osgi.service.jdbc BPC-7711

    Re: BPC Core |

  • Update DOMPurify BPC-7774

    Re: BPC Core |

  • Update vibur-object-pool BPC-7697

    Subject: BPC Core |

  • Update Mockito BPC-7700

    Subject: BPC Core |

  • Update json-schema-validator BPC-7701

    Subject: BPC Core |

  • Update json BPC-7704

    Re: BPC Core |

  • Prometheus Update BPC-7706

    Subject: BPC Core |

  • Apache POI Update (Excel Generation) BPC-7707

    Subject: Process Monitoring |

  • Update/Remove javaee-web-api BPC-7710

    Subject: BPC Core |

Miscellaneous

  • Migration to OpenSearch BPC-5819

  • Standardize backup configuration BPC-6235

    Subject: BPC Core | Documentation | Forms |

  • Changing the font for better readability during compressed transmission BPC-6967

    The font was changed from "Lato Light" to "Lato." This makes the font slightly less thin, resulting in better rendering during compressed transmission (e.g., when sharing a screen in meeting tools or using RDP).

    To ensure that custom themes also adopt this change, they must be rebuilt using "BPC-theme" version 4.1.0 or later.

    Re: BPC Core |

  • Required adjustment of backend modules when using BPC annotations: @BpcUserSessionRequired, …​ BPC-7384

    Relevant for BPC module developers / Important for BPC Developers

    This is only necessary if you use one of the following annotations in your backend modules or bundles:

    • @BpcUserSessionRequired

    • @BpcRoleRequired

    • @BpcRightRequired

    • @BpcRoleOrRightRequired

    • @BpcHardcodedBasicAuthentication

    If this is the case, please update your resources/OSGI-INF/blueprint/context.xml

    and replace

    <bean id="bpcJAXRSInvoker" class="de.Virtimo.BPC.jaxrs.BpcJAXRSInvoker"/>

    with

    <bean id="bpcJAXRSInvoker" class="de.Virtimo.BPC.jaxrs.BpcJAXRSInvoker" init-method="onStartup" destroy-method="onShutdown"> <argument ref="blueprintBundleContext"/> </bean>

  • Analysis: Replace Elasticsearch with OpenSearch BPC-7454

  • Migration from Nashorn Engine to GraalVM BPC-7485

    Subject: Data Analysis | Forms |

  • Cypress Test Logger Configuration Adjustment Following the Migration to OpenSearch BPC-7695

  • Percolators Are Not Deleted BPC-7833

    Subject: BPC Core |