Administration Changelog

The module is now displayed as a frontend module again. This ensures consistent display.

A bug in opensearch-env.bat has been fixed.

The configuration of OIDC and Keycloak backend Connections failed when the BPC homepage was specified as the redirect URL (post-login or post-logout). The cause was the settings validation, which received an HTTP status code 406 when checking the URL of the BPC homepage. As a result, it was not possible to create new OIDC or Keycloak backend Connections or edit existing ones. New cloud deployments, which create backend Connections via Custom Resources, were also affected.

This issue has been resolved.

This update increases the version of Apache Karaf.

Please update Karaf according to the update instructions.

Incorrect behavior in the monitor regarding the data_filter setting has been fixed: If you used OR as a link and did not set a base filter, all records were displayed despite the filter rules.

In a AND link, the base filter was negated and combined with the other filter rules using a logical UND. This was incorrect; the base filter is now no longer negated here either, and specifies which documents are generally visible. This means that a data record is visible if it meets the base filter OR any of the session-specific filter rules.

Note: If you are using Monitor instances with data_filter in your BPC deployment, please verify that they still function as intended.

More details on the “ data_filter ” setting can be found here: Restrict the visibility of monitor data

Incorrect behavior in the monitor regarding the data_filter setting has been fixed: If you used OR as a link and did not set a base filter, all records were displayed despite the filter rules.

With a AND link, the base filter was negated and combined with the other filter rules using a logical UND. This was incorrect; the base filter is now no longer negated in this case either, and specifies which documents are generally visible. This means that a record is visible if it satisfies the base filter OR all session-specific filter rules.

Note: If you are using Monitor instances with data_filter in your BPC deployment, please verify that they still function as intended.

More details on the “ data_filter ” setting can be found here: Restrict the visibility of monitor data

Data used by OIDC providers for login is stored in an encrypted cookie on the client side. This prevents system overload caused by a large number of login requests.

For BPC module developers

If you have developed your own UserFlowIdentityProvider implementation, you must adapt it. The function ` URI createAuthenticationRequestURI(String requestUrl) ` has been replaced with ` UserFlowLoginContext createAuthenticationRequestContext(String requestUrl) ` and now returns not only the redirect URL to the OIDC login but also a cookie containing the login state. This cookie is set by the frontend during a login attempt.

For BPC administrators

Install the new modules bpc-be-core.jar and bpc-fe-core.war. A restart of the BPC/Karaf is required. If the BPC is still unavailable, please delete the directory karaf/data and restart Karaf. (You may want to back up your log files first.)

Timeseries Management Administrators who do not belong to the "bpcadmin" role and previously only had the "webtsm_admin" permission now need the "webtsm_edit" permission instead. A Timeseries Management Administrator could also be assigned the "WEBTSM_ADMIN" role instead of the specific permission. This would also be more future-proof if, for example, future versions define fine-grained permissions for the endpoints instead of the "webtsm_edit" permission.

The Data Management Module no longer has a standalone backend component (bpc-be-vam.jar). It must be removed during the update.

For the update, first remove bpc-be-vam.jar and then install the updated bpc-fe-vam.war.

The Data Management Module has been incorporated into the regular release cycle.

Data used by OIDC providers for login is stored in an encrypted cookie on the client side. This prevents system overload caused by a large number of login requests.

For BPC module developers

If you have developed your own UserFlowIdentityProvider implementation, you must adapt it. The function URI createAuthenticationRequestURI(String requestUrl) has been replaced with UserFlowLoginContext createAuthenticationRequestContext(String requestUrl) and now returns not only the redirect URL to the OIDC login but also a cookie containing the login state. This cookie is set by the frontend when a login attempt is made.

For BPC administrators

Install the new modules bpc-be-core.jar and bpc-fe-core.war. A restart of the BPC/Karaf is required. If the BPC is still unavailable, please delete the directory karaf/data and restart Karaf. (You may want to back up your log files first.)

Timeseries Management Administrators who do not belong to the "bpcadmin" role and previously only had the "webtsm_admin" permission now need the "webtsm_edit" permission instead. A Timeseries Management administrator could also be assigned the “WEBTSM_ADMIN” role—instead of the specific permission. This would also be more future-proof if, for example, in subsequent versions, — instead of the "webtsm_edit" permission.

The Data Management Module no longer has a standalone backend component (bpc-be-vam.jar). It must be removed during the update.

To perform the update, first remove bpc-be-vam.jar and then install the updated bpc-fe-vam.war.

The Data Management Module has been incorporated into the regular release cycle.

BPC now supports PKCE (Proof Key for Code Exchange) for OpenID Connect and Keycloak identity providers to enable a hardened login flow. To enable this, you must set the PKCE method in the identity provider’s backend Connection and, if necessary, configure this in your Keycloak client.

The driver provided via pax-jdbc-mssql is no longer included in the release.

Make sure that the MSSQL driver you are using is at least the following version: 10.2.4, 11.2.4, 12.2.1, 12.6.5, 12.8.2, 12.10.2, 13.2.1

If an older driver is being used, it should be replaced. Remove the old driver by deleting it from the deploy directory or by uninstalling pax-jdbc-mssql or the driver itself. Then install an up-to-date driver (without the " `pax-jdbc-mssql`" feature). See also: Databases

If an error occurs during index migration, the index newly created for the migration is removed to prevent subsequent errors or to revert to a stable state.

If the configured Identity Provider is unreachable, the system no longer incorrectly logs that the local Karaf Identity Provider has been selected as a fallback. Instead, it indicates that this could be enabled as a fallback.

Retrieving subgroups has been adjusted to accommodate changes in the Keycloak API.

In the central configuration file (bpc.env.sh), a bug was fixed in the commented-out option DE_VIRTIMO_BPC_DECANTER_APPENDER_OPENSEARCH_DELETEENTRIESOLDERTHAN. Previously, enabling it did not work because the value must be enclosed in quotation marks. The Windows version was not affected.

This update upgrades Karaf to version 4.4.8. It is necessary to update the modules bpc-be-core, bpc-be-analysis, bpc-be-forms, and bpc-be-monitor.

For BPC module developers:

With the updated Karaf, we are shipping CXF 3.6.8 instead of 3.6.7, which provides Jackson version 2.19.2.

Please update the CXF version (3.6.8) and Jackson version (2.19.2) in your pom.xml. To do this, check whether you have an import package statement for this version. This must be added or adjusted if you use Jackson functions such as the ` ObjectMapper ` class.

HTTP calls made via an HTTP proxy or Flow connection filter out the BPC API key header (X-APIKey). Note: This could affect existing BPC configurations if, for example, an INUBIT process is triggered that, in turn, makes calls to the BPC API using the API key provided. (In this case, it would be better to store a fixed BPC API key within the INUBIT process.)

For Boolean values in the settings tables, a combo box is no longer displayed; instead, only the checkbox with the truth value appears. The value can be changed by clicking, pressing the spacebar, or pressing Enter.

HTTP calls via an HTTP proxy or Flow connection filter out the BPC API keyheader (X-APIKey). Note: This could affect existing BPC configurations if, for example, an INUBIT process is triggered that, in turn, makes calls to the BPC API using the API key provided. (In this case, it would be better to store a fixed BPC API key within the INUBIT process.)

For new backend Connections of the HTTP Proxy and Flow types, the " Filter BPC Session " option is enabled by default.

Replication could get stuck in a specific time window if it was adjacent to the present and no records were found.

Until now, a large portion of the Identity Provider (Backend Connections) configuration was handled via a single JSON setting. This has been split into individual settings. Existing configurations will be migrated automatically. If older deployment exports of Identity Provider components are in use, it is best to recreate them.

See also: Creating, Configuring, and Using an Identity Provider, Database as Identity Provider, Keycloak as an Identity Provider, Keycloak and Dynamic Redirect URIs, Deployment Constraints

The OpenSearch configuration directory can be configured via OPENSEARCH_PATH_CONF. This allows you to move the configuration directory out of the OpenSearchdirectory. This prevents you from overwriting it during an OpenSearch update. See also Moving the OpenSearch Configuration.

In the bundle installation file, BPC is now shipped with a configuration directory moved to INSTALLATIONSVERZEICHNIS/opensearch_config.

It is recommended to set OPENSEARCH_PATH_CONF in BPC.env.

A configuration interface for Identity Providers is now available.

This update requires you to update Karaf.

The BPC provides OpenAPI-compliant specification files for our APIs. These are available under Downloads and can also be accessed dynamically via the BPC, provided this option is enabled. For more information, see the BPC-API section.

The OpenSearch configuration directory can be configured via OPENSEARCH_PATH_CONF. This allows you to move the configuration directory out of the OpenSearch directory. This ensures that you no longer overwrite it during an OpenSearch update. See also Moving the OpenSearch Configuration.

In the bundle installation file, BPC is now shipped with a configuration directory moved to INSTALLATIONSVERZEICHNIS/opensearch_config.

It is recommended to set OPENSEARCH_PATH_CONF in BPC.env.

For Identity Providers (Backend Connections), a large portion was previously configured via a single JSON setting. This has been split into individual settings. Existing configurations will be migrated automatically. If older deployment exports of Identity Provider components are being used, it is best to recreate them.

See also: Creating, Configuring, and Using an Identity Provider, Database as Identity Provider, Keycloak as an Identity Provider, Keycloak and Dynamic Redirect URIs, Deployment Constraints

The plugin can now configure a process that is displayed immediately upon triggering. In addition, the text and icon can now be freely configured. See also Process Starter Plugin

The option for grouping settings is now enabled by default. It is recommended to use this view, as it displays the settings in a shared context.

During monitor export, empty columns for which there is no OpenSearch mapping yet are also exported.

You can now configure a preselection of a value for process status changes. The preselection is controlled based on the configuration preselectState in the setting function_changeStateConfig.

"preselectState": "_first": Always selects the first available value from the dropdown. "preselectState": "<Suchwert>": Selects the first entry that contains the specified text (case-sensitive). Both raw values and display names (from Custom Renderer) can be used.

If exactly one process is loaded and there are exactly two values to choose from, the status field automatically selects the status that does not match the current status.

During replication, Shadow Copy, Tail Sync, and Consistency Check encountered issues if the setting targetIndexCaseSensitivityOfFields was set to lowerCase or upperCase. In the case of Shadow Copy and Tail Sync, data loss could occur.

If the BPC is running in a cluster, it may not be possible to deactivate maintenance mode via the GUI.

The logging configuration has been changed so that session tokens are masked. For new Karaf installations, this happens automatically. For existing installations, please update the configuration file [KARAF]/etc/org.ops4j.pax.logging.cfg. Replace the old line

with the following lines:

Since session tokens in Keycloak and OIDC are UUIDs that are also used elsewhere, we log the first and last four characters here.

If binary files were uploaded via INUBIT or another backend system, the files might have been corrupted during download or viewing.

The " Monitor_FileReferenceColumn " field was missing in the editor.

For existing Karaf installations, add the following value to KARAF/etc/custom.properties:

Dashboard widgets now only display the configuration icon if the user is allowed to edit the dashboard. To do so, they need the “ bpcDashboard_editDashboard ” permission. Users without this permission can no longer edit dashboard widgets. If editing capabilities (e.g., for custom widgets) are to continue to be offered, either the corresponding permission must be granted or the configuration must be provided via alternative methods (e.g., via the widget header).

A health check endpoint can now be configured in the Identity Provider Backend Connections if the identity provider in use provides such an endpoint. If this is configured, the status can be queried in the Status API via /cxf/bpc-core/status/identity-provider. The /cxf/bpc-core/status/health endpoint includes the identity provider status in the health check. For further details, see Configuring Identity Providers and the Status API. Information on deploying health check endpoints in Keycloak can be found at Keycloak as an Identity Provider.

In the moduleHeaderContent setting, the parameter showSelectionCounter in the metablock can be used to control whether the number of selected records is displayed.

See also Monitor Quick Actions

Dashboard widgets now only display the configuration icon if the user is allowed to edit the dashboard. To do so, the user needs the " `bpcDashboard_editDashboard`" permission. Users without this permission can no longer edit dashboard widgets. If editing capabilities (e.g., for custom widgets) are to continue to be offered, either the corresponding permission must be granted or the configuration must be provided through alternative means (e.g., via the widget header).

In cluster mode, backups must be triggered by only one node. As a result of the change, the "bpc_backups_scheduled_jobs" metric has been removed. It contained the number of existing backup jobs.

The startup script no longer waits 30 seconds after OpenSearch and Karaf start. If problems arise where OpenSearch is not available in a timely manner, the watchdog should be used.

The startup script no longer makes any changes to the environment. Directories must be configured according to the installation instructions, and JAVA_HOME must also be configured correctly.

The Status API has been extended with an endpoint /cxf/bpc-core/status/license, which returns 200 OK if the license is valid and not expired, and 503 Not Available otherwise. The /cxf/bpc-core/status/health endpoint includes the license status in the health check. See also API Documentation

Users are now retrieved from Keycloak in batches. When using external Identity Providers in Keycloak (e.g., LDAP), longer loading times may still occur if Keycloak is performing a synchronization.

The ProcessStarter configuration for windowWidth and windowHeight now correctly affects the window.

The selection of an operator for "number" filters has been restricted to the operator list. "=" is defined as the default operator, and the default operator can also be changed in the filter configuration within the column configuration. See also Configuring Monitor Columns

The bpcMonitor_editMonitorViews permission can be set for specific instances to create and modify views in certain monitors by appending the module ID at the end.

See OpenSearch Index View

There is now a description of the BPC’s internal model_version at Versioning of the Internal BPC Configuration. It also explains that this can affect a BPC downgrade and the Deployment between different BPCs.

The changelog now indicates when an update to the internal configuration is available.

In addition, the Administration Changelog displays an overview of all versions in which a change to the model_version occurred. As part of this, an overview of versions with Karaf and OpenSearch updates has also been added.

See MinIO as an S3 Backup for OpenSearch

The installation via bundle file is now described at Installation. The included start and stop scripts are now described.

Notes added stating that database connections generally require read-only permissions.

See Backend Connections, Security, and Documents.

Instructions for downgrading the BPC, taking technical specifics into account. See: * Versioning of the Internal BPC Configuration * Troubleshooting * Downgrade Guide

Update OpenSearch according to the update instructions

Monitors that contain an externalReference field with an IGUASU reference can display a link that allows users to jump to the data source in IGUASU. To do this, the renderer flow!_!flowRenderer must be set in the monitor column configuration.

See also: BPC → IGUASU

Scripts are provided that can be used to start and stop BPC, Karaf, and OpenSearch.

See Download - Virtimo File Server

The user session can be supplemented with customData that comes from the Additional Info endpoint of the Identity Provider Backend Connection.

See also Add additional organizations/roles/permissions and other data to the user session

Replication now supports the direct entry of an SQL query as an alternative to existing database tables/views.

See also sourceCommonTableExpressionQuery in Replication

The OpenSearch log contains many entries such as "QueryGroup _id can’t be null, It should be set before accessing it." can be found in the OpenSearch log. This is a known OpenSearch bug that was introduced in version 2.18.0. We have reduced the output as much as we could on our end.

To display existing charts using a dark theme without a white background, the background color of the charts should be set to full transparency under Chart Configuration → Settings → Background Color (RGBA alpha value set to 0).

Snapshots whose names do not conform to the current naming scheme have blocked the execution of backups.

When the HTTP proxy used an HTTP/2 connection, the pseudo-header ":status" was passed on to the client. Under a strict interpretation, this results in an error. For example, nginx reported a 502 Bad Gateway error to the client in this case.

When a deployment was performed from a BPC with existing monitor views to a BPC that did not yet have any views, an error occurred.

This error has been fixed.

A bug was fixed that prevented instance-specific HTML content editing permissions from being granted by the role htmlcontent_editor_<MODUL-ID>.

Update OpenSearch according to the update instructions

Properties have been set in the custom.java.security

If you are not yet using a custom.java.security file via Central configuration file, you should do so.

Existing custom.java.security files should be updated with the following entry:

The bpc.env files now also set the security.properties for OpenSearch from the file custom.java.security. As a result, changes made to this file affect both Karaf and OpenSearch.

If you are using a BPC.env file, it is recommended that you update it. If it does not already exist, the file custom.java.security be added. To do so, the following must be added.

See also Central configuration file

Settings can now be protected from changes via the BPC license. This will primarily be used in our cloud installations (K8s). For example, there we use the core setting 'backupRepository' to define the configuration of OpenSearch backups in an Amazon S3 bucket, and we do not want this to be changeable via the BPC frontend.

To achieve this, when creating the license, the XML can be extended with the list element ` NON_WRITEABLE_SETTINGS `, which contains the IDs of the non-editable settings.

Excerpt from a sample license:

The settings (example: _core_noinstance_backupRepository) are the same as those used in the OpenSearch index ‘BPC-configuration’.

The structure is as follows: <ModuleId>_<InstancId>_<SettingName>

If the setting pertains to a module and not to an instance or component, then the value noinstance must be used for the <InstanceId>. You can access the <SettingName> by displaying the “ID” column in the Settings grid in the BPC frontend.

Example: _core_noinstance_backupRepository

We have reduced the number of shards to 1 in the Core_IndexTemplates setting. This is also the default setting that Elasticsearch/OpenSearch has been using for new indices for a few years now. This only affects newly created indices. Existing indices are not affected.

The application toolbar has been made slightly lighter. In the admin area, modified text in grids is now displayed with better contrast. The loading animation has been adjusted.

Optimizing accesses to the OpenSearch Backup API results in fewer accesses to the data storage. This reduces the associated costs, for example, when using Amazon S3.

Performance improved and heap memory usage reduced. Java must perform significantly fewer garbage collector calls. This is especially true when the log levels for the BPC packages are set to the default (WARN). This applies to the standard BPC modules for Karaf as well as the OpenSearch plugin.

When saving JSON settings, attributes within objects were automatically sorted. This behavior has been disabled. This makes it possible to customize the order according to your own criteria.

The bpc.env files now also apply the security.properties settings from the file custom.java.security to OpenSearch. As a result, changes made to this file affect both Karaf and OpenSearch.

If you are using a BPC.env file, it is recommended that you update it. If it does not already exist, the file custom.java.security To do so, add the following:

See also Central configuration file

The license filename may now also be license.xml.virtimo. Previously, it had to be license.xml.bpc. This makes it possible to use a license that is also a valid INUBIT license file.

This change speeds up the loading of the BPC configuration on the client.

Properties were set in the custom.java.security

If you are not yet using a custom.java.security file via Central configuration file, you should do so.

Existing custom.java.security files should be updated with the following entry:

The placeholder #user.loginName# is now correctly substituted in the Data_Filter when the dynamic filter # is used.

If the client sends multiple session cookies—possibly because multiple BPC instances are installed on the server—the appropriate session cookie is now taken into account.

In cases involving frequent data changes, errors could occur in the monitor when displaying detail views. As a result, the entire rendering of the application was disrupted, and the page had to be reloaded manually.

Uploaded files are no longer kept entirely in memory. This reduces memory usage and prevents "OutOfMemoryException".

This update requires updating Karaf and the modules bpc-be-core, bpc-be-analysis, bpc-be-forms, and bpc-be-monitor.

For BPC module developers:

In our earlier Karaf versions, we used CXF version 3.5.4. This version of CXF includes Jackson version 2.14.3. We now ship Karaf with CXF 3.6.5, which includes Jackson version 2.17.2.

Please update the CXF version (3.6.5) in your ` pom.xml`. More importantly, you must also update the Jackson version (2.17.2) you are using. To do this, check whether you have an import package statement for this version. This must be added or updated if you use Jackson functions such as the ` ObjectMapper ` class.

Replace

with

Update OpenSearch according to the update instructions

The log level for the BPC plugin in OpenSearch has been reduced from trace to info. This setting can be found in the file opensearch/config/log4j2.properties.

The interface for configuring and creating replication components has been standardized. It is no longer possible to directly enable or disable individual replications in the list of replication components. This is done after selecting a replication in the detail view.

The option for "CascadingDynamicFilter" has been added to the administration interface for monitor components.

The bundle info, which can be accessed via the Karaf console, no longer displays the build date but rather the date of the last change to the underlying source code.

Update OpenSearch according to the update instructions

You can use the LogService API to be redirected directly to the LogService configuration or to connected monitors. There are two new LogService endpoints for this purpose, which redirect the user to the corresponding BPC pages when called:

See also the API documentation: Log Service API

Starting with IGUASU version 3.0.6, you can now navigate directly from the BPC Flow Processor overview to the IGUASU processor. “Frontend URL” and “System ID” are now available in the Flow Manager. “URL” has been renamed to “Service URL.” Username and password are no longer required. Long descriptions of the processors are displayed in abbreviated form, with the full text available in a tooltip.

If free disk space falls below defined thresholds, shards are distributed to other nodes. It may also happen that indices are set to read-only to prevent the disk from filling up.

The value of ` cluster.routing.allocation.disk.threshold_enabled ` is now ` true`. This corresponds to the OpenSearch default value.

Fields containing nested JSON objects receive the value "formatter" : "jsonStringify" in the initial column configuration. This converts the contents to text and displays them in the monitor.

A bug has been fixed that caused individual replication jobs to not be distributed correctly across all available nodes when changes were made to the nodes in the BPC cluster.

Although the OpenSearch connection was configured to use HTTP, the system attempted to establish the TLS context based on the configuration. However, if this configuration was incorrect, an error occurred.

The configuration is now ignored, as it is not relevant for HTTP connections.

Nevertheless, it is recommended to use secure connections in this context.

There were various issues when the time zone of the "Last Updated" column in the database table was set to UTC: - Tail Sync did not always delete all records. - Instead, it updated all records on every run. - Interaction with replication was also disrupted.

The documentation on configuring secure network connections has been revised.

See in particular Secure Connection (TLS/HTTPS)

Update OpenSearch according to the update instructions

A dark theme is now available for BPC. It can be downloaded from the download page.

To switch between installed themes, you can use the plugin Theme Switcher, for example.

When impersonating other users, the language can no longer be changed in the impersonated user’s Keycloak profile. For this to work, Keycloak must be configured correctly so that Impersonator information is provided via an active scope.

Karaf access via SSH is described in more detail, and useful notes have been added.

The following documentation pages have been updated.

The following pages have been revised:

Update OpenSearch according to the update instructions

A breaking change was accidentally introduced. The User Account Plugin no longer displays the language selection even though the "changeLanguage" option is enabled. The option must now be named "languageSelector."

If you update to BPC 4.2.6 or later, the option will be renamed automatically.

See also User Account Menu

When configuring a Keycloak identity provider, there is no longer a need to configure a dedicated admin user. All actions in the integrated user management system are now performed in the context of the current user. This means that these users must be assigned all necessary roles in Keycloak. Thanks to this adjustment, actions can now be correctly assigned to individual users in the Keycloak audit log. See also Keycloak as an Identity Provider.

With this change, the maximum valid session duration in the BPC is no longer influenced by the corresponding setting in Keycloak. This must now be set in the file de.virtimo.bpc.core.cfg under the setting de.virtimo.bpc.core.auth.oidc.sessionExpirationMinutes. The default value is equivalent to 8 hours. If the duration in Keycloak is shorter, the session checker in BPC will also terminate the session. However, a delay may occur here if the user still has an AccessToken that has not expired.

In addition, the BPC itself no longer blocks the impersonation of users with the "bpcadmin" role. This must now be configured in Keycloak and is described at Impersonating Users with Keycloak.

It is now possible to create new users or change the name, email, and password of existing users via the integrated user management in Keycloak.

When the BPC is loaded, the version number of the Core Common Package (Fe-Core) is determined and stored in Local Storage. If this version number differs from the one saved during the previous load, local storage is reset.

A breaking change was accidentally introduced. The User Account Plugin no longer displays the language selector even though the "changeLanguage" option is enabled. The option must now be named "languageSelector".

If you update to BPC 4.2.6 or newer, the option will be renamed automatically.

See also User Account Menu

When configuring a Keycloak identity provider, there is no longer a need to set up a dedicated admin user. All actions in the integrated user management system are now performed in the context of the current user. This means that these users must be assigned all necessary roles in Keycloak. Thanks to this adjustment, actions can now be correctly assigned to individual users in the Keycloak audit log. See also Keycloak as an Identity Provider.

With this change, the maximum valid session duration in the BPC is no longer influenced by the corresponding setting in Keycloak. This must now be set in the file de.virtimo.bpc.core.cfg under the setting de.virtimo.bpc.core.auth.oidc.sessionExpirationMinutes. The default value is equivalent to 8 hours. If the duration in Keycloak is shorter, the session checker in BPC will also terminate the session. However, a delay may occur here if the user still has an AccessToken that has not expired.

In addition, the BPC itself no longer blocks the impersonation of users with the "bpcadmin" role. This must now be configured in Keycloak and is described at Impersonating Users with Keycloak.

It is now possible to create new users or change the name, email, and password of existing users via the integrated user management in Keycloak.

It is now possible to include references to external resources when writing audit information. For example, you can reference the IGUASU instance that generated the entry.

The configuration grid_showHeader is obsolete because it causes errors. The header’s behavior has been controlled by the Parameter moduleHeader_enabled for some time now. This setting will be automatically removed during the BPC update.

In the Flow module, a distinction can be made between IGUASU and INUBIT as instance types

See System Monitoring (Metrics for Prometheus)

Instance-specific editing roles can now be assigned for the HTML Content Module: htmlcontent_editor_<MODUL_ID> See also: HTML Content Module (User-Defined Content)

JSESSIONID cookie has been disabled

Update OpenSearch according to the update instructions

If an IP pinning error occurs, you can now log in normally after reloading the page in your browser. The error will not be displayed again (unless the IP address changes again).

When maintenance mode was activated on a single node (in cluster operation), replication was sometimes not paused. This issue has been resolved. When updating, it is particularly important that OpenSearch is also updated.

In current Karaf versions, Karaf-specific environment variables for setting JVM memory have been removed and must be replaced with an alternative.

Linux

Please replace `

` with ` bpc.env.sh

` and adjust the values accordingly.

Windows

Please replace bpc.env.cmd

with

and adjust the values accordingly.

See also Central configuration file and Karaf

In current Karaf versions, Karaf-specific environment variables for setting JVM memory have been removed and must be replaced with an alternative.

Linux

Please replace `

` with ` bpc.env.sh

` and adjust the values accordingly.

Windows

Please replace bpc.env.cmd

with

in the file and adjust the values accordingly.

See also Central configuration file and Karaf

The Backend Core version must match the OpenSearch plugin. Either update this manually or install the new OpenSearch version.

The JAR license files (filename bpc-be-license.jar) can no longer be used and must be replaced with XML-based license files (filename license.xml.bpc). If you are still using an old JAR license file, please contact Support to obtain a new license file.

Applies only to module developers When using the BPC JsonEditor (xtype bpcJsonField or bpcCodeEditorWindow.json), the optional JSON schema is now passed via schema and no longer via jsonSchema.

Karaf logs are now provided via a monitor (see also Karaf Log).

The additional component 'Decanter' is used to write Karaf logs to the OpenSearch index bpc-logs. In a new Karaf installation, this component is already preinstalled, and no action is required. If an existing Karaf installation cannot or should not be replaced, this component can also be installed later via the Karaf console (internet connection required).

For configuration of this feature, see Karaf Log.

The ` forceJson ` option has been removed from the HTTP proxy APIs.

Update OpenSearch according to the update instructions

Applies only to module developers When using the BPC JsonEditor (xtype bpcJsonField or bpcCodeEditorWindow.json), the optional JSON schema is now passed via schema and no longer via jsonSchema.

Karaf logs are now provided via a monitor (see also Karaf Log).

The additional component 'Decanter' is used to write Karaf logs to the OpenSearch index bpc-logs. In a new Karaf installation, this component is already preinstalled, and no action is required. If an existing Karaf installation cannot or should not be replaced, this component can also be installed later via the Karaf console (internet connection required).

For configuration instructions, see Karaf Log.

New status endpoint for querying the role of individual nodes in cluster mode. This endpoint can now be used to check whether a node has the "Leader" role or not. See also BPC API /cxf/bpc-core/status/clustermaster

For existing installations, the file bpc-be-dashboard.jar can be omitted without replacement and deleted from the KARAF/deploy directory. The Dashboard module now consists solely of the file bpc-fe-dashboard.war.

Update OpenSearch according to the update instructions

The JAR license files (filename bpc-be-license.jar) can no longer be used and must be replaced with XML-based license files (filename license.xml.bpc). If you are still using an old JAR license file, please contact Support to obtain a new license file.

The ` forceJson ` parameter has been removed from the HTTP Proxy APIs.