OpenIdentityPlatform/OpenDJ 5.2.0 on GitHub

What's Changed

CVE-2026-102648 DSMLv2 gateway: incomplete internal-address check allows SSRF when anyURI dereferencing is enabled, thanks @tonghuaroot, @maximthomas ❤️
GHSA-jr68-5c58-j463 DSMLv2 gateway changes XML data binding of other applications in the same JVM, thanks @leanworld7-netizen, @maximthomas ❤️
GHSA-c5gp-3768-jc59 OAuth2 file token authorization lets an unauthenticated client select files outside the token directory, thanks @manus-pi, @Kr1shna4garwal, @maximthomas ❤️
GHSA-7778-jm7p-68g5 LDAP listener lets unauthenticated clients hold connections until the server stops accepting new ones, thanks @Kr1shna4garwal, @maximthomas ❤️
GHSA-6f6q-q9gw-4jr4 Sort and VLV controls let authenticated users learn password hashes and other attributes hidden by access control, thanks @daveaitel-openai, @maximthomas ❤️
[#747] fix flaky MS SQL MERGE upsert PRIMARY KEY violation with WITH (HOLDLOCK) by @vharseko in #750
[#748] stabilize flaky GrizzlyLDAPConnectionFactoryTestCase.testResourceManagement by @vharseko in #749
[#746] remove stale opendj-server-legacy jar during upgrade by @vharseko in #751
Bump ch.qos.logback to 1.5.38 by @prthakre in #752
Bump org.bouncycastle by @prthakre in #754
[#755] wait for the LDAP listener after in-process server (re)start by @vharseko in #756
Fix java/insecure-randomness CodeQL alerts by using SecureRandom by @vharseko in #758
Fix all cpp/ CodeQL code-scanning alerts in Windows build-tools by @vharseko in #757
Fix java/implicit-cast-in-compound-assignment CodeQL alerts by @vharseko in #759
Fix java/regex-injection CodeQL alert in TargAttrFilters by @vharseko in #760
Fix remaining cpp/ CodeQL code-scanning alerts in Windows build-tools by @vharseko in #762
[#766] Fix flaky GrizzlyLDAPListenerTestCase load-balancer tests by @vharseko in #767
[#770] Fix flaky PostConnectedDisconnectTest by @vharseko in #771
Fix java/zipslip CodeQL alerts by validating archive entry paths by @vharseko in #761
Fix java/local-temp-file-or-directory-information-disclosure CodeQL alerts by using NIO temp file APIs by @vharseko in #763
Fix java/redos CodeQL alert in LDIFChangeRecordReader by @vharseko in #764
Fix java/tainted-arithmetic CodeQL alerts by @vharseko in #765
[#768] Fix winlauncher.exe stop reporting success without stopping the server by @vharseko in #772
[#769] Report stop progress to the SCM and never leave the service STOP_PENDING by @vharseko in #773
CVE-2026-54291 PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms by @dependabot[bot] in #774
Fix java/maven/non-https-url CodeQL alert by dropping the unused Oracle HTTP repository by @vharseko in #775
Fix java/comparison-with-wider-type CodeQL alert in SNMPMonitor.pow by @vharseko in #777
Fix java/rsa-without-oaep CodeQL alert by dropping the RSA PKCS#1 v1.5 fallback by @vharseko in #776
Fix java/overly-large-range CodeQL alerts by correcting the A-z letter ranges by @vharseko in #779
Harden GitHub Actions workflows: least-privilege permissions and SHA-pinned actions by @vharseko in #778
Fix java/sleep-with-lock-held CodeQL alert in ControlPanelInfo.stopPooling() by @vharseko in #780
Fix wrong-equals-signature and inconsistent-equals-and-hashcode CodeQL alerts in AttributeDescription by @vharseko in #783
Remove the never-populated globalArgumentMap from SubCommandArgumentParser by @vharseko in #786
Remove containers whose contents are never read (java/unused-container CodeQL alerts) by @vharseko in #784
Fix java/equals-on-unrelated-types CodeQL alerts by @vharseko in #781
Fix type-mismatch, index-out-of-bounds and boxed-equality CodeQL alerts by @vharseko in #782
Fix concurrency and equals-contract CodeQL alerts by @vharseko in #785
Notify connection event listeners when an internal connection is closed by @vharseko in #787
Fix java/unsynchronized-getter CodeQL alerts in DebugLogPublisher by @vharseko in #788
Fix CodeQL warning-severity alerts: weak salt PRNG, unsafe DCL, thread-unsafe date formats by @vharseko in #789
Fix CodeQL warning-severity alerts: missed wakeups, resource leaks, escaping threads by @vharseko in #790
Add explicit default clauses to switches flagged by java/missing-case-in-switch by @vharseko in #791
Fix CodeQL warning-severity alerts: dead checks, boxed locals and three null dereferences by @vharseko in #793
[#792] Fail fast when the replication server cannot bind its listen port by @vharseko in #795
[#794] Wait for the listen port to be open before returning from connection handler start by @vharseko in #796
[#797] Retry the deletion of the embedded server temporary directory on close() by @vharseko in #798
Fix CodeQL warning-severity alerts: process stream ownership and two leaks by @vharseko in #799
[#800] Allocate the replication test listen ports per invocation by @vharseko in #803
[#801] Drop the rerunFailingTestsCount setting that never applied to TestNG by @vharseko in #804
[#808] fix MS SQL MERGE upsert conversion deadlock with WITH (HOLDLOCK, UPDLOCK) by @vharseko in #810
[#807] Do not drop persistent search notifications through search-phase dedup by @vharseko in #812
[#809] Fix DSML gateway NPE on abandonRequest and on missing Content-Type by @vharseko in #811
[#802] Fail fast when the replication server cannot read its changelog by @vharseko in #805
Fix CodeQL note-severity alerts: array logging and uncaught NumberFormatException by @vharseko in #817
[#815] Wait for the topology to settle before asserting RS side DS counts by @vharseko in #822
[#828] Fix infinite loop picking the errors-encountered LDIF file name by @vharseko in #839
[#821] Unregister the handler when a handshake aborts after registration by @vharseko in #838
Fix CodeQL note-severity alerts: missing @OverRide annotations by @vharseko in #837
Fix CodeQL note-severity alerts: dead parameters of private methods by @vharseko in #834
Fix CodeQL note-severity alerts: deprecated JDK calls and inefficient expressions by @vharseko in #823
Fix CodeQL note-severity alerts: calls to the deprecated Entry compatibility methods by @vharseko in #826
[#816] Unmap only the locked domainMap in FileChangelogDB.removeDomain() by @vharseko in #827
Fix CodeQL note-severity alerts: uncaught NumberFormatException in the tools, the GUI and SNMP by @vharseko in #829
Remove the stale migration deprecations of ObjectClass and AttributeDescription by @vharseko in #832
[#819] Release the log when a changelog DB constructor cannot read its limits by @vharseko in #833
Fix CodeQL note-severity alerts: confusing overloads with subtype parameters by @vharseko in #840
Fix CodeQL note-severity alerts: ignored error status of file and stream calls by @vharseko in #814
Fix CodeQL note-severity alerts: uncaught NumberFormatException in the examples by @vharseko in #831
[#825] Cap the batchRequest count per SOAP body and the request body size in the DSML gateway by @vharseko in #835
Fix CodeQL note-severity alerts: stale @PARAM tags by @vharseko in #842
Fix CodeQL note-severity alerts: nested classes which never use the enclosing instance by @vharseko in #846
Fix CodeQL note-severity alerts: Thread.run() calls and getters leaking internal state by @vharseko in #847
[#824] Answer each batchRequest of a SOAP body with its own batchResponse by @vharseko in #836
Fix CodeQL note-severity alerts: shadowed locals, and the array cases of the debug formatter by @vharseko in #848
Fix CodeQL note-severity alerts: confusable class and method names, and an unused verifier by @vharseko in #849
Fix CodeQL note-severity alerts: the leftovers of the already-fixed rules by @vharseko in #850
[#813] Refuse to create a replica DB once the changelog shutdown has started by @vharseko in #820
[#841] Fix flaky InitOnLineTest: notify the requester when a remotely requested export cannot start by @vharseko in #845
[#818] Drop the empty domain map a replica DB creation leaves behind when it bails out by @vharseko in #830
[#843] Cap the number of operations accepted per batchRequest in the DSML gateway by @vharseko in #844
[#851] Add upgrade task for RFC 5805 transaction extended operation handlers by @vharseko in #852
Disable duplicate JSON access logger in the default configuration by @vharseko in #668
Generate entryUUID from a per-thread SecureRandom by @vharseko in #683
Avoid global write lock on every delete in GroupManager by @vharseko in #682
Skip replication processing when no replication domain is configured by @vharseko in #681
Avoid full attribute walk for types without subordinate types by @vharseko in #679
Use LongAdder for LDAPStatistics counters by @vharseko in #678
Make AciList reads lock-free with true copy-on-write by @vharseko in #674
Reduce per-bind allocations on the bind hot path by @vharseko in #672
Replace per-operation backend read lock with a scalable shared-access gate by @vharseko in #680
Remove per-bind global lock contention in AuthenticatedUsers by @vharseko in #660
Remove global digestLock serialization in digest password storage schemes by @vharseko in #667
Avoid global monitor on every bind in getDefaultPasswordPolicy by @vharseko in #669
Remove per-attribute read lock from CompressedSchema decode path by @vharseko in #670
CVE-2025-59250 false positive: bump mssql-jdbc to 13.4.0.jre11 by @vharseko in #856
Add Trivy vulnerability scanning for Docker images by @vharseko in #854
[#857] Iterate a snapshot of the connection set in AuthenticatedUsers.doPostResponse(modify) by @vharseko in #858
[#861] Fail fast when the CI Test replication step hangs by @vharseko in #862
[#860] Serve JDBC cursor repositioning from the fetched buffer and grow batches adaptively by @vharseko in #863
[#861] Fail fast when a total update request gets no answer by @vharseko in #864
Serve Cassandra cursor repositioning with CQL slice queries instead of a no-op iterator restart by @vharseko in #865
[#868] Release the import/export context before notifying the initialize task by @vharseko in #869
[#870] Stop replaying a rolled back read in the PersistIt backend by @vharseko in #871
[#885] Ask the catalog for the table of a tree by name by @vharseko in #886
Stamp JDBC backend tables with their tree name and refresh optimizer statistics after import by @vharseko in #866
Seek the primary key in the SQL Server upsert and retry a transaction conflict by @vharseko in #867
Report the OpenDJ container healthy only once its bootstrap has succeeded by @vharseko in #898
Wait for the renamed entry before reading the naming conflict monitor by @vharseko in #895
Let one package-info stand per package, and aggregate Javadoc before the merge by @vharseko in #899
[#872] Bound the connect of the JDBC pool and report a connect it cannot make by @vharseko in #876
[#874] Grant the offline tools a read-only JDBC transaction instead of refusing it by @vharseko in #880
[#879] Skip the validation of a pooled JDBC connection returned a moment ago by @vharseko in #883
[#890] Persist a compressed schema token before handing it out, and report the ones with no definition by @vharseko in #894
[#873] Give each backend its own compressed schema trees by @vharseko in #881
[#905] Warn when a replication handshake fails and document CA-signed certificates by @vharseko in #906
[#877] Bound a statement of the JDBC backend by the class of the work it belongs to by @vharseko in #882
Modernize Debian and RPM packaging (systemd, dedicated user, CI tests) by @vharseko in #663
[#878] Bound the JDBC connection pool and expire its connections one by one by @vharseko in #884
[#897] Skip a compressed schema definition stored under a key no encode hands out by @vharseko in #920
Modernize the Windows MSI: WiX v5, x64, upgrade from 5.1.x by @vharseko in #701
[#900] Time the ReplicaOfflineMsg grace period per replica, and spend it where the message can still be forwarded by @vharseko in #919
[#889] Keep a change the replay could not apply out of the ServerState by @vharseko in #892
[#910] Test that a ModifyDN conflict is still solved while server-error-result-code is one of the conflict codes by @vharseko in #938
[#888] Name the trees of a JDBC backend from a catalog in the database by @vharseko in #893
[#909] Cover the change a stopped replay thread hands back to the replication server by @vharseko in #941
[#939] Pin isServerFailure() directly, so the conflict result codes are guarded by @vharseko in #960
[#918] Record a ReplicaOfflineMsg as sent only when it really was published by @vharseko in #946
[#921] Bound the transaction replay of PDBStorage.write() by @maximthomas in #937
[#907] Change the base DNs of a pluggable backend outside the write the storage replays by @maximthomas in #914
[#885] Give a connection of the JDBC pool a read bound of its own, and take it off for a statement that carries none by @maximthomas in #934
[#924] Clear the disabled flag before a domain enables its session by @vharseko in #971
[#903] Grant the first replay of a conflict, and bound the rest by its class by @maximthomas in #904
[#917] Wait for every peer replication server to forward the ReplicaOfflineMsg by @vharseko in #947
[#891] Give the trees of an import connections of their own by @vharseko in #940
[#901] Make the replay retry budget of a replication domain configurable by @vharseko in #944
[#908] Wait for the changes being applied before a domain going down saves its ServerState by @vharseko in #945
[#916] Keep an update that lands during a ServerState save out of the saved flag by @vharseko in #948
Budget the Windows leg's runtime in wait-msi-artifact, not the queue it sits in by @vharseko in #989
[#955] Answer a ModifyDN whose entry is gone before the new superior is looked up by @vharseko in #965
[#885] Bound the wait of a JDBC DDL for a lock another session holds by @maximthomas in #936
[#911] Report the replication connections which used to be dropped in silence by @vharseko in #935
[#943] Refuse a domain configuration before it is written, not after it is live by @vharseko in #959
[#966] Tell the import and restore task listeners the task is over on every path by @vharseko in #969
[#951] Keep the persisted position when a domain drops its in-memory ServerState by @vharseko in #970
[#967] Keep the bookkeeping of a domain whose base entry is missing out of its configuration entry by @vharseko in #972
[#928] Compare the permissive-modify DN with the entry DN the operation reports by @vharseko in #973
[#927] Report a ds-sync-conflict marker AddMsg could not encode by @vharseko in #975
[#949] Report a ReplicaOfflineMsg the broker refused as not sent by @vharseko in #976
[#922] Give a change back when the replay which owns it is unwound by @vharseko in #958
[#963] Read the changelog again for a following replica the domain is ahead of by @vharseko in #964
[#926] Restart the session of a replication domain in one place, under the lock and the generation by @vharseko in #974
[#956] Tell a failed entryUUID search apart from an entry which is not there by @vharseko in #968
[#952] Keep a failed state write from killing the checkpointer and hanging the shutdown by @vharseko in #977
[#1031] Keep the replication test's admin and replication ports out of the ephemeral range by @vharseko in #1033
[#1046] Read the latest release with the workflow token, and fail the step when it comes back empty by @vharseko in #1047
[#913] Declare the crypto manager's SSL properties as requiring a server restart by @vharseko in #979
[#950] Announce a ReplicaOfflineMsg before it is published, not after it may have been forwarded by @vharseko in #978
[#953] Refuse a server-error-result-code which does not report a failure by @vharseko in #980
[#912] Provision the ads-truststore from an existing key store at setup time by @vharseko in #984
[#925] Keep asking for a session restart until it has run by @vharseko in #981
[#983] Interrupt the listen thread after the ReplicaOfflineMsgs are forwarded by @vharseko in #987
[#995] Classify the failure of a task on the message that reports it by @vharseko in #996
[#942] Warn once per interval that a change is being retried, not once per delivery by @vharseko in #982
[#986] Give back the changes a replay thread the pool stopped had parked by @vharseko in #988
[#991] Decide and report an index configuration change outside the write which is replayed by @vharseko in #997
[#993] Register an entry container's configuration listeners only once it has opened by @vharseko in #999
[#1036] Assert that a parked change is handed out, not which thread hands it out by @vharseko in #1037
[#962] Flag an admin action when a bounded storage write gives up on a configuration change by @maximthomas in #994
[#990] Drop what a previous index left behind instead of adopting it when an index is added by @vharseko in #998
[#885] Bound the create of the tree catalog, and say when an engine has no bound to give by @vharseko in #1003
[#961] Walk every link of a failure where the verdict decides something by @vharseko in #1004
[#963] Dump the state of the replication servers when a test fails by @vharseko in #1015
[#1012] Pin the commit of the post-import statistics refresh, and say why it is there by @vharseko in #1016
[#992] Apply the confidentiality of a backend index to the running backend by @vharseko in #1000
[#902] Name the table to the index guard of the JDBC backend the way the database stores it by @vharseko in #1001
[#896] Pin the replay of RootContainer.open, and the give-back of an open which is not replayed by @vharseko in #1002
[#933] Read a catalog table another session created while this one was creating it by @vharseko in #1005
[#932] Hand the bounds of a catalog connect in, so its cases stop setting them for the whole jvm by @vharseko in #1006
[#930] Build the names a JDBC backend gives its own trees once, from the id it was created with by @vharseko in #1007
[#931] Bound and escape the values a clear's report reads out of the database by @vharseko in #1008
[#1011] Wait out the connection limit an account is given of its own by @vharseko in #1018
[#1023] Delete every objectClass value a modification asks for by @vharseko in #1024
[#1025] Stop a restore which cannot lock its backend instead of completing it by @vharseko in #1027
[#1026] Close the import config on every path an import task can end on by @vharseko in #1028
[#1029] Send a directory server only the updates it gives send-window credit for by @vharseko in #1034
[#1040] Leave the session to a total update when a configuration change asks for a restart by @vharseko in #1042
[#1038] Pin the session lock and generation of #974, and the restart a configuration change does run by @vharseko in #1043
[#1039] Report a total update whose session stops before the DoneMsg as a failed import by @vharseko in #1044
[#929] Establish a catalog connection the way the pool establishes its own by @vharseko in #1009
[#915] Bound the wait of a write transaction for a row lock another session holds by @vharseko in #1010
[#1014] Report a ReplicaOfflineMsg as forwarded only to a peer which can decode it by @vharseko in #1019
[#1021] Reset the objectClass attribute of an entry when its object classes change by @vharseko in #1022
[#1017] Recognise a replication server by the address it names, not by the one its session came from by @vharseko in #1020
[#1059] Give no key up on import or rebuild under an index-entry-limit of 0 by @vharseko in #1060
[#1064] Replay a JE transaction ended by a lock conflict instead of giving it up at once by @vharseko in #1065
[#1067] Ask the memory quota whether an explicit db-cache-size fits instead of taking it by @vharseko in #1070
[#1071] Wrap the sources of the large values PDBStorageTest writes, so that four copies of a 63 MB value are not live at once by @vharseko in #1072
Add dependabot config and pin GitHub Actions to a commit SHA by @vharseko in #1073
[#1030] Keep the setup log out of the way of start-ds, and say when it is gone by @vharseko in #1032
[#1041] Claim the import context for the length of a session restart, and refuse the total update which lands across it by @vharseko in #1045
[#1048] Hold the session restart a released change asks for while a total update runs by @vharseko in #1049
Bump the github-actions group with 9 updates by @dependabot[bot] in #1083
Send what a replication session's publisher left queued when it is closed by @vharseko in #1035
[#1051] Replicate a change made under the Relax Rules control like any other by @vharseko in #1053
Keep PKCS5S2 usable on a FIPS-restricted JCE, and name the key wrapping property when the runtime has no RSA-OAEP by @vharseko in #1058
[#1061] Ask for the session restart under an owner as well, and leave it to the state checkpointer by @vharseko in #1062
[#1076] Walk every link of a connect failure where the verdict decides the retry by @vharseko in #1077
[#1078] Stop the MakeLDIF generator when a template import ends before its reader by @vharseko in #1082
[#1063] Give back what the open reserved rather than what the configuration says by then, and ask for a restart when the cache size changes by @vharseko in #1066
[#1050] Document the replication repair control, and test that a repaired modify stays on its replica by @vharseko in #1052
[#1055] Report a ReplicaOfflineMsg forwarded once it is written to the peer, not once it is queued by @vharseko in #1057
[#1088] Let the Docker image start under an arbitrary uid in group 0 by @vharseko in #1091
[#1068] Apply what a running backend takes of a configuration change, and ask for a restart for what it does not by @vharseko in #1069
[#1084] Keep the root password out of the log and off the command line when a Docker container joins replication by @vharseko in #1094
[#1096] Copy a value into Persistit once rather than twice, and write the large values of PDBStorageTest through a small buffer pool by @vharseko in #1097
[#1080] Give back the send-window permit of an update the writer drops, and count only what it sends by @vharseko in #1106
[#1085] Stop the server cleanly on SIGTERM in a container that bootstrapped its instance by @vharseko in #1098
[#1093] Hand the root password to the Docker bootstrap tools in a file by @vharseko in #1099
Refresh the Windows launchers only when their code changes, not their toolchain stamp by @vharseko in #1103
[#1081] Wrap with a 2048-bit key in the key wrapping check, and report a provider refusing with an Error by @vharseko in #1104
[#1075] Test the JDBC guards against a neighbouring MySQL database and Oracle schema by @vharseko in #1108
[#1074] Keep what says the connection is gone through the redaction of a connect failure by @vharseko in #1107
[#1095] Load a file based key store or trust store again when the file changes by @vharseko in #1101
[#1092] Probe the Docker container's health without binding as the root user by @vharseko in #1102
[#1109] Keep a connection handler listening when a change to it is rejected by @vharseko in #1110
[#1111] Refuse an HTTPS configuration without a key the handler can present, and leave a running HTTP handler as it is when one is applied by @vharseko in #1114
[#1087] Copy the secret volume on every start of the Docker image by @vharseko in #1100
[#1112] Listen on the configured listen-address in the HTTP connection handler and the JMX RMI connector by @vharseko in #1113
Update org.openidentityplatform.commons to 3.2.0 by @vharseko in #853
[#1117] Correct the default class of the governing-structure-rule virtual attribute, and check every default class exists by @vharseko in #1122
[#1116] Default the java-class of a new LDAP connection handler to LDAPConnectionHandler2 by @vharseko in #1124
[#1118] Register the shipped Referential Integrity plugin for the pre-operation types check-references needs, and refuse check-references without them by @vharseko in #1123
[#1133] Describe upgrade --force as performing the confirmed tasks, and say it does not accept the license by @vharseko in #1137
[#1119] Serve each LDAP connection handler with a transport of its own, built from its configuration by @vharseko in #1125
[#1120] Apply a change to plugin-type on an enabled plugin without disabling and enabling it again by @vharseko in #1127
[#1131] Escape the option placeholders of the generated reference, so AsciiDoc no longer reads them as missing attributes by @vharseko in #1142
[#1134] Give a VLV row of backendstat show-index-status its Confidential cell, so that its record count lands under Record Count by @vharseko in #1139
[#1136] Remove the unused DocBook xinclude supplements from the server tool messages by @vharseko in #1141
[#1135] Head the last near-limit column of backendstat show-index-status 80%, the threshold it counts from by @vharseko in #1138
[#1129] Point the guides' Javadoc links at the published apidocs, and resolve {opendj-version} in the uninstall and monitoring pages by @vharseko in #1140
[#1128] Replace the DocBook xinclude and olink leftovers of the generated reference with AsciiDoc by @vharseko in #1132
[#1144] Widen the ephemeral port range before the benchmark runs by @vharseko in #1145
[#1143] Do not report a Notice of Disconnection that cannot reach an already-closed client as an unhandled error by @vharseko in #1146
[#1150] Read the benchmark JTL with a CSV parser, so that an error whose message holds a comma reaches the step log by @vharseko in #1151
[#1149] Replay a rolled back PDB transaction until its conflict clears, bounded only by an optional db-txn-retry-time-limit by @vharseko in #1152
[#1147] Fail the doc build when a page leaves an AsciiDoc attribute unresolved by @vharseko in #1148
Bump the github-actions group with 3 updates by @dependabot[bot] in #1170
[#1154] Find the OpenIDM certificate by comparing names, not their string forms by @vharseko in #1162
[#1156] Keep colons inside the -J/--control value, and report an unreadable control value file instead of failing with a NullPointerException by @vharseko in #1163
[#1157] Quote BASE_DN when the Docker bootstrap creates the userRoot backend by @vharseko in #1164
[#1155] Make the rest2ldap bind templates and HTTP Basic credentials work as documented by @vharseko in #1165
[#1158] Split a check-references-filter-criteria value at its first colon, so the filter can contain one by @vharseko in #1167
[#1161] Keep bc-fips from seeding its DRBG from RDSEED in the test JVMs by @vharseko in #1168
[#1160] Report what start-ds printed when the server fails to start, and dump the quicksetup test instance's logs on a failed build by @vharseko in #1169
[#1173] Check the references of every managed attribute type of an add and every modification of a modify, not only the first by @vharseko in #1175
[#1086] Join replication in the background on every start of the Docker image by @vharseko in #1115
[#1159] Keep administrator-typed DNs intact in dsconfig batch lines, tools.properties and the SDK LDAPUrl by @vharseko in #1166
[#1172] Refuse a second check-references-filter-criteria value for an attribute type, and enforce all the filters of a configuration that already has one by @vharseko in #1174
Bump FreeMarker to 2.3.35 and fix the loadObjectClassesToMaps javadoc by @vharseko in #1176
[#1153] Parse the whole DN string, and build or split DN strings through DN instead of string operations by @vharseko in #1171
[#1180] Report the fail-over failure of the Grizzly proxy listener tests instead of timing out by @vharseko in #1181
Describe running, upgrading and removing the Docker image in the Installation Guide by @vharseko in #1179
Update Java version from 26 to 27 in build.yml by @vharseko in #1186
Fix Maven Central release: pin Maven 3.9.16, bump central-publishing to 0.11.0 by @vharseko in #1187
[#1178] Give the background join of the Docker image a server role, keep a failed bootstrap or upgrade unhealthy, and test the upgrade from a released image by @vharseko in #1184
Update commons.version to 3.2.1 by @vharseko in #1177
Apply Ubuntu security updates when building the Docker image by @vharseko in #1191
[#1188] Serialize and replace atomically the writes of the ads-truststore, and report a certificate it cannot take or drop by @vharseko in #1189
Wait for the background join to end before looking for the root password it leaves by @vharseko in #1193
[#1198] Take the own state of a replication server again after each answer of its peers when it gathers the monitoring data by @vharseko in #1205
Bump the github-actions group with 5 updates by @dependabot[bot] in #1212
[#1216] Keep the decoding error of the client filter when no LDAP connection is attached by @vharseko in #1217
[#1213] Try another free port when the offline connect of the proxy tests connects the client to itself by @vharseko in #1214
[#1090] Check replication convergence under load next to the Docker tests, and run the Docker tests of both images after their builds by @vharseko in #1192
[#1195] Publish every change done while a recovery runs, and end the recovery only once they are out by @vharseko in #1204
[#1207] Route total updates to a replica that has the server ID of a replication server, report such a replica, and draw the IDs of new replication servers and domains from one set by @vharseko in #1211
[#1206] Take a late handler of a replication server back to its queue only once its consumer has every change the queue lacks by @vharseko in #1219
[#1215] Check a replication server the topology already has against the configured ones again, from the URL it is known with or the one it now comes with by @vharseko in #1218
[#1056] Add the RSASVE/KDF-SHA256/AESKWP key wrapping transformation for runtimes without RSA-OAEP by @maximthomas in #1194
[#1202] [#1209] [#1222] Give the replication server a bounded time to give credit and to read once the broker is being stopped, and write nothing after a message given up by @vharseko in #1210
Use commons 3.2.2 to pick up BouncyCastle 1.86 by @vharseko in #1190
Refuse the local changes in HistoricalCsnOrderingTest only once the missing change publisher of the recovery before has left by @vharseko in #1226
[#1227] Keep the record a changelog cursor read in advance when the head log file it is positioned in is rotated by @vharseko in #1228

Full Changelog: 5.1.2...5.2.0

Backers

Thank you to all our backers! Become a backer 🙏

OpenIdentityPlatform/OpenDJ 5.2.0 on GitHub

What's Changed

Backers

Sponsors

OpenIdentityPlatform/OpenDJ 5.2.0
on GitHub