26.07.1-beta1

Release Date: 2026-07-28

Bug Fixes

Show error message when package install fails
Fix Access-Control-Allow-Origin (CORS) is only allowed from *.marini.systems
Fix SSRF via workflow “TriggerHub” action: user-controlled webhook URL with no allowlist / internal-range block
Remove forcing display_errors ON
Fix AOR_Reports controller discloses report conditions/charts by id
Fix missing OAuth2 encryption key validation
Fix OAuth2 password grant bypasses brute-force lockout
Fix OAuth2 password grant leaks username existence (account enumeration)
Fix M_ProjectTemplates custom controller actions perform delete/update/create with no ACL check
Fix PHP object injection via unguarded unserialize
Fix SSRF in McpServerRegistry probe
Fix potential XSS vulnerability in Reports
Fix API file download didn’t check access correctly
Fix potential SQL injection vulnerabilities in Report/Workflow conditions
Fix json join workflow actions fails with empty date field or values with quotes
Fix accounts contacts relationship should be one-to-many
Fix workflow dies in process when using a condition with undefined relation
Fix report condition not working for date comparison using base fields
Fix condition parameter not correctly set for detail/listview reports
Fix missing html dashlet content for detail/listview reports
Fix “on changed” workflow condition not handled correctly when using mass update
Improve error handling if a report is not found for detail/list view reports
Fix report didn’t finished loading when using enums as main group
Remove alert on inline edit when no content was changed
Fix select2 suppresses plain javascript on change handler
Allow self trigger for workflow trigger action
centralize API test fixture module - move _ApiTestModule into static test fixture wiring - repair API tests - normalize relationship filter handling for relationship GETs fixes #844
skip ClaudeAdmin acceptance test when API credit is exhausted
revert INSTANCE_TEMPLATE_BRANCH back to master - mcp-ci-enable was identical to master; MCP CI changes were already there
point install at marvin/mcp-ci-enable instance template branch - Temporary: revert to master once mcp-ci-enable is merged
harden MCP registry CSRF handling and stabilize related acceptance flows - a reusable namespaced CSRF token service and injected global storage adapter - enforce CSRF validation for probe/save actions and propagate tokens through MCP views, templates, renderer, and probe request payloads - add MCP CSRF/probe unit+acceptance coverage and improve acceptance stability around MCP edit view loading, workflow select timing, and email template navigation
centralize outgoing ssl env contract

Features

list Schedulers job and show massupdate success messages
extend acceptance test suite per release protocol
Security Update 2026-07
add unit and unit position configuration for kpi charts
Add changelog view for module
Add next week / next month / next quater / next year to report period conditions
add mcp registry fixes
Add support of select2 for Search Views
add select2 for dropdowns to search in long lists
add V8 API tests for uncovered endpoints - Add 6 new Cest files covering logout, search-defs, listview columns, user-preferences, mass module, and file download endpoints - Add grant type not allowed test to OAuth2Cest - Fix searchdefs metadata for test_TestModule and test_TestModule2 to use array format instead of plain string shorthand
wire DATAENGINE_OAUTH_CLIENT_ID into CI .env.test for MCP tests - Declare DATAENGINE_OAUTH_CLIENT_ID and DATAENGINE_OAUTH_CLIENT_SECRET in pipeline-level variables (empty default, set in GitLab CI/CD settings) - Pass both into core/.env.test heredoc so McpServerRegistryCest client- credentials probe test uses the MySQL-backed client from devInstall.sh
add mcp registry fixes
add mcp registry fixes
add mcp registry admin ui workflows
add mcp registry backend foundation

Maintenance

Update web auth library to 5.3