🚀 v5.17

This changelog provides a detailed overview of technical changes, including new features, bug fixes, and maintenance updates. It is intended for developers, DevOps engineers, and technical teams to track system improvements and API modifications.

Each update is categorized into:

• ✨ Added – New features and functionality improvements
• 🛠️ Fixed – Bug fixes and stability enhancements
• 🔧 Chore – Code refactoring, performance optimizations, and internal updates
• ⚠️ Breaking change – Changes that modify existing system behavior or require adjustments in configuration, calculations, templates, or integrations

📦 [5.17.8] - 2026-07-20

🛠️ Fixed

• tas-3355 Admin "view as user" switch no longer logs you out with "access token is invalid" 🛠️
  Note: When an admin toggled to a user view, the regenerated access token kept the previous token identifier, leaving it mismatched against the new refresh token and cached session. The token now only carries the extension fields (while preserving any active vice context), and the vice-switch endpoint clears the old auth cookies before setting the new vice session tokens.

• tas-3103 [Security] Backend sanitization of user text inputs 🛠️
  Note: User creation and update endpoints now sanitize text inputs (first name, last name, display name) using sanitize-html to strip all HTML tags before storage. This prevents XSS injection where attackers could inject images with malicious links or executable scripts into user profile fields.

• tas-3570 [Calculations] vars[...].setValue([...]) on an attachment variable now stores filenames in the canonical colon-delimited format 🛠️
  Note: The calculation engine used to JSON-stringify arrays assigned to attachment variables, so the file-reading getter split the JSON blob on : and returned a doubly-serialized value that matched no DMS entity. setValue() now writes the same colon-joined format as the template/instance paths, and getValue() returns a flat ["file.pdf"]. Forward-fix only — values already corrupted by the old path stay wrong until the task is recalculated (which re-runs setValue).

• tas-3537 SmartEvent - values assigned by a smart event are now visible to calculations in the same task 🛠️
  Note: saveToVariables now persists through the new InstanceVariableService.storeVariableAndRefresh, which re-reads the variable so vars[...].getValue() sees the newly assigned value.

• tas-2840 LogEditModule - fix ignored time-range filter and Elasticsearch offset overflow in log download 🛠️
  Note: The from/to date range parameters were silently ignored when filtering Elastic logs. Both the offset and the page size are now capped at max_result_window (10 000) to prevent Elasticsearch from rejecting requests that exceed the default window.

• tas-3297 lib.generateAsymmeticKeyPair - fix EC key generation silently failing 🛠️
  Note: EC key types now receive namedCurve instead of modulusLength, so elliptic-curve key pairs are generated correctly.

• tas-3286 PostponedTaskCron - fix query for fetching scheduled background events

📦 [5.17.7] - 2026-07-13

🛠️ Fixed

• tas-3487 Overviews - fix loss of variable mapping (TVAR_ALIAS) after sharing a view with multiple db.views on one template 🛠️
  Note: Sharing a view that contained multiple db.views on a single template produced an incorrect TVAR_ALIAS, losing the variable mapping. The alias is now resolved correctly.

• tas-3563 [Calculations] the async/await transpiler now handles every Array iteration method correctly 🛠️
  Note: An async callback (e.g. awaiting a TAS API) inside filter/find/findIndex/findLast/findLastIndex/some/every/reduce/reduceRight/sort used to be left synchronous, so the callback returned a Promise — filters kept everything, sort compared Promise objects, reduce accumulated Promises. These are now rewritten into sequential async loops (like map/flatMap/forEach) so the callback is awaited. Only inline function callbacks are rewritten, so same-named non-array API methods (e.g. tas.find("task")) are untouched. Lodash collection methods are also no longer mangled: _.map/_.flatMap/_.forEach and iteratees (_.sortBy, _.groupBy, _.remove, ...), including chains like _(arr).map(fn).value(), are left intact with a synchronous iteratee and simply awaited.

• tas-3491 [Templates] template-task instructions - stop the main task save from overwriting instructions with empty data 🛠️
  Note: Instructions are edited in their own modal (postInstructions), so the main task form no longer re-sends the stale ttask_instruction/ttask_instruction_<lang> fields that wiped saved instructions.

• tas-3614 template-header - fix "Case visible for role" selection being lost on save 🛠️
  Note: The header form sent the value as header_vis_role_id while POST /header expects hdr_vis_role_id, so the role was never persisted and the field came back empty after a page refresh.

• tas-3578 usage-statistics - fix monthly counts stuck at the first cron run of the day and shown as 0 🛠️
  Note: storeForCurrentMonth located the existing month row via an exact US_PERIOD datetime equality, which cannot round-trip against the sub-millisecond datetime2 precision, so later runs silently updated nothing. The update now targets the row by its primary key id.

• tas-3556 Overviews - template/header (and name/owner) changed in expert mode is no longer reverted by a subsequent save of edit mode 🛠️
  Note: The edit-mode save re-sent stale values from the store, overwriting changes made in expert mode.

• tas-3525 DR number - fix cursor jumping before the first digit when overwriting a selection that spans a formatting space 🛠️
  Note: Overwriting a selection that spanned a formatting space entered digits in reverse order (e.g. 135 became 351). The cursor position after reformatting is now derived from the meaningful characters left of the caret.

• tas-3520 Activity graph - fix Edit and Delete buttons being swapped

• tas-3521 Improve UI/UX for task definition

• tas-3481 Add a link to event in template task definition

[5.17.6] - 2026-06-24

🛠️ Fixed

• tas-3526 AuthorizationAuthController - restore authority fallback on login: when the default authority is used and rejects the credentials, the other enabled credential-based authorities (password/ldap) are retried in authOrder, so a user can still sign in through whichever one accepts them
  Note: Fallback only runs for the default-authority path (no explicit auth_id); an explicitly selected authority is not silently retried elsewhere. AuthorityFactory.getSortedFallbacks(excludeAuthId?) returns the enabled password/ldap authorities ordered by authOrder, excluding the already-tried one.
• tas-3201 [Emails] MailUsageStatisticsCron: fix the finishedTasksStatistics attachment filename, which was sent as finishedTasficsStatisticson (missing .json extension) and could be misinterpreted by mail clients as a binary file; the email body and the attachment now derive the reported month/year from a single previousMonth source so they can no longer drift apart
• tas-3486 [Calculations] Transpilation - change Array.map() and Array.flatMap() transpilation from Promise.all() to a sequential for-loop so calculation scripts run their async callbacks in deterministic order; the callback is now invoked directly, preserving the element, index and array parameters as well as destructuring patterns and function references, and flatMap flattens one level (spread arrays, push scalars)
  Note: Callbacks now run sequentially instead of in parallel, which is intentional but may run slower for scripts that relied on parallelism. Existing transpiled calculations keep the old Promise.all pattern until they are re-transpiled; use the system console commands sys.retranspileCalculationsByProcessId(tprocId), sys.retranspileCalculationsByTaskId(ttaskId) or sys.retranspileGlobalScripts() to re-transpile them.
• tas-3509 FirebaseConnector - fix startup verification: replace the auth listUsers + dry-run messaging send (which always threw on the deliberately invalid token and proved nothing) with a side-effect-free credential.getAccessToken() credential check, wrap init in try/catch, and log the actual error via console.error on init failure
• tas-3510 Fix cronRun failing to find error on heartbeat monitor

[5.17.5] - 2026-06-18

✨ Added

• tas-3432 [Emails] EWS removal safeguard - migration now logs the stored configuration of any remaining legacy EWS email cron (EwsCreateProcessesFromMailCron/EwsCheckUnprocessedMailsCron) during the update, so it can be recovered from the update log before the orphan-cron cleanup deletes the row
  Note: If an EWS mailbox configuration needs to be migrated to the MS Graph cron after the update, retrieve it from the update log line tagged [tas-3432], which contains the full CRON_PARAMETERS of each EWS cron that existed at update time.

🛠️ Fixed

• tas-3479 [Prints] PDF print - fix net::ERR_BLOCKED_BY_RESPONSE when rendering over internal container URLs; backend resources embedded in the print page (logos, asset/file images) are no-cors loads governed by Cross-Origin-Resource-Policy, which helmet's same-site default blocked once the page runs on the internal frontend origin. Default CORP changed to cross-origin
• tas-3479 [Prints] PDF print over internal container URLs - fix the "Unable to connect to server" overlay / Navigating frame was detached failure. When the print page runs on the internal frontend origin it calls the internal backend cross-origin, which made browser.require.js bootstrap the legacy xdomain CORS-proxy; its /proxy/ iframe is blocked by the backend CSP frame-ancestors 'self', so xdomain timed out and replaced the app. Skip xdomain on the internal print origin and rely on direct CORS (headless Chrome supports it and the internal origin is already in the backend CORS allowlist). Normal users on the external frontend URL are unaffected
• tas-3479 [Prints] Internal URLs are no longer exposed in window.config for every client - the frontend server now injects frontendInternalUrl/backendInternalUrl only when the page is served on the internal frontend origin (the PDF render), so internal container DNS is not leaked to normal external clients
• tas-3428 [Emails] MailUsageStatisticsCron: monthly report date range now shows the last day of the previous month (e.g. 01. 04. 2026 - 30. 04. 2026) instead of the first day of the current month; display-only fix, gathered data unchanged
• tas-3480 cron-runs - populate cron relation in GET /cron-runs so cron history table displays cron name
• tas-3496 [Calculations] AxiosCalculationAbstraction - add optional ciphers option to applySslConfig so HTTPS calls to peers whose certificate chain uses a weak signing digest (OpenSSL ca md too weak) can succeed
  Note: Forward the ciphers string to the underlying https.Agent. Pass ciphers: 'DEFAULT@SECLEVEL=0' to lower the OpenSSL security level for a connection whose CA/server cert is signed with MD5/SHA-1. This is independent of rejectUnauthorized, which does not affect the weak-digest check. Re-issuing the certificate with SHA-256 remains the recommended long-term fix.
• tas-3107 [DMS] AssetService - ensure the configured asset root folder exists before any read/write operation, so document scenarios (manuals, logos, visual-identity, images, documents, ai-content, csv) no longer fail when a root folder was never created; getRoot now performs an idempotent recursive mkdir

[5.17.4] - 2026-06-12

✨ Added

• tas-3412 Ollama smart event plugin - add OllamaSmartEvent plugin for running AI prompts against locally hosted Ollama models (supports custom host configuration)
• tas-3388 SmartEvent default-platform-ai - add Default Platform AI smart event that uses the configured system AI without requiring additional setup, allowing prompts and optional context to be sent directly to the platform AI
• tas-3396 OpenAISmartEvent - extend configuration with optional custom OpenAI API endpoint URL (e.g., for Azure OpenAI or proxies)
• tas-3204 System notification redesign

🛠️ Fixed

• tas-3479 [Prints] PDF print - route BE↔FE traffic over internal container URLs;
• tas-3401 Licenses - reload the whole app after adding or removing a license so newly licensed features/modules/limits take effect immediately instead of only refreshing the licenses grid

[5.17.3] - 2026-06-10

✨ Added

• tas-3464 [Calculations] Axios - support for SSL client certificates (mutual TLS) via applySslConfig() method; accepts raw strings/buffers or file system reads with fs.readFileSync() for SOAP services and other SSL-certificate-requiring endpoints
  Note: Axios calculation abstraction supports SSL/TLS client authentication. Pass CA bundle, client certificate, and private key as raw content or Buffer. Optional passphrase and rejectUnauthorized control (defaults to true).

🛠️ Fixed

• tas-3304 Migration - fix secret-store data migration failing when pre-existing secrets exist;

📦 [5.17.2] - 2026-06-02

🛠️ Fixed

• Overview settings — tooltip for the "Name" field was not displayed
• tas-3399 Fix of the setEventFilter function in EvalMathApi 🛠️
  Note: Fixed incorrect behavior of setEventFilter in EvalMathApi so event filtering now evaluates as expected.

📦 [5.17.1] - 2026-05-28

✨ Added

• tas-2991 Licenses — admin grid extended with license ID, note, issuer name, validity dates, active-only filter, and a delete action ✨
  Note: The license admin grid now shows more details per license and lets you filter active licenses and delete entries directly.

• tas-3327 Licenses — key validation before saving ✨
  Note: An invalid key is now rejected with a reason on hostname mismatch or an invalid/expired key. Domain comparison ignores the http/https protocol and ignores the port for localhost. The key input field is now multi-line.

• tas-2926 Template export/import — case overview sections are now included ✨
  Note: Exporting and importing templates now carries the case overview sections along with the template.

• tas-3159 CO Builder — step 5 (Dr. Max friendly builder) ✨

• tas-2930 CO Builder — step 4 ✨

• tas-3097 AI chat — finetuning v1 ✨

• tas-3177 AI chat — generation of short conversation titles and persistence of LLM runs used for title generation ✨
  Note: Conversations now get auto-generated short titles, and the LLM runs that produce them are persisted.

• tas-3231 Dynamic config — full AI provider settings are now exposed; the host field is required only for Ollama ✨

• tas-3243 GenerateThumbnailsCron — added parameters offset, startFromNewest, continueOnItemError, and suppressItemErrorLogs ✨
  Note: The thumbnail generation cron can now be paged with offset, processed newest-first via startFromNewest, and made resilient to per-item failures with continueOnItemError and suppressItemErrorLogs.

• tas-2982 Loading of user information in the Dynamic Conditions Builder ✨

• tas-3284 Plugins — KSeF plugin for API V2 ✨

🛠️ Fixed

• tas-3200 template-task-calculations — debugging of the new calculations v2 design 🛠️

• tas-3276 Moved the Template Logs tab button to the right

• tas-3329 Dynamic Conditions Builder — wrapped the "Operation with numbers", "Dynamic link", and "Dynamic date" expressions in an arrow function 🛠️
  Note: These expressions are now evaluated when the dependent variable changes instead of at script parse time.

• tas-3330 Number variable — alignment setting is now respected in the task form 🛠️

• Hotfix DatabaseConnector — fixed MSSQL NTLM connection handoff 🛠️

• tas-3339 DataGrid — pressing Enter in the delete confirmation modal no longer triggers opening the row in the grid 🛠️

• tas-3277 [DMS] FileEncryptionServiceModule — fixed createLegacyDecipher 🛠️
  Note: Key/IV derivation now follows OpenSSL EVP_BytesToKey, restoring decryption of legacy-encrypted files.

• tas-3240 Process history — added featureFlag.processHistory.createTechnicalCaseHistoryEntry

• tas-3243 GenerateThumbnailsCron — skips missing files, prevents the batch from getting stuck, and fixes a missing em.flush 🛠️

• tas-3243 ImageMagickConnector — memory/disk limit per invocation 🛠️

• [Calculations] Fixed lib.convertDmsFile() returning undefined 🛠️

• tas-3252 Fixed the fullscreen keyboard shortcut (Shift+F)

• tas-3157 Mobile app — getDomainWhitelist now returns the shouldActivatePushNotifications flag 🛠️

• tas-3153 5.17 — Variable assignment — scroll

• tas-3005 AI backend — removed the legacy AI client and the /ai/chat route 🛠️

• tas-3221 Mobile devices — DataGrid touch on a row (fix)

• tas-3225 Overviews — fullscreen and landscape (fix)

• tas-3070 5.15 — Attachments tab in CO — height (tuning)

• tas-3203 AI chat — title generation for conversations without a persisted ID 🛠️

• tas-3284 ZipApi — skips non-existent files during extraction 🛠️

• tas-3244 getCachedUser used for getUserHrMeta with the parameter onlyIfUserIsActive = false

• tas-3102 xml-process-import — import and attachment paths restricted to allowed sources 🛠️
  Note: Import and attachment paths are now limited to allowed sources, preventing reads from arbitrary locations.

• tas-3122 Status controllers — now return HTTP 503 in the CRITICAL state (instead of always 200) 🛠️

• tas-2984 Overview filter — fixed filtering of values containing quotation marks 🛠️

• tas-3128 SmartEventHttpRequester — auth fields are no longer required, and headers are always synchronized before saving 🛠️