QQQ 4.0.0

QQQ 4.0.0 establishes the framework’s semantic-versioning contract on Java 21. This release consolidates the Javalin and PicoCLI packages, removes deprecated APIs, aligns all 16 libraries through the BOM, and includes the accepted correctness and authorization fixes.

The release includes these bounded corrections:

• Process execution authorizes effective inputs; report state and downloads enforce the delivered caller and ownership checks. Failed report generation preserves an existing archive (#454, #455, #456, #457, #458).
• Exports enforce joined-table READ access; scheduled reports use an isolated owner session; saved-asset and share mutations bind authorization to stored ownership and the actual asset (#493, #499, #500, #501, #526).
• Query/Get responses protect private display values and backend details. Updates and joined reads retain active access rules. Insert identity, recursive Delete/Replace membership and declared uniqueness checks preserve the selected integrity contracts (#506, #507, #508, #509, #510, #525).
• CLI operations and widget endpoints enforce configured permissions. No-code, child-record and cron widgets retain caller context and source-table access rules (#547, #551, #557, #561, #563).
• Material preserves disabled input behavior, renders valid empty stacked charts, and keeps permitted parent-widget children usable when other children are hidden (#537, #552, #558).
• Next's delivered preview fixes nested-app navigation and canonical statistics, HTML and chart integration (#540, #549).

Start with the README, migration guide, and full changelog. Standard dashboard: Material 0.41.0. Its final release is published and verified. Next remains a compatible preview; widget parity is tracked in #550.

The published release candidate passed the QRun-owned sample (734 checks), starter HTTP/browser/MySQL acceptance, and parent/template consumer checks. Final core, parent and Material artifacts are verified. The final public sample passes 734 tests with zero failures/errors/skips; the starter passes real MySQL/browser acceptance and fresh delivered-main build checks. The starter and all three canonical templates are on their main branches. The website and wiki are updated and live-verified for 4.0. Comprehensive feature coverage remains incomplete: the 48 source-stage groups, additional published-stage BOM evidence, and all other deferred work retain individual issues under #534. Existing Medium/Low limitations are documented in the changelog; this release does not claim those scenarios pass.

Maven coordinates: com.kingsrook.qqq:qqq-bom-pom:4.0.0 for dependency alignment; com.kingsrook:qbit-build-parent:2.0.0 for the QBit parent. Refer to the migration guide before upgrading an existing application.

Deferred follow-ups include the SFTP exception-shape test assertion (#632), CI GitHub Release credentials and warning reporting (#633), and defining trusted inputs for input-dependent custom report permission checkers (#636). All 154 known deferred items have individual prioritized issues linked from #534; comprehensive sample coverage and Next widget parity are not claimed complete.

Released September 24, 2026. Signed tag v4.0.0 points to 912a5c53820020dd2ea233d10be6fe858b6d6c89, the immutable release commit. All 18 core coordinates and 66 artifact signatures were verified on Maven Central, with all 1,433 published Java sources matching the tag. All 13 coverage baselines passed. The final tag sample passed 734 checks without failures or skips; the publisher passed its framework checks with the 22 existing skips recorded.

The release artifacts are available from Maven Central and the build parent release. GitHub source archives correspond to the signed release tag.

The editable-source quickstart with Next by default is now available. With JDK 21+, Git, curl, unzip and Docker already installed/running, use Bash on macOS, Linux or Windows WSL:

curl -fsSLo quickstart.sh https://raw.githubusercontent.com/QRun-IO/qqq/quickstart-4.0.0/quickstart.sh
bash quickstart.sh

A fresh Ubuntu 26.04 ARM64 VM (4 vCPU, 6 GiB RAM) reached the real seeded Next page in 43.6 seconds, including bootstrap/source/Maven/image downloads, compilation and startup, with empty application caches. This meets the 90-second target on the tested machine; actual times depend on hardware and network. Real create/edit/refresh and the selected-record greeting process pass. The launcher builds only the editable sample against published QQQ 4.0.0. Next 0.1.0 is a separate preview release with tracked parity limitations. Main now includes the six launcher/wrapper/README files at 47e8712; the signed additional quickstart-4.0.0 tag leaves the original Java release tag/artifacts unchanged. The website quickstart, detailed guides, READMEs and wiki are published and live-verified under #641.