Skip to content

Releases: openremote/core

Release list

1.32.0

1.32.0 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Oct 13:04
1.32.0
13092fd
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

⚠️ Important notes / Before you upgrade ⚠️

  • Realm deletion is only allowed when there are no assets in the realm, this means all assets of the realm must be deleted first.
    Because of a behavior change made in #2916, we now require all assets to be removed before deleting a realm.
    This change resolves performance issues for larger installations, where all data is now wiped during a background task.

What's Changed

⭐ Enhancements

  • Reduce Maven publication size by @wborn in #3351
  • Implement datetime field in vaadin input by @Ekhorn in #3129
  • Update version of container images used by Helm charts for k8s deployment by @ebariaux in #3338
  • Asset soft delete and background purge task by @richturner in #2916

🐞 Bug fixes

📝 Documentation

Other changes

New Contributors

Full Changelog: 1.31.1...1.32.0

Contributors

ebariaux, richturner, and 6 other contributors
Assets 2
Loading

1.31.1

1.31.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Sep 14:50
1.31.1
0764c5d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

Other changes

  • Fix IO client reconnect and broken integration tests by @Ekhorn in #3346

Full Changelog: 1.31.0...1.31.1

Contributors

Ekhorn
Loading

1.31.0

1.31.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Sep 15:07
1.31.0
9c635f7

⚠️ Important notes / Before you upgrade ⚠️

  • Users without full READ and/or WRITE access (composite roles) lose access to all tunneling features
    We've added new read:tunnels and write:tunnels roles, therefore users with fine-grained access control lose access.
    You can manually assign the roles on the users page in the Manager UI, or through Keycloak itself.

What's Changed

🔒 Security updates

  • CVE pending on Cross-realm MQTT session disconnect without authorization
  • CVE pending on Gateway tunnel endpoints carry no @RolesAllowed: any authenticated user opens a bidirectional TCP circuit into an edge gateway's network
  • CVE pending Registered edge gateway can write and delete arbitrary assets in any realm (reversible-ID authorization bypass)
  • CVE pending Cross-realm gateway websocket events are not checked against the GatewayConnector realm
  • CVE pending Cross-realm gateway tunnel-info disclosure (getGatewayActiveTunnelInfos missing realm scoping)

⭐ Enhancements

🐞 Bug fixes

Other changes

  • Bump github/codeql-action/upload-sarif from 4.38.0 to 4.38.1 by @dependabot[bot] in #3334
  • Fix: CI/CD extensions is triggered before version is updated by @denniskuijs in #3339
  • Increase default test timeout for component tests by @Ekhorn in #3340
  • Update CloudFormation templates to send query-exporter metrics to CloudWatch by @denniskuijs in #3315

Full Changelog: 1.30.1...1.31.0

Contributors

ebariaux, dependabot, and 2 other contributors
Loading

1.30.1

1.30.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Sep 08:32
1.30.1
3edacfe
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

⭐ Enhancements

🐞 Bug fixes

Other changes

  • CI/CD: Bug fix for demo docker compose deployment by @richturner in #3260
  • Bump fast-uri from 3.1.5 to 3.1.6 by @dependabot[bot] in #3262
  • Bump qs from 6.15.2 to 6.16.0 by @dependabot[bot] in #3261
  • Group Dependabot Docker updates by name by @wborn in #3266
  • Upgrade Yarn to 4.18.0 by @wborn in #3264
  • Bump ubi10/openjdk-21-runtime in /balena by @dependabot[bot] in #3267
  • Upgrade Gradle Wrapper to 9.7.1 by @wborn in #3269
  • Output UI build/test artifacts to build directory and fix .prettierignore by @Ekhorn in #3145
  • Bump fast-uri from 3.1.3 to 3.1.6 by @dependabot[bot] in #3273
  • Bump ip-address from 10.2.0 to 10.5.0 by @dependabot[bot] in #3274
  • Bump aws-actions/configure-aws-credentials from 6.2.3 to 6.2.4 by @dependabot[bot] in #3268
  • Upgrade spotless-gradle-plugin to 8.10.1 by @wborn in #3272
  • Use demo sourceSet for demo extensions by @wborn in #3271
  • Bump docker/setup-qemu-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #3275
  • Use ClientRole enum from model throughout the UI by @Ekhorn in #3282
  • Bump js-yaml from 4.3.0 to 4.3.2 by @dependabot[bot] in #3294
  • Bump baseline-browser-mapping from 2.10.37 to 2.11.20 by @dependabot[bot] in #3295
  • Add gateway API compatibility tests by @wborn in #3281
  • Remove manager storage volume from postgres container and related references by @ebariaux in #3288
  • Bump actions/setup-java from 6.0.0 to 6.0.1 by @dependabot[bot] in #3299
  • Bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.0 by @dependabot[bot] in #3300
  • Bump actions/setup-java from 6.0.0 to 6.0.1 in /.github/actions/get-version-details by @dependabot[bot] in #3301
  • Fix configuration cache error in manager:run by @Ekhorn in #3304
  • Bump docker/setup-buildx-action from 4.3.0 to 4.4.0 by @dependabot[bot] in #3323
  • Bump aws-actions/configure-aws-credentials from 6.2.4 to 6.3.0 by @dependabot[bot] in #3324
  • Bump docker/build-push-action from 7.3.0 to 7.4.0 by @dependabot[bot] in #3325
  • Bump docker/setup-qemu-action from 4.3.0 to 4.4.0 by @dependabot[bot] in #3326
  • Bump the vaadin group with 23 updates by @dependabot[bot] in #3328
  • Update security policy by @Ekhorn in #3291

Full Changelog: 1.30.0...1.30.1

Contributors

ebariaux, richturner, and 3 other contributors
Loading

1.30.0

1.30.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 02 Sep 14:31
1.30.0
bf6ea01
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

⚠️ Important notes / Before you upgrade ⚠️

  • Keycloak v26.7.0+ is now the minimum required version.
    We've upgraded the OpenRemote codebase to work with the latest version of Keycloak.
    Because of this, every older version of Keycloak is unsupported, and will be prompted an error message during Manager startup.
    As a result some environment variables have also changed for keycloak, generally these changes are needed:
-    KEYCLOAK_ADMIN_PASSWORD: ${OR_ADMIN_PASSWORD:?OR_ADMIN_PASSWORD must be set}
-    KC_HOSTNAME: ${OR_HOSTNAME:-localhost}
-    KC_HOSTNAME_PORT: ${OR_SSL_PORT:--1}
+    KC_BOOTSTRAP_ADMIN_PASSWORD: ${OR_ADMIN_PASSWORD:?OR_ADMIN_PASSWORD must be set}
+    KC_HOSTNAME: https://${OR_HOSTNAME:-localhost}/auth

Also custom themes will need updating as well.

For a detailed overview of breaking changes, for example in their database schemas, see their upgrade guide.

  • Local UI development now requires NodeJS version 20.19 or higher
    If you're using the repository in a local system, be aware that it's now required to use NodeJS version 20.19 or higher. Upgrade here.

What's Changed

⭐ Enhancements

  • Upgrade Keycloak dependencies to work with Keycloak 26.7.0 by @richturner in #3070
  • Convert Java JUnit unit tests to Groovy Spock specs by @ebariaux in #3146
  • Bump brace-expansion to latest version; 5.0.9 and 2.1.4 by @MartinaeyNL in #3231
  • Upgrade RSPack from 1.7.10 to 2.1.10 by @MartinaeyNL in #3219
  • hotfix: Upgrade Camel to 4.22.0 to remove vulnerability with CVE ID CVE-2026-78329 by @pankalog in #3249
  • feat(i18n): update and refine Ukrainian (uk) translation by @Hard7Rock in #3235
  • Migrate Material Design switch to Vaadin toggle by @Ekhorn in #2982
  • UI: Migrate Rules dialogs to Vaadin counterpart by @MartinaeyNL in #3089

🐞 Bug fixes

  • Fix scheduler start date not applying to period events by @Ekhorn in #3229
  • Fix anonymous MQTT authentication with empty passwords by @pankalog in #3244

Other changes

Full Changelog: 1.29.0...1.30.0

Contributors

ebariaux, richturner, and 6 other contributors
Loading

1.29.0

1.29.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Aug 10:03
1.29.0
212d6e7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

⚠️ Important notes / Before you upgrade ⚠️

  • The basic identity provider has been removed as of this release.
    It has not been maintained for a long time, as we are using Keycloak as the main identity provider for OpenRemote.
    There is no upgrade path for installations that were using this. Manually migrating data must be performed.

What's Changed

⭐ Enhancements

🐞 Bug fixes

Other changes

  • Bump docker/login-action from 4.5.2 to 4.6.0 by @dependabot[bot] in #3133
  • Add Spotless Gradle plugin configuration and apply it by @wborn in #1441
  • Ignore Spotless Apply commit with Git Blame by @wborn in #3136
  • Use category with Grype scan SARIF results by @wborn in #3137
  • Resolve UI app test auth server url from manager info by @Ekhorn in #3135
  • Bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.4 by @dependabot[bot] in #3147
  • Bump ip-address from 10.2.0 to 10.3.1 by @dependabot[bot] in #3149
  • Bump fast-uri from 3.1.3 to 3.1.4 by @dependabot[bot] in #3153
  • Bump postcss from 8.5.19 to 8.5.23 by @dependabot[bot] in #3154
  • Bump socket.io-parser from 4.2.6 to 4.2.7 by @dependabot[bot] in #3155
  • Update actions in composite actions as well by @Ekhorn in #3165
  • Bump actions/setup-java from 5.6.0 to 5.7.0 by @dependabot[bot] in #3148
  • Bump actions/setup-java from 5.2.0 to 5.7.0 in /.github/actions/get-version-details by @dependabot[bot] in #3173
  • Bump actions/cache from 6.0.0 to 6.1.0 by @dependabot[bot] in #3171
  • Bump github/codeql-action/upload-sarif from 4.37.4 to 4.37.5 by @dependabot[bot] in #3172
  • Fix detecting changes for spotless by @Ekhorn in #3174
  • Bump grpc from 1.82.2 to 1.83.1 by @dependabot[bot] in #3167
  • Bump bouncyCastle from 1.84 to 1.85 by @dependabot[bot] in #3168
  • Replace LitElement with OrElement by @Ekhorn in #3102
  • Bump github/codeql-action/upload-sarif from 4.37.5 to 4.37.6 by @dependabot[bot] in #3176
  • Bump pl.allegro.tech.build.axion-release from 1.21.2 to 1.21.3 by @dependabot[bot] in #3177
  • Bump org.webjars:swagger-ui from 5.32.8 to 5.32.11 by @dependabot[bot] in #3179

New Contributors

Full Changelog: 1.28.1...1.29.0

Contributors

wborn, dependabot, and 4 other contributors
Loading

1.28.1

1.28.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 30 Jul 07:59
1.28.1
51f4c3c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

Other changes

  • Fix release demo extension dependency resolution by @Ekhorn in #3131

Full Changelog: 1.28.0...1.28.1

Contributors

Ekhorn
Loading

1.28.0

1.28.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Jul 13:50
1.28.0
25d8661
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

🔒 Security updates

  • CVE-2026-73616 on Notification delete crosses realm boundaries
  • CVE-2026-81679 on Cross-realm information disclosure in Notification REST API exposes all tenants' sent notifications

🎉 New features

⭐ Enhancements

  • Generate and publish OpenAPI specification by @wborn in #3116
  • Generate and publish OpenAPI YAML specification by @wborn in #3121
  • Migrate Material UI confirm dialogs (showOkCancelDialog) with Vaadin components by @MartinaeyNL in #2998

🐞 Bug fixes

  • Render JSON Forms for multidimensional supported well known types by @Ekhorn in #3107
  • fix: commit location coordinates input on blur so Save enables by @mvanhorn in #3017
  • Add back change alarm status field by @Ekhorn in #3124
  • Skip already-selected alarms when selecting all by @Ekhorn in #3125

📝 Documentation

  • Clean up component README badges by @wborn in #3119
  • Improve OpenAPI documentation and machine usability by @wborn in #3120

Other changes

New Contributors

Full Changelog: 1.27.1...1.28.0

Contributors

mvanhorn, wborn, and 4 other contributors
Loading

1.27.1

1.27.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Jul 16:05
1.27.1
1b4617c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

⭐ Enhancements

  • Make simulator replay data a singular input by @Ekhorn in #3027

Other changes

Full Changelog: 1.27.0...1.27.1

Contributors

wborn, dependabot, and 2 other contributors
Loading

1.27.0

1.27.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Jul 12:53
1.27.0
12396be
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

⚠️ Important notes / Before you upgrade ⚠️

  • The Energy- related source code, together with the Demo setup, have been moved to separate extension artifacts.
    These artifacts are still included in the openremote/openremote Docker image, therefore no breaking changes are introduced.
    Users can now install and build their own extensions; read more about this on our documentation website.

  • Deprecation warning for custom projects: using openremoteVersion in gradle.properties is now deprecated,
    and a warning is sent when used. Instead, users should set the openremote version in the gradle/libs.versions.toml file.

What's Changed

🔒 Security updates

  • CVE-2026-67310 on Cross-tenant IDOR in setAssetLinks allows cross-realm alarm-asset link persistence via validation bypass

⭐ Enhancements

  • Improve Gradle plugin and dependency version catalog configuration by @wborn in #3058

🐞 Bug fixes

  • Fix services migration in development when the keystore file is missing by @Ekhorn in #3044

Other changes

Full Changelog: 1.26.2...1.27.0

Contributors

wborn, dependabot, and 2 other contributors
Loading