1.27.0

⚠️ Important notes / Before you upgrade ⚠️

• The Energy- related source code, together with the Demo setup, have been moved to separate extension artifacts.
  These artifacts are still included in the openremote/openremote Docker image, therefore no breaking changes are introduced.
  Users can now install and build their own extensions; read more about this on our documentation website.

• Deprecation warning for custom projects: using openremoteVersion in gradle.properties is now deprecated,
  and a warning is sent when used. Instead, users should set the openremote version in the gradle/libs.versions.toml file.

What's Changed

🔒 Security updates

• CVE-2026-67310 on Cross-tenant IDOR in setAssetLinks allows cross-realm alarm-asset link persistence via validation bypass

⭐ Enhancements

• Improve Gradle plugin and dependency version catalog configuration by @wborn in #3058

🐞 Bug fixes

• Fix services migration in development when the keystore file is missing by @Ekhorn in #3044

Other changes

• [Extensions] Remove Energy and Demo Setup extensions by @denniskuijs in #3008
• [CI/CD] Add CI/CD workflow for extensions by @denniskuijs in #3007
• Fix staging workflow issue by @denniskuijs in #3036
• Bump websocket-driver from 0.7.4 to 0.7.5 by @dependabot[bot] in #3040
• Bump groovy from 5.0.6 to 5.0.7 by @dependabot[bot] in #3029
• Remove energy assets and duplicate tests from asset.test.ts by @Ekhorn in #3048
• Fix issues with Extensions CI/CD by @denniskuijs in #3046
• Fix Gradle deprecations by @wborn in #3043
• fix: Add missing permissions to extensions CI/CD workflow by @denniskuijs in #3049
• fix: extensions CI/CD uses wrong GH token by @denniskuijs in #3050
• fix: Change extensions workflow parameter names to lowerCase by @denniskuijs in #3052
• Bump the vaadin group across 1 directory with 22 updates by @dependabot[bot] in #3038
• fix: Extensions CI/CD issues by @denniskuijs in #3059
• Update Process CI/CD JSON GitHub Action SHA by @denniskuijs in #3062
• Bump actions/setup-java from 5.5.0 to 5.6.0 by @dependabot[bot] in #3055
• Bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by @dependabot[bot] in #3054
• Read OpenRemote version from Gradle version catalog by @wborn in #3065
• Bump openremote/openremote/.github/actions/process-cicd-json from 3125aa4 to f667c60 by @dependabot[bot] in #3067
• fix: CI/CD Deployment issue with extensions by @denniskuijs in #3069
• fix: Release issue with demo-setup by @denniskuijs in #3076

Full Changelog: 1.26.2...1.27.0