1.28.0

What's Changed

🔒 Security updates

• CVE-2026-73616 on Notification delete crosses realm boundaries
• CVE-2026-81679 on Cross-realm information disclosure in Notification REST API exposes all tenants' sent notifications

🎉 New features

• Feature: Notification management by @Ekhorn in #2673

⭐ Enhancements

• Generate and publish OpenAPI specification by @wborn in #3116
• Generate and publish OpenAPI YAML specification by @wborn in #3121
• Migrate Material UI confirm dialogs (showOkCancelDialog) with Vaadin components by @MartinaeyNL in #2998

🐞 Bug fixes

• Render JSON Forms for multidimensional supported well known types by @Ekhorn in #3107
• fix: commit location coordinates input on blur so Save enables by @mvanhorn in #3017
• Add back change alarm status field by @Ekhorn in #3124
• Skip already-selected alarms when selecting all by @Ekhorn in #3125

📝 Documentation

• Clean up component README badges by @wborn in #3119
• Improve OpenAPI documentation and machine usability by @wborn in #3120

Other changes

• fix: Update OpenRemote version in CI/CD extensions by @denniskuijs in #3101
• Bump docker/login-action from 4.4.0 to 4.5.0 by @dependabot[bot] in #3100
• Bump camel from 4.20.0 to 4.21.0 by @dependabot[bot] in #3037
• Bump netty from 4.2.15.Final to 4.2.16.Final by @dependabot[bot] in #3097
• Bump docker/login-action from 4.5.0 to 4.5.1 by @dependabot[bot] in #3108
• Bump postcss from 8.5.15 to 8.5.19 by @dependabot[bot] in #3109
• Replace PAT with App tokens by @wborn in #3114
• Update gradle version commit user to CI bot by @denniskuijs in #3115
• List failed tests in test summary by @wborn in #3118
• Stabilize flaky predicted datapoint deletion tests by @Ekhorn in #3064
• Bump docker/login-action from 4.5.1 to 4.5.2 by @dependabot[bot] in #3123
• Temporarily make manager image vulnerability scan non-blocking by @wborn in #3126
• Fix unstable integration tests by @Ekhorn in #3111

New Contributors

• @mvanhorn made their first contribution in #3017

Full Changelog: 1.27.1...1.28.0