From d77e8fb2683cbbea0d5a483d8852736e515a1f40 Mon Sep 17 00:00:00 2001 From: Quinn Tracy <142489060+quinntracy@users.noreply.github.com> Date: Mon, 17 Aug 2026 09:30:53 +0200 Subject: [PATCH 1/5] Add 9.24.44 Studio Pro Release Notes --- .../en/docs/releasenotes/studio-pro/9/9.24.md | 33 +++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/content/en/docs/releasenotes/studio-pro/9/9.24.md b/content/en/docs/releasenotes/studio-pro/9/9.24.md index fe70d8fda77..fb69c8ff0c7 100644 --- a/content/en/docs/releasenotes/studio-pro/9/9.24.md +++ b/content/en/docs/releasenotes/studio-pro/9/9.24.md @@ -13,6 +13,39 @@ lts: true This is the [LTS](/releasenotes/studio-pro/lts-mts/#lts) version 9 release for apps in production. {{% /alert %}} +## 9.24.44 + +**Release date: August __, 2026** + +{{% button color="info" href="https://marketplace.mendix.com/link/studiopro/9.24.44" text="Go to Marketplace" title="Download version 9.24.44 from the Marketplace" %}} + +### Improvements + +* We improved the security of the module import process by validating the file paths declared in an MPK package before extraction. Packages containing paths that traverse outside the app directory or target protected directories (such as `.git`, `deployment`, or `releases`) are now rejected with an error. +* We fixed a bypass in the extraction-time path filter where non-canonical ZIP entry names (e.g. paths containing `..` segments) could evade the protected-subtree check. Entry names are now canonicalized before filtering. +* We added support for the following database versions: + * MariaDB 12.3 + * MySQL 9.7 +* We updated the .NET Runtime to version 10.0.7. +* We added a confirmation dialog when enabling anonymous user access in App Security, warning that unrestricted anonymous roles may expose data unintentionally. +* We now delete the log files generated by Studio Pro that are older than 7 days. + +### Fixes + +* On SQL Server, when a unique constraint or foreign key constraint is dropped, we now use `IF EXISTS`. This avoids an automatic rollback of the synchronization transaction in case the constraint does not exist. (Ticket 279545) +* We fixed an issue in the call web service activity and in consumed OData services that consume services using OData version 3. The XML parser now rejects DTD declarations and external entities, because a compromised server might exploit those features. +* We fixed an issue in Studio Pro where publishing a microflow in a new a REST service allowed adding that service to read-only modules such as the System module. +* We have upgraded Jetty dependencies to fix CVE-2026-2332. (Tickets 277670, 281968) +* We have upgraded Netty dependencies to fix CVE-2026-42578, CVE-2026-42583, CVE-2026-42587, CVE-2026-42585, CVE-2026-42584, CVE-2026-42581, CVE-2026-42580, CVE-2026-41417, CVE-2026-42577, CVE-2026-42579. (Tickets 278202, 278290, 277691, 278290) +* We fixed an issue where local file storage does not use optimal directory structure. +* We fixed an issue where files with `%` in the filename could not be downloaded which caused incorrect “file could not be found” errors (Ticket 281292). + +### Deprecations + +* We dropped support for the following database versions that are no longer supported by the vendors: + * PostgreSQL 13 + * MariaDB 10.6 + ## 9.24.43 **Release date: May 13, 2026** From cacffbb16011f79f1f9d72613a18297b8f494116 Mon Sep 17 00:00:00 2001 From: Quinn Tracy <142489060+quinntracy@users.noreply.github.com> Date: Mon, 17 Aug 2026 13:44:03 +0200 Subject: [PATCH 2/5] Review --- content/en/docs/releasenotes/studio-pro/9/9.24.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/content/en/docs/releasenotes/studio-pro/9/9.24.md b/content/en/docs/releasenotes/studio-pro/9/9.24.md index fb69c8ff0c7..aff072edefd 100644 --- a/content/en/docs/releasenotes/studio-pro/9/9.24.md +++ b/content/en/docs/releasenotes/studio-pro/9/9.24.md @@ -22,7 +22,7 @@ This is the [LTS](/releasenotes/studio-pro/lts-mts/#lts) version 9 release for a ### Improvements * We improved the security of the module import process by validating the file paths declared in an MPK package before extraction. Packages containing paths that traverse outside the app directory or target protected directories (such as `.git`, `deployment`, or `releases`) are now rejected with an error. -* We fixed a bypass in the extraction-time path filter where non-canonical ZIP entry names (e.g. paths containing `..` segments) could evade the protected-subtree check. Entry names are now canonicalized before filtering. +* We fixed a bypass in the extraction-time path filter where non-canonical ZIP entry names (for example, paths containing `..` segments) could evade the protected-subtree check. Entry names are now canonicalized before filtering. * We added support for the following database versions: * MariaDB 12.3 * MySQL 9.7 @@ -33,12 +33,12 @@ This is the [LTS](/releasenotes/studio-pro/lts-mts/#lts) version 9 release for a ### Fixes * On SQL Server, when a unique constraint or foreign key constraint is dropped, we now use `IF EXISTS`. This avoids an automatic rollback of the synchronization transaction in case the constraint does not exist. (Ticket 279545) -* We fixed an issue in the call web service activity and in consumed OData services that consume services using OData version 3. The XML parser now rejects DTD declarations and external entities, because a compromised server might exploit those features. +* We fixed an issue in the call web service activity and in consumed OData services that consume services using OData version 3. The XML parser now rejects DTD declarations and external entities because a compromised server might exploit those features. * We fixed an issue in Studio Pro where publishing a microflow in a new a REST service allowed adding that service to read-only modules such as the System module. -* We have upgraded Jetty dependencies to fix CVE-2026-2332. (Tickets 277670, 281968) -* We have upgraded Netty dependencies to fix CVE-2026-42578, CVE-2026-42583, CVE-2026-42587, CVE-2026-42585, CVE-2026-42584, CVE-2026-42581, CVE-2026-42580, CVE-2026-41417, CVE-2026-42577, CVE-2026-42579. (Tickets 278202, 278290, 277691, 278290) +* We upgraded Jetty dependencies to fix CVE-2026-2332. (Tickets 277670, 281968) +* We upgraded Netty dependencies to fix CVE-2026-42578, CVE-2026-42583, CVE-2026-42587, CVE-2026-42585, CVE-2026-42584, CVE-2026-42581, CVE-2026-42580, CVE-2026-41417, CVE-2026-42577, CVE-2026-42579. (Tickets 278202, 278290, 277691, 278290) * We fixed an issue where local file storage does not use optimal directory structure. -* We fixed an issue where files with `%` in the filename could not be downloaded which caused incorrect “file could not be found” errors (Ticket 281292). +* We fixed an issue where files with `%` in the filename could not be downloaded, which caused incorrect “file could not be found” errors (Ticket 281292). ### Deprecations From 30d67af43a0ccaecd779cd1fa681851fbfa1050d Mon Sep 17 00:00:00 2001 From: "MENDIXDOMAIN\\Maria.Shaposhnikova" Date: Tue, 18 Aug 2026 16:00:08 +0200 Subject: [PATCH 3/5] Review --- .../en/docs/releasenotes/studio-pro/9/9.24.md | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/content/en/docs/releasenotes/studio-pro/9/9.24.md b/content/en/docs/releasenotes/studio-pro/9/9.24.md index aff072edefd..cb428d20f19 100644 --- a/content/en/docs/releasenotes/studio-pro/9/9.24.md +++ b/content/en/docs/releasenotes/studio-pro/9/9.24.md @@ -20,25 +20,26 @@ This is the [LTS](/releasenotes/studio-pro/lts-mts/#lts) version 9 release for a {{% button color="info" href="https://marketplace.mendix.com/link/studiopro/9.24.44" text="Go to Marketplace" title="Download version 9.24.44 from the Marketplace" %}} ### Improvements - + * We improved the security of the module import process by validating the file paths declared in an MPK package before extraction. Packages containing paths that traverse outside the app directory or target protected directories (such as `.git`, `deployment`, or `releases`) are now rejected with an error. -* We fixed a bypass in the extraction-time path filter where non-canonical ZIP entry names (for example, paths containing `..` segments) could evade the protected-subtree check. Entry names are now canonicalized before filtering. +* We fixed a bypass in the extraction-time path filter where non-canonical ZIP entry names (for example, paths containing `..` segments) evaded the protected-subtree check. Entry names are now canonicalized before filtering. * We added support for the following database versions: - * MariaDB 12.3 - * MySQL 9.7 + * MariaDB 12.3 + * MySQL 9.7 * We updated the .NET Runtime to version 10.0.7. * We added a confirmation dialog when enabling anonymous user access in App Security, warning that unrestricted anonymous roles may expose data unintentionally. -* We now delete the log files generated by Studio Pro that are older than 7 days. +* We now delete the log files generated by Studio Pro that are older than seven days. ### Fixes -* On SQL Server, when a unique constraint or foreign key constraint is dropped, we now use `IF EXISTS`. This avoids an automatic rollback of the synchronization transaction in case the constraint does not exist. (Ticket 279545) -* We fixed an issue in the call web service activity and in consumed OData services that consume services using OData version 3. The XML parser now rejects DTD declarations and external entities because a compromised server might exploit those features. -* We fixed an issue in Studio Pro where publishing a microflow in a new a REST service allowed adding that service to read-only modules such as the System module. * We upgraded Jetty dependencies to fix CVE-2026-2332. (Tickets 277670, 281968) * We upgraded Netty dependencies to fix CVE-2026-42578, CVE-2026-42583, CVE-2026-42587, CVE-2026-42585, CVE-2026-42584, CVE-2026-42581, CVE-2026-42580, CVE-2026-41417, CVE-2026-42577, CVE-2026-42579. (Tickets 278202, 278290, 277691, 278290) +* We fixed an issue where files with `%` in the filename could not be downloaded, which caused incorrect *file could not be found* errors. (Ticket 281292) +* On SQL Server, when a unique constraint or foreign key constraint is dropped, we now use `IF EXISTS`. This avoids an automatic rollback of the synchronization transaction in case the constraint does not exist. (Ticket 279545) +* We fixed an issue in the **Call web service** activity and in consumed OData services that consume services using OData version 3. The XML parser now rejects DTD declarations and external entities because a compromised server might exploit those features. +* We fixed an issue where publishing a microflow in a new a REST service allowed adding that service to read-only modules such as the System module. * We fixed an issue where local file storage does not use optimal directory structure. -* We fixed an issue where files with `%` in the filename could not be downloaded, which caused incorrect “file could not be found” errors (Ticket 281292). + ### Deprecations From b48af6e54d83e8a36c6bbb13d22ca4799a4f17c0 Mon Sep 17 00:00:00 2001 From: "MENDIXDOMAIN\\Maria.Shaposhnikova" Date: Tue, 18 Aug 2026 16:22:14 +0200 Subject: [PATCH 4/5] Align fixes with existing fixes --- content/en/docs/releasenotes/studio-pro/9/9.24.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/releasenotes/studio-pro/9/9.24.md b/content/en/docs/releasenotes/studio-pro/9/9.24.md index cb428d20f19..caea8ccb294 100644 --- a/content/en/docs/releasenotes/studio-pro/9/9.24.md +++ b/content/en/docs/releasenotes/studio-pro/9/9.24.md @@ -34,7 +34,7 @@ This is the [LTS](/releasenotes/studio-pro/lts-mts/#lts) version 9 release for a * We upgraded Jetty dependencies to fix CVE-2026-2332. (Tickets 277670, 281968) * We upgraded Netty dependencies to fix CVE-2026-42578, CVE-2026-42583, CVE-2026-42587, CVE-2026-42585, CVE-2026-42584, CVE-2026-42581, CVE-2026-42580, CVE-2026-41417, CVE-2026-42577, CVE-2026-42579. (Tickets 278202, 278290, 277691, 278290) -* We fixed an issue where files with `%` in the filename could not be downloaded, which caused incorrect *file could not be found* errors. (Ticket 281292) +* We fixed an issue where files with `%` in the filename could not be downloaded, which caused incorrect *File could not be found* errors. (Ticket 281292) * On SQL Server, when a unique constraint or foreign key constraint is dropped, we now use `IF EXISTS`. This avoids an automatic rollback of the synchronization transaction in case the constraint does not exist. (Ticket 279545) * We fixed an issue in the **Call web service** activity and in consumed OData services that consume services using OData version 3. The XML parser now rejects DTD declarations and external entities because a compromised server might exploit those features. * We fixed an issue where publishing a microflow in a new a REST service allowed adding that service to read-only modules such as the System module. From f85a0c7b518213cd9672a40d024690959e9b29b2 Mon Sep 17 00:00:00 2001 From: Quinn Tracy <142489060+quinntracy@users.noreply.github.com> Date: Wed, 19 Aug 2026 12:30:52 +0200 Subject: [PATCH 5/5] Change date --- content/en/docs/releasenotes/studio-pro/9/9.24.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/releasenotes/studio-pro/9/9.24.md b/content/en/docs/releasenotes/studio-pro/9/9.24.md index caea8ccb294..5ea4d9f9bf5 100644 --- a/content/en/docs/releasenotes/studio-pro/9/9.24.md +++ b/content/en/docs/releasenotes/studio-pro/9/9.24.md @@ -15,7 +15,7 @@ This is the [LTS](/releasenotes/studio-pro/lts-mts/#lts) version 9 release for a ## 9.24.44 -**Release date: August __, 2026** +**Release date: August 19, 2026** {{% button color="info" href="https://marketplace.mendix.com/link/studiopro/9.24.44" text="Go to Marketplace" title="Download version 9.24.44 from the Marketplace" %}}