Self-Managed Commerce 8.4.x Release Notes

Learn about changes to Self-Managed Commerce for this release. Fixes since the release are summarized in the changelog.

Changelog

The changelog contains the list of fixes and improvements made to Self-Managed Commerce 8.4 since its release date. To learn how to consume the updates, see Consuming Support Fixes.

Commit	Description	Badges	Release Date
7252d204	Build stability fix.		4‑Nov‑2026
a680a0e2	Build stability fix.		4‑Nov‑2026
0c6d0b5d	Build stability fix.		4‑Nov‑2026
6a824d0e	Upgraded Jackson from 2.22.3 to 2.22.4 to address three security vulnerabilities (CVE-2026-104895, CVE-2026-106554, CVE-2026-110879).	Security	26‑Oct‑2026
3732af5b	Fixed an issue where orders with three or more partial captures against the same payment reservation failed with a duplicate key error, leaving orders partially charged and requiring manual intervention.		21‑Oct‑2026
1a007487	Removed msgpack-core dependency to address CVE-2026-90472.	Security	20‑Oct‑2026
0d0debb3	Fixed an issue where the Search Server threw OutOfMemoryError during index rebuilds because queued index notifications were loaded entirely into memory before deletion.		13‑Oct‑2026
2a3cf9fe	Upgraded certified Java version from 8u492 to 8u504.	Security	9‑Oct‑2026
98b81b70	Upgraded httpclient5 from 5.6.3 to 5.6.4 to address CVE-2026-71290.	Security	7‑Oct‑2026
e9297311	Fixed multiple reliability issues in Operational Insights report generation.		5‑Oct‑2026
8c6e1dba	Upgraded Tomcat from 9.0.121 to 9.0.122 to address CVE-2026-86350, CVE-2026-77762, CVE-2026-78383, CVE-2026-75973, CVE-2026-78437, CVE-2026-73581, CVE-2026-77756.	Security	5‑Oct‑2026
1266a803	Upgraded Jackson from 2.22.1 to 2.22.3 to address CVE-2026-83557, CVE-2026-19032, CVE-2026-68497, CVE-2026-89425, CVE-2026-89407, CVE-2026-91776, CVE-2026-91777.	Security	1‑Oct‑2026
007aaceb	Removed a redundant Tomcat version property from the extensions module to simplify Tomcat upgrades.		29‑Sep‑2026
ae409389	Fixed an issue where Cortex permission checks bypassed a required pre-check and passed resource identifiers from unrelated resource types to parameter resolution strategies.		28‑Sep‑2026
4356c044	Build stability improvements.		24‑Sep‑2026
66c9b4dc	Upgraded ant from 1.10.14 to 1.10.18 to address CVE_2026-78254.		23‑Sep‑2026
65348343	Upgraded Zookeeper from 3.9.5 to 3.9.6 to address CVE-2026-79993, CVE-2026-59969, CVE-2026-59739, CVE-2026-84439, CVE-2026-84501.	Security	22‑Sep‑2026
2fc361f0	Fixed issue with a NullPointerException appearing in Operational Insights when the webapp smoketests were run.		22‑Sep‑2026
94df440a	Upgraded the certified MySQL 8.0 RDS version from 8.0.43 to 8.0.46.	Security	22‑Sep‑2026
971fe32a	Upgraded the certified PostgreSQL 16 Amazon Aurora version from 16.10 to 16.14.		21‑Sep‑2026
c771e415	Cleaned up Cortex Studio npm dependencies by dropping unused packages and bringing package-lock.json back in sync with package.json.		21‑Sep‑2026
52747782	Upgraded jsoup from 1.15.3 to 1.23.2 to address CVE-2026-71497.	Security	11‑Sep‑2026
265c874b	Upgraded Postgresql JDBC driver from 42.7.11 to 42.7.13 to address CVE-2026-54291.	Security	10‑Sep‑2026
dbc3034c	Upgraded Netty from 4.1.136.Final to 4.1.137.Final to address CVE-2026-75595 and CVE-2026-75596.	Security	9‑Sep‑2026
44fe04d1	Upgraded httpclient5 from 5.3.1 to 5.6.3 and httpcore5 from 5.2.4 to 5.4.3 to address CVE-2026-64607, CVE-2026-54399, CVE-2026-54428.	Security	9‑Sep‑2026
9de06738	Replaced the unmaintained org.fusesource.jansi:jansi 1.18 library with org.jline:jansi 4.3.1.		9‑Sep‑2026
a99a9c08	Removed the unused http-builder dependency from Cucumber test modules to eliminate a transitive dependency on a vulnerable version of commons-lang (CVE-2025-48924).	Security	8‑Sep‑2026
202ff9b5	Upgraded Tomcat from 9.0.120 to 9.0.121 to address multiple high-severity vulnerabilities.	Security	8‑Sep‑2026
f0778aed	Fixed an issue where transacted JMS consumers open and tear down a real TCP connection to the ActiveMQ broker on every receive cycle, causing significant connection churn at idle and under load.		2‑Sep‑2026
e475b149	Fixed an issue where Camel JMS request-reply (InOut) routes fail with an IllegalArgumentException after connection pooling changes removed a required connection factory property.		31‑Aug‑2026
d96519ad	Removed the unmaintained Natty date-parsing library from the test application to resolve a security vulnerability (CVE-2025-48924) in its transitive dependency on Commons Lang.	Security	24‑Aug‑2026
51d4b845	Upgraded Tomcat from 9.0.118 to 9.0.120 to address CVE-2026-59084, CVE-2026-59083, CVE-2026-55276, CVE-2026-53404, CVE-2026-55955, CVE-2026-55956.	Security	23‑Aug‑2026
e75df022	Build stability improvements.		23‑Aug‑2026
c9fbd34b	Updated the ActiveMQ container entrypoint to ensure signals reach the broker JVM process	Build Tools	22‑Aug‑2026
0163857b	Fixed an issue where Selenium tests intermittently fail with a stale element reference error when calling click, doubleClick, or setChecked on a RAPTable row, resolved by adding retry logic to each method.		22‑Aug‑2026
ed8f3573	Upgraded Netty from 4.1.135.Final to 4.1.136.Final to address CVE-2026-59901.	Security	22‑Aug‑2026
ea15c924	Fixed an intermittent cache eviction error during search indexing caused by several Ehcache cache key classes not implementing Serializable.		22‑Aug‑2026
2263a037	Upgraded Jackson from 2.21.4 to 2.22.1 to address CVE-2026-59889, CVE-2026-54515.	Security	21‑Aug‑2026
8a952b9a	Parallelizes previously serial isolated Cucumber regression tests by scoping test data and configuration to unique stores, catalogs, and scenarios per test run, reducing pipeline duration by approximately 20–30 minutes.		20‑Aug‑2026
541e21b0	Fixed intermittent test failures where the ORDER_CREATED message assertion fails because the message is consumed before the listener is fully initialized.		18‑Aug‑2026
78859645	Fixed intermittent VirtualCatalog.feature failures by improving reliability of menu item widget interactions.		14‑Aug‑2026
139ad08a	Refactored AccountAssociates.feature so its scenarios can run concurrently.		13‑Aug‑2026
0ff5f192	Improves Commerce Manager Selenium test reliability by removing broken stale-element wait methods, consolidating redundant wait call stacks, introducing stale-safe widget wrappers, and cleaning up dialog handling.		12‑Aug‑2026
2f01a4bb	Improved reliability of ProductCacheInvalidation.feature by dynamically creating unique test identifiers.		11‑Aug‑2026
35f63c01	Build stability improvements.		10‑Aug‑2026
74b3e72d	Added new RAPMenuItem test widget to standardize menu access in Selenium tests.		7‑Aug‑2026
7162be2a	JMS message consumers now use dedicated, non-pooled connections instead of shared pooled connections, preventing consumers on low-traffic queues from becoming stranded when a broker connection fails silently.		4‑Aug‑2026
4150c389	Upgraded Jackson from 2.21.2 to 2.21.4 to address CVE-2026-54513, CVE-2026-54512, CVE-2026-54516, CVE-2026-54514, CVE-2026-54517.	Security	28‑Jul‑2026
a156414c	Adds a new downloadChecksumWithAlgorithm field to ops-spec.json for all four tool entries (Java, Maven, Tomcat, ActiveMQ), enabling vendor-published SHA-256/SHA-512 hashes to be used directly instead of manually calculated MD5 values.	Build Tools	23‑Jul‑2026
a0b40733	Operational Insights revenue metrics now only count completed orders, using the order completion date instead of the creation date, preventing historical revenue figures from changing retroactively.		22‑Jul‑2026
640255b5	Upgraded Netty from 4.1.133.Final to 4.1.135.Final to address CVE-2026-45416, CVE-2026-50010, and CVE-2026-44249.	Security	7‑Jul‑2026
a31e27e2	Upgraded certified Java version from 8u482 to 8u492.	26‑Jun‑2026
aabfb205	Upgraded certified PostgreSQL version from 16.10 to 16.14.	Security	23‑Jun‑2026
5f575bc8	Build stability improvements.		11‑Jun‑2026
545da8ef	Upgraded Netty from 4.1.130.Final to 4.1.133.Final to address CVE-2026-42583.	Security	9‑Jun‑2026
9e2a6996	Upgraded Liquibase from 4.8.0 to 4.33.0 to address a bug with the latest PostgreSQL JDBC driver.	Security Data model changes	9‑Jun‑2026
f2e7f614	Upgraded Postgresql JDBC driver from 42.4.4 to 42.7.11 to address CVE-2026-42198.	Security	3‑Jun‑2026
c398160b	Modified build parameters to remove ReservedCodeCacheSize 128m setting and use JDK default instead.	Build Tools	2‑Jun‑2026
86e82c23	Upgraded Tomcat from 9.0.117 to 9.0.118 to address CVE-2026-43512, CVE-2026-41284, CVE-2026-42498, CVE-2026-41293, CVE-2026-43513, CVE-2026-43515, CVE-2026-43514.	Security	2‑Jun‑2026
a3c20f3b	Build stability improvements.		1‑Jun‑2026
5c01dbb7	A Liquibase changeset has been added to automatically run ANALYZE on PostgreSQL databases during each data population run, preventing query performance issues caused by missing table statistics after a major PostgreSQL version upgrade.	Performance	26‑May‑2026
11b153f7	Upgraded certified Oracle version from 19.0.0.0.ru-2025-07.rur-2025-07.r1 to 19.0.0.0.ru-2025-10.rur-2025-10.r1.	Security	17‑May‑2026
df8ee6ff	Upgraded certified Aurora MySQL 8.0 version from 8.0.mysql_aurora.3.08.2 to 8.0.mysql_aurora.3.10.3.	Security	16‑May‑2026
d0a8b45c	Upgraded Jackson from 2.19.1 to 2.21.2 to address WS-2026-0003 (CVSS3 7.5), with SnakeYAML also upgraded from 2.4 to 2.5.	Security	11‑May‑2026
1ceb6e5b	Fixed intermittently failing Catalog Syndication integration tests.		9‑May‑2026
358a1d0b	Updated handling of promotion category exclusions so that if the excluded category is a subcategory of the included category, products belonging to both the included and excluded category satisfy the condition.		8‑May‑2026
35e8915a	Improved Selenium test widgets: Fluent table-cell assertions, text-field clear, sharper retry classification in both retryAttempts, and retryFunction.		2‑May‑2026
d825fb44	Removed deprecated Maven repositories from individual-settings.xml.		29‑Apr‑2026
d36971a2	Upgraded Tomcat from 9.0.116 to 9.0.117 to address CVE-2026-34487, CVE-2026-34486, CVE-2026-34483, and CVE-2026-34500.	Security	28‑Apr‑2026
f65d6719	Removed deprecated ServiceMix dependencies and replaced with wrapped bundles maintained by Elastic Path.		23‑Apr‑2026
afc4331e	Upgraded Zookeeper from 3.9.4 to 3.9.5 to address CVE-2026-24281 and CVE-2026-24308.	Security	21‑Apr‑2026
368f3747	Fixed missing checkbox label issue in Commerce Manager.		20‑Apr‑2026
a139f215	Added missing distributionManagement to boms/pom.xml that was causing Maven deploy operations to fail.		15‑Apr‑2026
a6a67aaa	Upgraded pf4j from 3.10.0 to 3.15.0 to address CVE-2025-70952.	Security	15‑Apr‑2026
97638ede	Added assertColumnContainsExactly method to RAPTable class.		14‑Apr‑2026
3836b83e	Upgraded Tomcat from 9.0.110 to 9.0.116 to address CVE-2026-24734, CVE-2026-24733, and CVE-2025-66614.	Security	10‑Apr‑2026
5edeb292	Added assertDoesNotContainRow method to RAPTable class.		9‑Apr‑2026
1a3e67da	Updated Git configuration to ignore .claude folders.		8‑Apr‑2026
999af266	Improved Selenium test reliability and maintainability with typed widget APIs, replacing brittle CSS selectors with strict assertions, automatic retry on transient errors, and session cleanup.		3‑Apr‑2026
5aa170a2	Upgraded AssertJ from 3.11.1 to 3.27.7 to address CVE-2026-24400.	Security	2‑Apr‑2026
031e8948	Upgraded the EhCache servicemix version to make it consistent with the EhCache version.	Security	1‑Apr‑2026
3020cd43	Fixed test teardown issue in MergeEngineImplITest that can cause SyncToolLauncherMultipleExecutionsITest to fail.		31‑Mar‑2026
eb59125c	Data sync change to ensure that only changed values are updated in the target entities. This also ensures that products and skus are not reindexed when a new sku option value is added.		27‑Mar‑2026
6eadb574	Fixed a race condition in Utils.uniqueCode() used during tests.		24‑Mar‑2026
4bc25dca	Added the ability to override the P2 repository locations.	Build Tools	19‑Mar‑2026
9db1b187	Upgraded okhttp from 3.14.1 to 4.12.0 to address CVE-2021-0341.	Security	12‑Mar‑2026
4662d117	Upgraded rhino from 1.7.7.2 to 1.7.14.1 to address CVE-2025-66453.	Security	11‑Mar‑2026
400f01a3	Upgraded certified Java version from 8u442 to 8u482.	Security	5‑Mar‑2026
9bbf0727	Upgraded certified Java version from 8u442 to 8u482.	Security	4‑Mar‑2026
22b2734f	Fixed multiple bugs with promotion exception logic and reverted behaviour change of the "cart contains category" promotion condition done in a previous patch.		4‑Mar‑2026
90ee629c	Fixed null pointer exception that can occur when retrieving inventory details for a bundle with no constituents.		25‑Feb‑2026
ef70f805	Added Maven Deploy Plugin configuration to new bom/pom.xml to avoid "repository element was not specified" error when deploying artifacts.		25‑Feb‑2026
71eb817b	Removed the runAlways flag off of the FK-BATCH Liquibase changesets to avoid creating repeat DATABASECHANGELOG entries in the database.	Data model changes	11‑Feb‑2026
4d1ca7fa	Added new with-snapshot-api-platform and with-snapshot-ep-xpf-spi profiles for building with development versions of these dependencies.		10‑Feb‑2026
64847ae5	Enforced dependency version properties stay in sync between pom and bom.		10‑Feb‑2026
c5488885	Upgraded msgpack-core from 0.8.13 to 0.9.11 to address CVE-2026-21452.	Security	4‑Feb‑2026
40a4a4da	Improved reliability of WebDriver management in Selenium tests.		3‑Feb‑2026
edb4d89d	Improved reliability of search-related Commerce Manager test steps to avoid race conditions.		3‑Feb‑2026
7e0a8d1d	Cleaned up EmailStepDefinitions by removing inappropriate TestExecutionListeners.		29‑Jan‑2026
e1452183	Fixed intermittent failures in Performance Insights tests caused by resetting the database between each test.	Performance	28‑Jan‑2026
43cb989e	Removed Felix webconsole dependency from ext-cm-webapp.		23‑Jan‑2026
44f9355e	Fixed skipITests and skipCucumberTests properties not skipping some expected modules.		19‑Jan‑2026
abf28a54	Added more detail to assertion output when Cortex Cucumber step definitions fail.		19‑Jan‑2026
17ca8020	Fixed issue causing Order Cleanup jobs to fail when order has associated order holds.	Data model changes	13‑Jan‑2026
eb9474ee	Fixed intermittently failing Pre/Back-Order Cucumber tests.		9‑Jan‑2026
80f5cf3e	Added the ability to set and distinguish between present and not present boolean customer attribute values in Commerce Manager.		7‑Jan‑2026
92a5aee1	Removed zoom graph builder functionality in Cortex Studio.	Security	6‑Jan‑2026
f4b717a6	Updated protobuf-java version from 3.16.3 to 3.25.5 to address CVE-2024-7254.	Security	6‑Jan‑2026
04b6534b	Upgraded certified Oracle version from 19.0.0.0.ru-2025-01.rur-2025-01.r2 to 19.0.0.0.ru-2025-07.rur-2025-07.r1.	Security	5‑Jan‑2026
0ef54a4a	Upgraded certified MySQL RDS version from 8.4.5 to 8.4.6.	Security	17‑Dec‑2025
a91e68c4	Added support for MySQL 8.4 in Build Tools. The default MySQL version that gets built by the build_base_images.yml playbook is now 8.4.	Build Tools	17‑Dec‑2025
24549899	Updated coupon service to ensure that whitespace is trimmed when new coupon codes are created.		9‑Dec‑2025
fbf8987e	Upgraded certified PostgreSQL version from 16.9 to 16.10.	Security	8‑Dec‑2025
1c5f5285	Upgraded certified MySQL 8.0 RDS version from 8.0.41 to 8.0.43.	Security	28‑Nov‑2025
ce1d91be	Fixed AbstractPageObject#clearAndTypeText to improve detection that ensures that the field text was correctly entered.		27‑Nov‑2025
ae07ba3d	Upgraded jQuery UI from 1.11.4 to 1.13.2 to fix autocomplete UI issue in Cortex Studio.	Security	22‑Nov‑2025
085f5199	Fixed incorrect payment API response error message when refund fails.		22‑Nov‑2025
1edde3f2	Fixed an intermittent failure in Create Catalog Selenium tests.		22‑Nov‑2025
bb5322c8	Build stability improvements.		22‑Nov‑2025
b8401ac5	Fixed multiple issues related to null or blank customer profile attribute values.		18‑Nov‑2025
bd5c679b	Fixed issue in which a new master catalog with all languages configured could not be opened in Commerce Manager.		15‑Nov‑2025
8c93e177	Added certification for MySQL RDS 8.4.		14‑Nov‑2025
573b6484	Fixed refund error that can occur if the order payment events include reverse charges.		13‑Nov‑2025
4a3a1902	Fixed NullPointerException that can occur in Import/Export API when import fails.		12‑Nov‑2025
3be459e6	Upgraded Tomcat from 9.0.107 to 9.0.110.	Security	7‑Nov‑2025
77073210	Upgraded Zookeeper from 3.9.3 to 3.9.4 to address CVE-2025-58457.	Security	6‑Nov‑2025
798ae75f	Fixed issue where the applied line item discount amount could exceed the line item subtotal if multiple promotions are stacked.		5‑Nov‑2025
c4dc3f96	Set default maxThreads for all services to 250 to match Operational Insights recommendations.	Build Tools	3‑Nov‑2025
71109f25	Upgraded dependencies within Fluent RelOS Client to address CVE-2025-48924.	Security	31‑Oct‑2025
e8819585	Upgraded fsevents from 1.2.8 to 1.2.11 to address CVE-2023-45311.	Security	31‑Oct‑2025
f251a974	Modified XPFTaxableShoppingItem so cart tax calculation results are reusable at checkout by the ElasticPathTaxCalculator cache.		29‑Oct‑2025
660dd6f8	Added jvmRuntimeArguments for ActiveMQ to ops-spec.json.		29‑Oct‑2025
b9afb142	Added a new index to TCOUPONUSAGE to improve performance for the query to find automatically applied coupons.	Performance Data model changes	17‑Oct‑2025
16e7989c	Fixed product reindexing issues after updating sku option values in a catalog.		14‑Oct‑2025
c1a54612	Resolved the localized message key: incompatible-configuration warnings during service startup.		2‑Oct‑2025
f707c948	Fixed checkout failure that can occur when resubmitting a shopping cart that previously had a payment issue.		1‑Oct‑2025
338cd646	Upgraded netty-handler from 4.1.118.Final to 4.1.125.Final to address CVE-2025-58057.	Security	24‑Sep‑2025
38c85968	Fixed issues running reset-db on a local Oracle database.		24‑Sep‑2025
4e752990	Upgraded certified PostgreSQL version from 16.6 to 16.9.	Security Data model changes	18‑Sep‑2025
a85dd286	Fixed load.sh/unload.sh/replace.sh scripts generated by the Maven Archetype when creating an external plugin so that they work properly with the new cargo-based service startup mechanism.		18‑Sep‑2025
4d1d126e	Fixed data type issues with TRMAGENERATOR and TORDERNUMBERGENERATOR that required the database to workaround through implicit casts.	Data model changes	17‑Sep‑2025
9ace1a82	Fixed issue with Search Server taking up to an hour to process index update notifications by reducing the query cache timeout from 1 hour to 5 seconds.		15‑Sep‑2025
959e09ec	Fixed an issue in the data-pop tool container entrypoint script where files from a secure-configuration repository were being ignored and not applied.		15‑Sep‑2025
25b420eb	Fix for potential "Value not present" error in Cortex if a new sku option value is added and assigned to a new product SKU before the sku option cache expires.		13‑Sep‑2025
074104c7	Changed the behaviour of the "cart contains category" promotion condition so that exclusions only override categories that are explicitly included.		13‑Sep‑2025
cbe60ade	Updated the ext-container-layout project to include the same assembly rules used in the ext-deployment-package project, specifically so builds will fail if artifacts don't exist.		8‑Sep‑2025
e0ef158d	Changed "No product was found for base amount" error to a warning.		29‑Aug‑2025
18025abe	Modified the XPFTaxableShoppingItem so that its GUID matches the shopping cart line item GUID, so that the ElasticPathTaxCalculator cache doesn't miss on subsequent identical tax lookups. WARNING: Make sure to consume patch f707c948 at the same time as this patch to avoid potential checkout failures.		29‑Aug‑2025
f34958e0	Removed all ESAPI dependencies, which were not effectively protecting the Cortex API endpoints and were including vulnerable transitive dependencies.		25‑Aug‑2025
9e49e18c	Added pagination support for wish list line items in Cortex.		14‑Aug‑2025
28d80bac	Added logic to handle situation where a child shopping cart line item is missing a pointer to its parent line item.		13‑Aug‑2025
46193e7e	Upgraded Jackson from 2.16.1 to 2.19.1 and switched to jackson-bom to define dependency versions.	Security	12‑Aug‑2025
2128bbb7	Fixed connection leak in DBConnector classes.		28‑Jul‑2025
7fc59d78	Fixed potential race condition for limited use coupons when incrementing the coupon usage count during checkout, causing some uses to be missed.		24‑Jul‑2025
b2859892	Fixed issue where getSettingValue(final String path) doesn't work when using the cached settings reader.		24‑Jul‑2025
9c2eb397	Fixed the Build Tools script build_source_tree.sh to properly handle the --deploy command-line argument.	Build Tools	22‑Jul‑2025
10a0417b	Fixed multiple incorrect XML bean configurations.		18‑Jul‑2025
9cd24162	Upgraded Tomcat from 9.0.106 to 9.0.107.	Security	18‑Jul‑2025
708bcf27	Fixed all @Named annotations that are paired with @Autowired to the correct @Qualifier annotation.		17‑Jul‑2025
9755c7fd	Updated both the Build Tools build container image and the Build Tools application container base images to Amazon Linux 2023.7.20250623.1.	Build Tools	15‑Jul‑2025
9c703338	Modified bundle availability logic so that bundles appear as available as long as sufficient constituents are available to satisfy the bundle selection rules.		12‑Jul‑2025
facde4bd	Fixed issue where resending a Gift Certificate for a specific order line item was resending all order gift certificates to the specified recipient.		10‑Jul‑2025
632c4ff9	Added a new warning to the logs when a service using SwitchableProxyBinder is using the fallback implementation, which usually indicates that application-level caching is not working.		10‑Jul‑2025
e5ec2885	Fixed infinite recursion bug in CacheableFacetService#findAllFacetsForStore.		9‑Jul‑2025
be80dc2c	Added new ext-container-layout module to single-threaded-modules.lst.		8‑Jul‑2025
a624cfeb	Added a new ext-container-layout module, with updated build tools, to simplify building Commerce container images.	Build Tools	3‑Jul‑2025
a935daaa	Refactored dependencies to define versions in bill-of-materials/pom.xml.		27‑Jun‑2025
d7cf1157	Fixed parsing of queries in LuceneRawQueryComposerImpl that was causing problems for the search server when processing some index notifications.		26‑Jun‑2025
d1ddb5e1	Build Tools: Set timeouts for Maven commands, so that Maven builds triggered by these tools will fail fast if Maven artifact download connections hang.	Build Tools	25‑Jun‑2025
913a9eaa	Build Tools: Updated the ActiveMQ container's entrypoint.sh script to enable new ActiveMQ container configuration options. Users can set new environment variables EP_ACTIVEMQ_X_JVM_ARGS and MAXIMUM_CONNECTIONS.	Build Tools	24‑Jun‑2025
952c0dd5	Fixed an issue where domain events are not always triggered as expected if the domain class has been extended.		23‑Jun‑2025
e79e6cc1	Fixed issue in which the CM_USER_CREATED event is sent before the Commerce Manager user is persisted.		22‑Jun‑2025
21fda436	Fixed the Operational Insights revenue calculations to exclude failed but include cancelled orders.		20‑Jun‑2025
d1a813a3	Fixed issue that causes search indexing to fail if multiple attribute values exist for the same attribute with the same locale.		19‑Jun‑2025
57b1c7f3	Replace the unmaintained tag library taglibs-standard-impl with the newer jakarta.servlet.jsp.jstl.	Security	18‑Jun‑2025
1793c4ce	Upgraded Tomcat from 9.0.102 to 9.0.105.	Security	12‑Jun‑2025
72fd86c6	Fixed multiple issues with limited usage promotions: Promotion wizard not saving the flag, error occurring when checking out, and a potential race condition during checkout.	Data model changes Requires downtime	10‑Jun‑2025
e8001bad	Fixed SQL injection warnings identified by Static Application Security Testing tooling in ep-persistence-openjpa.	Security	6‑Jun‑2025
fdd93070	Fixed suppression for false positive FindBugs issues.	Security	5‑Jun‑2025
9de526da	Added calls to super.configure() within configure methods of route builders extending CRSCEnabledRouteBuilder.		3‑Jun‑2025
c8a495d4	Fixed intermittently failing Report for B2B Buyer using system Data Policy Segments test.		31‑May‑2025
e66cfd67	Build stability improvements.		30‑May‑2025
86d85950	Fixed issue that was sending messages to VirtualTopic.ep.catalog containing an error message when Catalog Syndication was triggered.		29‑May‑2025
5e44cfc3	Made ordering of payment method elements consistent in Cortex.		28‑May‑2025
75882dc0	Fixed issue with Extension Point Framework entities missing all non-localized attribute values when a localized attribute contains a non-localized fallback value.		28‑May‑2025
d48afce2	Added optional JUnit 5 support to the platform.		28‑May‑2025
7576bbd7	Added debug logging for SwitchableProxyBinder.		14‑May‑2025
6e2af4f9	Refactored b2b-buyer-functionality.feature to use client.authRegisteredUserByName instead of JWT authentication.		12‑May‑2025
fcb7bc20	Fixed problem with XPFShoppingCartPricing#getTaxes returning the cart total instead of the cart taxes.		7‑May‑2025
c16c31ee	Upgraded certified MySQL 8.0 Aurora version from 8.0.mysql_aurora.3.04.2 to 8.0.mysql_aurora.3.08.2.	Security	6‑May‑2025
f6e99b6c	Upgraded certified Oracle version from 19.0.0.0.ru-2024-01.rur-2024-01.r1 to 19.0.0.0.ru-2025-01.rur-2025-01.r2.	Security	6‑May‑2025
cb89c65f	Build stability improvements.		6‑May‑2025
b773aa47	Upgraded certified MySQL RDS version from 8.0.35 to 8.0.41.	Security	5‑May‑2025
c615d23c	Fixed vulnerability in DownloadServiceHandler.	Security	5‑May‑2025
3e985599	Fixed intermittently failing ExternalPluginTest integration tests.		2‑May‑2025
eeda238a	Upgraded certified MySQL 5.7 Aurora version from 5.7.mysql_aurora.2.11.4 to 5.7.mysql_aurora.2.12.5.	Security	2‑May‑2025
628b852d	Fixed a performance issue in LocalizedAttributeKeyUtils#getLocaleFromLocalizedKeyName.	Performance	23‑Apr‑2025
3a7c548f	Fixed issue with CouponUsageDaoImpl#findEligibleUsagesByEmailAddressInStore passing wrong value to the named query when email address is empty.		23‑Apr‑2025
3131c879	Upgraded Tomcat version from 9.0.98 to 9.0.102 to address CVE-2025-24813.	Security	17‑Apr‑2025
631b7f33	Upgraded Solr from 8.11.3 to 8.11.4 to address CVE-2024-45216.	Security	17‑Apr‑2025
8cb7e4e2	Improved "View Disabled Data Policy for Customer" Selenium test to not fail on retry.		3‑Apr‑2025
b8ac49f0	Hardcoded "mobee" and "vestri" values removed from scope autocomplete in Cortex Studio.		3‑Apr‑2025
c8fdff3e	Fixed the Operational Insights revenue calculations to exclude failed and cancelled orders.		2‑Apr‑2025
39e7e22c	Fixed search indexing issue in which delete requests are ignored if there are no corresponding add/update requests.		26‑Mar‑2025
4e7e8a27	Fixed an issue with structured error messages from some shopping item validators not showing a link to the affected shopping item.		22‑Mar‑2025
63a6f272	Created filter to ensure that the Cortex OSGi console is only accessible on the port specified by ep.management.port.		21‑Mar‑2025
3296ffa7	Initial release of new build tools for configuring a build environment, building and testing the code project, building the set of application container images, and running the application containers locally.	Build Tools	21‑Mar‑2025
7e4366f2	Added ops-spec.json file to describe external dependency requirements for this version of Self-Managed Commerce.		18‑Mar‑2025
de03b4e4	Upgraded netty-handler from 4.1.113.Final to 4.1.118.Final.	Security	14‑Mar‑2025
de683f71	Performance optimization for the Extension Point Framework to avoid classpath scanning when extensions are retrieved from the framework. Performance		13‑Mar‑2025
e90b3d97	Fixed potential table scan when retrieving the order list in Commerce Manager.		10‑Mar‑2025
1ac75af0	Fixed intermittently failing Selenium test "Verify price facets are updated when a promotion is changed".		6‑Mar‑2025
9684a077	Fixed issue where attributes with keys that match the regex for having a language tag are incorrectly treated as localized attributes when passed to Extension Point Framework entities.		5‑Mar‑2025
a496e60f	Fixed behavior of the first time buyer flag if the shopper's first order fails.		4‑Mar‑2025
a63d4143	Modified Tax Calculator extension point so that extensions don't need to calculate before tax price for inclusive taxes.		4‑Mar‑2025
03233fac	Fixed issue with order hold getting stuck in RESOLVE_PENDING if order lock is present.		3‑Mar‑2025
7c928bbb	Fixed issue with Operational Insights interpreting serviceResponseWaitTime in minutes instead of milliseconds.		28‑Feb‑2025
68cf5c24	Fixed Tax Calculator extension IndexOutOfBoundsException exception for empty tax records collection.		26‑Feb‑2025
c3452989	Fixed issue with Core Request Scoped Caching where some database lookups were not being cached.	Performance	25‑Feb‑2025
78a2d3d6	Eliminated unnecessary shopper and shopping cart lookups during cart order retrieval.	Performance	25‑Feb‑2025
45be9634	Removed unitils-core dependency to address CVE-2016-3093.	Security	24‑Feb‑2025
6130fa45	Ensure that affected products are re-indexed when catalog promotions are added, modified, or become active or inactive to ensure that the indexed price is correct.		22‑Feb‑2025
cc58760f	Fixed "bad value for type int" error that appeared in the logs when running Operational Insights with a PostgreSQL database.		22‑Feb‑2025
92c81d84	Fixed query error that occurs in MySQL when the anonymous customer cleanup job is executed if the customer has wish list items.		18‑Feb‑2025
fd9f2b3a	Removed unnecessary TCUSTOMER index on CREATED_DATE.	Data model changes	14‑Feb‑2025
cf332f12	Fixed race condition that can occur when multiple users execute keyword or navigation searches with different sort keys.		14‑Feb‑2025
a331f739	Removed unnecessary product/category cleanup after Cucumber tests and fixed issue that allowed bundles to be created in Commerce Manager without a valid sku code.		13‑Feb‑2025
5714ccaa	Upgraded xstream from version 1.4.20 to 1.4.21 to address CVE-2024-47072.	Security	13‑Feb‑2025
9b0005d7	Fixed intermittent Selenium issue related to case-sensitive ErrorDialog class.		4‑Feb‑2025
3363c30d	Fixed an issue that was causing unnecessary TORDER and TORDERAUDIT update queries to be created.		31‑Jan‑2025
9b4376f2	Upgraded Tomcat version from 9.0.97 to 9.0.98 to address CVE-2024-56337 and CVE-2024-50379.	Security	28‑Jan‑2025
0056852c	Updated getDisplayNames method to lazy loaded in all Extension Point Framework entities to address a potential performance issue when stores have a large number of locales enabled. Performance		22‑Jan‑2025
74b43cfa	Improved performance of Operational Insights revenue query.	Performance Data model changes	17‑Jan‑2025
d4e246fa	Added missing indexes to PostgreSQL and Oracle that were created implicitly in MySQL.	Performance Data model changes	17‑Jan‑2025
ce46d06f	Renamed xpfXPFConverterUtil fields to xpfConverterUtil for clarity.		15‑Jan‑2025
edfc9022	Removed jetty-runner dependency to address CVE-2024-52046.	Security	15‑Jan‑2025
f159acce	Updated Commerce Manager cookies to always set the HttpOnly flag for improved security.	Security	8‑Jan‑2025
fed3cd8f	Changed the orders list on the customer record in Commerce Manager to sort by created date instead of order number to avoid alphanumeric sorting issues.		8‑Jan‑2025
2720d58f	Enabled state comparison version strategy on order holds to ensure that two users don't resolve the same hold simultaneously.		7‑Jan‑2025
267312c6	Upgraded zookeeper from 3.9.2 to 3.9.3 to address CVE-2024-51504 and CVE-2024-47535.	Security	6‑Jan‑2025
d82295a7	Added system property to ensure that Log4j always uses the BasicContextSelector to avoid OSGi issues in Cortex.		20‑Dec‑2024
f7468066	Changed featuredoffers link on navigations resource from a conditional to a static link to remove unnecessary product query.	Performance	17‑Dec‑2024
0ffe4469	Added subquery support to JpqlQueryBuilder.		13‑Dec‑2024
d9fac170	Changed the way that SkuOptionValue is associated with ProductSkuOptionValue, using a lazy load approach instead of the Eager Field Post Load Strategy, to prevent possible "context has been closed" exceptions.		12‑Dec‑2024
17d83cd7	Fixed Core Request-Scoped Caching to ensure that retrievals with different load tuners or fetch groups are cached separately.		10‑Dec‑2024
786337df	Upgraded Tomcat version from 9.0.85 to 9.0.97.	Security	9‑Dec‑2024
8e1f3e78	Added a new getAttributeValueByKey method to all Extension Point Framework entities with attributes for use with non-localized attribute values.		8‑Dec‑2024
e07ecbf8	Upgraded esapi from 2.5.3.1 to 2.5.4.0.	Security	6‑Dec‑2024
8c49175b	Added comments above api-platform.version and ep-xpf-spi.version properties in bill-of-materials/pom.xml to reduce merge conflicts.		4‑Dec‑2024
b3a18427	Upgraded Quartz from version 2.3.2 to 2.4.0 to address CVE-2023-39017.	Security	4‑Dec‑2024
90c57322	Fixed issue with ProductDaoImpl#findUidBySkuCode that can cause OpenJPA to read all product skus from the database in rare circumstances.		3‑Dec‑2024
5203908a	Fixed intermittent failure in Selenium tests due to problems verifying that a user interface element contains the expected value.		2‑Dec‑2024
03679e5c	Fixed NullPointerException in Cortex when ep.log.level=TRACE is enabled.		29‑Nov‑2024
242a4d61	Fixed intermittent failure in Selenium tests due to problems obtaining focus on a user interface element.		28‑Nov‑2024
bbed1a58	Build stability improvements.		27‑Nov‑2024
fa891913	Upgraded commons-io from version 2.8.0 to 2.14.0 to address CVE-2024-47554.	Security	26‑Nov‑2024
a540a73d	Fixed intermittent failure in Selenium tests due to problems typing into text boxes.		25‑Nov‑2024
cb0a95e8	Fixed Import/Export to ensure that the necessary product search indexes are rebuilt when base amounts are updated.		22‑Nov‑2024
8aee6e2a	Improved order hold resolution error handling to ensure that order holds don't get stuck in a pending state.		20‑Nov‑2024
c7d44cd1	Modified extensions.json requirements so that just the identifier and enabled flag can be specified; all other fields are now optional.		19‑Nov‑2024
63185442	Refactored ProductAssociationQueryBuilder to use JPQLQueryBuilder and optimized generated query for determining product associations.	Performance	15‑Nov‑2024
c8fb64ba	Added new X-Ep-Follow-Location-Status header to indicate the status of the second resource when followLocation is used.		15‑Nov‑2024
9100d036	Changed root link expectations in Cucumber tests to prevent failures if new resources are added.		14‑Nov‑2024
1047f90d	Fixed Cortex structured message response when purchase form is submitted with validation errors.		12‑Nov‑2024
03f424ab	Fixed query error that occurs in MySQL when the anonymous customer cleanup job is executed.		12‑Nov‑2024
1ebce7d4	Fixed cart subtotal applied promotions to ensure it only returns the applied 'best of' promotion.		1‑Nov‑2024
33fa9fee	Fixed error handling for shipping option determination so that the actual underlying error is reported rather than a NullPointerException.		31‑Oct‑2024
cdfbcdcf	Fixed a NullPointerException that can occur when publishing multi-sku products through the Data Sync Webapp.		29‑Oct‑2024
0466942c	Upgraded Wiremock from version 2.27.2 to 2.35.1.	Security	16‑Oct‑2024
7015d488	Fixed Spring circular dependency that was causing NullPointerExceptions during Integration Server startup.		10‑Oct‑2024
64ebb9d6	Fixed preconditions in core-changelog-2020-08-cleanup-expired-failed-orders-job.xml to avoid potential upgrade error.	Data model changes	3‑Oct‑2024
06a7f06d	Removed support for user-name and user-company fields in JWT metadata payload, which was leading to unique constraint errors in PunchOut.		26‑Sep‑2024
293b8828	Fixed issue with Data Sync Webapp where changesets containing base amounts were causing multiple product index notifications to be created and were also holding the base amount objects in memory until the service was restarted.		19‑Sep‑2024
4fa8a5e4	Fixed issue with Cortex attempting to write logs to a folder based on the build machine home folder instead of the runtime machine home folder.		13‑Sep‑2024
fb87b2cb	Refactored the Catalog Syndication builders to use AbstractBatchJob instead of Spring Batch, to address lock wait timeout issues during the build process.		13‑Sep‑2024
3ddfd603	Fixed issues with the shopper conditions user interface in Commerce Manager where conditions were sometimes duplicated or could not be removed.		13‑Sep‑2024
d74cbd0b	Upgraded Tomcat version from 9.0.85 to 9.0.90.	Security	12‑Sep‑2024
251ef7a8	Build stability improvements.		10‑Sep‑2024
64ac220e	Colored logging now disabled by default, only enabled for local development deployments.		2‑Sep‑2024
7615e569	Fixed duplicate entry error that appears when editing tax values in Commerce Manager.		29‑Aug‑2024
04348009	Fixed Cortex keyword search functionality so it correctly reads the COMMERCE/SEARCH/* system configuration settings.		29‑Aug‑2024
28c94697	Fix for NullPointerException that can occur if looking up a non-existent compound GUID with CategoryLookup#findByCompoundCategoryAndCatalogCodes.		29‑Aug‑2024
4a30569e	Fix for NullPointerException that can occur if RuleService#findByRuleGuid is called with a non-existent guid.		28‑Aug‑2024
5111709c	Removed unused setting definitions: COMMERCE/SEARCH/minimumResultsThreshold, COMMERCE/SEARCH/maximumResultsThreshold, COMMERCE/SEARCH/maximumSuggestionsPerWord, and COMMERCE/SEARCH/accuracy.	Data model changes	27‑Aug‑2024
616e50e8	Consolidated all Awaitility dependencies from version 2.0.0 to 3.1.6.	Security	26‑Aug‑2024
f1ee2a4e	Updated the Log4j configuration for all services to ensure that log file sizes are limited by using a fixed window rolling policy.		25‑Aug‑2024
bfa813fc	Fixed issue where the parentCategoryCodes field was not populated in the SOLR index for linked categories.		21‑Aug‑2024
7880eb86	Fixed issue with logging of some Catalog Syndication failures.		19‑Aug‑2024
25e78f29	Fixed Catalog Syndication cucumber test stability issue.		17‑Aug‑2024
70ea53cc	Fixed issue with SKU selection dialog not allowing users to search after clicking the clear button.		15‑Aug‑2024
11d02401	Build stability improvements.		14‑Aug‑2024
f6a9ceb6	Fixed intermittent failure in Order search for failed order Selenium test.		6‑Aug‑2024
8e3d5f62	Removed checksum validation from core-changelog-2024-07-expired-data-point-values-job changeset due to required changes in earlier versions.	Data model changes	2‑Aug‑2024
79896b90	Improved warning Setting retrieval strategy {} threw an exception to ensure that full stack trace is logged.		30‑Jul‑2024
63afea16	Fixed issue where parent-widget-id and widget-type attributes on a table row were not properly set after a table is updated. This could lead to Selenium test issues.		26‑Jul‑2024
4f1316cb	Fixed all query strings defined on beans for Catalog Syndication JpaPagingItemReader instances to ensure they have an ORDER BY clause.		24‑Jul‑2024
bbc5c1dd	Fixed issue where importing entities doesn't properly invalidate the application cache in some circumstances.		24‑Jul‑2024
fe064863	Fixed out of memory error that can occur on the Batch Server if database contains a large number of TCUSTOMERCONSENT records.		23‑Jul‑2024
40fb053d	Improved Oracle reset-db script to ensure that the tablespace is created automatically.		18‑Jul‑2024
9f2ec0b8	Enhanced Operational Insights to ensure that Integration Server waits for all service reports to be received before the report is generated.		18‑Jul‑2024
914ae96f	Removed line from com.elasticpath.cmclient.core/plugin.xml that caused the XML to be invalid.		20‑Jun‑2024
7b1afe8a	Updated all Camel routes to extend CRSCEnabledRouteBuilder so they properly evict the Core Request-Scoped Cache and avoid dirty reads.		19‑Jun‑2024
56a36935	Added exclusion on Spring Framework dependencies within ext-commerce-engine-wrapper to ensure that Spring dependencies aren't accidentally embedded in the bundle.		17‑Jun‑2024
ddfd31bc	Fixed issue where CouponUsageLimitValidator doesn't properly handle some coupon-related issues.		14‑Jun‑2024
f0264ca4	Fixed issue with Commerce Manager initialization that can occur if several initial requests are received concurrently.		14‑Jun‑2024
e0dca1bb	Added database index on name and state_code fields of the TCHANGESET table to address performance issue in the Automated Imports Accelerator.	Performance	12‑Jun‑2024
ff44d644	Fix for potential race condition around CategoryLookup and CategoryService load tuners which can cause errors about unloaded fields.		10‑Jun‑2024
9e91e504	Fix to avoid retrying the post capture checkout steps if there is an exception thrown.		7‑Jun‑2024
254fe970	Fixed issue for scenario when multiple customer records have the same username for different stores, the wrong customer record could be selected during authentication.		6‑Jun‑2024
e766ca3c	Fixed issue where the Cortex health checks may read the internal health check URL using the wrong Tomcat connector, which can cause the health checks to show Cortex as healthy before startup completes.		4‑Jun‑2024
1c07dbc7	Fix for intermittent Selenium test failure "Error forwarding the new session Empty pool of VM for setup".		4‑Jun‑2024
86841ba8	Fixed intermittent Selenium test failures related to long generated catalog entity names.		4‑Jun‑2024
c3d70511	Fixed intermittent Selenium test failures related to the "Promotion Search With Quotes" test.		31‑May‑2024
e82d2b3b	Removed the logic that allowed cached tax calculation for a shopping cart to be reused when checking out, which was unnecessarily complex and was causing a possible issue where tax calculation failures could occur.		30‑May‑2024
bca17711	Improved H2DataSourceInitializerImpl to prevent H2 database snapshots from being corrupted when multiple tests are run concurrently.		28‑May‑2024
e6ee5a8b	Removed check from Commerce Manager and Batch Server health checks that verifies that search server is reachable. This was causing health checks to fail incorrectly in some circumstances.		28‑May‑2024
74f34df0	Upgraded solr-core from 8.11.1 to 8.11.3 to address CVE-2023-50298, CVE-2023-50291 and CVE-2023-50292.	Security	27‑May‑2024
59e805a2	Changed "Less shipment discount" on Commerce Manager shipment summary to always appear as black.		24‑May‑2024
de482808	Liquibase fix for "Improved performance of case-insensitive queries involving store code" to convert TSHOPPER.STORECODE to upper case and add foreign key constraint.	Performance Data model changes	22‑May‑2024
a45e42f6	Fixed anonymous customer cleanup job failure that occurs if customer has wish list items.		22‑May‑2024
47e18111	Updated logic to prevent customer store code from changing when they log into a linked store.		22‑May‑2024
f0879624	Build stability improvements.		15‑May‑2024
b0a81373	Updated activemq-kahadb-store from version 5.14.3 to 5.17.6.	Security	15‑May‑2024
0f023ccd	Separated product and product type caching to reduce product cache memory use by 30-60%.		14‑May‑2024
1687977b	Upgraded Jetty from 9.4.44.v20210927 to 9.4.54.v20240208 to address CVE-2024-22201, CVE-2023-44487, CVE-2023-36479, CVE-2023-26049, CVE-2023-26048, and CVE-2022-2048.	Security	14‑May‑2024
a9385d98	Removed duplicate localization property key in email.properties that was causing confusion.		14‑May‑2024
023141ae	Added a check at Search Server startup to delete compiled Drools records if they are invalid due to being compiled with an older version of Drools.		6‑May‑2024
ecb820c1	Fixed NullPointerException that can occur if attempting to save a sku option value using SkuOptionService#add(SkuOptionValue).		5‑May‑2024
ce5b8dcd	Updated PostgreSQL reset-db behaviour to avoid dropping the user and all related objects, and allow multiple schemas to be created on the same database.		2‑May‑2024
a37ea053	Changed ep-test-application dependencies to test scope to ensure that test artifacts don't end up in the compiled WAR files.		29‑Apr‑2024
899cb414	Refactored core-changelog-2021-01-data-fields-as-json-clob.xml to make it run 20-30X faster on PostgreSQL databases.	Performance Data model changes Requires downtime	26‑Apr‑2024
0fd32ab9	Fixed issue with reset-db operation on PostgreSQL if epdb.schemaname is set to a value with uppercase characters.		26‑Apr‑2024
13d73495	Fix to ensure that services connect to the correct PostgreSQL schema when a non-public schema is used.		26‑Apr‑2024
d0de788f	Migrated fusesource mqtt-client 1.3 to activemq-mqtt 5.17.6 to address CVE-2019-0222.	Security	17‑Apr‑2024
45552367	Upgraded hibernate-validator from 6.0.20.Final to 6.2.0.Final to address CVE-2023-1932.	Security	17‑Apr‑2024
d5dafd32	Fixed issue with promotion rules never executing in Cortex if the compiled rules don't exist in the database on the first attempt to load them.		15‑Apr‑2024
aa7da634	Fixed exception handling around attribute value types.		15‑Apr‑2024
c4a9bcef	Build stability improvements.		12‑Apr‑2024
3500fe1f	Modified default cache TTL for checking promotion updates from 60 minutes to 5 minutes so that promotion changes are reflected more quickly in Cortex.		12‑Apr‑2024
deda3ed4	Fixed fuzzy search functionality in Cortex item and offer keyword search.		11‑Apr‑2024
628089bf	Added missing field types to SOLR sku schema to prevent exceptions that can cause a performance bottleneck during indexing.	Performance	10‑Apr‑2024
7de51992	Fixed more issues with Helix exception handling where the stack trace can be lost.		10‑Apr‑2024
dc29f8c2	Fixed OSGi split package issue for org.apache.commons.fileupload packages.		9‑Apr‑2024
5a907f48	Build stability improvements.		8‑Apr‑2024
83ebcbae	Added a 60-second cache around inventory lookups done by Cortex during add-to-cart operations and availability requests. The final inventory lookup at checkout is not cached.	Performance	5‑Apr‑2024
74a70bbc	Improved exception handing around customer creation logic to ensure that root cause is properly logged.		5‑Apr‑2024
662b6187	Fixed Commerce Manager issue where scroll bar doesn't appear as expected after adding new promotion conditions or actions.		5‑Apr‑2024
fb571068	Excluded htrace-core4 from transient dependencies which contains vulnerable shaded copy of jackson-databind 2.4.0.	Security	4‑Apr‑2024
741e119f	Fixed issue with the ActiveMQ console showing an error when accessed on a local developer machine.		25‑Mar‑2024
ddd9d179	Modified PostgreSQL functionality to use epdb.schemaname parameter for schema name instead of using the default public schema name.		25‑Mar‑2024
a651d73f	Additional performance improvement to avoid creating unnecessary shopper records when the x-ep-account-shared-id header is set in Cortex.	Performance	22‑Mar‑2024
cb9dfbd7	Fixed potential race condition that can cause payment provider configuration property values to be returned as empty.		21‑Mar‑2024
f90147cb	Upgraded esapi from 2.5.2.0 to 2.5.3.1 to address WS-2023-0429.	Security	20‑Mar‑2024
d3d1e69e	Performance improvement to avoid creating unnecessary shopper and shopping cart records when the x-ep-account-shared-id header is set in Cortex.	Performance	20‑Mar‑2024
a25a01b2	Fix to allow orders in the CREATED state to be cancelled.		20‑Mar‑2024
1d58b063	Fixed potential race condition that can cause product/sku/category attribute values to be returned as empty.		18‑Mar‑2024
6acc0149	Upgraded Tomcat version from 9.0.50 to 9.0.85 to address multiple vulnerabilities.	Security	18‑Mar‑2024
dee2bbff	Upgraded javax.el from 3.0.0 to 3.0.4 to address CVE-2021-28170.	Security	14‑Mar‑2024
52197b94	Fixed issue where a selling context condition that uses "not matching" or "not containing" incorrectly evaluated to false if the key was not present in the tagset.		13‑Mar‑2024
8bb22c1a	If order hold resolution fails due to a locked order, process will now retry automatically.		13‑Mar‑2024
8761aa2c	Fixed issue with the ext-cm-libs bundle being unable to access ep-settings classes.		12‑Mar‑2024
cbb71b34	Upgraded postgresql from 42.4.3 to 42.4.4 to address CVE-2024-1597.	Security	12‑Mar‑2024
7f3683b3	Upgrade Drools from 7.6 to 7.74.1 to address CVE-2022-1415.	Security	7‑Mar‑2024
ad771627	Migrated jstl 1.1.2 and 1.2 to taglibs-standard-impl 1.2.3 to address CVE-2015-0254.	Security	7‑Mar‑2024
8ab23294	Fix to prevent inventory lookup for all skus in a multi-sku product when checking inventory for a single sku.	Performance	7‑Mar‑2024
ab07794f	Fixed intermittent failure in the AccessTokenDtoTransformerTest.testTransformToOAuth2AccessToken unit test.		6‑Mar‑2024
10337607	Refactored InventoryFlowServiceImpl so that product skus are passed as parameters and unnecessary database lookups can be avoided.	Performance	5‑Mar‑2024
e86b5b0e	Removed nekohtml dependency to address CVE-2022-29546, CVE-2022-28366, and CVE-2022-24839.	Security	1‑Mar‑2024
68b926df	Disabled JMX for Cortex and Integration Server in Cucumber tests to avoid port conflicts.		1‑Mar‑2024
55fafc80	Upgraded Apache Shiro from 1.12.0 to 1.13.0 to address CVE-2023-46749.	Security	27‑Feb‑2024
6172a5ab	Upgraded json-path from 2.6.0 to 2.9.0 to address CVE-2023-51074.	Security	22‑Feb‑2024
230acb87	Upgraded poi from 4.0.1 to 4.1.1 to address CVE-2019-12415.	Security	21‑Feb‑2024
7b154c38	Upgraded antisamy from 1.7.4 to 1.7.5 to address CVE-2024-23635.	Security	21‑Feb‑2024
8fc7eeaa	Upgraded wiremock from 2.23.2 to 2.27.2 to address CVE-2021-23369.	Security	19‑Feb‑2024
9c9bfb68	Upgraded commons-net to version 3.9.0 to address CVE-2021-37533.	Security	19‑Feb‑2024
bb856c54	Upgraded commons-configuration2 from version 2.1.1 to 2.8.0.	Security	19‑Feb‑2024
164a7186	Upgrade htmlunit from 3.0.0 to 3.9.0 to address CVE-2023-49093.	Security	15‑Feb‑2024
7255ae6b	Upgraded htmlunit from 2.70.0 to 3.0.0 to address CVE-2023-26119.	Security	15‑Feb‑2024
65dd08ae	Updated failsafe plugin to use alphabetical ordering instead of default filesystem ordering.		13‑Feb‑2024
8bdbdb97	Upgraded logback from version 1.2.10 to 1.2.13 to address vulnerability CVE-2023-6481.	Security	12‑Feb‑2024
18062f81	Upgraded ant from 1.7.1 to 1.10.14 to address CVE-2020-11979.	Security	12‑Feb‑2024
7583b84d	Upgraded junit from 4.12 to 4.13.1 to address CVE-2020-15250.	Security	12‑Feb‑2024
347cc0a8	Upgraded postgresql from 42.4.1 to 42.4.3 to address CVE-2022-41946.	Security	12‑Feb‑2024
f79220d3	Upgraded postgresql from 42.3.3 to 42.4.1 to address CVE-2022-31197.	Security	9‑Feb‑2024
a8ab13df	Improved JMS-related test reliability.		8‑Feb‑2024
419dd8e5	Removed ops-spec.json so that the CloudOps fallback ops-spec.json will be used.		8‑Feb‑2024
614d6f56	Upgraded xerces from 2.12.0 to 2.12.2 to address CVE-2022-23437.	Security	7‑Feb‑2024
01f5a7f7	Fix for race condition that can occur if a user posts multiple requests to the registration form concurrently. This change ensures that only a single authentication record is created in this circumstance.		7‑Feb‑2024
cd1d892d	Upgraded jsoup from 1.14.2 to 1.15.3 to address CVE-2022-36033.	Security	7‑Feb‑2024
ec8abc80	Upgraded protobuf-java from 3.11.0 to 3.16.3 to address CVE-2022-3509 and CVE-2022-3171.	Security	7‑Feb‑2024
5d0d8219	Upgraded jsoup from 1.8.3 to 1.14.2 to address CVE-2021-37714.	Security	7‑Feb‑2024
0a463159	Fix to avoid JMX "port in use" conflicts in cargo with multi-threaded builds.		7‑Feb‑2024
bfe3c581	Upgraded mysql-connector-java from 8.0.30 to 8.2.0 to address vulnerability CVE-2023-22102.	Security	6‑Feb‑2024
f5a95416	Modified quoted search behavior to match on the complete phrase when searching for products and skus in Commerce Manager.		29‑Jan‑2024
25b85f93	Upgraded antisamy from 1.6.7 to 1.7.4 to address CVE-2023-43643.	Security	29‑Jan‑2024
e71a586e	Upgraded jackson-databind from 2.13.4 to 2.16.1 to address CVE-2022-42003.	Security	26‑Jan‑2024
2d4f447e	Resolved "Unable to find [appName]" error during Cortex startup.		26‑Jan‑2024
b2c24cb9	Remove dependency on ext-commerce-engine-wrapper bundle from ep-jms bundle to prevent possible bidirectional dependency.		17‑Jan‑2024
8dee502b	Optimization to eliminate unnecessary TSHOPPINGITEMRECURRINGPRICE queries when a shopping cart is retrieved.	Performance Data model changes Requires downtime	16‑Jan‑2024
5376d1d9	Optimization to eliminate unnecessary queries to update cart item last modified date when a shopping cart is persisted.	Performance	11‑Jan‑2024
4fd826c4	Fixed issue with ESAPI bundle startup after upgrading ESAPI from 2.4.0.0 to 2.5.2.0.	Security	9‑Jan‑2024
b1d88989	Changed sortattributes link to static instead of conditional to remove unnecessary extra product search when using the offersearch resource.	Performance	12‑Dec‑2023
fbf76cf4	Added null check in SolrQueryFactory to avoid NullPointerException if an expected attribute key does not exist.		11‑Dec‑2023
073624a4	Fixed Cucumber tests that fail if test run order is changed.		11‑Dec‑2023
7c8eafbf	Updated individual-settings.xml to use secure Nexus URLs.		11‑Dec‑2023
b471112a	Upgraded ESAPI from 2.4.0.0 to 2.5.2.0 to address WS-2023-0388.	Security	7‑Dec‑2023
43bfb47c	Upgraded shiro-core from 1.9.1 to 1.12.0 to address CVE-2023-34478.	Security	1‑Dec‑2023
39c9fb26	Fixed product lookup cache population bug that can lead to unnecessary database queries.	Performance	29‑Nov‑2023
c51788ab	Fixed issues with Helix exception handling where the stack trace can be lost and the reference number shown to the user doesn't match the logged reference number.		29‑Nov‑2023
90a974aa	Fixed Cortex permission error that can occur if x-ep-account-shared-id header is set when reading accounts associated to the current user.		29‑Nov‑2023
286382de	Fixed issue that can cause Query Analyzer to fail if default encoding type is not set to UTF-8.		27‑Nov‑2023
b5a31794	Upgraded Jersey version from 2.27 to 2.40 in api-platform to match ep-commerce version.	Security	24‑Nov‑2023
a93b3c4a	Upgraded ESAPI from 2.3.0.0 to 2.4.0.0 to address CVE-2022-28366 and CVE-2022-29546.	Security	23‑Nov‑2023
b3cfcc98	Fix for NullPointerException that can occur if looking up a non-existent category GUID with CategoryLookup#findByGuid.		23‑Nov‑2023
68267091	Upgraded guava from 31.1-jre to 32.0.1-jre to address CVE-2023-2976.	Security	22‑Nov‑2023
bf057b9f	Fix for intermittent failure in "Payment Configuration" tests.		21‑Nov‑2023
eeb9f4ae	Added non-null constraint on customer authentication username field.		20‑Nov‑2023
66f95350	Fixed Cortex server error that occurs when reading applied promotions on a shopping cart where one or more line items has no price.		20‑Nov‑2023
fb9b2999	Performance improvement to eliminate duplicate shopper and customer queries when zooming into wishlistmembership link.	Performance	17‑Nov‑2023
24b25405	Removed reference to spring-security-oauth2 in ext-cortex-webapp pom.xml.		17‑Nov‑2023
df171005	Upgraded pf4j from 3.6.0 to 3.10.0 to address CVE-2023-40828.	Security	15‑Nov‑2023
793e97f4	Fix for error that can appear when doing search operations in Commerce Manager if the COMMERCE/SEARCH/boosts system configuration setting is specified.		10‑Nov‑2023
cd4701d3	Updated catalog syndication projection rebuild process to better utilize Spring Batch and avoid long database record locks.		9‑Nov‑2023
d3059141	Replaced legacy SOLR LRUCache with CaffeineCache.	Performance	8‑Nov‑2023
28d6acda	Upgraded json from 20220924 to 20231013 to address CVE-2023-5072.	Security	8‑Nov‑2023
3c7df5fe	Upgraded velocity from version 1.6.2 to 2.3 to address CVE-2020-13936.	Security	8‑Nov‑2023
a2575a69	Upgraded ActiveMQ from 5.16.4 to 5.16.7 to address CVE-2023-46604.	Security	8‑Nov‑2023
2a4e6ce2	Improved how ClasspathResourceLoader is initialized to prevent a possible memory leak related to Velocity email rendering.		8‑Nov‑2023
58ffdce1	Fixed a failure in the wishlistmembership resource if a wish list contains the same product sku more than once.		8‑Nov‑2023
c3ad5f57	Upgraded shiro-core from version 1.8.0 to 1.9.1 to address CVE-2022-32532.	Security	7‑Nov‑2023
08c3cbe8	Modified the handling of email localized property values so that properties that are explicitly set to empty string result in an empty string being used as the value.		7‑Nov‑2023
9cb7fab9	Upgraded jackson-databind from 2.12.7 to 2.13.4.	Security	7‑Nov‑2023
6fc85581	Modified the behavior of data cleanup jobs to process at most X records per scheduled execution. The value of X is defined by the associated COMMERCE/SYSTEM/{batch job name}/batchsize system configuration setting.		7‑Nov‑2023
72b28cdd	Upgraded commons-fileupload from 1.4 to 1.5 to address CVE-2023-24998.	Security	6‑Nov‑2023
aead58c2	Upgraded json-smart from 2.4.7 to 2.4.10 to address CVE-2023-1370.	Security	6‑Nov‑2023
63261447	Upgraded xstream from 1.4.19 to 1.4.20 to address CVE-2022-41966.	Security	6‑Nov‑2023
97977f00	Fixed issue with PostgreSQL initialization scripts to ensure that they don't attempt to drop and recreate high-privilege user.	Security	16‑Oct‑2023
9965f09d	Fixed PostgreSQL initialization scripts so that they work properly when a low-privilege database user is specified in the data.population.username data population parameter.	Security	16‑Oct‑2023
970f80f1	Fixed issue with selected disabled radio buttons and checkboxes being invisible on the shopping cart promotion wizard.		6‑Oct‑2023
2274b653	Fixed issue where buyer admins can see customers from other stores when associating buyers to an account.		6‑Oct‑2023
e77cde68	Added an expiry to all messages sent to ActiveMQ to ensure that the message broker file system is not filled up with unconsumed messages.		2‑Oct‑2023
2efcf827	Added ability to use quotes to request an exact match on each individual word when searching for products and skus in Commerce Manager.		28‑Sep‑2023
f26b7c52	Added a Liquibase custom change class for adding new setting definitions and setting values.		27‑Sep‑2023
5929a39d	Fixed issue with customer CSV imports still treating shared ID as case-sensitive.		26‑Sep‑2023
b53a7c0f	Fix for localization issue on gift certificate emails.		26‑Sep‑2023
7dc36fc2	Removed unnecessary smallint type alteration in the PostgreSQL initialization scripts.		18‑Sep‑2023
cb64145a	Added Vary header to Cortex response to prevent browser cache issues.		18‑Sep‑2023
1c9f5fdb	Fixed issue where price list drop-down in Commerce Manager product editor was empty unless user had access to all catalogs.		15‑Sep‑2023
957d0590	Fix for health check failure that occurs when running behind a load balancer.		14‑Sep‑2023
c476c0c7	Fixed issue where physical product inventory was not properly released if an order failed.		13‑Sep‑2023
fabf5874	Fix for Operational Insights "tomcat-*" fields returning values for the health check connector instead of the primary connector.		13‑Sep‑2023
4a9b63ac	Fixed issues in set-ep-versions.sh script and Maven settings used for builds.		12‑Sep‑2023
32bae214	Fixed issue with offer price range not including bundle price adjustments.		11‑Sep‑2023
9ff72ab5	Added non-null constraint to TCUSTOMERAUTHENTICATION.USERNAME to ensure that invalid customer authentication records are not created.		11‑Sep‑2023
f5c2c0a1	Fix for "Parent cannot be changed on an existing customer record" error when importing customers.		11‑Sep‑2023
48f41875	Fixed Commerce Manager issue with sorting accounts by business number where duplicate records were appearing.		7‑Sep‑2023
e944f8e5	Improved Liquibase changeset 2023-06-build-status-unique-index to ensure that duplicate records are cleaned up before adding the unique constraint.	Data model change	6‑Sep‑2023
89270495	Fixed an issue where a large number of queries were being executed to retrieve customer, product, product sku, and category attribute values.	Performance	4‑Sep‑2023
ad8f32e6	Fixed Cortex memory leak that can occur if a resource repeatedly throws exceptions.		4‑Sep‑2023
4422a3d1	Added ops-spec.json file to describe external dependency requirements for this version of EPC. Correction to previous commit.		31‑Aug‑2023
e2540720	Fix for logged Correlation ID value that is incorrect for requests to OAuth endpoints.		31‑Aug‑2023
1e4131b7	Modified the "items in shopping cart" promotion conditions to ignore cart items that were added by promotions.		25‑Aug‑2023
d536a46c	Added ops-spec.json file to describe external dependency requirements for this version of EPC.		25‑Aug‑2023
2d55824c	Fixed bug in verifyDebugMessage method used by Cucumber tests.		24‑Aug‑2023
4e2fe696	Fixed several coupon-related named queries that were using the unindexed coupon_code field instead of the indexed coupon_code_upper field, leading to table scans.	Performance	24‑Aug‑2023
455cae0a	Fixed a potential race condition in CachedSettingsReaderImpl that can cause errors during Cortex startup.		16‑Aug‑2023
22543793	Standardized Cucumber test configuration across modules.		10‑Aug‑2023
c39e8974	Performance improvement for selling context evaluation that replaces the Groovy implementation for a faster Java equivalent.	Performance	28‑Jul‑2023
a7e4218c	Fixed an issue where a NullPointerException can occur when deleting a cart line item that triggered a free item promotion.		27‑Jul‑2023
b5f38b25	Added caching for product association lookups to improve performance.	Performance	20‑Jul‑2023
f5f03491	Changed Cortex database connection pool max size from 150 to 250 to ensure that it matches the default Tomcat max thread pool.		19‑Jul‑2023
9c8bf2ea	List of classes defined in auditableClasses now ensures that subclasses are also audited.		14‑Jul‑2023
f647b125	Added unique constraint on TINDEXBUILDSTATUS.INDEX_TYPE to prevent search indexing errors due to invalid record duplication.	Data model changes	10‑Jul‑2023
1e16e03d	Added annotations to the code to suppress false positive SonarQube issues.	Security	7‑Jul‑2023
1440c274	Fixed issue where order context is not updated properly after being persisted by the order holds checkout action.		4‑Jul‑2023
a20d6b08	Fixed issue with Operational Insights not returning Tomcat metrics in deployed environments.		3‑Jul‑2023
1a0b99af	Improvements to Operational Insights exception handling when an exception is thrown during cache inspection.		30‑Jun‑2023
00881fa5	Added missing implementations for "not matching" and "not containing" selling context tag operators.		29‑Jun‑2023
c4715de6	Fix for potential "output value too large" error when running changeset PB-8894-CLOB-order-data-oracle-mysql on Oracle.	Data model changes	28‑Jun‑2023
e649b476	Fixed an issue with Object Auditing where audit records show changes that were not applied with the same old and new value.		26‑Jun‑2023
5e8cdd76	Fixed issue with editing promotions without shopper conditions that causes a selling context to be created and then immediately deleted in the database.		26‑Jun‑2023
723832d5	Updated Cortex to automatically remove a bundle from the cart if it no longer matches the catalog definition of the bundle constituents.		16‑Jun‑2023
0b6d7744	Fix for issue where a NullPointerException can occur when updating the quantity for a shopping cart line item with children.		16‑Jun‑2023
5a740ab6	Changed serviceResponseWaitTime query parameter to optional for Operational Insights REST API.		15‑Jun‑2023
c6732398	Fixed NoClassDefFoundError that can occur when Operational Insights tries to determine cache sizes.		7‑Jun‑2023
cd1361ce	Allow Operational Insights clients to override service response wait time by setting serviceResponseWaitTime query parameter.		7‑Jun‑2023
410081d5	Added ability to specify wildcard (*) character when searching for products and skus in Commerce Manager.		31‑May‑2023
4f67a6ea	Added ability for business users to manually set shared ID when creating an account in Commerce Manager.		24‑May‑2023
7ef0d45d	Fix for encountered unmanaged object error when publishing bundles with sku constituents through DST.		22‑May‑2023
dd5b4e0f	Fix for broken backwards compatibility in Tax Calculation Extension Point.		22‑May‑2023
4d537c96	Added missing indexes to TLOCALIZEDPROPERTIES table to improve performance.	Performance Data model changes	19‑May‑2023
1350d7fe	Ensure that Cortex bundles are always loaded in the correct order to ensure that cache configuration is properly recognized.	Performance	19‑May‑2023
122f2256	Added Import/Export validation check to prevent adding a category with a parent assigned to itself.		18‑May‑2023
a0cfe9fa	Refactored core-changelog-2021-01-data-fields-as-json-clob.xml to make it run 20-30X faster on MySQL and Oracle databases.	Performance Data model changes Requires downtime	16‑May‑2023
7dbdd2bf	Fix for "invalid number" error that occurs on Oracle in the 2020-08-flatten-order-sku-tree-for-better-performance changeset.	Performance Data model changes Requires downtime	16‑May‑2023
3866f147	Refactored several EPC 8.0 upgrade Liquibase changesets to better handle large order volumes in the database.	Data model changes	8‑May‑2023
75fb393e	Fix for Can't DROP FK_OPAY_ORDER error that can occur when migrating from EPC 7.6 to newer versions.	Data model changes	8‑May‑2023
db675554	Fixed issue in which cart item modifiers are lost on dependent cart line items if the parent line item is updated.		27‑Apr‑2023
b6a4d18b	Fixed issue where shopping cart line items with children are not properly migrated when a customer logs in.		26‑Apr‑2023
8ac3927c	Fixed store selector support in Tax Calculator extension point.		24‑Apr‑2023
549fe0c3	Fix for java.lang.IllegalStateException: Product futureProduct is not linked to any categories error during search indexing.		21‑Apr‑2023
7e166c5e	Allow additemstocartform to be used to add items to cart with optional cart item modifiers.		18‑Apr‑2023
b2ff2e14	Improvements to JWT token error logging and ensure that errors are returned as structured error messages.		18‑Apr‑2023
1b174264	Avoid running JWTTokenStrategy when Authorization header contains an OAuth access token to improve performance.		17‑Apr‑2023
fda4cdd6	Avoid loading OAuth token from the database during logout operations to improve performance. Performance		17‑Apr‑2023
e877f8fc	Upgraded bootstrap from 3.3.5 to 3.4.1 and jQuery from 1.11.3 to 3.5.1 to address potential cross-site scripting vulnerabilities in Cortex Studio.	Security	12‑Apr‑2023
eff3ac49	Modified how promotion and price list assignment start and end dates are stored to allow queries to easily exclude expired records.	Performance	4‑Apr‑2023
827d2800	Fixed several Operational Insights metrics that were broken for customers using PostgreSQL.		28‑Mar‑2023
b75907e5	Improved Operational Insights error handling when hardware metrics calls generate a NoClassDefFoundError.		20‑Mar‑2023
cbf513ee	Fixed potential NullPointerException when requesting Operational Insights report if no services respond with results.		20‑Mar‑2023
88b40814	Improved parallelization of Import/Export Cucumber tests to generate directories using a UUID instead of a sequential number to avoid potential conflicts.		5‑Mar‑2023
2d9aa0e9	Performance improvement which replaces full product lookup with simple query when only product sku guid to product sku code conversion is needed.	Performance	14‑Feb‑2023
5c033334	Resolved local Cortex startup warning The AJP Connector is configured with secretRequired="true" but the secret attribute is either null or "".		9‑Feb‑2023
7910c054	Reduced the amount of logging produced when running Selenium tests.		8‑Feb‑2023
5acbde0a	Fix for intermittent test failures in PaymentConfigurations Cucumber tests.		8‑Feb‑2023
531d90e0	Fixed issue with changeset list resetting to page one when locking or publishing changesets.		7‑Feb‑2023
5e090d91	Fixed issue where a free item is not automatically removed if the promotion becomes ineligible.		7‑Feb‑2023
65a2ee95	Added @SupportsMultiplePartialCharges annotation that allows payment plugins to indicate if the payment gateway supports multiple partial captures against a single pre-auth.		7‑Feb‑2023
97b24cf8	Added support for quartz.timezone JVM parameter in Batch Server to define the timezone used by Quartz jobs.		7‑Feb‑2023
068b1dac	Added support for format=nolinks query parameter in Cortex to prevent unnecessary conditional link evaluation.	Performance	6‑Feb‑2023
fa0b2439	Fix for intermittent Selenium test failures due to thread safety issues.		30‑Jan‑2023
1c0ab0ea	Fixed issues with the skuOptions and modifierGroups options in the product type load tuner.		27‑Jan‑2023
68311c24	Fix for "Device is disposed" error in Commerce Manager.		26‑Jan‑2023
a3565152	Fix for intermittent failure in "Import Data Policies with existing Data Policies" test.		26‑Jan‑2023
ef88b929	Fix SonarQube issues introduced by the Tax Calculator extension point.	Security	25‑Jan‑2023
f53c1a76	Fix for potential deadlocks on shopping cart last modified date updates.		24‑Jan‑2023
a1c4573b	Fixed ability to run Cucumber integration tests on Windows developer machines.		24‑Jan‑2023
a87a3c1e	Modified Product Association export mechanism to significantly improve performance.	Performance	17‑Jan‑2023
d5035ba6	Fix for NoClassDefFoundError: org/slf4j/IMarkerFactory error when the first Cortex request is received.		17‑Jan‑2023
58321249	Added additional address data point fields and a new CUSTOMER_ALL_ADDRESSES data point location for data protection.		16‑Jan‑2023
ab9ab14e	Fixed issue with empty facet name when assigning available facets to a store in Commerce Manager.		10‑Jan‑2023
e83b4834	Fixed incorrect logging of successful / skipped messages in batch jobs after failure.		9‑Jan‑2023
4ba0e874	Fixed NullPointerException that can occur when updating a shopping cart line item quantity if the line item has a non-bundle-constituent child.		9‑Jan‑2023
1ea05359	Wherever an order is marked failed, there should always be a reason added as an order note.		5‑Jan‑2023
a7023d48	Returned default JMS max active session per connection size back to 25.		16‑Dec‑2022
5e5626fc	Upgraded ehcache-openjpa from version 0.2.0 to 0.2.0-ep1.0 to address potential ConcurrentModificationException.		15‑Dec‑2022
d5586a3a	Removed problematic and unnecessary ep-core-cucumber-itests module.		15‑Dec‑2022
3e23abbd	Fix for intermittent "Create category in existing category" selenium test failure.		15‑Dec‑2022
0466e9e2	Refactored TaxCalculatorXPFBridge so it adheres to best practices.		8‑Dec‑2022
bf20745d	Addressed XML parse warning in search server logs during startup on local developer machines.		7‑Dec‑2022
3dfa3560	Limited orders list to 25 on customer record in Commerce Manager to prevent slowness when accessing that tab for customers with many orders.	Performance	6‑Dec‑2022
9b9df078	Addressed api-platform build issue on M1 MacBooks.		5‑Dec‑2022
d42065eb	Include all caches in Operational Insights API response, instead of just select caches.		29‑Nov‑2022
17e2fd98	Upgraded hibernate-validator from version 5.4.3.Final to 6.0.20.Final to address CVE-2020-10693.	Security	25‑Nov‑2022
6fa45112	Added caching to the isInCategory method to improve performance of promotions and price lists that are conditional on a product being in a category. Performance		25‑Nov‑2022
977f88b9	Added caching of payment provider configurations to improve performance.	Performance	24‑Nov‑2022
f090f119	Upgraded groovy-all from version 2.4.15 to 2.4.21 to address CVE-2020-17521.	Security	23‑Nov‑2022
e238fff6	Fixed an issue where a free item promotion triggered by a coupon was not activated.		23‑Nov‑2022
37263ca5	Fixed error in JWT authentication if token does not contain either sub or account.		16‑Nov‑2022
ffbc03e2	Upgraded ESAPI from version 2.1.0.1 to 2.3.0.0 to resolve CVE-2022-23457.	Security	15‑Nov‑2022
1fbc1f37	Fix for search server race condition that can prevent indexes from building.		15‑Nov‑2022
0df22379	Changed log level in PriceListPriceScoreDocComparator to prevent logs from being flooded during search indexing.		15‑Nov‑2022
379fed99	Removed duplicate "Assign Customer Segments" permission appearing in Commerce Manager.		14‑Nov‑2022
04004932	Upgraded httpclient from version 4.5.5 to 4.5.13 to resolve CVE-2020-13956.	Security	11‑Nov‑2022
4305e9c4	Upgraded mybatis from version 3.2.3 to 3.5.11 to resolve CVE-2020-26945.	Security	10‑Nov‑2022
d42b5d95	Upgraded spring-security-oauth2 from 2.3.8.RELEASE to 2.5.2.RELEASE to resolve CVE-2022-22969.	Security	10‑Nov‑2022
f9f98925	Modified EpEmailValidator to accept empty values to be consistent with other validators.		8‑Nov‑2022
9208c034	Upgraded json-path from version 2.4.0 to 2.6.0.	Security	7‑Nov‑2022
e6ef87a6	Upgraded jdom from version 1.1.3 to 2.0.6.1.	Security	7‑Nov‑2022
6ec94a6a	Fix to populate the cart item modifier fields in the OrderSkuDTO object that is passed to payment plugins.		3‑Nov‑2022
4cb673a0	When checking out a cart that contains a coupon that has run out of uses, block checkout instead of removing the coupon code automatically.		31‑Oct‑2022
b37bae0c	Upgraded xstream version from 1.4.18 to 1.4.19 to address CVE-2021-43859.	Security	31‑Oct‑2022
0c6b1472	Upgraded mysql-connector-java version from 8.0.25 to 8.0.30.	Security	31‑Oct‑2022
4745dbd0	Upgraded json library version from 20170516 to 20220924.	Security	28‑Oct‑2022
2d58ed72	Added a timeout on Helix resource operations to ensure that stuck threads are released. Timeout defaults to 30 secs but can be overridden with relos.prototype.operation.timeout JVM parameter.		27‑Oct‑2022
5485b8df	Returned default JMS connection pool size back to 25.		27‑Oct‑2022
4908ca6b	Fixed issue preventing email notifications from being sent when a changeset publish completes.		25‑Oct‑2022
eda7c53a	Upgraded commons-text from version 1.9 to 1.10 to address CVE-2022-42889.	Security	24‑Oct‑2022
24f966c5	Upgraded logback and slf4j versions in api-platform so they match ep-commerce.		21‑Oct‑2022
aa352e18	Fixed issue where cart item modifier fields were sometimes immutable, preventing customizations from modifying them.		20‑Oct‑2022
7c52313a	Replaced libsass-maven-plugin to resolve build errors on Mac M1 machines.		19‑Oct‑2022
a64b23ef	Upgraded commons-validator from version 1.6 to 1.7. This allows Cortex to recognize recent new DNS top-level domains when validating email addresses.		18‑Oct‑2022
d750c7eb	Changed customer shared ID to be case insensitive on PostgreSQL and Oracle to match MySQL behaviour.		17‑Oct‑2022
fd625832	Added a customData map to all Extension Point Framework entity and context classes to allow project teams to pass custom data through these classes with limited code changes.		14‑Oct‑2022
beb65dca	Removed UPPER from all queries involving store code.	Performance	7‑Oct‑2022
43dd05df	Removed the failover protocol from the JMS broker URL in accordance with our policy of discouraging use of ActiveMQ high availability mode.		6‑Oct‑2022
c3a28994	Modified Commerce Manager product and category display name localization so that only intentionally specified values are displayed and saved.		5‑Oct‑2022
a6eb6621	Improved performance of case-insensitive queries involving store code.	Performance Data model changes	5‑Oct‑2022
1d6aa8bc	Modified Oracle connection defaults so it uses service names instead of SIDs and supports PDBs.		4‑Oct‑2022
9d442ff1	Improvements to Selenium test suite run time.	Performance	27‑Sep‑2022
04c91f77	Fixed an issue where a promotion is returned in appliedPromotions to more line items than expected.		26‑Sep‑2022
7bb5d9cd	Removed all Direct Web Remoting library dependencies.	Security	21‑Sep‑2022
5c3ec7b7	When importing a product with localized attribute values that already exist, attempting to set a more specific attribute value locale incorrectly updated the "broader" locale value.		21‑Sep‑2022
e65c1dd6	Updated Maven Minimal configuration so that changes to ext-cm-libs trigger the correct subprojects.		20‑Sep‑2022
e5741972	Fixed issue with product not being automatically added to cart by free item promotion action.		19‑Sep‑2022
cad0ebfe	Fixed issue where promotion date range was being checked using application timezone instead of database timezone.		16‑Sep‑2022
9413b995	Build stability improvements.		8‑Sep‑2022
6ee848d7	Refactored additional logging calls from using Log4j2 classes to SLF4j classes to allow these log messages to appear properly in Cortex (which uses Logback for logging).		7‑Sep‑2022
fbfc1a2c	Corrected the location of the purchase-order-plugin in the Integration webapp pom.xml.		2‑Sep‑2022
5ca6be6d	Separated indexing pipelines by type to ensure that long queues in one pipeline doesn't delay indexing in another.		1‑Sep‑2022
1bd450f5	Upgraded antisamy from version 1.5.8 to 1.6.7.	Security	30‑Aug‑2022
e735dc0a	Upgraded Jackson from version 2.12.3 to 2.12.7 to address jackson-databind security vulnerability.	Security	25‑Aug‑2022
ccb253b2	Disabled an intermittently failing Selenium test.		24‑Aug‑2022
849d7eeb	Disabled an intermittently failing Selenium test.		24‑Aug‑2022
d1163749	Upgraded Guava from version 24.1.1-jre to 31.1-jre.	Security	22‑Aug‑2022
6a4e37e5	Removed duplicate database indexes from the TORDERADDRESS table.	Data model changes	18‑Aug‑2022
0673d053	Removed Product Recommendations job to avoid OptimisticLockingExceptions in DST.		18‑Aug‑2022
d2db7aae	Removed checksum validation from 2021-09-create-FK-indices-for-8.0 changeset due to required changes in earlier versions.	Data model changes	18‑Aug‑2022
ccfa7ba1	Fixed content root error appearing in IntelliJ for some modules.		17‑Aug‑2022
a2fc287c	Fixed issue with payment framework charges that could cause a successful operation to be treated as a failure, and retried.		17‑Aug‑2022
72f5a1f0	Updated Catalog Syndication projection builder to ensure that projection and projection history records are persisted in separate transactions to prevent deadlocks.		16‑Aug‑2022
d25730d1	Replaced the single-threaded taskExecutor used by the blueprint-extender with a configurable ThreadPoolTaskExecutor version. This allows the extender to work in parallel on the bundles resulting in faster Cortex boot time.		7‑Aug‑2022
bceec926	Reduce maximum default product cache size to avoid out of memory issues with larger catalogs.		5‑Aug‑2022
3fc54097	Use embedded web server to reliably serve test mail attachment for Cucumber emailFileAttachments.feature.		5‑Aug‑2022
35b32938	Disabled checksum validation on the SUP-1020-customer-search-fields-case-insensitive changeset to account for required changes in backports to earlier versions.	Data model changes	19‑Jul‑2022
a6b5707f	Changed DBSettingValueRetrievalStrategy so dependencies are more explicit to prevent failures if extensions create a circular dependency.		13‑Jul‑2022
e18d3f39	Extracted portions of changeset 2020-08-purge-expired-failed-orders-job-recreate-FKs-with-cascade-delete into separate changesets that are only executed if the TORDERDATA and TORDERITEMDATA tables exist, since they are removed by another patch.	Data model changes	12‑Jul‑2022

Badge legend

• Security: Indicates that the patch includes security fixes.
• Performance: Indicates that the patch improves system performance.
• Data model changes: Indicates that the patch includes Liquibase scripts that make changes to the data model.
• Requires downtime: Indicates that the Self-Managed Commerce services should be shut down while the Data Population Tool is executed.
• Build Tools: Indicates that the patch includes changes to Build Tools.

Changelog Announcements

Refactored core-changelog-2021-01-data-fields-as-json-clob.xml to make it run 20-30X faster on MySQL and Oracle databases

The changesets in the core-changelog-2021-01-data-fields-as-json-clob.xml Liquibase file that are used as part of the EPC 8.1 upgrade have been refactored to allow it to upgrade the schema much more quickly on MySQL and Oracle databases. This was done by taking advantage of the JSON_OBJECTAGG function which serializes JSON within the database. However, this function was only added to MySQL in version 5.7.22, so project teams using MySQL must upgrade to at least MySQL RDS version 5.7.22 or MySQL Aurora version 5.7.mysql_aurora.2.11.2 before applying this patch.

Modified how promotion and price list assignment start and end dates are stored to allow queries to easily exclude expired records

The "Time Conditions" editor has been removed from the Shopping Cart promotions wizard and editor. Now the enable and expiration dates for Shopping Cart promotions appear on the summary tab (or first page of the wizard) consistently with catalog promotions.

This patch includes a Liquibase changeset that will migrate existing start and end dates to the new fields.

8.4.0

Released: July 2022

Release highlights

Correlation ID Support

We now support the ability to pass an identifier to our Cortex and Integration Server APIs, which will be included in all logs related to that request. The correlation ID will also flow through to all corresponding asynchronous tasks.

For example, if a correlation ID is passed to the Cortex request that initiates a purchase, all asynchronous checkout events that are executed on the Integration Server will also have the same correlation ID. The correlation ID is exchanged between these services as part of the domain event message that is sent through JMS.

Both Cortex and the Integration Server REST APIs will accept an x-correlation-id header as part of the requests. If present, the correlation ID will appear in the fourth log column, as shown in the example below:

2022-05-17T13:23:41,051-02:30 | INFO  | EP-Integration | correlationIdTest | Camel (ep-order-email-handler) thread #31 - JmsConsumer[Consumer.orderCancelledEmailHandler.VirtualTopic.ep.orders] | org.apache.camel.processor.interceptor.Tracer.log(CamelLogger.java:159) | Test log message

Extensions can also access the correlation ID if it needs to be passed to downstream services.

For more information, see X-Correlation-Id and Extension Point Framework Correlation ID.

Payment instrument data cleanup jobs

Three new data cleanup jobs have been created to remove old and unused payment instruments from the database.

cleanupOrphanedOrderPaymentGuidsJob searches for order payment records on orders older than a configured age, and sets the payment instrument GUID reference to null (UPDATE TORDERPAYMENT SET PAYMENT_INSTRUMENT_GUID = null WHERE UIDPK IN <list>). This reference is only used for showing the "display name" (usually last 4 digits of the card number) when viewing order history in Commerce Manager. This job runs once per day at midnight, if enabled. This job is configured by the following system configuration settings:

• COMMERCE/SYSTEM/ORDERPAYMENTCLEANUP/enable controls whether this job is enabled. Defaults to false.
• COMMERCE/SYSTEM/ORDERPAYMENTCLEANUP/maxHistory controls how many days old an order should be before its order payment references to payment instruments should be cleared. Defaults to 365.
• COMMERCE/SYSTEM/ORDERPAYMENTCLEANUP/batchSize controls the maximum number of records that should be processed in each job execution.

cleanupOrphanedOrderPaymentInstrumentsJob deletes order payment instrument records on orders older than a configured age (DELETE TORDERPAYMENTINSTRUMENT WHERE UIDPK IN <list>). These records are only needed for operations that require doing a payment reservation using the existing payment method, such as order modification. This job runs once per day at midnight, if enabled. This job is configured by the following system configuration settings:

• COMMERCE/SYSTEM/ORDERPAYMENTCLEANUP/enable controls whether this job is enabled. Defaults to false.
• COMMERCE/SYSTEM/ORDERPAYMENTCLEANUP/maxHistory controls how many days old an order should be before its order payment references to payment instruments should be cleared. Defaults to 365.
• COMMERCE/SYSTEM/ORDERPAYMENTCLEANUP/batchSize controls the maximum number of records that should be processed in each job execution.

cleanupOrphanedPaymentInstrumentsJob deletes payment instrument records that are orphaned (have no incoming references from TORDERPAYMENTINSTRUMENT, TORDERPAYMENT, TCARTORDERPAYMENTINSTRUMENT, and TCUSTOMERPAYMENTINSTRUMENT). This job runs once per day at midnight, and is always enabled. This job is configured by the following system configuration settings:

• COMMERCE/SYSTEM/PAYMENTINSTRUMENTCLEANUP/batchSize controls the maximum number of records that should be processed in each job execution.

Changeset data cleanup job

A new cleanup job has been created to cleanup old changesets from an author environment.

cleanupChangesetsJob deletes changesets that are in the FINALIZED state and published more than a configured number of days ago. This job runs once per day at midnight, if enabled. This job is configured by the following system configuration settings:

• COMMERCE/SYSTEM/CHANGESETCLEANUP/enable controls whether this job is enabled. Defaults to false.
• COMMERCE/SYSTEM/CHANGESETCLEANUP/maxHistory controls the minimum number of days to consider a changeset since it was published. Defaults to 60.
• COMMERCE/SYSTEM/CHANGESETCLEANUP/batchSize controls the maximum number of records that should be processed in each job execution.

Core request-scoped caching

Currently, Self-Managed Commerce employs two major caching approaches:

• Long-term: Application Caching using EhCache
• Short-term: Cortex Request-Scoped Caching

While both caches solve the major bottleneck related to excessive database calls, the major challenge of handling transactional entities (e.g. carts, orders, shoppers etc) still exists.

To solve this issue, a new request-scoped cache has been developed to cache JPA named query execution. This cache is enabled in Cortex, Search Server, and Integration Server. Entries in the cache only last for the duration of a "request", usually meaning a single API request. For that reason, it has a small memory footprint, and adds no risk of "dirty reads" after database modifications.

This cache has been named Core Request-Scoped Caching or CRSC for short. For more information, see Core Request-Scoped Caching.

Enabled Application Caching in Search Server and Integration Server

Until now, Application Caching using EhCache was only enabled for Cortex and the Import/Export tool. Now we’ve also enabled application caching for the Search Server and Integration Server. This significantly improves the performance of search indexing, asynchronous checkout operations, and Integration Server APIs.

With the application cache enabled in Search Server, the number of queries required to index the mobee test store was reduced from ~400,000 to ~50,000.

note

This change can cause some services to return dirty reads; in other words, if a cached result is returned then it might be an out-of-date representation of the object. If certain customizations are sensitive to dirty reads, you can reference the non-caching versions by adding nonCaching prefix to the reference in your service bean definition. For example, references to the storeService bean can be changed to nonCachingStoreService. You can also completely disable application caching for a service by setting the -Dnet.sf.ehcache.disabled=true JVM parameter.

For more information, see Application Caching using EhCache.

System requirements and compatibility

Self-Managed Commerce 8.4.0 is compatible with the following Elastic Path releases:

Elastic Path Component	Compatibility
Extension Point Framework	Extension Point Framework compatibility matrix
CloudOps for Kubernetes	CloudOps for Kubernetes compatibility matrix

For more information, see Supported Technologies.

New in this release

In addition to the Release Highlights, this release contains the following updates:

Allow Batch Server to determine database type automatically

In prior versions, the Spring Batch framework used within the Batch Server required that the following JVM parameters be specified if using any database engine except MySQL:

-Dep.catalog.batch.database.create.script=
-Dep.catalog.batch.database.drop.script=

Now these JVM parameters are no longer required, and the Batch Server will determine the database type automatically.

The modifier group importer now supports dependentelement for modifier fields

When importing modifier groups through Import/Export, there was no way to remove existing modifier fields from an existing modifier group.

To support this, the importconfiguration.xml used by the Import/Export API, the Import/Export CLI, and data population now allows a dependentelement to be defined for the MODIFIERGROUP importer, as in the following example:

<importer type="MODIFIERGROUP">
    <importstrategy>INSERT_OR_UPDATE</importstrategy>
    <dependentelements>
        <dependentelement type="MODIFIER_FIELDS">CLEAR_COLLECTION</dependentelement>
    </dependentelements>
</importer>

If not specified, the behaviour defaults to RETAIN_COLLECTION, which is the same as the old behaviour. The Import/Export API has now been configured to use the CLEAR_COLLECTION behaviour.

Added "identifier" Cortex link on user profile

The user profile resource now contains a new identifier link that returns the shared ID of the currently logged-in user. This works the same way as the existing identifier link on accounts.

Added security headers to Cortex responses

We have added several new headers to Cortex responses to improve security, in line with the recommendations provided by the Open Web Application Security Project Secure Headers Project.

• Content-Security-Policy: default-src 'none'
• Referrer-Policy: no-referrer
• Strict-Transport-Security: max-age=31536000 ; includeSubDomains
• X-Content-Type-Options: nosniff
• X-XSS-Protection: 0

For more information, see Cortex Response Headers.

Added new fields to Operational Insights API response

Some additional values to the Operational Insights API response, as shown below:

• Added configuration-->service-->operating-system-->os-lang. This represents the Operating System default language. If this value is not UTF-8, then Elastic Path services will have problems when reading certain files from the classpath.

• Added configuration-->service-->jvm-->jvm-charset. This represents the JVM default character set. If this value is not something ending with .UTF-8, then Cortex will report severe symlink errors during startup.

• Added commerce-ticker. This is only contained in the response by adding a zoom=commerce-ticker query parameter to the request. It contains details that can be used for showing near-realtime metrics about purchases, grouped by store and currency. Example response:

  "commerce-ticker": {
    "last-minute": [
      {
        "store-code": "MOBEE",
        "order-count": 1,
        "booked-revenue": 23.44,
        "currency-code": "CAD"
      }
    ],
    "since-midnight": [
      {
        "store-code": "MOBEE",
        "order-count": 3,
        "booked-revenue": 174.1,
        "currency-code": "CAD"
      },
      {
        "store-code": "KOBEE",
        "order-count": 1,
        "booked-revenue": 12.16,
        "currency-code": "CAD"
      }
    ]
  }

For more information, see Operational Insights API.

Refactored permission parameter strategy classes to improve Cortex authorization performance

The previous permission parameter strategy implementations needed to retrieve every possible identifier that a user is permitted to access so that Shiro knows if a user is an "owner". However, since Shiro is actually only validating a single resource with a known identifier, we have modified the implementation so that Cortex now passes the requested identifier to each permission parameter strategy, allowing for significantly more performant implementations.

Previously, permission parameter strategies extended AbstractCollectionValueStrategy, which required implementing this method:

Collection<String> getParameterValues(PrincipalCollection principals);

Implementations of this method could only access the scope and user ID from the PrincipalCollection, and would then need to return a collection of all identifiers that the user is allowed to access. This list could be quite large for scenarios like the purchases that a user has placed. Note that this approach is still supported, but the method above has been marked as deprecated.

As of Self-Managed Commerce 8.4, permission parameter strategies should extend AbstractOptimizedCollectionValueStrategy, which requires implementing this method:

String getParameterValue(PrincipalCollection principals, String encodedResourceIdToVerify);

Implementations of this method need to decode the encodedResourceIdToVerify, verify that the user is permitted to access the identified entity, and then return the URI-encoded identifier if permitted, or missing if not. The code sample below shows an example of how this might be done:

	@Override
	protected String getParameterValue(final PrincipalCollection principals, final String encodedOrderNumberToVerify) {
		String scope = PrincipalsUtil.getScope(principals);
		final IdentifierTransformer<Identifier> identifierTransformer = identifierTransformerProvider.forUriPart(PurchaseIdentifier.PURCHASE_ID);
		String orderNumberToVerify = decodeResourceId(identifierTransformer, encodedOrderNumberToVerify);

		return repository.get()
				.resourceExists(StringIdentifier.of(scope), orderNumberToVerify)
				.map(resolvedPurchaseIdentifier -> identifierTransformer.identifierToUri(resolvedPurchaseIdentifier.getPurchaseId()))
				.blockingGet();
	}

Note that the repository class makes calls to the PermissionSupportRepositoryImpl class for determining if a user is permitted to access a particular entity. The getResourceId method returns the missing string if access is denied.

Purchase order payment plugin now available by default

Self-Managed Commerce has had a dormant Purchase Order payment plugin in the source since version 8.0, but it was difficult to wire into the platform. This payment plugin is now wired in by default, and can be enabled by adding a payment configuration record through Commerce Manager or Import/Export, and associating it to one or more stores.

This payment plugin allows shoppers to place orders using a payment method that only requires a purchase order number to be specified.

Item keyword search functionality improved

Previously, when searching for items (product skus) using the keyword search functionality, Cortex would use the Product index for searching, and would only return a single result per-product: The default SKU. We have now changed this functionality so that Cortex searches for items using the product SKU index, and returns all matching SKUs.

For example, assume we have a catalog with a single product as follows:

• Product Aliens Movie, with attribute Runtime: 120
  • SKU Aliens DVD, with attribute Media: DVD (Default SKU)
  • SKU Aliens LaserDisc, with attribute Media: LaserDisc

Before this change, searching for Aliens Movie or 120 would return a single result: Aliens DVD. Searching for "LaserDisc" would (confusingly) return Aliens DVD.

After this change, searching for Aliens Movie or 120 returns two results: Aliens DVD and Aliens LaserDisc. Searching for LaserDisc now returns Aliens LaserDisc.

Note that these changes do not affect the offer (product) keyword search in any way. So if you prefer to have a single result per-product in your search result, we recommend using the offer keyword search instead of the item keyword search.

Added a new JMX method to return a list of all loaded Extension Point Framework plugins

A new attribute has been added to the XPFPluginFactory JMX object named AllLoadedPluginIDs. This returns the plugin IDs for all external plugins that are currently loaded into the service.

For more information, see Get All Loaded External Plugins.

Updated all services to use a consistent logging format for console and file output

There were many problems with our old logging configuration:

• Formats were inconsistent between services (i.e. Search vs Cortex).
• Formats were inconsistent between CONSOLE and FILE output.
• File format was split into two lines.
• Format was hard to parse by log aggregators due to a lack of consistent field separators.
• Some fields were duplicated or unnecessary.

The new format outputs the following columns (FILE and CONSOLE log output will be consistent):

• Date/time
• Log level
• Service name
• Correlation ID
• Thread name
• Class/method/line
• Message

Example output:

2022-07-12T09:24:58,360-07:00 | INFO  | EP-Cortex      | CorrelationID | EclipseGeminiBlueprintExtenderThread-1 | com.elasticpath.commons.util.impl.VersionService.init(VersionService.java:25) | Commerce Version: Cortex REST Web Application 8.3.1 by Elastic Path Software, Inc
2022-07-12T09:24:58,360-07:00 | INFO  | EP-CM          | CorrelationID | main | com.elasticpath.commons.util.impl.VersionService.init(VersionService.java:25) | Commerce Version: Commerce Manager Web Application 8.3.1 by Elastic Path Software, Inc
2022-07-12T09:24:58,360-07:00 | INFO  | EP-Search      | CorrelationID | main | com.elasticpath.commons.util.impl.VersionService.init(VersionService.java:25) | Commerce Version: Search Web Application 8.3.1 by Elastic Path Software, Inc
2022-07-12T09:24:58,360-07:00 | INFO  | EP-Integration | CorrelationID | main | com.elasticpath.commons.util.impl.VersionService.init(VersionService.java:25) | Commerce Version: Integration Web Application 8.3.1 by Elastic Path Software, Inc
2022-07-12T09:24:58,360-07:00 | INFO  | EP-Batch       | CorrelationID | main | com.elasticpath.commons.util.impl.VersionService.init(VersionService.java:25) | Commerce Version: Batch Web Application 8.3.1 by Elastic Path Software, Inc
2022-07-12T09:24:58,360-07:00 | INFO  | EP-DataSync    | CorrelationID | main | com.elasticpath.commons.util.impl.VersionService.init(VersionService.java:25) | Commerce Version: Data Sync Web Application 8.3.1 by Elastic Path Software, Inc

Added support for multiple JDBC driver JARs in the deployment package

It is now possible to easily define multiple JDBC driver JARs at build time for inclusion in the deployment package that is used when deploying Self-Managed Commerce.

For more information, see Deployment package JDBC drivers.

Significantly improved the performance of customer, account, and order searches in Commerce Manager

When the customer SOLR index was removed, the way that Commerce Manager looks up customer details was refactored to lookup customer and account details in the database instead of using SOLR. However, since many of the search fields need to do case-insensitive searches and/or partial matches, database indexes were not being leveraged effectively. This lead to very slow response times when the database contains a large number of user, account, or order records. The search queries have been updated to effectively use the database indexes, even for lookups that are case-insensitive or prefix (searches for results starting with the specified value).

The tables below show the type of search that is used for each search field.

Searchable user fields:

Field	Search Type
Shared ID	Exact Match
Email	Case Insensitive Match
Username	Case Insensitive Match
First Name	Case Insensitive Prefix Match
Last Name	Case Insensitive Prefix Match
Zip / Postal Code	Case Insensitive Match
Phone Number	Case Insensitive Match
Store	Exact Match

Searchable account fields:

Field	Search Type
Shared ID	Exact Match
Business Name	Case Insensitive Prefix Match
Business Number	Case Insensitive Prefix Match
Phone Number	Case Insensitive Match
Fax Number	Case Insensitive Match
Zip / Postal Code	Case Insensitive Match

Searchable order fields:

Field	Search Type
Order Number	Exact Match
User Shared ID	Case Insensitive Match
User First Name	Case Insensitive Prefix Match
User Last Name	Case Insensitive Prefix Match
User Email	Case Insensitive Match
User Phone Number	Case Insensitive Match
Account Shared ID	Exact Match
Account Business Name	Case Insensitive Prefix Match
Account Business Number	Case Insensitive Prefix Match
Account Phone Number	Case Insensitive Match
Billing Address First Name	Case Insensitive Prefix Match
Billing Address Last Name	Case Insensitive Prefix Match
Billing Address Phone Number	Case Insensitive Match
Billing Address Fax Number	Case Insensitive Match
Billing Address Zip / Postal Code	Case Insensitive Match
Shipping Address First Name	Case Insensitive Prefix Match
Shipping Address Last Name	Case Insensitive Prefix Match
Shipping Address Phone Number	Case Insensitive Match
Shipping Address Fax Number	Case Insensitive Match
Shipping Address Zip / Postal Code	Case Insensitive Match
Order Status	Exact Match
Shipment Status	Exact Match
Store	Exact Match
Product SKU Code	Exact Match
RMA Code	Exact Match

Additionally, the following bugs were fixed:

• The "Account details" fields on the order search tab now works properly (these fields were being ignored).
• The "Shipping zip / postal code" field on the order search tab was actually searching for billing zip/postal code.
• The customer search sort by username was actually sorting by shared ID.
• The progress indicator in the bottom right corner of Commerce Manager now indicates when a search is in progress.

Fixed Issues

Stability/Correctness

• Extended expiry date for test Commerce Manager passwords to correct test failures.
• Fix for purchase lookup form not finding orders that were placed on behalf of the account that is specified in x-ep-account-shared-id.
• Fixed issue where service logs were not being written to the correct location. They are now always written to [user.home]/ep/logs.
• Fixed issue where adding a dependency within an embedded extension on any bean that has a direct or transitive settings:setting dependency caused a circular dependency.
• Fixed a potential LinkageError when external Extension Point Framework plugin attempted to use SLF4j logging classes.
• Fixed multiple issues when retrieving setting definition values:
  • When retrieving a value for a Boolean setting definition, if the value was missing it would be returned as false instead of throwing an exception.
  • When retrieving a context-specific value for a setting definitions using the immediate cache refresh strategy, the framework did not fall back to the default value if the context key was missing.
• XPFEntityUtil#getAttributeValueByKey threw a NullPointerException instead of returning Optional.empty if an attribute value wasn’t found for the passed locale.
• Modified Cortex to allow it to continue functioning normally if ActiveMQ is overloaded or offline.
• Refactored most logging calls from using Log4j2 classes to SLF4j classes to allow these log messages to appear properly in Cortex (which uses Logback for logging).
• Fixed issue where Cortex prevented checkout for default shopping carts that were missing cart modifier values.
• When a Data Sync Tool failure occurs, the log now contains details about which object failed.
• Fixed issue where JMX still showed an Extension Point Framework plugin as loaded after it is unloaded dynamically.
• Improved the SETTING_VALUE_RETRIEVAL Extension Point so that if an extension throws an exception, any subsequent extensions will still be invoked.
• If attempting to unload an Extension Point Framework plugin that does not exist, a meaningful error is now returned instead of a NullPointerException.
• Fixed issue where an Extension Point Framework extension class without any @XPFAnnotation could not be assigned to an extension point using the extensions.json file.
• Fixed issue with the pricing engine not properly differentiating between product codes and sku codes when searching for base amounts. If a product and a product sku have the same code, then without this fix the pricing engine might incorrectly return the price for the wrong base amount.
• Fixed an issue where domain event messages were not being published for domain classes that were extended. The DomainEventTypeFactoryImpl class evaluates which domain event type should be published based on the entity class being persisted. Now as long as the extended domain class is assignable to the specified class, the domain events will work normally.
• Fixed issue where users with the same username in different upper/lowercase are treated as separate users in PostgreSQL.
• When accessing the Operational Insights API, the response no longer returns a redirect to a different URL. The redirect was causing issues for environments with multiple Integration Servers behind a load balancer.
• Fixed issues with custom sort attributes that used the date data type.
• Updated the order item detail table in Commerce Manager to allow values to be copied into the clipboard on completed orders.
• Fixed optimistic locking error that would occur when attempting to edit the same system configuration setting more than once in a Commerce Manager session.
• Updated promotion rule caching to prevent a potential thundering herd issue under high load.
• Modified the coupon service to skip updating coupon usage values for unlimited use coupons to avoid concurrency issues under high load with unlimited public coupons.
• Fixed issue where offer search results can sometimes return the wrong result from the cache due to incorrect hashcode/equals methods on SearchCriteria classes.
• Fixed an issue where creating an exchange can result in two payments being collected from the customer.
• Increased the size of the fields used to hold catalog syndication content.
• Fixed issue with multiple Cortex OSGi bundles exporting the same package, leading to potential instability at startup.
• Improved thread safety around promotion rule compilation.
• Added ResetAbandonedTimer JDBC interceptor and increased remove abandoned timeout on the Tomcat JDBC Connection Pool to prevent "Connection has already been closed" errors.
• Fixed issue where cart item modifiers on shopping cart child line items cannot be updated.
• Fixed issue where if there is a bundle in the cart with children, and the bundle cart item modifier is modified, the cart item modifier values on all child items are lost.
• When a promotion can apply to multiple cart line items, this fix ensures that the appliedpromotions resource shows the promotion for all of the applicable line items.
• Enabled Checkstyle and PMD for liquibase-extensions module.
• Fixed issue with DST cache that is not cleared after failed synchronizations, which can lead to errors in subsequent synchronization attempts.
• Fixed potential NullPointerException during Batch server startup, caused by the way that configuration settings were wired into some batch job classes.
• Refactored TaxCalculationResultImpl to improve consistency around how it is initialized.
• Fixed boolean datatype for the "deleted" column of the TCATALOGHISTORY table (in PostgreSQL).
• Modified I search for an order by number Cucumber expectation to wait until all Outbox messages are consumed to resolve intermittent test failures.
• Removed duplicate DataPopulationMojoRunner class in extensions module.
• Modified RelayOutboxMessageBatchProcessor to inject the producer template via Spring instead of @EndpointInject annotation to improve reliability.
• Improved the exception message logged when an extension class fails to startup by logging the name of the extension class that failed.
• Allow super users to move changeset objects to changesets created by other users.
• Allow business users to add "not sold separately" products as associations.
• Fixed a scenario where the Integration Server product lookup cache could be populated with a partially loaded product object, which led to NullPointerExceptions.
• Fixed intermittent failure in OrderHoldStrategyXPFBridgeImplTest#testEvaluateOrderHoldsWithDefaultExtensions integration test.
• Fixed intermittent failure in XPFExtensionLookupImplTest.testGetMultipleExtensionsTimeLogging unit test.
• Fixed intermittent failure in InsightsServiceImplTest#testConvertLocalDateTimeToDBDate unit test.
• Fixed race condition in IndexNotificationProcessor preventing index notifications from being deleted properly.
• Added ability to set customer username as a data policy data point so that Personally-Identifiable Information data in that field (usually email address) is removed when consent is revoked.
• Removed the Top Seller quartz job and corresponding sales count field on products. This job was only intended for use in demos, and was causing optimistic locking errors in the Data Sync Tool.
• Updated Commerce Manager to allow base amounts to be added/edited/deleted without first adding the price list to the changeset.
• Fixed issue where the wishlistmemberships Cortex resource returned no results if the x-ep-account-shared-id header was set.
• Fixed issue where deployment package module would fail to build if the project version contained the string data or schema.
• Reduced the amount of unnecessary logging produced when running Cucumber tests.
• Resolved Cannot resolve plugin org.eclipse.m2e:lifecycle-mapping:1.0.0 warning when loading code in IntelliJ.
• Fixed issue with extension point proxy that could cause a ClassCastException if an extension is extended.
• All P2 repository URLs pointing to http://download.eclipse.org have been be updated to https://download.eclipse.org.
• Removed unused .gitignore files.
• Fix for failing email file attachments Cucumber test due to change in place-hold.it URL.

Import/Export

• Fixed issue where exporting a specific store using the filter query in the Import/Export API would export all associated stores instead of just the requested store. For example, https://[INTEGRATION_BASE_URL]>/api/importexport/export?query=FIND Store WHERE StoreCode = 'mobee'&type=Store should only export the mobee store.
• Disabled unnecessary dependency retrieval when exporting products through Import/Export API to greatly improve performance. Also fixed DIRECT_ONLY flag in exportconfiguration.xml so it correctly excludes associated products from the product export.
• Fixed error when importing promotion condition rules: The content of element conditions is not complete.

Performance

• Performance improvement to ensure that if StoreProductService#wrapProduct is invoked on a wrapped product, that it isn’t double wrapped.
• Performance improvement for the Cortex shopping cart link on cart order, which was retrieving a fully loaded cart order when only the shopping cart guid was required.
• Performance improvement for the isItemPurchaseable method that was unnecessarily retrieving the shopping cart GUID.
• Performance improvement to avoid loading the entire cart order when only the shopping cart GUID is needed.
• Modified the Commerce Manager promotion wizard sku and product selection dialogs to avoid showing prices, which can be a performance bottleneck.
• Performance improvements for tax lookups when using Elastic Path tax tables with a large number of tax regions and values.
• Fixed a performance issue where shopping cart validators were executed twice at checkout.
• Fixed performance inefficiency when importing price lists through Import/Export if the BASE_AMOUNTS dependent element is set to CLEAR_COLLECTION.
• Fixed search indexing to allow each index to commit as soon as it is complete instead of waiting for all indexes to complete.
• Modified coupon table to store coupon codes in uppercase so we can do a case-insensitive lookups without a table scan.
• Changed attribute value LONG_TEXT_VALUE field from CLOB to VARCHAR to prevent JPA from making additional database queries for each attribute value.
• Improved the CatalogPromotionMonitor to ensure that products aren’t re-indexed immediately after a full build completes.
• Avoid inventory lookup during search indexing for stores with isDisplayOutOfStock set to true.
• Increased the number of primary key sequence values that are retrieved in a batch for additional transactional entities to improve record insert performance.
• Removed unnecessary event handler that was loading price lists into memory during authentication.

Liquibase Changesets

• Improved upgrade performance of the PB-8250 Migrate Data to USERNAME Liquibase changeset on MySQL.
• Fix for the 2020-08-remove-gender changeset to ensure that it doesn’t unintentionally delete unrelated localized properties.
• Significantly improved performance of the 2020-05-update-accountmanagement-customertype Liquibase changeset.
• Fixed multiple issues with Liquibase changesets in core-changelog-2020-03-payments.xml which could cause errors during a database upgrade.
• Improved upgrade performance of Liquibase changesets: 7.6.0-torder-make-cart-order-guids-unique, 2020-09-convert-customer-passwords-to-bcrypt, 2020-08-flatten-order-sku-tree-*, 2020-03-payment-configurations-*, 2020-05-update-accountmanagement-customertype.
• Improved upgrade performance of the PopulateCustomerType custom Liquibase data migration task.
• Improved upgrade performance of the UpdateDuplicateOrders custom Liquibase data migration task.
• Improved upgrade performance of the PurgeDanglingCartOrders custom Liquibase data migration task.
• Added preconditions to ensure that PostgreSQL-specific changesets aren’t executed after migrating from MySQL or Oracle to PostgreSQL.
• Renamed the ROLE_CODE field in several tables to better reflect what it actually contains.

Security & Dependency Upgrades

• Fixed potential cross-site scripting vulnerability in Cortex Studio when adding a custom entry point.
• Added HTTP header and Javascript to defend against potential clickjacking attacks on Cortex Studio.
• Upgraded all code to use Apache Commons Collections 4 packages instead of Apache Commons Collections 3.
• Upgraded Apache OpenJPA from version 2.4 to 3.2.
• Upgraded Plexus utils from version 2.0.4 to 3.0.24.
• Upgraded Apache SOLR from version 7.4 to 8.11.1.
• Upgraded Apache Shiro from version 1.3.2 to 1.8.0.
• Upgraded Liquibase from version 3.10.3 to 4.8.0.
• Upgraded Apache Spring Batch from version 4.0.4 to 4.2.3.
• Upgraded ActiveMQ to version 5.16.4 which uses Reload4j instead of Log4j to address several security vulnerabilities.
• Upgraded PostgreSQL JDBC driver from version 42.2.23 to 42.3.3.
• Upgraded Logback from version 1.2.3 to 1.2.10.
• Upgraded Log4j2 from version 2.13.3 to 2.17.1.

Upgrade notes

The upgrading Elastic Path guide provides general instructions on upgrading Elastic Path projects.

Core classes now use SLF4j logging classes instead of Log4j

Since Cortex uses Logback, and other services use Log4j for logging, we should be using SLF4j as a common interface to access either logging implementation. Most Self-Managed Commerce code has now been modified to use SLF4j classes instead of Log4j classes. If Log4j classes are used, then those logs may not appear in Cortex. Therefore we recommend that any logging done in extension code should also be migrated to SLF4j, as in the following example:

Extension code using Commons Collections 3 classes need to be upgraded to Commons Collections 4

Some Apache Commons Collections 3 dependencies have been removed. Therefore any extension code using org.apache.commons.collections.* imports will need to be changed to use org.apache.commons.collections4.* instead.

Core request-scoped caching

The important thing to consider for extensions is that the core request-scoped cache is properly invalidated.

In Cortex this is done by CRSCSupportRequestListener#requestDestroyed. Since this is invoked by a Servlet filter, it should work properly with all extensions.

In Search Server this is done by AbstractIndexServiceImpl#buildIndexJobRunner and AbstractIndexingStage.LogWrappedIndexingTask#run. Make sure that any search extensions extend these abstract classes.

In Integration Server this is done by CRSCEnabledRouteBuilder. Make sure that any custom Camel routes extend this class instead of RouteBuilder.

Changed attribute value LONG_TEXT_VALUE field from CLOB to VARCHAR

This fix changes the type of the LONG_TEXT_VALUE field in all attribute value tables (TCATEGORYATTRIBUTEVALUE, TCUSTOMERPROFILEVALUE, TPRODUCTSKUATTRIBUTEVALUE, and TPRODUCTATTRIBUTEVALUE) from CLOB to VARCHAR. This is done to avoid an extra select query on the database for each record returned in these tables. These extra select queries significantly slows performance when retrieving customers, categories, products, and product skus from the database, even when the LONG_TEXT_VALUE field is not populated.

Before deploying this change to production, note the following impacts:

• If any of the tables listed above contain a large amount of data in the LONG_TEXT_VALUE field for any single record, the data population process may fail.
  • For MySQL, the new limit is 20,000 characters.
  • For PostgreSQL, the new limit is 65535 bytes (note that each unicode character can consume between 1 and 4 bytes).
  • For Oracle, the new limit is 32767 bytes (note that each unicode character can consume between 1 and 4 bytes).
• The data population process may take several minutes or hours to execute, depending on the number of records in the tables listed above, database type used, and database size. While data population is running, Cortex operations may fail or be very slow due to database load and database table locks.
• Teams using Oracle must ensure that the MAX_STRING_SIZE parameter is set to EXTENDED before running data population process or it will fail.

For all these reasons, before deploying this change to production, your teams should test the data population process on a snapshot of your production database in a pre-production environment. Verify that the process is able to complete successfully and make note of how long the data population process takes. Also validate the behaviour of Cortex during the data population process; you may need to plan for downtime during this process if the Cortex impact is significant.

For teams using Oracle, follow these instructions to change your database MAX_STRING_SIZE parameter to EXTENDED:

• Oracle instructions
• Amazon RDS instructions

Modified logging format

Due to the changes to the logging formats (both CONSOLE and FILE), if you have any log aggregation tools that parse the log output, they will need to be updated.

Tax Calculation plugins

Any custom Tax Calculation plugins will need to be migrated from the old plugin approach to the new Extension Point Framework approach. Guidance on how to migrate can be found here.

Database changes

• Deleted unused TSETTINGDEFINITION records:
  • COMMERCE/SYSTEM/INVENTORY/inventoryStrategy
  • COMMERCE/SYSTEM/encryptionKey
• Dropped tables related to Top Seller functionality:
  • TTOPSELLER
  • TTOPSELLERPRODUCTS
• Dropped TPRODUCT.SALES_COUNT field.
• Deleted Top Seller TSETTINGDEFINITION record: COMMERCE/SYSTEM/CATALOG/catalogTopSellerCount.
• Renamed TRULE.ROLECODE field to TRULE.GUID.
• Renamed TAPPLIEDRULE.RULE_CODE field to TAPPLIEDRULE.RULE_CODE_CHECKSUM.
• Renamed TCOUPONCONFIG.RULECODE field to TCOUPONCONFIG.RULE_GUID.
• Added an index on the TTAXREGION.REGION_NAME field.
• Added a unique index on the composite of the TAX_REGION_UID and TAX_CODE_UID fields in TTAXVALUE. Also changed these fields to be non-nullable.
• Inserted records into TINDEXNOTIFY table to trigger a rebuild of all indexes after the upgrade from SOLR 7.4.x to 8.11.x.
• Converted the following field types from CLOB to VARCHAR:
  • TCATEGORYATTRIBUTEVALUE.LONG_TEXT_VALUE
  • TCUSTOMERPROFILEVALUE.LONG_TEXT_VALUE
  • TPRODUCTSKUATTRIBUTEVALUE.LONG_TEXT_VALUE
  • TPRODUCTATTRIBUTEVALUE.LONG_TEXT_VALUE
• Changed field type of TCATALOGHISTORY.DELETED from TINYINT to BOOLEAN (PostgreSQL only).
• Increased the size of the TCATALOGPROJECTIONS.CONTENT and TCATALOGHISTORY.CONTENT fields.
• Added LAST_MODIFIED_DATE field to TCHANGESET table.
• Changed the foreign key between TOBJECTGROUPMEMBER and TOBJECTMETADATA to cascade on delete.
• Changed the foreign key between TCHANGESET and TOBJECTGROUPMEMBER to cascade on delete.
• Changed the foreign key between TCHANGESET and TCHANGESETUSER to cascade on delete.
• Changed the foreign key between TORDERPAYMENT and TPAYMENTINSTRUMENT to cascade on delete.
• Changed the foreign key between TCARTORDERPAYMENTINSTRUMENT and TPAYMENTINSTRUMENT to cascade on delete.
• Changed the foreign key between TCUSTOMERPAYMENTINSTRUMENT and TPAYMENTINSTRUMENT to cascade on delete.
• Changed the foreign key between TPAYMENTINSTRUMENT and TPAYMENTINSTRUMENTDATA to cascade on delete.
• Inserted TSETTINGDEFINITION records for the new cleanup jobs:
  • COMMERCE/SYSTEM/CHANGESETCLEANUP/batchSize
  • COMMERCE/SYSTEM/CHANGESETCLEANUP/maxHistory
  • COMMERCE/SYSTEM/CHANGESETCLEANUP/enable
  • COMMERCE/SYSTEM/ORDERPAYMENTCLEANUP/batchSize
  • COMMERCE/SYSTEM/ORDERPAYMENTCLEANUP/maxHistory
  • COMMERCE/SYSTEM/ORDERPAYMENTCLEANUP/enable
  • COMMERCE/SYSTEM/PAYMENTINSTRUMENTCLEANUP/batchSize
• Added PAYMENT_PROVIDER_CONFIG_GUID field to TORDERPAYMENT table.
• Added indexes on:
  • TORDERADDRESS.FIRST_NAME
  • TORDERADDRESS.LAST_NAME
  • TORDERADDRESS.PHONE_NUMBER
  • TORDERADDRESS.FAX_NUMBER
  • TORDERADDRESS.ZIP_POSTAL_CODE
• Added COUPONCODE_UPPER field and index to TCOUPON.
• Added USERNAME_UPPER field and index to TCUSTOMERAUTHENTICATION.
• Changed TBASEAMOUNT index from a composite on PRICE_LIST_GUID and OBJECT_GUID, to a composite on PRICE_LIST_GUID, OBJECT_GUID, and OBJECT_TYPE.
• Updated COMMERCE/SYSTEM/SEARCH/searchHost setting definition to use application cache strategy.

Upgraded libraries

The following libraries are upgraded as part of this release, primarily to address vulnerabilities detected within these libraries:

Library	Change
aopalliance-repackaged-2.5.0-b42.jar	Removed
commons-daemon-1.2.4.jar	Removed
commons-io-2.11.0.jar	Removed
commons-lang-2.3.jar	Added
commons-lang3-3.12.0.jar	Removed
commons-logging-1.2.jar	Removed
commons-net-3.5.jar	Added
drools-persistence-api-7.6.0.Final.jar	Removed
drools-persistence-jpa-7.6.0.Final.jar	Removed
esapi-osgi-bundle-2.1.0.1.jar	Removed
gemini-blueprint-extender-2.1.0.RELEASE.jar	Removed
geronimo-annotation_1.0_spec-1.1.1.jar	Removed
geronimo-jacc_1.1_spec-1.0.2.jar	Removed
geronimo-jpa_2.0_spec-1.1.jar	Removed
geronimo-jpa_2.2_spec-1.1.jar	Added
hadoop-annotations-3.2.2.jar	Added
hadoop-auth-3.2.2.jar	Added
hadoop-common-3.2.2.jar	Added
hawtbuf-1.11.jar	Removed
hawtbuf-proto-1.11.jar	Removed
HdrHistogram-2.1.11.jar	Added
hk2-api-2.5.0-b42.jar	Removed
hk2-locator-2.5.0-b42.jar	Removed
hk2-utils-2.5.0-b42.jar	Removed
jasypt-1.9.3.jar	Removed
java-uuid-generator-3.1.5.jar	Removed
javax.inject-2.5.0-b42.jar	Removed
javax.xml.rpc_1.1.0.v201209140446.jar	Removed
javax.xml.soap_1.2.0.v201005080501.jar	Removed
jbpm-audit-7.6.0.Final.jar	Removed
jbpm-flow-7.6.0.Final.jar	Removed
jbpm-human-task-core-7.6.0.Final.jar	Removed
jbpm-human-task-workitems-7.6.0.Final.jar	Removed
jbpm-persistence-api-7.6.0.Final.jar	Removed
jbpm-persistence-jpa-7.6.0.Final.jar	Removed
jbpm-query-jpa-7.6.0.Final.jar	Removed
jbpm-runtime-manager-7.6.0.Final.jar	Removed
jcl-over-slf4j-1.7.25.jar	Removed
jdk.tools-1.8.jar	Added
jdom2-2.0.6.jar	Removed
jersey-client-2.27.jar	Removed
jersey-common-2.27.jar	Removed
jersey-container-servlet-2.27.jar	Removed
jersey-container-servlet-core-2.27.jar	Removed
jersey-hk2-2.27.jar	Removed
jersey-media-jaxb-2.27.jar	Removed
jersey-media-multipart-2.27.jar	Removed
jersey-server-2.27.jar	Removed
jul-to-slf4j-1.7.25.jar	Removed
LatencyUtils-2.0.3.jar	Added
liquibase-core-4.8.0.jar	Version changed from 3.10.3
log4j-over-slf4j-1.7.25.jar	Removed
logback-classic-1.2.10.jar	Version changed from 1.2.3
logback-core-1.2.10.jar	Version changed from 1.2.3
micrometer-core-1.3.9.jar	Added
mimepull-1.9.6.jar	Removed
objenesis-2.1.jar	Added
ojdbc8-19.9.0.0.jar	Removed
openjpa-3.2.2-ep1.0.jar	Version changed from 2.4.0-ep2.4
org.apache.axis_1.4.0.v201411182030.jar	Removed
org.apache.batik.css_1.8.0.v20170214-1941.jar	Removed
org.apache.batik.ext.awt_1.6.0.v201011041432.jar	Added
org.apache.batik.util_1.8.0.v20170214-1941.jar	Removed
org.apache.batik.util.gui_1.8.0.v20170214-1941.jar	Removed
org.apache.commons.discovery_0.2.0.v201004190315.jar	Removed
org.apache.commons.logging-1.1.1.v201101211721.jar	Removed
org.apache.felix.configadmin-1.8.16.jar	Removed
org.apache.felix.eventadmin-1.4.10.jar	Removed
org.apache.felix.fileinstall-3.6.4.jar	Removed
org.apache.felix.framework-5.6.10.jar	Removed
org.apache.felix.http.api-3.0.0.jar	Removed
org.apache.felix.http.bridge-4.0.2.jar	Removed
org.apache.felix.http.proxy-3.0.2.jar	Removed
org.apache.felix.http.servlet-api-1.1.2.jar	Removed
org.apache.felix.inventory-1.0.6.jar	Removed
org.apache.felix.metatype-1.1.6.jar	Removed
org.apache.felix.scr-2.0.14.jar	Removed
org.apache.felix.webconsole.plugins.ds-2.0.8.jar	Removed
org.apache.felix.webconsole.plugins.event-1.1.8.jar	Removed
org.apache.felix.webconsole.plugins.memoryusage-1.0.8.jar	Removed
org.apache.felix.webconsole.plugins.packageadmin-1.0.4.jar	Removed
org.apache.lucene.core_6.1.0.v20170814-1820.jar	Added
org.apache.lucene.core_7.1.0.v20171214-1510.jar	Removed
org.apache.servicemix.bundles.commons-collections-3.2.1_3.jar	Removed
org.apache.servicemix.bundles.josql-1.5_5.jar	Removed
org.apache.servicemix.bundles.quartz-2.3.2_1.jar	Removed
org.apache.servicemix.bundles.spring-context-support-4.3.30.RELEASE_1.jar	Removed
org.apache.servicemix.bundles.spring-jdbc-4.3.30.RELEASE_1.jar	Removed
org.apache.servicemix.bundles.spring-jms-4.3.30.RELEASE_1.jar	Removed
org.apache.servicemix.bundles.spring-orm-4.3.30.RELEASE_1.jar	Removed
org.apache.servicemix.bundles.spring-security-config-4.2.4.RELEASE_1.jar	Removed
org.apache.servicemix.bundles.spring-security-core-4.2.13.RELEASE_1.jar	Removed
org.apache.servicemix.bundles.spring-security-web-4.2.4.RELEASE_1.jar	Removed
org.apache.servicemix.bundles.spring-tx-4.3.30.RELEASE_1.jar	Removed
org.apache.servicemix.bundles.spring-web-4.3.30.RELEASE_1.jar	Removed
org.apache.servicemix.bundles.spring-webmvc-4.3.30.RELEASE_1.jar	Removed
org.apache.servicemix.bundles.xstream-1.4.18_1.jar	Removed
org.eclipse.birt_4.7.0.v201706222054.jar	Removed
org.eclipse.birt.chart.device.pdf-4.7.0.v201706222054.jar	Added
org.eclipse.birt.report.data.oda.excel-4.7.0.v201706222054.jar	Added
org.eclipse.birt.report.data.oda.jdbc_4.7.0.v201706222054.jar	Removed
org.eclipse.birt.report.data.oda.sampledb_4.7.0.v201706222054.jar	Removed
org.eclipse.birt.report.designer.editor.xml.wtp_4.7.0.v201706222054.jar	Removed
org.eclipse.birt.report.engine-4.7.0.v201706222054.jar	Added
org.eclipse.birt.report.viewer-4.7.0.v201706222054.jar	Added
org.eclipse.core.contenttype_3.7.0.v20180426-1644.jar	Removed
org.eclipse.core.expressions_3.6.100.v20180426-1644.jar	Removed
org.eclipse.core.filesystem_1.7.100.v20180304-1102.jar	Removed
org.eclipse.core.jobs_3.10.0.v20180427-1454.jar	Removed
org.eclipse.core.resources_3.13.0.v20180512-1138.jar	Removed
org.eclipse.core.runtime_3.14.0.v20180417-0825.jar	Removed
org.eclipse.datatools.connectivity.oda.feature_1.14.100.201802212225.jar	Removed
org.eclipse.equinox.app_1.3.500.v20171221-2204.jar	Removed
org.eclipse.equinox.common_3.10.0.v20180412-1130.jar	Removed
org.eclipse.equinox.preferences_3.7.100.v20180510-1129.jar	Removed
org.eclipse.equinox.registry_3.8.0.v20180426-1327.jar	Removed
org.eclipse.equinox.security_1.2.400.v20171221-2204.jar	Removed
org.eclipse.equinox.simpleconfigurator.manipulator_2.1.0.v20180103-0918-4.8.0.jar	Removed
org.eclipse.equinox.simpleconfigurator.manipulator-2.1.0.jar	Added
org.eclipse.help_3.8.100.v20180512-1136.jar	Removed
org.eclipse.osgi_3.13.0.v20180409-1500-4.8.0.jar	Removed
org.eclipse.osgi_3.13.0.v20180409-1500.jar	Removed
org.eclipse.osgi-3.13.0.jar	Added
org.eclipse.osgi.services_3.7.0.v20180223-1712.jar	Removed
org.eclipse.osgi.util_3.5.0.v20180219-1511-4.8.0.jar	Removed
org.eclipse.osgi.util_3.5.0.v20180219-1511.jar	Removed
org.eclipse.osgi.util-3.5.0.jar	Added
org.eclipse.sisu.inject-0.3.3.jar	Removed
org.eclipse.update.configurator_3.4.0.v20180512-1141-4.8.0.jar	Removed
org.eclipse.update.configurator-3.4.0.jar	Added
org.eclipse.wst.common.fproj_3.7.1.v201711202234.jar	Removed
org.osgi.service.log-1.3.0.jar	Removed
org.w3c.sac_1.3.0.v201706222054.jar	Removed
osgi-over-slf4j-1.7.25.jar	Removed
osgi-resource-locator-1.0.3.jar	Removed
postgresql-42.3.3.jar	Version changed from 42.2.23
slf4j-ext-1.7.32.jar	Version changed from 1.7.26
spring-batch-core-4.2.3.RELEASE.jar	Version changed from 4.0.4.RELEASE
spring-batch-infrastructure-4.2.3.RELEASE.jar	Version changed from 4.0.4.RELEASE
spring-retry-1.2.5.RELEASE.jar	Version changed from 1.2.4.RELEASE
spring-security-oauth2-bundle-2.3.3.RELEASE.jar	Removed
uk.co.spudsoft.birt.emitters.excel-4.7.0.v201706222054.jar	Added
velocity-engine-core-2.3.jar	Removed
xbean-asm9-shaded-4.20.jar	Added
xbean-spring-4.18.jar	Removed