#28674 Security issues in the UMLJS project

enhancement

major

#28994

TableComponent: ConfigKey should be customizable

#29055

User-specified CSS classes cannot override default numeric alignment in table columns

#29084

JSON Schema Support for Typed Configuration

#29092

Multi-factor authentication and self-service account management

minor

#29037

Upload/update workflows at application startup

#29095

No fixed reference to tl-build-processor in tl-parent-build

#29204

TreeGrid Modelbuilder API: Node predicate does not get component model

nice-to-have

#29103

Making REST client JSON parser robust against empty content

defect

critical

#29080

Unwanted row objects in tables with changes from other sessions

#29199

XSS vulnerability in /jsp/openapi/server/displayAPISpec.jsp

major

#28674

Security issues in the UMLJS project

#28710

Accounts with reused contact have no authorization

#28993

Filters of dynamic columns ignore the attribute type

#29042

Error in column filter for double values

#29107

StackOverflowError when rolling back in the transaction monitor

#29111

JavaDoc-based I18N generation ignores custom ResKey in I18NConstants

minor

#27850

Modelleditor swallows classification with a less-than sign in the name

#28456

Reference to missing files in subsession.jsp

#28485

Immutable/Disbled Boolean fields accessible/focusable via tab

#28651

Unnecessary space for inline tables

#28725

Pointless scroll bar in the help editor

#29053

TL-Script: format() with null input returns IllegalArgumentException

#29061

Missing replacement of KnowledgeItem by ObjectKey in Collections in Queries

#29066

"SafeHTML not started" error with scripted tests

#29069

A calculated attribute of the type "General search expression" cannot return a closure

#29073

Abstract attributes can be accessed in transient objects

#29074

The form data of a component cannot be accessed in a value transformation of a component channel

#29075

After changing the model, calculated attributes that have become invalid can no longer be edited

#29076

API key in REST interface configuration is not hidden

#29087

Incorrect access to the D&D cache in the browser

#29091

Values of a composition attribute cannot be edited if previously used in the same form

#29106

Error when restarting the KnowledgeBase

#29112

Update minimatch and serialize-javascript to fix CVE-2026-27903, CVE-2026-27904, and GHSA-5c6j-r48x-rmvq

#29197

Eclipse error after dependency update: maven-jar-plugin 3.5.0 causes "outside of a scoping block" error in m2e

update

critical

#29110

Update dependency com.fasterxml.jackson.core:jackson-core to v2.21.1 [SECURITY]

defect

major

#28674

Security issues in the UMLJS project

Charts SecurityIssue

Various npm dependencies are integrated via the com.top_logic.umljs module.

Vulnerabilities have been found in several of these dependencies in the meantime:

braces: CVE-2024-4068 | High severity
micromatch: CVE-2024-4067 | Moderate severity
rollup: CVE-2024-47068 | High severity
cross-spawn: CVE-2024-21538 | High severity
serialize-javascript: CVE-2024-11831 | Moderate severity
brace-expansion: CVE-2025-5889 | Low severity
js-yaml: CVE-2025-64718 | Moderate severity

The version of the explicit dependencies rollup and cross-spawn is thus raised manually and the others automatically by compiling with npm.