enhancement
major
#29661
TL Views: Prototyp "TopLogic UI on MUI" – Adaptermodul mit Material UI für die ersetzbaren Komponenten
#29692
TL Views: Formularfelder, Tabellenzellen und das Bearbeiten eines Formulars richten sich nach den Modell-Zugriffsrechten
#29693
TL Views: Große und mehrwertige Werte erscheinen in Tabellenzellen als einzeilige Vorschau mit einem Knopf, der den vollständigen Editor in einem Dialog öffnet
#29707
Reduce PR CI build time: parallel reactor build, sharded scripted tests, affected-module builds
#29730
React-Oberfläche: Kanban-Board als View-Element (Karten per Drag & Drop zwischen Spalten verschieben)
#29744
TL Views: Entwicklerwerkzeuge (Designer, Aufzeichnen, Untersuchen, Agentenzugriff) in einem eigenen Entwicklungsmenü der App-Leiste
#29752
React-UI: Kleine Verbesserungen der Oberfläche (Snackbar, Hover, Tooltips, Schieberegler, Abstände)
#29758
ModelAccessRights: Anlegerecht in Kompositionsattribut für Spezialisierung des Zieltyps prüfen
#29759
React-UI: Commit-Nachrichten für Änderungen aus Sichten (TL-Script-Aktionen, Transaktionen, Löschen) konfigurierbar, sinnvolle Standard-Nachrichten
defect
major
#29642
React dialog size memory: one key for every dialog, stored size beats the declared width and is never clamped to the window
#29646
TL Views: Der Build der React-Client-Module prüft die TypeScript-Typen nicht, in com.top_logic.layout.react sind dadurch 29 Typfehler aufgelaufen
#29697
HistoryQuery: Start- und Stop-Revision aus HistoryQueryArguments werden bei der Suche ignoriert.
#29701
TL Views: a form shown again after its sidebar section or tab was hidden keeps the values it had when hidden; a reload renders the stale values again
#29711
Setzen einer geordneten Liste (ListStorage) ist beim Einfügen vor bestehenden Elementen überquadratisch langsam; TestListStorage misst Wanduhrzeit und scheitert unter Last
#29716
Modellbasierte Leseprüfung: Rollen-Lookup kompiliert pro Objekt und Gruppe neue KB-Abfragen, Nicht-Admin wartet 70 s statt 9 s
#29724
PathNavigation: abstract attribute rejected by isDerived() check even though concrete overrides exist and are tracked
#29728
FlowChartComponent: Ein Neubau des Diagramms entfernt Objekte aus der Selektion, die im Diagramm nicht dargestellt werden
#29731
TL Views: <persist-transient> copies the draft's empty values over the creation defaults; a sequence number or creation date computed at commit is lost
#29732
TL Views: <create-transient container="…"> creates the draft without the container's context; option lists and context-dependent defaults of the draft see no container
#29734
View form: <store-form-state/> does not persist new rows of a <composition-table>, so saving a persistent owner fails
#29737
TL Views: a collapsing toolbar measures its commands only when its groups change; a command that shows itself later keeps a 0 px toolbar and draws over the panel title
#29745
Zugriff auf ein abstraktes Attribut meldet einen Fehler, der nicht sagt, dass das Attribut abstrakt ist: eigene Storage für abstrakte Attribute
minor
#29696
Scheduler: Start- und Cluster-Verhalten von Tasks bereinigen – <on-startup/> pro Knotenstart, Tasks erst ab RUNNING, run-on-startup entfernen, kein Default für isNodeLocal()
#29699
TL-Script: htmlText(htmlSource($text), images) drops the images of a stored structured text, since it does not accept the "ref:" references it writes itself
#29700
TL Views: the open session of a deleted account keeps evaluating as that account; every model event logs "DeletedObjectAccess … was already deleted" from its observers
#29733
TL Views: a click on the padding of the React rich-text editor's content area does not focus the editor; the typed text is lost
#29738
TL Views: the menu cliques of a toolbar are labelled in English in every language ("More", "View", "Export")
#29739
React tooltip stays open at the window's top-left corner when its anchor is removed under the pointer
task
major
#29725
CheckDependencies: npm-Abhängigkeiten werden nicht aktualisiert, transitive Maven-Abhängigkeiten mit bekannten Sicherheitslücken
The Jenkins job CheckDependencies reports a growing number of known vulnerabilities (7 in August 2026, 42 in build #1211), although Renovate Bot keeps the declared Maven dependencies current.
Causes
- Renovate runs the maven manager only. The package.json / package-lock.json files of the React modules (com.top_logic.layout.react*, com.top_logic.react.flow.server, com.top_logic.model.search.react, com.top_logic.umljs, com.top_logic.demo.react.corporate) are never updated. Findings: vitest, @vitest/mocker, nanoid, postcss, source-map-js, browserslist, baseline-browser-mapping, @tiptap/core.
- Renovate only updates versions declared in a POM. Transitive dependencies stay at the version the declaring library requests:
- com.github.luben:zstd-jni 1.5.6-4 (via Kafka 3.9.2), fixed in 1.5.7-14.
- org.apache.pdfbox:pdfbox-io 3.0.7, fixed in 3.0.8.
- org.xerial.snappy:snappy-java 1.1.10.5 (via Kafka), no fixed version available.
- org.springframework:spring-core 6.2.19 (via pac4j-oidc), the CVEs concern Spring MVC / WebFlux / SpEL / RSocket, no open-source 6.2.x fix.
- com.ibm.mq:com.ibm.mq.jakarta.client 9.4.5.1 is current; the CVEs concern the IBM MQ queue manager.
Change
- Repository renovate.json enabling the npm manager (including lock file maintenance) in addition to maven.
- Update of the npm lock files.
- Pin fixed versions of vulnerable transitive Maven dependencies in the dependency management of tl-parent-all.
- Profile no-multi-module-directory in tl-parent-all: installs Node into the module build directory when maven.multiModuleProjectDirectory is not set (embedded Maven, e.g. Eclipse m2e).
- The profile full-build of tl-parent-all (which adds the engine modules to the reactor) is activated by the absence of the property skipFullBuild instead of activeByDefault, so that other active profiles of the POM no longer deactivate it. It can still be deactivated with -P !full-build or -DskipFullBuild.