Released 2026-10-22
Bug Fixes
- [.NET] - Fixed error when receiving multiple xAPI statements with same target statement.
Improvements
- [Upgrade] - New setting ParallelRowFetch to enable parallel batch reading for certain supported tasks.
- Added three new configurable items:
- QueueFetchImportJobs - If enabled, all CreateFetchAndImportCourseJob requests will create the job and queue it - not start the job immediately. Defaults to "false".
- QueueFetchImportJobsIntervalSeconds - How long to sleep between checking for Fetch Import tasks to retry. Default to 120 seconds.
- QueueFetchImportJobsMaxAttempts - How many times to attempt a queued Fetch Import request before giving up. Defaults to 2 attempts.
- Added new Enumeration state for ImportJobResultSchemaStatus of QUEUED.
- [Memory/xAPI] - Reduced default "xapiStatement" index write cache expiration and therefore memory usage and cache pressure when receiving xAPI statements.
- [Memory/Tenancy] - Reduced cold tenant memory usage by 300 bytes/tenant. LocalCacheMaxEntries should be increased by 2x the max number of active tenants because tenant cache entries were not previously counting towards this total. For example, if "LocalCacheMaxEntries" is "200000" against 100 concurrent tenants, increase to "200200".
- [xAPI] - General memory improvements for background xAPI/ETL process.
- [Metrics/tenancy] - Adds new setting EnableRecordingTenantMetrics to disable tenant-specific metrics and save 1KB/tenant.
- Adds new setting AllTenantsUseSameDatabaseConnectionInfo (defaults to "false"). Enabling can improve performance for processing tasks across all tenants.
Security
- Increased validation to player redirect and OIDC flow URLs to prevent Cross-Site Scripting (XSS) vulnerabilities.
- [.NET] - Bumped BouncyCastle.Cryptography to 2.7.0 for CVE-2026-103600. Deeply nested ASN.1 input could overflow the stack and terminate the Engine process (DoS).
- [Java] - CVE-2026-10532, CVE-2026-104721, and CVE-2026-1225 have no Logback fix on Java 8. Follow the new Logback guidance in Setup-Installation to avoid them.
- [Java] - Bumped Jackson to 2.18.11 and Bouncy Castle to 1.86 for CVEs with no evident exploit path in Engine: CVE-2026-89407, CVE-2026-89425, CVE-2026-19032, CVE-2026-59889, CVE-2026-68497, CVE-2026-77310, CVE-2026-83557, CVE-2026-91776, CVE-2026-91777, CVE-2026-0636, CVE-2026-13506, CVE-2026-8763, CVE-2026-5588.
[Java] - Updated Jackson libraries to 2.18.12 to address CVE-2026-110879. Not exploitable in Engine.