Released 2026-10-29
Security
- Increased validation to content connector "toolDeepLinkingUrl" to prevent Cross-Site Scripting (XSS) vulnerabilities.
- Increased validation to player redirect and OIDC flow URLs to prevent Cross-Site Scripting (XSS) vulnerabilities.
- [.NET] - Bumped BouncyCastle.Cryptography to 2.7.0 for CVE-2026-103600. Deeply nested ASN.1 input could overflow the stack and terminate the Engine process (DoS).
- [Java] - CVE-2026-10532, CVE-2026-104721, and CVE-2026-1225 have no Logback fix on Java 8. Follow the new Logback guidance in Setup-Installation to avoid them.
- [Java] - Bumped Jackson to 2.18.11 and Bouncy Castle to 1.86 for CVEs with no evident exploit path in Engine: CVE-2026-89407, CVE-2026-89425, CVE-2026-19032, CVE-2026-59889, CVE-2026-68497, CVE-2026-77310, CVE-2026-83557, CVE-2026-91776, CVE-2026-91777, CVE-2026-0636, CVE-2026-13506, CVE-2026-8763, CVE-2026-5588.
- [Java] - Updated Jackson libraries to 2.21.8 to address CVE-2026-110879. Not exploitable in Engine.
- [Java] - Updated logback from 1.5.32 to 1.6.5.
- [Java] - Updated log4net from 3.3.0 > 3.5.0.
Bug Fixes
Fixed a regression where "about:blank" was rejected as a redirect URL (e.g. "redirectOnExitUrl on course preview and registration launch links).
- [xAPI] - Fixes LRS request failures when machine hostname is longer than 50 characters.
- [CMI5] - Fixes an issue where CMI5 /finalize "updateReason" values (e.g. Administrative) appeared correctly in registration progress but showed as "unknown" in RegistrationChanged webhook notifications.
- [.NET] - Fixed error when receiving multiple xAPI statements with same target statement.
Improvements
- Added three new configurable items:
- QueueFetchImportJobs - If enabled, all CreateFetchAndImportCourseJob requests will create the job and queue it - not start the job immediately. Defaults to "false".
- QueueFetchImportJobsIntervalSeconds - How long to sleep between checking for Fetch Import tasks to retry. Default to 120 seconds.
- QueueFetchImportJobsMaxAttempts - How many times to attempt a queued Fetch Import request before giving up. Defaults to 2 attempts.
- Added new Enumeration state for "ImportJobResultSchemaStatus" of "QUEUED".
- [LTI]: Added feature support for LTI Dynamic Registration when using Engine as an LTI tool.
- The PENS collect request "parametersvendor-data", "package-id" and "client" are now surfaced in the relevant course's "additionalMetadata" field.
- [CMI5] - Adds safeguard to prevent seeking past the end of a YouTube video on re-launch.
- [Upgrade] - Documents migration tolerates obsolete data.
- [Upgrade] - Adds MaxWritableRowsPerStatementBatch to control how many statements to process at once during the statements migration.
- [Upgrade] - Change upgrade setting "SkipOrphanRowCleanup" default from "false" to "true" to more appropriately control the "Repair Orphaned Rows" phase.
- [Upgrade] - Graceful legacy data handling of missing or corrupted actors and asserters during the documents migration.
- [Upgrade] - New setting ParallelRowFetch to enable parallel batch reading for certain supported tasks.
Performance
- [Memory/xAPI] - Reduced default "xapiStatement" index write cache expiration and therefore memory usage and cache pressure when receiving xAPI statements.
- [Memory/Tenancy] - Reduced cold tenant memory usage by 300 bytes/tenant. LocalCacheMaxEntries should be increased by 2x the max number of active tenants because tenant cache entries were not previously counting towards this total. For example, if "LocalCacheMaxEntries" is "200000" against 100 concurrent tenants, increase to "200200".
- [xAPI] - General memory improvements for background xAPI/ETL process.
- [Metrics/Tenancy] - Adds new setting EnableRecordingTenantMetrics to disable tenant-specific metrics and save 1KB/tenant.
- Adds new setting AllTenantsUseSameDatabaseConnectionInfo (defaults to "false"). Enabling can improve performance for processing tasks across all tenants.