Engine and Engine Dispatch 23.50.577

Released 2026-11-09

Fixed regression where about:blank was rejected as a redirect URL (e.g. redirectOnExitUrl) on course preview and registration launch links.
Fixed an intermittent 500 error ("The given key was not present in the dictionary") from plugin API call - such as LTI 1.3 line items - when a tenant was deleted at the same moment.
[Upgrade] - Fixes problem loading internal schema document when upgrading from 21 and below while relying on the FromMajorVersion setting.
[LTI 1.3] - Launch tokens (id_token) received from Platform and Assignment and Grade Services client assertions received from tools are now rejected if their iat (issued at) claim is ApiTokenPostbackValidHours or more in the past. Prior to this, only tokens issued too far in the future were rejected.
[LTI 1.3] - Nonces from LTI 1.3 dispatch launches are now remembered for twice ApiTokenPostbackValidHours instead of being stored with an expiry decades in the future.
[LTI 1.3] - Fixed Assignment and Grade Services access tokens and LTI 1.3 launch tokens being issued already expired when ApiTokenPostbackValidHours is set to "597" or more.
[Content Connector] - Fixed temp directory cleanup for content connector import when using QueueFetchImportJobs.

When SingleUsageQueryAcrossTenants is "true", gather usage counts across tenants in one query. If unset, SingleUsageQueryAcrossTenants falls back to AllTenantsUseSameDatabaseConnectionInfo.
Added "onpagehide" handler to launch page ("unload" and "beforeunload" were already present).
Two new endpoints were added to allow course metadata to be updated via PATCH requests: /courses/{courseId}/versions/{versionId}/metadata and /courses/{courseId}/metadata.
[LTI 1.1] - Custom parameter names are now stored and sent in the form the spec describes (lowercase, non-alphanumerics replaced with _) when Engine adds the custom_ prefix. For example, the supplemental launch parameter userId is now sent as custom_userid instead of custom_userId.
[Upgrade] - Validates and warns when legacy 'utf8' collation detected on schema.
[Upgrade] - Defer dropping upgrade-specific indexes until the tail-end of the process.

Breaking Change: Course and asset imports from Engine's local file system (file: URLs or local paths in fetchRequest, referenceRequest, /courses/importJobs, and asset fetchUrl) are now rejected unless the new system setting ImportLocalFileAllowList lists the directories they may come from. Paths are resolved (including ..) before checking and must be one of those directories or inside one.
Updated Guava to 33.8.0-jre to address CVE-2026-118042.
[LTI 1.3] - Throttle JWKS refetches triggered by unknown kid values so a forged token can no longer force unbounded requests to the platform's JWKS endpoint.

Search