Released 2026-11-09
Bug Fixes
- [Player] - Improved RecordResults reliability by fixing the sendBeacon fallback call.
Improvements
- [LTI] - Adds the value configured as
LtiPlatformIssuer, the Platform Issuer Identifier, as a trusted audience when validating the audience (aud) claim in the client assertion token for LTI access token requests to Engine's/tokenendpoint.
Security
- [.NET] - Bumped BouncyCastle.Cryptography to 2.7.0 for CVE-2026-103600. Deeply nested ASN.1 input could overflow the stack and terminate the Engine process (DoS).
- [Java] - CVE-2026-10532, CVE-2026-104721, and CVE-2026-1225 have no Logback fix on Java 8. Follow the new Logback guidance in Setup-Installation to avoid them.
- [Java] - Updated Jersey dependencies to version 2.47 to address CVE-2025-12383.
- [Java] - Updated Jackson from 2.16.1 to 2.18.12, Bouncy Castle to 1.86 and Guava to 33.7.2 for CVEs with no evident exploit path in Engine.
- [Java] - Bumped Jackson to 2.18.11 and Bouncy Castle to 1.86 for CVEs with no evident exploit path in Engine: CVE-2026-89407, CVE-2026-89425, CVE-2026-19032, CVE-2026-59889, CVE-2026-68497, CVE-2026-77310, CVE-2026-83557, CVE-2026-91776, CVE-2026-91777, CVE-2026-0636, CVE-2026-13506, CVE-2026-8763, CVE-2026-5588.