X-Road v7.7 Release Notes
Release Info
Latest version release | 7.7.1 |
|---|---|
Release date | 26.12.2025 |
Earlier version releases | 7.7.0 (17.07.2025) |
Supported versions |
|
Supported platforms | Central Server
Configuration Proxy
Security Server
|
Official documentation | |
Source code | |
Software license |
Table of Contents
Changes in This Release
Summary of changes in version 7.7.0
Support for automatically activating authentication and sign certificate on the Security Server when they have been automatically renewed using ACME.
Support for defining a full name for subsystems.
Support for disabling all subsystems of a Security Server together and putting a Security Server in a maintenance mode.
Visualize subsystem and service usage metrics in the Security Server UI.
Support for removing HSM tokens using the Security Server UI and REST management API.
Support for automatically adjusting the memory allocation of the Security Server’s proxy component.
Support for Brazilian Portuguese, Russian and Turkmen languages on the Central Server and Security Server web interfaces contributed by the community.
Support for proxy component’s memory-related warnings via the healthcheck interface.
Minor enhancements and bug fixes based on user feedback.
Summary of changes in version 7.7.1
Fix a security vulnerability discovered and reported by Sivaaditya Panuganti.
Notices
Version 7.7.0
Currently no notices posted for version 7.7.0.
Version 7.7.1
Currently no notices posted for version 7.7.1.
Tickets in Release
Issue types: fix (bug fix or technical debt), improvement (improvement to an existing feature), new (a new feature).
Issue ID | Type | Summary |
|---|---|---|
Version 7.7.0 | ||
New | Introduce a script to the Security Server that allows changing the proxy memory limits during installation and when ran by the administrator. The script also provides suggested limits based on the available system memory. Further information is available in the Security Server installation and user guides. | |
Improvement | Reserve X-Road metaservice codes ( | |
Improvement | Allow removing HSM tokens via the Security Server UI to make the process less error-prone. When an HSM token is removed using the UI, restarting the The following limitation applies:
| |
Fix | Refactor code to get rid of hibernate-mappings to remove soon to be deprecated Hibernate functions from the X-Road codebase. | |
Improvement | Add support for downloading a Diagnostic Report from the Security Server. The report is a JSON file containing basic information about the Security Server’s configuration, e.g., X-Road version, operating system and version, Java version, etc. The report can be submitted as an attachment to technical support requests. | |
Improvement | Improve the Security Server ACME implementation to allow automatically activating authentication and signing certificates. By default, the automatic activation is disabled and it can be enabled using the When When Using ACME manually means that a Security Server administrator starts the ACME process manually on the Security Server. Instead, ACME auto renewal means automatically renewing a certificate that has been ordered using ACME. Finally, ordering a certificate manually means that a Security Server administrator manually generates a Certificate Signing Request (CSR) file on the Security Server and sends it to a Certificate Authority (CA) for signing. The authentication certificate registration request is sent automatically to the Central Server when authentication certificate is automatically renewed using ACME. Instead, when an authentication certificate is ordered manually using ACME, the authentication certificate registration request must be sent manually. Instead, in both cases, the automatic activation of the authentication certificate once the authentication certificate registration request has been approved on the Central Server depends on the value ( | |
New | Add support for defining and displaying subsystem names in a single language on the Security Server web interface. Changes in subsystem names are sent to the Central Server using the new When adding a new subsystem that doesn’t exist in the global configuration yet, the subsystem code is initially used as the subsystem name in the Security Server UI. Once the client registration request has been received by the Central Server and the client has been added to the global configuration, the user-defined subsystem name will automatically appear in the Security Server UI. When upgrading the Security Server from an older X-Road version that doesn’t support the subsystem name yet, the subsystem code is initially used as the default name for each subsystem until the subsystems are manually renamed by Security Server administrators. | |
New | Add support for defining and displaying subsystem names in a single language on the Central Server web interface. Persist and distribute the information in global configuration. When upgrading the Central Server from an older X-Road version that doesn’t support the subsystem name yet, the subsystem code is initially used as the default name for each subsystem until the subsystems are manually renamed by Security Server administrators. Enabling Security Servers to update subsystem names, the management service WSDL must be refreshed on the management Security Server(s). New management service | |
Improvement | Improve the Security Server diagnostics view to show the status of the authentication certificate registration notifications. When the notification is enabled, a notification email is sent to the defined email address when the authentication certificate is successfully registered. This applies to authentication certificates applied manually and using ACME. | |
Improvement | Improve the Security Server web interface to show fields in a fixed order in all views that depend on a dynamic source for available fields, e.g., during the certificate request generation process. Before the change, the field order may have varied between page loads on certain views. | |
Fix | Improve the X-Road code base so that annotations are used instead of XML mappings for all Hibernate related objects. | |
Fix | Improve internal exception classes and mappings so that they are used in a more uniform manner across the X-Road code base. | |
New | Review and merge a community contribution adding Russian language support to the Security Server and Central Server user interface. | |
New | Review and merge a community contribution adding Turkmen language support to the Security Server and Central Server user interface. | |
New | Add a new functionality to the health check interface to allow giving a warning if proxy memory usage exceeds the configured threshold. Note: By default, no threshold is configured and the feature is disabled. The threshold can be configured using the | |
New | Add new functionality to the Security Server diagnostics page to show current proxy memory usage, limits and the threshold (if configured using the Note: By default, no threshold is configured. Please refer to the System Parameters document for details. | |
Fix | Update Spring Boot to the latest version and fix migration issues on both Security Server and Central Server components. | |
Fix | Fix issue where certain files were missing from the Security Server Sidecar Docker image. | |
Improvement | Improve the look and feel of ACME-releated email notification statuses on the Security Server diagnostics page. | |
Improvement | Introduce a new environmental variable | |
Fix | Fix an issue introduced in version 7.6.0 where the Security Server applied only the first change to the | |
Improvement | Improve the Security Server keys and certificates CSR wizard to allow client side filtering of the member drop-box for signing certificates. | |
New | Add functionality to support setting a Security Server into maintenance mode on the Central Server. Maintenance mode can be enabled or disabled on the Security Server by its administrator, and the corresponding request is sent to the Central Server via the management services. These management requests are approved automatically and do not require manual approval. The Central Server administrator cannot enable or disable maintenance mode on behalf of a Security Server. However, the maintenance mode status of each Security Server is visible on the Central Server. Enabling Security Servers to enable/disable the maintenance mode, the management service WSDL must be refreshed on the management Security Server(s). New management services | |
New | Add functionality to support setting a Security Server into maintenance mode on the Security Server. When maintenance mode is enabled, the Security Server will not accept requests from other Security Servers. Any attempt to send a request to a Security Server in maintenance mode will result in an error. This error may include an optional message configured by the administrator of the target Security Server. If the target service is also registered on another Security Server that is not in maintenance mode, a client Security Server running X-Road version >= 7.7.0 will send the request to one of the available Security Servers. Instead, an older client Security Server is not able pick up an optional Security Server and the request will fail. The Security Server administrator can enable or disable maintenance mode as needed. However, a Security Server that provides management services cannot be placed into maintenance mode. In such cases, the maintenance mode feature is entirely disabled. When enabling or disabling maintenance mode on a Security Server, the maintenance mode status changes within a couple of minutes. The Security Server sends a maintenance mode activation/deactivation request to the Central Server through management services and the request is approved automatically. The Security Server status is updated to the global configuration by the Central Server and once the updated global configuration has reached all the Security Servers, the new maintenance mode status has been fully applied. | |
Fix | Fix issue in the Security Server Sidecar causing backing up the configuration to fail when the bound mount for | |
New | Add a gRPC endpoint to the Security Server operational monitoring add-on to allow providing visualization data for the Security Server REST interface. | |
New | Add a REST endpoint to the Security Server The traffic data is available only if the Operational Monitoring add-on is installed on the Security Server. For example, the Security Server Sidecar Docker image’s slim variants don’t include the add-on and therefore, the data are not available on them. | |
New | Add a page to the Security Server Diagnostics view that provides a visual representation of traffic passing through the Security Server. The page supports filtering traffic data by time frame, role (consumer/provider), member code, subsystem code, service code, and message status (success/failure). The available time frame depends on the configuration of the Operational Monitoring add-on. By default, the add-on retains operational monitoring data for seven days. This retention period can be adjusted using the The traffic data is available only if the Operational Monitoring add-on ( | |
Improvement | Improve Configuration Client logging to facilitate easier debugging of error scenarios. | |
Fix | Add support for TLSv1.3 to the Security Server admin UI and management REST API. After this change, both TLSv1.2 and TLSv1.3 will be supported by default. In addition, apply the TLS protocols and cipher suites defined by the | |
New | Review and merge a contribution from the community adding Brazilian Portuguese support to the Security Server and Central Server web interfaces. | |
Fix | Fix issues in Security Server error handling causing error messages to be incorrect or too general in certain cases. | |
Fix | Fix incorrect alignment of the node type in the UI of a secondary Security Server node within a Security Server cluster. | |
Fix | Fix minor layout issues in the Mail Notification Status section of the Security Server Diagnostics page that occur when sending a test email fails and an error message is displayed. | |
Version 7.7.1 | ||
Fix | Replace the JavaScript chart library used for operational monitoring metrics in the Security Server UI. | |
Fix | Resolve an issue that enabled path traversal attacks against connected REST services when access permissions were defined at the endpoint level and wildcard expressions were used in path definitions. | |
New/Updated Dependencies
Dependency | Old Version | New Version |
|---|---|---|
Version 7.7.0 | ||
ch.qos.logback.access:logback-access-tomcat |
| 2.0.6 |
ch.qos.logback.access:tomcat | 2.0.3 |
|
ch.qos.logback:logback-classic | 1.5.12 | 1.5.18 |
com.fasterxml.jackson.core:jackson-annotations | 2.18.2 | 2.19.0 |
com.fasterxml.jackson:jackson-bom | 2.18.2 | 2.19.0 |
com.google.protobuf:protobuf-java-util | 4.29.0 | 4.30.2 |
com.google.protobuf:protoc | 4.29.0 | 4.30.2 |
com.societegenerale.commons:arch-unit-gradle-plugin |
| 4.0.0 |
com.zaxxer:HikariCP | 6.2.1 | 6.3.0 |
commons-codec:commons-codec | 1.17.2 | 1.18.0 |
commons-io:commons-io | 2.18.0 | 2.19.0 |
io.github.openfeign:feign-hc5 | 13.5 | 13.6 |
io.grpc:grpc-netty-shaded | 1.68.2 | 1.72.0 |
io.grpc:grpc-protobuf | 1.68.2 | 1.72.0 |
io.grpc:grpc-stub | 1.68.2 | 1.72.0 |
io.grpc:protoc-gen-grpc-java | 1.68.2 | 1.72.0 |
io.opentelemetry.instrumentation:opentelemetry-instrumentation-annotations | 2.10.0 | 2.15.0 |
io.rest-assured:rest-assured | 5.5.0 | 5.5.1 |
io.swagger.core.v3:swagger-annotations | 2.2.28 | 2.2.30 |
io.swagger.parser.v3:swagger-parser | 2.1.25 | 2.1.26 |
io.swagger.parser.v3:swagger-parser-v3 | 2.1.25 | 2.1.26 |
jakarta.validation:jakarta.validation-api | 3.1.0 | 3.1.1 |
org.apache.ant:ant | 1.10.15 |
|
org.apache.commons:commons-configuration2 | 2.11.0 | 2.12.0 |
org.apache.commons:commons-text | 1.13.0 | 1.13.1 |
org.apache.cxf:cxf-rt-transports-http | 4.1.0 | 4.1.1 |
org.apache.cxf:cxf-tools-validator | 4.1.0 | 4.1.1 |
org.apache.httpcomponents.client5:httpclient5 | 5.4.1 | 5.4.4 |
org.apache.santuario:xmlsec | 4.0.3 | 4.0.4 |
org.apache.tika:tika-core | 3.0.0 | 3.2.0 |