2026.06

Changes since the 2026.03 release.

Servoy AI — Integrated AI Assistant

The flagship addition in 2026.06 is a fully integrated Servoy AI perspective and view directly inside the Eclipse IDE.

Servoy generates/configurates a full servoy skill and mcp server setup for deep integration in Servoy Developer.

This is for now invite only, please contact us if you like to work with us to test this.

Rhino upgrade

Rhino upgraded to 1.9.1 (from 1.8.x) this brings a lot of (internal) changes and improvements to the ECMA spec

See https://github.com/mozilla/rhino/releases (1.9.0 and 1.9.1 release notes) for more information. Not all features that are api or syntax are ported yet to the editor (will work at runtime), but if you notice one that you really would like to have please let us know.

Java upgraded to 25.0.3

Angular upgraded to 21.2.16 (the latest major release of 21.x)

This can potentially have some issues with webpackages that don't implement all components for TiNG or don't implement all the spec handlers fully (the one starting with "on" will then result in angular not building TiNG) For this a few packages like bootstrap, bootstrap-extra, servoy-extra and advanced renderers need to be updated.

Security Hardening

A comprehensive batch of security improvements was applied to servoy-client:

Encryption upgraded to AES-256-GCM + PBKDF2 — CryptUtils was rewritten with a new streaming API (newEncryptingStream, fileEncryption/fileDecryption). The legacy MD5+AES-ECB decrypt path is kept as a fallback for existing encrypted files but is deprecated; the old createCipher API is marked @Deprecated. All new encryption uses AES-256-GCM.
AES-GCM IV reuse vulnerability fixed — EncryptionHandler was reusing the same IV across calls; it now generates a cryptographically fresh IV per encryption call.
PBKDF2 iteration count raised from 9,999 to 600,000 — aligned with NIST SP 800-63B (2024 revision).
JWT fallback signing key now uses SecureRandom — was previously using Math.random().
PKCE PLAIN method removed — only S256 is accepted in OAuthHandler.
HTTP security response headers added: X-Content-Type-Options, X-Frame-Options, and Strict-Transport-Security (HSTS) are now sent on all responses.
CSRF token removed from server logs — the token value was being written to INFO-level logs in plain text; it is no longer logged.
CSRF Secure cookie flag is now set conditionally based on request.isSecure().
Failed authentication attempts are now logged at WARN level with the username and remote IP address.
Multiple XSS vulnerabilities fixed (CodeQL scanning alerts 69, 70, 74).
Zip Slip vulnerability fixed in archive extraction (alert 81).
Uncontrolled command line fixed (alert 49).
XML external entity injection fixed (alert 50).
Implicit narrowing conversion in compound assignment fixed (alert 55).

Database & Data Model

SVY-20967 — JSONB is now a native column type, enabling direct use of PostgreSQL's binary JSON type without wrapping or manual casting.
SVY-21085 — query.getSQLParameters() now casts parameters to the actual column type rather than returning them as raw objects.
SVY-20984 — Valuelist state is now correctly preserved after a find/search cycle.
SVY-20988 — DBTreeView state restore was silently failing; it now works correctly.
SVY-20942 — New @constant annotation alongside @enum; constants also work in relation columns.

Script Editor & Type System

uuid now extends String — UUID typed values are now assignable to and from String variables, removing spurious type-mismatch warnings throughout the script editor.
form.elements[x] returns the unified Component type — IBaseFormRuntimeComponent is the new Component base type shared by both web components and classic components. Casts between the two now work correctly, and the base type exposes visible and enabled.
Array<T> maps to java.lang.Object at runtime — enables correct type inference for constructs such as Array<bytes>.
SVY-20992 — Multiple DLTK typing issues resolved: stack overflow on self-referencing custom types, incorrect QB join return types, JSFoundSet.getParentRecords() returning the correct Array<JSRecord> type, and var x = {} now allowed when x is a CustomType.
SVY-20944 — Many new @SuppressWarnings tags added; line-level suppression is now supported.
SVY-21086 — Suppressed unnecessary compiler warning when assigning a variable with an element of the same type.
SVY-20909 — Overriding a method from a base form now correctly inherits JSDoc from the parent method.
SVY-20921 — QB methods coalesce, nullif, and mod now have documentation in Solex and show @param types correctly in the script editor tooltip.
SVY-20653 — Script editor tooltips: bold parameter name rendering in collapse component fixed; rogue @return without a description removed.
SVY-20983 — Solex shows a component's API even when the component is installed as a ZIP package.

Form Designer

SVY-21129 — Dynamic alignment guides no longer jump when resizing a component in a single direction.
SVY-20910 — Responsive form builder now blocks pasting components outside a container; behavior is consistent with drag-drop.
SVY-21056 — Restoring a default value on a tabpanel tabs property now correctly refreshes the form designer ghosts.

Mobile Client

SVY-20993 — Services without server-side scripting now work in the mobile client.
SVY-20994 — forms.<formname>.containers.<name> navigation paths now work in the mobile client.

Testing

SVY-20918 — Code coverage is now reported in unit test runs.
SVY-21025 — [AI] New "Show form in browser" action opens a form directly in the browser for testing purposes, bypassing authentication.
SVY-21024 — [AI] jsunit test tool can now be run from within the IDE with results fed back inline.

Bug Fixes

Case

Description

SVY-21077

Menus: enabled=false now propagates correctly

SVY-21072

Duplicate UUID and name in script methods after clone

SVY-21054

Non-bootstrap date input fields now update data correctly when entered without a separator

SVY-21043

Cannot select files to upload (incident fix)

SVY-21017

Popup menu: tooltip text support on submenu items

SVY-21011

Tab order now works correctly in a second popup form

SVY-20987

OAuth plugin: state mismatch callback, JWK key with no algorithm specified, webclient compatibility

SVY-20948

Stateless login form no longer flickers when permissions change

SVY-20932

JSWindow.setSize() is no longer ignored for dialog windows

SVY-20904

Rhino updated to 1.9.0; PDF viewer server-side compile error fixed

SVY-20784

WebCustomType flattened serialization refactored; fixes related e2e and jsunit failures

SVY-20950

async-now API now correctly sends component/service changes to the client

SVY-19340

InvalidDateTime error no longer thrown when the hour has only one digit

SVYX-1128

Typeahead dropdown caret rendering fixed

REST Web Services

Binary response handling improved — When a REST web service method returns a byte[] and the declared content type is binary, the byte array is now sent directly to the response without conversion. Previously this could cause incorrect serialization of binary data.
SVY-20995 — Upgraded to Apache Commons FileUpload2 M5. (this is also used in other places where uploads are done like NGClient)

Platform & Infrastructure

Eclipse 2026-03 (4.39) — The underlying Eclipse platform, JFace, and all p2 target sites have been updated to the latest 2025-12 release. The splash screen text visibility regression introduced by Eclipse 4.39 has been fixed.
Tomcat 11.0.22 — Embedded Tomcat updated to 11.0.22.
Chromium/CEF 144.0.5 — Bundled Chromium browser updated to 144.0.4.
Rhino 1.9.1 — JavaScript engine updated (also fixes the PDF viewer server-side compile error, see SVY-20904).

20226.06.0 (final) Cases

there are some extra fixes in the rhino/dltk part in the final build

Components

Key

Summary