2026.09

Changes since the 2026.06 release.

26.09 is a Major update to our TiNG client, the whole core is fully migrated to Angular 22 (see below) The result of this was that all our packages need to adjust for this, so we already did (and will add more) releases for many packages.

For customers that have there own custom components, these will not work and need to be also migrated. For this we have an AI skill: https://raw.githubusercontent.com/Servoy/servoy-eclipse/refs/heads/master/skills/servoy-component-migration/SKILL.md

Currently we are in zoneless mode (this is something of angular), but we still include the older zone.js (which handles all the events and triggers for updates on components). But that include will only be in the 09RC versions, we plan te remove it in the final. We do include it because then exceptions like this can sometimes be seen in the browser:

NG0100: ExpressionChangedAfterItHasBeenCheckedError: Expression has changed after it was checked.

those kind of exceptions means that the components is not fully migrated yet and is doing updates at the wrong time, and it still needs fixes. So do report this to us so we can have a look.

Angular upgraded to 22

The NGClient (TiNG) stack was upgraded to Angular 22.1.x (from 21.x), together with a large modernization effort across all Angular projects (NGClient core, @servoy/public, @servoy/servoydefault, servoycore, the RFB designer and the Web Package Manager):

Standalone components everywhere — NgModules were removed in favor of bootstrapApplication and standalone components with direct imports.
Zoneless change detection — zone.js was removed; reactive state was migrated to signals (input()/output()/model(), signal queries, computed()), with ChangeDetectionStrategy.OnPush and dev-mode exhaustive checks enabled.
inject()-based DI — constructor injection was replaced with the inject() function across services, components and directives.
Vitest replaces Karma/Jasmine for unit tests, and ESLint flat config replaces the legacy setup.

As with previous major Angular bumps, web packages that don't implement all TiNG component/spec handlers may need to be updated. Packages such as bootstrap, bootstrap-extra, servoy-extra and advanced renderers should be on their latest versions.

Servoy AI — MCP server for solutions

Building on the integrated Servoy AI perspective from 2026.06, this release ships an MCP (Model Context Protocol) server for Servoy solutions (SVY-21326). The servoy_mcp endpoint is bundled with the developer, is registered automatically and re-scans/invalidates on solution import and save, so AI tooling can inspect and act on the live solution model.

Rhino upgrade

Rhino was updated to 1.9.1.s4 (from 1.9.1.s2). This build includes fixes to compiled-mode execution:

Fixed NullPointerException compiling destructuring parameters and an IndexObject ClassCastException in compiled mode (SVY-21250).
Flatten ConsString in NativeArray.unwrap() to fix a string-concatenation issue (SVY-21180).
Added a getScriptStack() API for cross-thread script stack extraction, used to enhance server stack dumps with Rhino script stack traces.

See https://github.com/mozilla/rhino/releases for the upstream 1.9.x notes. Not all new syntax/API is ported to the editor yet (it works at runtime); let us know if there is one you'd like to see.

Security Hardening

Multiple XSS CodeQL findings fixed across the runtime and server (alerts 29, 61, 62, 71).
Open redirect (URL redirection from remote source) fixed in AngularIndexPageFilter and on the server (CodeQL alerts 5, 6, 60).
CSRF protection added to cloud intermediate form submissions (SVY-21327).
A polynomial ReDoS warning in AbstractAuthenticatorManager was addressed with a possessive quantifier.
CodeQL configuration was added to exclude legacy NG1 and third-party code from scanning.

Platform & Infrastructure

The Servoy Developer and application server were updated to newer platform components:

Eclipse 2026-06 — Servoy Developer now runs on the Eclipse 2026-06 platform (including updated JFace, GEF, TM4E and Nebula widgets).
Tomcat 11.0.25 — The embedded application server was updated (SVY-21304).
Node.js 24.18.0 — The Node.js runtime bundled with Developer for building the NGClient was updated.
Rhino 1.9.1.s4 — The JavaScript engine was updated (see the Rhino upgrade section above).

Bundled libraries were also refreshed, including Apache HttpClient/HttpCore, PDFBox/FontBox, Jackson, Bouncy Castle (1.85.x), Auth0 java-jwt/jwks-rsa, Apache Commons IO, the RabbitMQ AMQP client and metadata-extractor.

For the final 2026.09 build the bundled libraries were refreshed once more: Bouncy Castle 1.86, Jackson 2.22.3, Auth0 java-jwt 4.6.1, byte-buddy 1.18.14, slf4j 2.0.20, snakeyaml 2.7, OWASP encoder 1.4.1, ethlo itu 1.16.0, stax2-api 4.3.1 and Apache Aries SpiFly 1.3.8.

Database & Data Model

SVY-21279 — H2 added as an in-memory (temp table) JDBC driver, with fixes for temp-table visibility, SAPDB/Oracle/Postgres keyword handling, transactions and identity columns.
SVY-21218 — Follow-up: the TEMP_ prefix filter moved from lookForNewTempTables into loadTables, fixing repeated loadTables calls and a memory leak for TEMP_ tables.
SVY-21316 — HXTT DBF database now handles composite primary keys correctly.
SVY-21276 — ColumnInfo is now shared from the parent server for clone servers in WAR deployment.
Bulk updates now use a PK IN condition in JSFoundSetUpdater when all PKs are loaded.

Script Editor & Type System

SVY-21306 — String.replaceAll() added to the documentation model.
SVY-21055 — Fixed tooltip line breaks for component API methods in the Solution Explorer, and duplicate <br> tags before doc tags when blank lines precede them.
SVY-21118 — Object<String> parameter types are now displayed instead of a plain Object; jsType is propagated from documentation to ScriptParameter.
SVY-21357 — TiNG combobox bound to a value list now shows the display value (not the raw dataprovider value) in Find Mode.

Form Designer

SVY-21255 — Fixed column size not being updated in the form editor.
SVY-21249 — "Save All" now saves changes on the form editor; fixed path doubling in composite change detection.
SVY-21248 — Added an invisible_element indicator for responsive layout in the designer.
SVY-21150 — Ctrl+click now duplicates the AG Grid columns instead of the whole grid.
SVY-21202 — Outline tree expand state is preserved on persist changes.
SVY-21360 — Fixed the "toggle exploded view" button working in reverse.
SVY-21315 — Fixed a ClassCastException in the Outline for a responsive form component.
SVY-21263 — Fixed an IllegalArgumentException in TreeItem.setImage during filter expansion.
SVY-21294 — Fixed wrong min-width for components with variants.
SVY-21149 — Fixed an error when searching in a workspace with the dark theme.
SVY-21121 — Console and Servoy AI views added to the Servoy Design perspective.
SVY-21281 — DB valuelist with no dataproviders is now flagged as an error marker; new-solution wizard runs git init.
SVY-21356 — Builder error markers added for invalid artifacts that bypass UI wizard validation.

Mobile Client

SVY-21223 — Server-side scripting execution is now supported in the mobile client; server-side scripts and spec types are exported by the MobileExporter.
SVY-21234 — Support for custom value lists, and handling of value-list filter requests from the typeahead component.
SVY-21267 — Support for valuelistConfig filtering attributes.
SVY-21262 — The Angular TypesRegistry is now filled with client-side specs (generated client-side type JS).
SVY-21328 — Button arguments passed to plugins.dialogs are now handled correctly in mobile.

Testing

SVY-21173 — A dedicated headless Cypress form test runner application (FormPreviewNGClient), for running Cypress form tests headlessly. Tomcat activation was made resilient to individual provider failures.
SVY-21296 — Cypress testing extracted into a standalone plugin (added to the plugins profile).
SVY-21171 — Cypress form test files moved out of the media folder (follow-up to SVY-21025).
SVY-21369 — Fixed getCypressDir creating .metadata outside the workspace.
SVY-21195 — The screenshotForm MCP tool now returns the error when a form is invalid.
SVY-21174 — Cypress form test result reporting in Servoy Developer.

Runtime & Stability

SVY-21344 — Fixed form components extending another form/component being broken after update.
SVY-21282 — Fixed cloneForm shared-map regression, setJson NPE and an NPE when custom-type properties lack svyUUID.
SVY-21271 — Nested custom-type creation now persists JSON in the properties view.
SVY-21257 — Fixed a duplicate UUID on AG Grid copy/paste by resetting customTypesInitialized.
SVY-21358 — Hardened ObjectPropertyType against leaked AWT Dimension/Point values.
SVY-21225 — Table filter is now applied on valuelist values correctly.
SVY-21335 — Fixed AG Grid border-variable warnings on the List Form Component.
SVY-21308 — Fixed enabledDataProvider using the wrong signal in ListFormComponent.
SVY-21214 — Prevented unbounded thread creation in SessionClient.invokeAndWait.
SVY-21325 — Plugin loading is now resilient to individual plugin failures.
SVY-21382 — Full user/permissions/tenant support across all stateless login types (cloud, authenticator).
SVY-21312 — Graceful cloud login failure when the service is unreachable; added addCloudRestoredListener.
SVY-21254 — New LoginResult object with i18n support for stateless login.
SVY-21237 — Popup menus: dropdown submenus can now be targeted with CSS.
SVY-21251 — Bootstrap datalabel onAction now triggers when entered.
SVY-20449 — The scrollbar never definition now works in NG2 (overflow hidden applied in default tabpanel/tablesspanel).
SVYX-1140 — Fixed the bottom position of anchored components in absolute-layout forms.
SERVOY-295 — Fixed StackOverflowError and NPE in WebCustomType for missing component specs.

Developer & Build

SVY-21374 — Added addBrowserFunction to the IBrowser abstraction.
SVY-21384 — Added setOutputStream to IRunNPMCommand for custom console output.
SVY-21387 — Fixed a strange duplicate-jar message on WAR export (skip false positives for distinct manifest names; show the version of the skipped jar).
SVY-21338 — Fixed reset-property refresh and undo in the Properties view.
SVY-21272 — Fixed a ClassCastException in hasChildren operator precedence.
SVY-15231 — NGGrid: added a master-detail grid option and skipRendering tag support for formcomponent properties.
SVY-21208 — Dynamic Jasper reports creation no longer blocked by Java issues.
SVY-21117 — Moved com.servoy.eclipse.docgenerator.tests to the docgenerator-ui repo.

Executable signing

servoy.exe is now code-signed with a proper (non-expired) certificate via the SafeNet USB token (jsign updated to 7.5). The setup keeps the p2 jar signing on the self-signed keystore, and the executable's old (expired Eclipse.org) signature is now replaced rather than a second signature appended.