Release 2026-10-23 (#921)

* added the metering code

* added logging

* added the sap metering sidecar

* updated the auth token usage

* updated the comments

* updated the env vars

* fix: update cryptography to 46.0.7 to address CVE-2026-39892

- Updated cryptography from 46.0.5 to 46.0.7
- Fixes buffer overflow vulnerability in non-contiguous buffer handling
- Regenerated requirements.txt with Python 3.10
- All unit tests passing (184 passed)
- All linting checks passing

* Bumped the cryptography module version to latest 47.0.0

* Fix CVE-2026-25645 and CVE-2026-34073 by upgrading requests and cryptography

Updated requests from 2.32.5 to 2.33.1 to address CVE-2026-25645.
Updated cryptography from 46.0.5 to 47.0.0 to address CVE-2026-34073.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* Security/upgrade requests urllib3 CVE fix (#894)

* Security: Upgrade requests to 2.34.2 and urllib3 to 2.7.0

Fixes high-severity CVEs:
- CVE-2026-25645 (requests): Fixed in 2.33.0+
- GHSA-mf9v-mfxr-j63j (urllib3): Streaming API decompression issue
- GHSA-qccp-gfcp-xxvc (urllib3): Cross-origin redirect header leakage

Changes:
- requests: 2.32.5 → 2.34.2
- urllib3: 2.6.3 → 2.7.0
- charset-normalizer: 2.0.3 → 3.4.7 (transitive)
- idna: 3.10 → 3.15 (transitive)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* Fixes high-severity CVEs:
   - CVE-2026-25645 (requests): Fixed in 2.33.0+
   - GHSA-mf9v-mfxr-j63j (urllib3): Streaming API decompression issue
   - GHSA-qccp-gfcp-xxvc (urllib3): Cross-origin redirect header leakage

---------

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>

* (fix) add typing extension lib (#898)

* Update requirements.txt

* Update requirements.in

* Expand static files caching (#901)

Support static files caching

* Security: Fix CVE-2026-45409 (idna) and GHSA-537c-gmf6-5ccf (cryptogr… (#902)

Security: Fix CVE-2026-45409 (idna) and GHSA-537c-gmf6-5ccf (cryptography)

Upgrades dependencies to address high-severity vulnerabilities:
- cryptography 47.0.0 → 48.0.1: Fixes vulnerable OpenSSL in wheels
- idna 3.10 → 3.15: Fixes DoS vulnerability in IDNA encoding

CVE-2026-45409: idna versions prior to 3.15 were vulnerable to DoS
attacks via specially crafted inputs to idna.encode() function.

GHSA-537c-gmf6-5ccf: cryptography wheels prior to 48.0.1 included
a statically linked copy of OpenSSL with security vulnerabilities.

* Security: Upgrade nginx from 1.26.1 to 1.30.4 to fix CVE-2025-23419 a… (#909)

Security: Upgrade nginx from 1.26.1 to 1.30.4 to fix CVE-2025-23419 and CVE-2026-42945

Co-authored-by: bhavin.shah <bhavin.shah@mendix.com>

* Fix CVE-2026-69247(cryptography)andCVE-2026-59939(httplib2) (#907)

Co-authored-by: Piyush <piyush.tiwari@mendix.com>
Co-authored-by: mayankmendix <60148863+mayankmendix@users.noreply.github.com>

* Add deprecation warning for Cloud Foundry Buildpack (#910)

Added a warning about the deprecation of the Cloud Foundry Buildpack for Mendix 12 and future Runtime versions.

* Fix PostgreSQL metrics query to filter by application database (#914)

Co-authored-by: Bhavin <bhavin.shah@mendix.com>

* Feature/sap hana client jar stage (#915)

Added SAP HANA client JAR staging support

* Skip staging SAP HANA client JAR if already present in userlib or vendorlib (#916)

Skip staging SAP HANA client JAR if already present in userlib or vendorlib

* Add RDS ap-southeast-7 support (#917)

* Add RDS ap-southeast-7 support

* Fix cert vulnerability (#920)

* Update requirements.in for certifi

* Update requirements.txt for certifi

* Update dependencies.yml for JDK patch versions

---------

Co-authored-by: bhavin.shah <bhavin.shah@mendix.com>
Co-authored-by: priyal.chawda@mendix.com <priyal.chawda@mendix.com>
Co-authored-by: Piyush <piyush.tiwari@mendix.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
Co-authored-by: Bhavin Shah <162097397+bhavinshah-mendix@users.noreply.github.com>
Co-authored-by: Sanny Ramirez <sai.ramirez.umak@gmail.com>
Co-authored-by: EnasAbdelrazek <96430281+EnasAbdelrazek@users.noreply.github.com>
Co-authored-by: Bhavin Shah <162097397+bhavinshahM@users.noreply.github.com>
Co-authored-by: PiyushTiwari-LowCode <106152452+PiyushTiwari-LowCode@users.noreply.github.com>
Co-authored-by: Mário Serrador <61971372+mruiserrmendix@users.noreply.github.com>
Co-authored-by: Priyal Chawda <86288192+Pri1235@users.noreply.github.com>

Author: 11 people

dependencies.yml

@@ -40,10 +40,10 @@ dependencies:
         - jdk
       vendor: Adoptium
       version:
-        - "8": 8u392
-        - "11": 11.0.23
-        - "17": 17.0.9
-        - "21": 21.0.3
+        - "8": 8u511
+        - "11": 11.0.33
+        - "17": 17.0.21
+        - "21": 21.0.13
   logs:
     mendix-logfilter:
       artifact: logs/mendix-logfilter-{{version}}.tar.gz

requirements.in

@@ -1,5 +1,5 @@
 backoff==2.2.1
-certifi==2024.8.30
+certifi==2026.10.19
 cryptography==50.0.0
 distro==1.9.0
 httplib2==0.32.0

requirements.txt

@@ -8,7 +8,7 @@ antlr4-python3-runtime==4.9.3
     # via omegaconf
 backoff==2.2.1
     # via -r requirements.in
-certifi==2024.8.30
+certifi==2026.10.19
     # via
     #   -r requirements.in
     #   requests