stasp

The purpose of this article is to provide the list of issues addressed in the most current cumulative hotfix build for JasperReports Server 8.0.x. The hotfix package itself can be downloaded from https://support.tibco.com/wolken-support/file_structure (requires login). For more details please review the readme file in the hotfix package. All the hotfixes are cumulative, meaning that the latest one contains all the fixes included in all the previous hotfix builds for the given product version. Below is the list of issues addressed by each build/package. hotfix_JRSPro8.0.4_cumulative_20241204_0508.zip JS-73737: RequireJS upgrade to 2.3.7 in JRL Pro JARs (CVE-2024-38998, CVE-2024-38999) hotfix_JRSPro8.0.4_cumulative_20241202_0206.zip JSSEC-105 -Normalizing the URL to avoid path traversal vulnerability JS-74002 - Suppressed CVE-2024-45772 due to CVE is false positive for lucene modules except lucene-replicator hotfix_JRSPro8.0.4_cumulative_20241119_0616.zip JS-66473 - HighCharts CVE-2021-29489 (fixed since 8.0.3) JS-74002 - Suppressed CVE-2024-45772 due to CVE is false positive for lucene modules except lucene-replicator hotfix_JRSPro8.0.4_cumulative_20241030_1735.zip JS-74009 - [Case #02299589] Upgraded apache-xmlgraphics-fop from 2.7 to 2.10 to fix CVE-2024-28168 JS-74010 - [Case #02299589] Upgraded commons-io from 2.11.0 to 2.14.0 to fix CVE-2024-47554 hotfix_JRSPro8.0.4_cumulative_20241025_0108.zip JSSEC-89 - HTML Injection Vulnerability in Manage Roles Functionality JS-73742 - [Case #02300083] Updated Spring from 5.3.37 to 5.3.39 to avoid CVE-2024-38808 JS-73858 - [Case #02299589] Updated Spring from 5.3.37 to 5.3.39 to avoid CVE-2024-38809 JS-71565 Added Configurable flag to avoid returning the detailed 404 error message in the response JS-73859 - CVE-2023-52070 on JFreeChart- Suppressed as CVE is currently awaiting analysis,no reasonable evidence to determine the existence of a vulnerability hotfix_JRSPro8.0.4_cumulative_20241017_1028.zip JS-73743 - [case #02299756] Resolved CVE-2024-38816 on spring-webmvc by removing unused FileSystemResource package in jrs JS-32017 [case #66045 + 3] 'Refresh report with latest data' button pulls data from Ad Hoc cache instead of data source JS-73411 - Backport the changes made for Back/Close button hotfix_JRSPro8.0.4_cumulative_20241014_1134.zip JS-71394 - Removed iReport-utils jar as it's replaced by built-in features in JRL JS-71799 Updated jboss-modules from 1.3.0.Final to 1.3.11.Final to fix CVE-2014-0093 JS-71801 - Removed quartz-commonj and quartz-backward-compat jar to fix CVE-2019-13990 JS-71746 Removed ftpserver-core-1.0.3.jar to avoid CVE-2023-22551 JS-71935 : updated js-crypto to 3.1.5 to fix CVE-2023-33201, CVE-2023-33202 JS-71754 - Updated jjwt-api jar from 0.11.2 to 0.11.5 and json jar from 20231013 to 20240303 to avoid CVE-2023-5072 hotfix_JRSPro8.0.4_cumulative_20240902_0811.zip JS-68641 Enhanced Scheduler to handle Duplicate Jobs at the time of upgrade hotfix_JRSPro8.0.4_cumulative_20240807_0953.zip JS-71031 - JDBC Connection leaks leading to Connection Pooling problems and high JVM memory usage hotfix_JRSPro8.0.4_cumulative_20240722_0812.zip (AND EARLIER) JS-62936 [case 02035710] Buildomatic takes a very long time to export large number of users JS-64596 Jasperserver failed to start when installed using "js-install minimal" JS-64551 [case #02066165] - JSON validation error when refreshing a report JS-63364 Selecting cascading input controls values after scrolling resets position back to the top of list JS-64756 Upgrade Log4j to 2.17.1 version to fix CVE-2021-44228, CVE-2021-45046 and CVE-2021-45105 JS-65348 [Case #2087115] Cannot save view if same field is used in measure and field calculations JS-65258 [case #02065852] - Data Chooser performance issue when clicking on "View as Tree" JS-65501 [case 02093962] Query generator creates aggregate expression for sum calculated field in the adhoc crosstab in 8.0.1 JRS JSS-3212 [case #02077765] Faulty email hyperlinks in tagged PDFs JS-65580 Resolve CVE-2022-22965 in JasperReports Server across all supported versions JS-65239 [case 02083861] Encode report export file names JS-65495 [case #2091501] JRS 8.0 IC fails to load when parameter value is injected from URL JS-56746 [case 01826463] Add "IF EXISTS" or "IF NOT EXISTS" to the MySQL upgrade scripts to the sections where something is deleted JS-64614 [case 01908246] XSS. Set default configuration in /WEB-INF/applicationContext-rest-services.xml to prevent browser rendering of the rest-api responses in html & xml format by restricting content type headers JS-65535 [case 02085967] selectedValues Input Control request generate SQL query with NULL values JS-32446 [case 01949706] Errors saving tabular report with shared / global reference to subreport JS-65947 [case 02102938] Incorrect chart date/time values for timezones JS-66025 [case 02102613] IS_IGNORE_PAGINATION input control is not taking effect JS-64375 [case 02051860] Adhoc View Column is Changing When Exporting or Saving as Report. JS-65763 [case #2099441,+1] Non Standard US Date format is not working with date field in JRS 7.9 cascading IC JS-61493 [case 01929557] chart.events.load not called on report exports JS-66422 [case 02112895] In 8.0 the initial full page Loading message is no longer shown JS-66373 - Visualize.JS keeps authenticating with same credentials even if they have been changed JS-64596 Jasperserver failed to start when installed using "js-install minimal" JS-66441 Visualize.js - running Dashboard with configured non-US (non-default) date filter shows "Specify a valid value for type Date." JS-64844 [case 02076333] Filter value is missing in Adhoc report due to case sensitivity JS-66503 [Case #02083480] Dashboard does not show the updated data, you have to refresh the dashboard to get the updated data JS-66732 [Case #02120647] Slow Adhoc export with markup="html" in the Adhoc report template JS-65876 [case #2100210]Dashboard Hang When No Data Is In The Report JS-64045 [case 02116978] Creating report from adhoc view (attached) gives 500 error with duplicate declaration of parameter JS-66815 [case #2126619]Domain calculate field working in 7.5.2 but failed in JRS 8.0.2 with aggregate function error JS-66770 [case #2124123]Getting "Missing property" error when saving ad hoc view with filter in JRS 7.5.2 and 8.0.2 JS-66820 Visualize: wrong data on mouse over for Gauge chart types adhoc view JS-66831 Client side code of Ad Hoc Designer and Viewer should check "Content-Type: application/repository.adhocDataView" header in case-insensitive mode JS-65887 Update JARs to avoid CVE's in JRS 8.0.1 JS-67000 Upgrade pgjdbc for CVE-2022-3119 JS-66757 commons-configuration2 JAR flagged for critical CVE-2022-33980 JS-67139 restricting JNDI service name to not allow ldap://host JS-66745 - removing Xalan dependency (using saxon for xslt) JS-65388 - upgrading Apache FOP to version 2.7 JS-67275 missing validation for Dashlets url JS-67268 upgrading commons-text to version 1.10.0 to address CVE-2022-42889 JS-67049 users can read errors from /jasperserver-pro/rest_v2/contexts JS-67337: [Case #02140888] Theme not applied when sessionDecorator=no is added in the url JS-67556 Oracle DB - report takes about 17 minutes to acquire connection JS-67181 [case 02135517] - Input controls validation failure on JRS 7.9 JS-67502 Users can read errors from /jasperserver-pro/rest_v2/connections JS-60038 Fixes issues in Ad Hoc View Crosstab with Time Balance JS-67566 [case #2147839] DDL for JIAccessEvent.resource_uri not being big enough to contain all the URI information. Increased size of JIAuditEvent.resource_uri, JIAuditEventArchive.resource_uri and JIReportMonitoringFact.report_uri to 451. SQLServer upgrade bugs JS-67482 getting java.lang.NoClassDefFoundError com/simba/athena/shaded/apache/logging/log4j/core/util/SystemClock during JRS startup JS-57052 [case 01843572 +1] exception occurs using ad hoc filter on datetime from AWS Redshift JS-65375 Report book: cannot select tabs beyond the displayed ones JS-66985 Performance issue in Chrome browser when executing report with big html output JS-64895 Ad Hoc Report Excel / XLSX export no longer displays AM/PM in date timestamp format JS-67541 stripTags and unescapeHTML components in Prototype 1.7.3 in JasperReports Server JS-67825 [case 02137904] CSRF at jasperserver-pro/log_settings.html JS-67466 EURO Symbol used in adhoc column formatting is not visible in dashboard JS-67846 [case #02153841 ] Reports not working without disabling SQL validation in 8.0.3 JS-67716 [Case #02147733]Some column names for adhoc view are seen in German when used in dashboard for English users JS-67732 [case #2151198] Chart images as attachments in reportExecutions REST service JS-66331 fixed permission issue for ROLE_USER by passing existing context while fetching resource JS-60865 [Case - 01917827] Presence of only subtitle for a highchart in a report does not render chart in dashboard JS-67903 [case #02155667] Domain based Input control search not working in 8.x JS-63544, JS-68680 [case #02045165] Update role-based authorisation for /reportresource** servelet JS-68699 Upgraded moment and moment-timezone libraries JS-68564: Performance - Big Repository - client side rendering is blocked by parsing tree items JS-68260 Ad hoc view containing long text or email ID with long text is overlapping into next column when added to dashboard JRL-1820: Chrome Version 111 breaks export of HTML5 charts and dashboards JS-68291: Report Input Control "Save" option is not visible even having read+write+delete permission JS-68951 Upgraded commons-fileupload-1.4 to commons-fileupload-1.5 and commons-io-2.8.0 to commons-io-2.11.0 to avoid CVE-2023-24998 JS-69058 Upgraded json-smart-2.4.7 to json-smart-2.4.10 to avoid CVE-2023-1370 JS-68679 Upgraded commons-net-3.3 to commons-net-3.9.0 for CVE-2021-37533 JS-67510 Upgraded batik-1.14 to batik-1.16 to avoid CVE-2022-42890 JS-69067: Dashboard with an Ad Hoc Chart doesn't refresh the chart on No Data if the calc function is Count Distinct JS-69125: Running the report is showing the error for Safari 16.x browser JS-69037: Jasperadmin can see specific of error message in report using no permission attribute JS-67181 [Case #02135517] Input controls validation failure on JRS 7.9 JS-24285: Relative date range values are not displayed correctly in reports JS-61440 Cascading input control date format validation issue JS-69099: [case 02177521] Input control validation failure for IC based on an Oracle Date column JS-69023 [case #02170494] Changing data type of field in domain schema getting changed automatically to earlier data type on importing. JS-68208: [case 02128995] Stack trace not being returned from error on the UI JS-67600: [case 02148501] Ad Hoc views cannot be opened if they have a calculated field with an IF that returns two different data types JS-69351: Issue with column header of table component when expanding a dashlet and then scrolling JS-69548 [Case# 02180063] Dashboard is not bringing the expected results JS-69454: Issue with report rendering and jasperserver ui with Mobile Mode on iPad device JS-69438: add Java 17 Runtime Support JS-69716: [case 02193513] Drill down repository hyperlinks in reports don't work in dashboards for different org users JS-67587 [case #02146373] Calculated measure from domain showing wrong calculation JS-69053 [case 02135517] - Facing an "The character '' is an invalid XML character" error once we run an export command that includes audit reports JS-69575 JRS API for rest_v2/contexts does not work properly with empty sets in Domain JS-69507: [Case #02185601] - IC Queries sent multiple times to data source JS-69982: Input control values are not updated in report even after updating list of values/query JS-70493 [Case #2207116] Ad Hoc input control has incorrect Selected items JS-70544: Update hotfix 8.x help url JS-70861: [Case# 02218745][Case# 02218763] - Upgrading activemq to fix CVE-2023-46604 JS-70896: Upgrading snappy-java to fix CVE-2023-34455 and CVE-2023-34454 JS-68714 [Case #02153498] Getting resource.of.type.not.found error intermittently while running multiple Report versions using Visualize.js JS-65398 [case #02089334] Allow HTML in Maps/Charts Pro tooltips JS-70648 [case #2214530] Use UUID for autogenerated report names in temp JS-71129 Added validation to restrict file extension for Repository file upload JS-71130 Added Adhoc Function validator JS-70906 [Case #02159689] Duplicate Reports Showing in UI JS-71128 enhance escaping JS-71333 Add custom 400 error page (bad request) JS-71131 Enhanced role-based checks for accessing scheduled job messages JS-71332 Improve Data Source URL validation JS-71300 [case #8415] - Added and changed the mapping and validation for contentResource JS-70477 [Case #02204119] JRS 8.0.4 Reports failed with Input controls validation error in Adhoc Report when the filters applied JS-71174 Add option to prevent usage of Localhost or 127.0.0.1 for data source URL's JS-71620 [CASE-8436] removing ion-java and upgrading aws-java-sdk-ec2 to 1.12.653 to fix CVE-2024-21634 JS-71262 [CASE-8436] CVE-2023-31826 on nevado-jms-1.3.2-JS.jar JS-71087 Prevent updating the creation date for a report job JS-71687 - [02234034] upgrading snowflake-jdbc to 3.14.4 to fix CVE-2021-22573 JS-70795 CVE-2023-5072 on json-20090211.jar JS-71295 Added new implementation for TilesConfigurer & SpringLocaleResolver class in jrs to avoid CVE-2023-49735 JS-71591 - [02234034] downgrading elasticsearch driver x-pack-sql-jdbc to 7.17.18 to fix CVE-2020-28491 JS-71689 CASE-8436 - CVE-2021-22569 on infinispan-core-10.1.8.Final.jar in SQE JS-71852 - Upgraded postgresql-42.5.4.jar to postgresql-42.5.5.jar to fix CVE-2024-1597 JS-71914 - JSON 20231013 upgrade caused String <-> Object conversion issue JS-71742 Update Spring And Spring Security jars to avoid CVEs JS-71847 - Upgrade ehcache to 2.10.10.18.17 to resolve CVE-2020-36518 and CVE-2023-36478 JS-71181 Improve Organization propagation on user edit JS-71980 - fix for the legacy html component in the report viewer JS-71949 - [02226484] Upgraded commons-compress 1.21 to 1.26.0 to fix CVE-2024-25710 JS-72073 - [02226484 02234034] fixing CVE-2024-22259, upgrading Spring to 5.3.33 JS-72074 - [02226484 02234034] fixing CVE-2024-22257, upgrading Spring Security to 5.7.12 JS-71744 Upgraded batik from 1.16 to 1.17 to avoid CVE-2022-44729 and CVE-2022-44730 JS-71747 Updated grizzly from 2.3.25 to 2.4.4 to avoid CVE-2017-1000028 JS-71749 Upgraded guava from 30.1.1-jre to 33.0.0-jre to avoid CVE-2020-8908 and CVE-2023-2976 JS-71753 Upgrading jackson jar from 2.15.0 to 2.16.1 to avoid multiple CVE's JS-71743 Update accessors-smart-2.4.9 to accessors-smart-2.5.0 to avoid cve JS-71755 - removed jmx-logger-log4j-0.3.1.jar to fix CVE-2019-17571 Log4j 2 has built-in support for JMX JS-72442 - Upgrading Spring from 5.3.33 to 5.3.37 to avoid CVE-2024-22262 JS-71579 can't pass MongoDB connection options after schema was autogenerated JS-71233 - Upgrading mongo-java-driver-3.10.2.jar to 3.12.14 to fix CVE-2021-20328 JS-72091 - Fixed the issue of bypassing the password change dialog by updating the sequence of UserPreferencesFilter in the filter chain, introduced a new property called passwordExpirationInDays for UserPreferencesFilter, that takes value from passwordExpirationProcessingFilter, to redirect requests to the password change screen in case of password expiration. Also, added a 401 response in the case of basic authentication JS-72164 - [02226484] CVE-2024-29133 & CVE-2024-29131 upgrading commons-configuration2 to 2.10.1,js-crypto to 3.1.2.1 and org.owasp.esapi to 2.5.3.1 JS-72608 - Fixing JS-72180 and JS-71042. Making key more unique by adding tenant, user and datasource url. Changes to controlLogicCacheManager bean to control cachePerTenant (true) and cachePerUser (false); Reduced defaults on engineCache to 5 min JS-72181 - [02249038] fix WS-2021-0646, Update Lucene JARs to 8.11.3 JS-71565: a validation was added to know if a resource not found exception will be returned, if so, then we scape the return message JS-72030 - [CASE-8376] - Jar Uploads should be controlled by OS user only JRL-1923: Unpaginated CSV export uses a wrong time zone JS-73027: Fixed RepoLogEvent clean-up query issue caused by the Hibernate upgrade

The purpose of this article is to provide the list of issues addressed in the most current cumulative hotfix build for JasperReports Server 9.0.x. The hotfix package itself can be downloaded from https://support.tibco.com/wolken-support/file_structure (requires login). For more details please review the readme file in the hotfix package. All the hotfixes are cumulative, meaning that the latest one contains all the fixes included in all the previous hotfix builds for the given product version. Below is the list of issues addressed by each build/package. hotfix_JRSPro9.0.0_cumulative_20241206_0059.zip JS-74097 - Saving dashboard failed with error "Folder not found at xxx" JS-71898 - After session timeout, the GUID in the URL resulted in its invalidation, leading to a crash of the user's page intermittently. hotfix_JRSPro9.0.0_cumulative_20241204_0626.zip JS-71751 Remove hibernate-jmx and upgrade hibernate-validator to fix CVE-2019-14900, CVE-2020-25638, CVE-2019-10219, CVE-2020-10693 JS-70906 [Case #02159689] Duplicate Reports Showing in UI - additional refactors to methodOverride logic. hotfix_JRSPro9.0.0_cumulative_20241202_2255.zip JSSEC-105 - Normalizing the URL to avoid path traversal vulnerability hotfix_JRSPro9.0.0_cumulative_20241127_1935.zip JS-74069 - The cascading date picker input control is not functioning for multiple reports hotfix_JRSPro9.0.0_cumulative_20241127_1317.zip JS-73681 - Ad Hoc View with date filters fails to open with java.util.ConcurrentModificationException JS-73689 - Ad Hoc View with date filters intermittently fails to open with QueryValidationException error hotfix_JRSPro9.0.0_cumulative_20241126_0806.zip JS-73692 [Case #02285946] - Not able to use the output filename of the scheduler with special characters JRL-1954 - Chart tooltips in PDF export hotfix_JRSPro9.0.0_cumulative_20241120_0242.zip JS-73981 - [case #2296759]Job Status Email Content Repeated Twice After applying JRS 9.0 Hotfixes hotfix_JRSPro9.0.0_cumulative_20241119_0141.zip JS-74103 - [case #2303414]Urgent: Incorrect dest_type Default Value in Oracle Upgrade Script for JasperReports Server 9.0.0 - updated dest_type default value to 1 hotfix_JRSPro9.0.0_cumulative_20241113_0201.zip JS-71577 Single Select Query Input Control displaying incorrect selected value when we search for a value hotfix_JRSPro9.0.0_cumulative_20241110_2315.zip JS-73206 - Calculated Measure unable to concatenate more than 2 string with the Amazon Redshift Data Driver hotfix_JRSPro9.0.0_cumulative_20241028_1241.zip JS-73732 - Input control selection is not applied when applying quickly JS-74009 - [Case #02299589] Upgraded apache-xmlgraphics-fop from 2.7 to 2.10 to fix CVE-2024-28168 JS-74010 - [Case #02299589] Upgraded commons-io from 2.11.0 to 2.14.0 to fix CVE-2024-47554 JS-73859 - CVE-2023-52070 on JFreeChart- Suppressed as CVE is currently awaiting analysis,no reasonable evidence to determine the existence of a vulnerability. hotfix_JRSPro9.0.0_cumulative_20241024_2258.zip JS-73742 - [Case #02300083] Updated Spring from 5.3.37 to 5.3.39 to avoid CVE-2024-38808 JS-73858 - [Case #02299589] Updated Spring from 5.3.37 to 5.3.39 to avoid CVE-2024-38809 JS-71565 Added Configurable flag to avoid returning the detailed 404 error message in the response hotfix_JRSPro9.0.0_cumulative_20241016_0026.zip JS-73743 - [case #02299756] Resolved CVE-2024-38816 on spring-webmvc by removing unused FileSystemResource package in jrs hotfix_JRSPro9.0.0_cumulative_20241014_1712.zip JS-73137 - Cannot Activate Paused job using different locale than en JS-72997 - accounting for attempt to remove already evicted item when clearing session cache to fix intermittent exception when trying to render report with IC's (after some time) JS-68641 - Enhanced Scheduler to handle Duplicate Jobs at the time of upgrade hotfix_JRSPro9.0.0_cumulative_20240911_1405.zip JRL-1926 - The ignoreCellBorder flag does not work for XLSX exports hotfix_JRSPro9.0.0_cumulative_20240904_0508.zip JS-73266 - [Case #02288923] Scheduler sending empty report email when no notifications on empty is set JS-33378 - Imported values of java.util.List report parameters produce errors hotfix_JRSPro9.0.0_cumulative_20240829_2251.zip (AND EARLIER) JS-72016 - Disable Alerts Feature. If isAlertEnabled flag is false then existing alerts will be purged JRL-1923 - Unpaginated CSV export uses a wrong time zone JS-72551 [case 02260555] Ad Hoc editor in NoData mode issues SQL queries when in Chart mode JS-73268 - Configuration checkSourcesInStrictMode not working JS-72375 - Mailing support for sendGrid integrated for scheduler & alerting JS-70500 - When users attempt to log in with a weak password, throwing exception on UI page. JS-71672 - Report IC always prompt prevent report from automatic execution when invoked through a hyperlink JSSEC-72, JSSEC-90 - HTML Injection Vulnerability in JNDI and Bean data source creation JS-70624 - Java 17 source build JRWS-1131 Issue in configuring data adapters in Web Studio JS-68659 Ad Hoc Table column data formatted Percentage % Symbol not working in Dashboard and PDF export JS-64794: Text right align does not work in reports JS-73000 - Adhoc - Table columns right click menu not working with 'No Data' Selection JS-71516 Redshift view having clause WITH NO SCHEMA BINDING causes domain to break JS-71565: a validation was added to know if a resource not found exception will be returned, if so, then we scape the return message JS-71233 - Upgrading mongo-java-driver-3.10.2.jar to 3.12.14 to fix CVE-2021-20328 JS-71972 - Cascaded multi-select input control keeps loading frequently and unable to select any values JS-72883 - Enable base64 images for CVC components in JRS JS-72932 - Searching on terms with word-break(s) does not highlight the last character(s) JS-71689 CASE-8436 - CVE-2021-22569 on infinispan-core-10.1.8.Final.jar in SQE JS-69782 - [Case# 02194992] Search throwing ArrayIndexOutOfBounds JS-71446 - Changes for AzureSQL Native connector certification, Re-map -2 to Timestamp for MS AzureSQL to fix the issue with the Timestamp datatype column not visible on UI JS-71069 - JRS - Amazon Athena Native Connector Certification JS-72181 - [02249038] fix WS-2021-0646, Update Lucene JARs to 8.11.3 JS-72051 [case #2242330]Resource bundle adhoc_Mask is not working JRS 9.0 Docker JS-72608 - Fixing JS-72180 and JS-71042. Making key more unique by adding tenant, user and datasource url. Changes to controlLogicCacheManager bean to control cachePerTenant (true) and cachePerUser (false); Reduced defaults on engineCache to 5 min. JS-69791 [Case #02191928] Adhoc date/timestamp format seems to be different in the table column than the format selected in 8.1 JRS JS-72164 - [02226484] CVE-2024-29133 & CVE-2024-29131 upgrading commons-configuration2 to 2.10.1,js-crypto to 3.1.2.1 and org.owasp.esapi to 2.5.3.1 JS-72660 - [Jaspersoft Case #02258438] - Unable to edit domains after 9.0 upgrade JS-72091 - Fixed the issue of bypassing the password change dialog by updating the sequence of UserPreferencesFilter in the filter chain, introduced a new property called passwordExpirationInDays for UserPreferencesFilter, that takes value from passwordExpirationProcessingFilter, to redirect requests to the password change screen in case of password expiration. Also, added a 401 response in the case of basic authentication. JS-71711 - Adhoc - Calculated field based on Decimal function in adhoc breaks the adhoc view JS-72206 - [Case #02236509 ]CVE-2024-29025 on netty-codec-http-4.1.106.Final.jar,Upgrading netty-codec-http and netty-handler to 4.1.109.Final JS-67848: [Case #02147852] Dashboard in 8.1 JRS embedding an adhoc view auto selects all the filter value whereas running the running the Ad Hoc View standalone shows where (1=1) instead of all the values JS-72550 - Not able to connect to DB2 AS400 using customer driver(Select 1 doesn't work) JS-70958 - Not able to add conditional formatting in report JS-71754 - Updated json jar from 20231013 to 20240303 to avoid CVE-2023-5072 JS-71746 Removed ftpserver-core-1.0.3.jar to avoid CVE-2023-22551 JS-71935 : updated js-crypto to 3.1.5 to fix CVE-2023-33201, CVE-2023-33202 JS-71801 - Removed quartz-backward-compat jar to fix CVE-2019-13990 JS-71799 Updated jboss-modules from 1.3.0.Final to 1.3.11.Final to fix CVE-2014-0093 JS-71394 - Removed iReport-utils jar as it's replaced by built-in features in JRL JS-71745 upgrading bcpkix/bcprov-jdk15on-1.68 to bcpkix/bcprov-jdk18on-1.77 to fix CVE-2023-33201, CVE-2023-33202 JS-72271 - unable to create any chart from Parameterized Report topic JS-72030 - [CASE-8376] - Jar Uploads should be controlled by OS user only JRL-597 - support for report background section in DOCX export JS-72442 - Upgrading Spring from 5.3.33 to 5.3.37 to avoid CVE-2024-22262 JS-70424 [Case #02193534] - For external database authentication added multiTenancyConfiguration for updateInternalUserRecord method and updated applicationContext-externalAuth-db-mt xml JS-71753 - Upgrading jackson jar from 2.15.2 to 2.16.1 to avoid multiple CVE's JS-71749 - Upgraded guava from 32.1.2-jre to 33.0.0-jre to avoid CVE-2020-8908 and CVE-2023-2976 JS-71747 - Updated grizzly from 2.3.25 to 2.4.4 to avoid CVE-2017-1000028 JS-72210 [Case #02250438] JRS 8.2.0,9.0 Scheduler job edit issue. JS-72315 [Case #02229292] Error During Report Execution in JRS: net.sf.jasperreports.engine.JRException: java.lang.NumberFormatException: Input String '4100028930' JS-71407 - [02243632] Upgraded microsoft-graph to 5.80.0 to avoid CVE-2023-3635 in okio-jvm JS-72121 - [02234034] fix CVE-2023-52428, upgraded nimbus-jose-jwt to 9.37.3 JS-72027 - [Case #02243694 ] Getting hibernate error when opening some domains in AdHoc JS-72194 [Case #02251072] Drilldown functionality is not working properly when display mode is selected as View in adhoc view JS-57052 [case 01843572 +1] exception occurs using ad hoc filter on datetime from AWS Redshift JS-72198 [Case #02251270 ]While trying to export the Adhoc View report (chart) in the dashboard after clicking on drill-down, there is no chart present in the exported PDF(basically it is blank). JS-72080 [Case #02245151] JRS 9.0 unable to pass input control values to the ad-hoc reports using visualize.js while display mode is in view mode JS-72074 - [02226484 02234034] fixing CVE-2024-22257, upgrading Spring Security to 5.7.12 JS-72073 - [02226484 02234034] fixing CVE-2024-22259, upgrading Spring to 5.3.33 JS-71072 - enhancements and Fixes for Simba Google BigQuery Driver JS-71652 - Fixed NullPointerException error when importing v7.5 domains with missing field Type into v8.x JS-71949 - [02226484] Upgraded commons-compress 1.21 to 1.26.0 to fix CVE-2024-25710 JS-71876 Update Spring And Spring Security jars to avoid CVEs JS-71847 - Upgrade ehcache to 2.10.10.18.17 to resolve CVE-2020-36518 and CVE-2023-36478 JS-70923 - Added non-null filter for user attributes and jackson annotation to resolve bi-directional recursion issue. JS-71070 - Fixed Cassandra's connection validation statement JS-71852 - Upgraded postgresql-42.5.4.jar to postgresql-42.5.5.jar to fix CVE-2024-1597 JS-71914 - JSON 20231013 upgrade caused String <-> Object conversion issue JS-71651 - [case #2234990, 2234994]JRS 9.0 WAR installation problem JS-71676 - [02234034] Upgrading reactor-netty-core to version 1.0.39 and azure-* libs to fix CVE-2023-34062 and CVE-2023-41329 JS-71675 - [02234034] Upgrading netty to 4.1.106.Final to fix CVE-2023-44487 JS-71591 - [02234034] downgrading elasticsearch driver x-pack-sql-jdbc to 7.17.18 to fix CVE-2020-28491 JS-70795 - CVE-2023-5072 on json-20090211.jar JS-71295 - Added new implementation for TilesConfigurer & SpringLocaleResolver class in jrs to avoid CVE-2023-49735 JS-71687 - [02234034] upgrading snowflake-jdbc to 3.14.4 to fix CVE-2021-22573 JS-71262 - [CASE-8436] CVE-2023-31826 on nevado-jms-1.3.2-JS.jar JS-71620 - [CASE-8436] removing ion-java and upgrading aws-java-sdk-ec2 to 1.12.653 to fix CVE-2024-21634

Jaspersoft® Product Suite will no longer include Simba Drivers after April 30, 2023. All Simba JDBC drivers, including the following, will be removed: - Athena - Cassandra - Impala - Neo4j - Spark FAQs What happens to my current installation that includes Simba Drivers after April 30, 2023? If you have a perpetual license to a Jaspersoft product version that includes Simba Drivers, you can continue using that particular version in your current installation. If you have a subscription license to Jaspersoft products that include Simba Drivers, you can continue using the Simba Drivers until the expiration of your current subscription term. However, for any subscription renewals occurring after April 30, 2023, you must upgrade your Jaspersoft products to versions without Simba Drivers as noted in the table below. Versions with Simba Drivers Included Versions without Simba Drivers Included JasperReports® Server 8.0.3 and earlier; 8.1.x 8.0.4 and later 8.0.x; 8.2.0 and later JasperReports® Server for AWS Marketplace 8.0.3 and earlier; 8.1.x 8.0.4 and later 8.0.x; 8.2.0 and later JasperReports® Server for Microsoft Azure 8.0.2 and earlier; 8.1.x 8.0.4 and later 8.0.x; 8.2.0 and later Jaspersoft® Studio 8.0.3 and earlier; 8.1.x 8.0.4 and later 8.0.x; 8.2.0 and later JasperReports® Library - Professional Edition 8.0.3 and earlier; 8.1.x 8.0.4 and later 8.0.x; 8.2.0 and later JasperReports® IO - Professional Edition 3.0.3 and earlier; 3.1.x 3.0.4 and later 3.0.x; 3.2.0 and later JasperReports® IO - At-Scale Edition 3.0.3 and earlier; 3.1.x 3.0.4 and later 3.0.x; 3.2.0 and later JasperReports® IO - Professional Edition for AWS Marketplace 1.2.0 and earlier 3.0.4 and later JasperReports® Web Studio - Professional Edition 1.0.0 2.0.0 and later Can I continue to receive assistance with JDBC drivers after April 30, 2023? Yes, the Jaspersoft Support team will continue to assist you with any JDBC driver issues used with Jaspersoft Product Suite, regardless of whether these drivers were obtained from us or a third party. However there will be no further Hotfixes or Service Packs for any potential issues with the listed Simba drivers. Will I be eligible to receive hotfixes and service packs for Jaspersoft product versions that include Simba drivers after April 30, 2023? For Mainstream (MS) releases, the answer is no. For the LTS releases 8.0.x and 3.0.x, the answer is yes. Such hotfixes and service packs will be delivered as version 8.0.4 (and later) and 3.0.4 (and later), where the Simba drivers are removed. What Jaspersoft product versions will be available on eDelivery after April 30, 2023? For Long-Term Support (LTS) releases, versions 8.0.4 (and later) and 3.0.4 (and later) will be available. For Mainstream (MS) releases, versions 8.2.0 and 3.2.0 will be available. Please reach out to the Jaspersoft Support team for assistance if you are entitled to an older version that is no longer available on eDelivery. What if I want to continue using Simba Drivers after upgrading to a version which doesn't include them? Where else can I get them? Please consult your legal team to make sure you are in compliance with vendor licensing before using/distributing any of the drivers listed below. You can contact insightsoftware to obtain licensing for Simba drivers. For native drivers, we can suggest contacting the vendors below: Amazon for Athena Cloudera for Impala Neo4j Datastax for Cassandra and Spark If you have any other questions please contact our Support via https://support.tibco.com/

UPDATE: New cumulative patches are now available for JasperReports Server 8.0.3 and 8.1.1. For JRS 8.0.x: the latest 8.0.3 patch can be applied to any build of 8.0.0, 8.0.1, 8.0.2 or 8.0.3, including the Service Packs. It contains all fixes included in the latest 8.0.2 patch, and all the latest security fixes. For JRS 8.1.x: the latest 8.1.1 patch can be applied to any build of 8.1.0 or 8.1.1, including the Service Pack. It contains all fixes included in the latest 8.1.0 patch, and all the latest security fixes. All the hotfixes are available to download from TIBCO Support Portal. Following the directions below is no longer necessary. It is sufficient to apply the latest cumulative patch to your corresponding JasperReports Server version. For any questions, please contact TIBCO Support. PremiseOn December 13, 2022, Jaspersoft released a Service Pack with security fixes for the commercial releases of JasperReports Server 8.0.x and 8.1.x. The Service Pack is available for download from the TIBCO Support Portal, and more details about the addressed issues can be found on our Security Advisories page. IssueThe Service Pack is compatible with most builds of the corresponding versions 8.0.2 and 8.1.0 of JasperReports Server. If you don't see your JasperReports Server build number listed below, you can install the Service Pack following the standard steps from the README file. However, the Service Pack from December 13, 2022 is not compatible with several latest builds of cumulative hotfix for JRS versions 8.0.2 and 8.1.0. Please see the section below for the complete lists of the non-supported cumulative hotfix builds. Compatibility by VersionFor JasperReports Server 8.0.2the following cumulative hotfix builds are NOT compatible with the Service Pack 8.0.3:hotfix_JRSPro8.0.2_cumulative_20221007_0310.ziphotfix_JRSPro8.0.2_cumulative_20221021_1338.ziphotfix_JRSPro8.0.2_cumulative_20221031_1613.ziphotfix_JRSPro8.0.2_cumulative_20221102_0944.ziphotfix_JRSPro8.0.2_cumulative_20221108_1535.ziphotfix_JRSPro8.0.2_cumulative_20221114_0154.ziphotfix_JRSPro8.0.2_cumulative_20221206_1040.ziphotfix_JRSPro8.0.2_cumulative_20221208_0915.zipFor JasperReports Server 8.1.0the following cumulative hotfix builds are NOT compatible with the Service Pack 8.1.1:hotfix_JRSPro8.1.0_cumulative_20220930_0923.ziphotfix_JRSPro8.1.0_cumulative_20221024_0418.zipIf you have a JasperReports Server build incompatible with the Service Pack 8.0.3 or 8.1.0 If you are currently using a JasperReports Server build that is listed in the section above, it means that one of the newest versions of JRS hotfixes was applied to your JRS instance. In that case, at the moment the best approach for applying the Service Pack is as follows: Re-install JasperReports Server of your corresponding version (8.0.2 or 8.1.1) from the original (vanilla) distribution. NOTE: The underlying Repository Database for the JRS instance may remain untouched. Only the deployment in the application server (usually in the WAR file format) needs to be re-deployedApply the Service Pack for your corresponding version (8.0.3 or 8.1.1) to the new JRS deploymentAlternatively, you can wait for the changes from the aforementioned builds to be backported to cumulative hotfixes for versions 8.0.3 and 8.1.1. These cumulative hotfixes will be released as soon as they pass all the necessary test. How to check your JasperReports Server build numberOn any page of JasperReports Server user interface, click on the 'About' link in the bottom left corner of any page of the application. A small pop-up window will appear which shows the build version of your deployment: For any questions, please contact TIBCO Support

UPDATE: New cumulative patches are now available for JasperReports Server 7.5.2, 7.8.1 and 7.9.1. For JRS 7.5.x: the latest 7.5.2 patch can be applied to any build of 7.5.1, and also to 7.5.2 Service Pack. It contains all fixes included in the latest 7.5.1 patch, and all the latest security fixes. For JRS 7.8.x: the latest 7.8.1 patch can be applied to any build of 7.8.0, and also to 7.8.1 Service Pack. It contains all fixes included in the latest 7.8.0 patch, and all the latest security fixes. For JRS 7.9.x: the latest 7.9.1 patch can be applied to any build of 7.9.0, and also to 7.9.1 Service Pack. It contains all fixes included in the latest 7.9.0 patch, and all the latest security fixes. All the hotfixes are available to download from TIBCO Support Portal. Following the directions below is no longer necessary. It is sufficient to apply the latest cumulative patch to your corresponding JasperReports Server version. For any questions, please contact TIBCO Support. PremiseOn October 12, 2021, TIBCO Jaspersoft released a Service Pack with security fixes for all the currently supported commercial versions of JasperReports Server. The Service Pack is available for download from the TIBCO Support Portal, and more details about the addressed issues can be found on our Security Advisories page. IssueThe released Service Pack is compatible with the Generally Available (the base) build of JasperReports Server for each corresponding version, as well as with the majority of the cumulative hotfix build for each corresponding version. However, the Service Pack from October 12, 2021 is not compatible with several latest builds of cumulative hotfix for JRS versions 7.5.1, 7.8.0 and 7.9.0. Please see the section below for the complete lists of the supported cumulative hotfix builds. Compatibility by VersionFor JasperReports Server 7.9.0the following cumulative hotfix builds are compatible with Service Pack 7.9.1:Initial JasperReports Server 7.9.0 release, build 20201202_2053hotfix_JRSPro7.9.0_cumulative_20210126_1045.ziphotfix_JRSPro7.9.0_cumulative_20210205_0933.ziphotfix_JRSPro7.9.0_cumulative_20210305_0557.ziphotfix_JRSPro7.9.0_cumulative_20210401_1704.ziphotfix_JRSPro7.9.0_cumulative_20210427_1201.ziphotfix_JRSPro7.9.0_cumulative_20210506_0744.ziphotfix_JRSPro7.9.0_cumulative_20210511_0714.ziphotfix_JRSPro7.9.0_cumulative_20210517_0750.ziphotfix_JRSPro7.9.0_cumulative_20210524_0222.ziphotfix_JRSPro7.9.0_cumulative_20210608_0150.zipAll fixes available for JRS 7.9.0 which are not included in the builds listed above will be released later, as part of a cumulative patch for version 7.9.1. For JasperReports Server 7.8.0the following cumulative hotfix builds are compatible with Service Pack 7.8.1:Initial JasperReports Server 7.8.0 release, build 20200807_1438hotfix_JRSPro7.8.0_cumulative_20200903_1722.ziphotfix_JRSPro7.8.0_cumulative_20201012_1447.ziphotfix_JRSPro7.8.0_cumulative_20201021_1501.ziphotfix_JRSPro7.8.0_cumulative_20201023_1424.ziphotfix_JRSPro7.8.0_cumulative_20201109_0718.ziphotfix_JRSPro7.8.0_cumulative_20201112_1255.ziphotfix_JRSPro7.8.0_cumulative_20201119_1044.ziphotfix_JRSPro7.8.0_cumulative_20201209_1512.ziphotfix_JRSPro7.8.0_cumulative_20201224_0543.ziphotfix_JRSPro7.8.0_cumulative_20210118_1419.ziphotfix_JRSPro7.8.0_cumulative_20210121_1634.ziphotfix_JRSPro7.8.0_cumulative_20210127_1609.ziphotfix_JRSPro7.8.0_cumulative_20210203_1155.ziphotfix_JRSPro7.8.0_cumulative_20210209_1430.ziphotfix_JRSPro7.8.0_cumulative_20210216_0228.ziphotfix_JRSPro7.8.0_cumulative_20210226_0129.ziphotfix_JRSPro7.8.0_cumulative_20210303_1326.ziphotfix_JRSPro7.8.0_cumulative_20210406_1035.ziphotfix_JRSPro7.8.0_cumulative_20210423_0954.ziphotfix_JRSPro7.8.0_cumulative_20210519_0959.ziphotfix_JRSPro7.8.0_cumulative_20210525_0250.ziphotfix_JRSPro7.8.0_cumulative_20210531_0818.ziphotfix_JRSPro7.8.0_cumulative_20210607_1302.zipAll fixes available for JRS 7.8.0 which are not included in the builds listed above will be released later, as part of a cumulative patch for version 7.8.1. For JasperReports Server 7.5.1the following cumulative hotfix builds are compatible with Service Pack 7.5.2:Initial JasperReports Server 7.5.1 release, build 20200507_1627 hotfix_JRSPro7.5.1_cumulative_20200601_1100.ziphotfix_JRSPro7.5.1_cumulative_20200624_0657.ziphotfix_JRSPro7.5.1_cumulative_20200710_2031.ziphotfix_JRSPro7.5.1_cumulative_20200716_1950.ziphotfix_JRSPro7.5.1_cumulative_20200720_1831.ziphotfix_JRSPro7.5.1_cumulative_20200730_1215.ziphotfix_JRSPro7.5.1_cumulative_20200916_1323.ziphotfix_JRSPro7.5.1_cumulative_20201005_1714.ziphotfix_JRSPro7.5.1_cumulative_20201009_1022.ziphotfix_JRSPro7.5.1_cumulative_20201012_1219.ziphotfix_JRSPro7.5.1_cumulative_20201015_1426.ziphotfix_JRSPro7.5.1_cumulative_20201020_1718.ziphotfix_JRSPro7.5.1_cumulative_20201027_0834.ziphotfix_JRSPro7.5.1_cumulative_20201028_0528.ziphotfix_JRSPro7.5.1_cumulative_20201105_1514.ziphotfix_JRSPro7.5.1_cumulative_20201128_1310.ziphotfix_JRSPro7.5.1_cumulative_20210118_2309.ziphotfix_JRSPro7.5.1_cumulative_20210122_1659.ziphotfix_JRSPro7.5.1_cumulative_20210209_1128.ziphotfix_JRSPro7.5.1_cumulative_20210219_1510.ziphotfix_JRSPro7.5.1_cumulative_20210322_0449.ziphotfix_JRSPro7.5.1_cumulative_20210413_0301.ziphotfix_JRSPro7.5.1_cumulative_20210607_1354.zipIf you have a JasperReports Server build incompatible with the Service Pack 7.5.2, 7.8.1 or 7.9.1 If you are currently using a JasperReports Server build that is not listed in the section above, it means that one of the newest versions of JRS hotfixes was applied to this instance. In that case, at the moment the best approach for applying the Service Pack is as follows: Re-install JasperReports Server of your corresponding version (7.9.0, 7.8.0 or 7.5.1) from the original (vanilla) installer. NOTE: The underlying Repository Database for the JRS instance may remain untouched. Only the deployment in the application server (usually in the WAR file format) needs to be re-deployedApply the Service Pack for your corresponding version (7.9.1, 7.8.1 or 7.5.2) to the new JRS deploymentHow to check your JasperReports Server build numberIn a default (non-customized) JasperReports Server user interface, click on the 'About' link in the bottom left corner of any page of the application. A small pop-up window will appear which shows the build version of your deployment: For any questions, please contact TIBCO Support

Issue descriptionStarting Sunday, January 17 2021 all jobs in Jaspersoft ETL/Talend Studio, as well as in Talend Administrative Center (TAC) fail to run or compile. The exact stack trace of the exception will vary based on the operation you are trying to perform, but the root cause will look similar to this: java.security.cert.CertificateExpiredException: NotAfter: Sun Jan 17CauseThe exceptions are caused by an unprecendted issue with Talend product stack where a set of certificates have expired (on January 17, 2021). Please see this article for more details: https://community.talend.com/s/article/REQUIRED-by-Jan-17-2021-Mandatory-Talend-Certificate-update-for-Talend-v7-0-v7-1-v7-2-v7-3 SolutionYou will have to apply patch to the affected products (Jaspersoft ETL/Talend Studio and/or Talend Administrative Center) in order address the problem. For JETL/Talend Studio:- Download patch distribution Patch_20201211_TPS-4416_v2-7.1.1.zip - Follow the instructions from the Readme Notes: https://help.talend.com/r/G2Umu1essoGJRFm7SFxzbA/5XCYs91bTTsh6kHXA2ttcw For Talend Administrative Center (TAC):- Download patch distribution Patch_20201211_TPS-4556_v2-7.1.1.zip (or the newer version, Patch_20210115_TPS-4632_v1-7.1.1.zip) - Follow the instructions from the Readme Notes: https://help.talend.com/r/xAG5ieGhYWbhI84Y~cCdpQ/U51sEUUUCfpxQuZma0zIxw If you are running a Job Server- See if you need to follow the Additional Instructions: https://community.talend.com/s/article/REQUIRED-by-Jan-17-2021-Mandatory-Talend-Certificate-update-for-Talend-v7-0-v7-1-v7-2-v7-3-Additional-Instructions - Restart your Job Server For TAC 7.3.1 with jobs that were migrated from version 7.1.1- you may experience the same exception, in which case you and need to download and apply the patch for TAC version 7.3.1_ Patch_20201215_TPS-4576_v1 (for TAC): Link: https://talend365-my.sharepoint.com/:u:/g/personal/dsegard_talend_com/ESC1Ojk622pHvDo36FvOiucBt-D3XQ0S9CbNdLaxQVXh8w?e=MuS8sE Password: eh&PEshrMJeu:6=T Additional troubleshootingIf you have applied the patch and some of the jobs are still failing with an exception like this: Failed to execute goal org.talend.ci:signer-maven-plugin:7.1.1:sign (sign) on project Test_job: Sign artifact failed: NotAfter: Sun Jan 17 05:36:12 IST 2021 -> [Help 1]you will have to replace the signer-maven-plugin-7.1.1 jar. Please follow these steps: - Backup file the jar file in the directory below <studio_installation_folder>/configuration/.m2/repository/org/talend/ci/signer-maven-plugin/signer-maven-plugin-7.1.1.jar - Replace the signer-maven-plugin-7.1.1 jar in the directory with the attached jar. - Restart the application patch_20201218_tps-4556_v2-7.1.1.zip patch_20201211_tps-4416_v2-7.1.1.zip signer-maven-plugin-7.1.1.jar patch_20210115_tps-4632_v1-7.1.1.zip

This video provides guidelines for adding custom functions to Ad Hoc Designer in Jasperreports Server 7.2.x or 7.5.x.

This video goes over the functionality of the new textAdjust attribute, which was introduced in JasperReports Library 7.5.0 to replace the deprecated isStretchWithOverflow. === In JasperReports Library 7.5.0 the isStretchWithOverflow attribute has been deprecated, and replaced with the textAdjust attribute. These are helpful when your textField's dimensions might be too small for the amount of data which might come from your datasource. The textAdjust attribute includes the original two behaviors and adds a third. - CutText: involves is the default behavior and like the previous default behavior it involves truncation. - StretchHeight: replicates the previous behavior you got from setting isStretchWithOverflow to true - ScaleFont: is new, The font size of the text is scaled down so that the entire content fits the text field element size. Reference: http://jasperreports.sourceforge.net/schema.reference.html#textField ===

This video goes over the background and required steps to configure which day of the week should be listed first in Calendar Date Picker on JasperReports Server 7.5.x. For a similar video for JasperReports Server 7.2.x and earlier please check out this link: https://community.jaspersoft.com/wiki/video-how-configure-first-day-date-picker-tibco-jasperreports-server-72x

This video goes over the background and required steps to configure which day of the week should be listed first in Calendar Date Picker on JasperReports Server 7.2.x. For a similar video for JasperReports® Server 7.5.x please check this link: https://community.jaspersoft.com/wiki/video-how-configure-first-day-date-picker-tibco-jasperreports-server-75x

This video focuses on creating a new Google Cloud database and importing existing database structure from a *.sql file. For more detailed overview of creating a Google Cloud database from scratch, as well as for creating a Data Source connection to such database from JasperReports Server, please check the previous video from the series:

This video demonstrates how to configure VisualVM for Tomcat and then generate a Heap dump or a Thread dump.

This video gives a brief introduction to Ad Hoc Crosstabs in general, and then focuses on a specific use case of configuring custom Date/Time format for Crosstab date grouping.