Knowledge Base
Knowledge Base
  • Login
Font Size:
Ask Joget AI

Version 9.0.2

Version Highlights

Release Date: 7 November 2025
Editions: All Editions, Enterprise & Cloud Editions
Focus Areas: Security updates, UI fixes, plugin enhancements, theme consistency

Upgrade Notes

Starting from Joget DX 9.0.2, HTTP header handling has been standardized to comply with HTTP/1.1 (RFC 7230) specifications.

Key Change

  • Valid header field name characters include:
    • Alphanumeric (a–z, A–Z, 0–9)
    • Hyphen (-)
    • Limited additional symbols
  • Underscores (_) are not officially allowed under a strict interpretation of the standard.

Example:

  • Joget DX 9.0.1 and prior: __ajax_theme_loading
  • Joget DX 9.0.2 or higher: ajax-theme-loading

Potential Impact

You may encounter issues if:

  • Custom plugins read headers using underscores
  • Older theme versions are in use
  • Reverse proxies strip or modify headers
  • API-based plugins depend on the previous header format

Known Affected Plugins

Plugin

Affected Versions

Resolution

Onsen Theme

8.0.7 and below

Fixed in 8.0.9+

API Builder

7.0.9 and below

Fixed in 7.0.10+

Other plugins that interact with HTTP headers should also be updated to their latest versions.

Post-Upgrade Checklist

After upgrading to Joget 9.0.2 or above, ensure you:

  • Test all apps
  • Test AJAX-based pages
  • Test API integrations
  • Test deployments behind reverse proxies (if applicable)

Related Documents

Security Updates

Component

Description

Apache Tomcat

Upgrade Apache Tomcat to 11.0.13 CVE-2025-61795.

UserSecurityImpl

Fixed unauthenticated username enumeration vulnerability

SQL Injection

Prevented injection via the sort parameter
 

Core Platform Fixes

Builder & Import

  • Fixed a mismatch between the builder JSON and definition ID during import
  • Quick Edit now correctly links to the builder when the JSON ID differs
  • Improved error handling for form definition import

UI & Styling

  • Trimeda: Resolved inconsistent styling across DX 8 and DX 8
  • DX 8 Trimeda Theme: Fixed horizontal menu and compact mode issues
  • Date Picker: Fixed layout, width, and icon position issues across themes
  • Admin Bar: Removed min-width constraint
  • Grid Properties: Fixed icon visibility in light/dark themes

Functionality

  • WebSocket Plugin: Profile now correctly set in multitenant environments
  • List API: Now supports filtering by tag
  • Form Element ID: Added “primaryKey” to the reserved ID list
  • Overview Map: Fixed browser crash when rendering large apps
  • PostgreSQL: Fixed numeric boolean comparison in user reassignment

Plugin Fixes

Run Process Form

  • Fixed the Advanced Grid popup misalignment
  • Resolved CSS issues in List Grid and Form
  • Fixed Rich Text Editor theme issues

Database Wizard

  • Fixed grouping column behavior
  • Added autoCaseHandle detection based on DB type

Others

  • Advanced Form Data List Binder: Fixed grouping with sql_mode=only_full_group_by
  • CrudMenu: Quick Edit now links correctly
  • Multi-Paged Form: Resolved glitchy transitions on mobile
 

Theme & Styling Enhancements

  • DX 8 Trimeda: Fixed multiselect spacing, compact mode UI, and button text overflow
  • Date Picker: Aligned clear button and preserved previous value on edit
  • Property Editor: Improved select box population and ID length validation
 

Modifications

Component

Change

Request Headers

Renamed headers to use hyphens

AWS EC2 Support

Added IMDS v2 compatibility

Dashboard Menu

Renamed “Using UI Menu Plugin” to “Using Page Components”

List

Auto-handles Oracle uppercase

Throw Error

Now throws an error if the response status is not OK
 

Miscellaneous

  • Removed .page styling from XAdmin
  • Reduced unnecessary cache retrieval for the current profile
  • Added PostgreSQL aspect
  • Fixed the merge error in 666d75bf

Full Changelogs

Bug Fixes and Improvements

All Editions

[ FIXED ]        CORE       : Regression of #1045 causing Directory Manager default properties does not populate.
[ FIXED ]        CORE       : Builder - Fixed tool editing with json definition tool does not get updated.
[ FIXED ]        CORE       : Trimeda - Fixed inconsistent styling with DX 8 and DX 8 
[ FIXED ]        CORE       : DX 8 Trimeda Theme - Fixed DX 8 Trimeda Horizontal Menu UI Issues 
[ FIXED ]      SECURITY     : Upgrade Apache Tomcat to 9.0.111 CVE-2025-61795.
[ FIXED ]        CORE       : WebSocket Plugin - Profile is not set correctly on multitenant environment. 
[ MODIFIED ]     CORE       : List API not able to filter by tag.
[ FIXED ]        CORE       : Prevent SQL injection in sort parameter. 
[ FIXED ]        CORE       : Prevent SQL injection in sort parameter. 
[ FIXED ]        CORE       : XAdmin - Removed .page styling 
[ FIXED ]        CORE       : Profile - fixed input validation method to allow different languages 
[ FIXED ]        CORE       : Advanced Tool - Overview Map - Browser crashed rendering large app. 
[ FIXED ]        CORE       : ServiceImpl - Update cached load binder with store binder data after executing form actions.
[ FIXED ]        CORE       : Ensure builder JSON and definition ID are equal during import.  
[ FIXED ]        CORE       : UserviewWebController - Quick Edit uses wrong builder link when builder JSON has different ID.  
[ FIXED ]        CORE       : Quick Edit uses wrong builder link when builder JSON has different ID.  
[ FIXED ]        CORE       : Plugin - Regression of #1020. Empty properties can't save in multi elements select field. 
[ FIXED ]        CORE       : Plugin - Regression of 1e093147. NPE when plugin option is null.
[ FIXED ]        CORE       : Process Builder - Run Process Form when Dark/Light theme is not handled, and messy form. 
[ FIXED ]        CORE       : Form Element ID  - Missing "primaryKey" in the reserved ID list.
[ FIXED ]        CORE       : DX 8 Trimeda - Fixed regression on the multiselect caused by the recent change 
[ FIXED ]        CORE       : Multiselectbox  - Fixed remove button overlapping 
[ FIXED ]        CORE       : Trimeda - Fixed and  Modified Stylings 
[ FIXED ]        CORE       : Fixed UI issues in regards to compact 
[ FIXED ]        CORE       : Trimeda - Fixed Multi Select Box inconsistent spacing 
[ FIXED ]        CORE       : DX 8 Trimeda - Fixed some compact mode issues  
[ FIXED ]        CORE       : Modified the input minimum height, and fix issues due to changes 
[ FIXED ]        CORE       : DX 8 Trimeda Theme - Fixed text going outside the button 
[ MODIFIED ]     CORE       : DX 8 Trimeda Compact Theme - Added compacted mode to Trimeda 
[ FIXED ]        CORE       : Web Filter - Scripts that are currently using the old header name do not work as expected 
[ MODIFIED ]     CORE       : Request Headers - renamed headers to use hyphens instead of underscores
[ FIXED ]        CORE       : fixed numeric boolean comparison in user reassignment using postgresql

Enterprise & Cloud Editions

[ FIXED ]        CORE       : Merge error in 666d75bf.
[ FIXED ]        CORE       : Grid Properties - Fixed action icons visibility issues in light and dark theme. 
[ FIXED ]        CORE       : Datalist Filters - Fixed position issue in RTL
[ FIXED ]      PLUGINS      : Wrong implementation of default property values cache. 
[ FIXED ]        CORE       : Date Picker - Clear button in Advanced Grid not aligned in Progressive and Universal themes. 
[ FIXED ]        CORE       : Date Picker - Previous value cleared when editing in Progressive and Universal theme. 
[ FIXED ]      PLUGINS      : Handle legacy plugins properties.
[ FIXED ]        CORE       : Guider - Fix guider not responsive 
[ MODIFIED ]     CORE       : Throw error if response status not OK during call. 
[ FIXED ]        CORE       : Failed to recover stuck route & subflow during startup. 
[ FIXED ]        CORE       : Admin Bar - Removed min-width
[ FIXED ]         UI        : Fixes issue where default style did not reflect correctly when set. 
[ FIXED ]        CORE       : Property editor select box field not populated after applying styling to field in sub form. 
[ FIXED ]        CORE       : Property Editor - Only check ID length in property editor panel.   
[ FIXED ]        CORE       : Improved form definition import error handling. 
[ FIXED ]        CORE       : List builder - Fixed default styling show blanks configuration.
[ FIXED ]        CORE       : /wflow-core - common.css & adminBar.js - Fixed CSS Stylesheet & JS not being updated 
[ FIXED ]        CORE       : Fixed Date picker field layout breaks when using Field Label "Top" issue. 
[ FIXED ]        CORE       : Date Picker - Fixed Date Picker Field width issue in X-Admin Theme. 
[ FIXED ]        CORE       : DatePicker - Fixed DatePicker Icon Position issues when using multiple layers of Field Label Position Styling. 
[ MODIFIED ]     CORE       : List - Support auto handle Oracle uppercase.
[ FIXED ]        CORE       : Reduce unnecessarily retrieve cache when retrieve current profile. 
[ FIXED ]      PLUGINS      : Advanced Form Data List Binder - Fixed grouping is not working when sql_mode is only_full_group_by. 
[ FIXED ]      PLUGINS      : Security - Fixed unauthenticated username enumeration vulnerability in UserSecurityImpl. 
[ FIXED ]      SECURITY     : Upgrade Apache Tomcat to 11.0.13 CVE-2025-61795.
[ FIXED ]        CORE       : AppLicenseAspect - Decode protected app to prevent JSONException during import.  
[ FIXED ]      PLUGINS      : CrudMenu - Quick Edit uses wrong builder link when builder JSON has different ID.  
[ FIXED ]      PLUGINS      : Run Process Form - Fixed Advanced Grid active column popup misalignment issue. 
[ FIXED ]      PLUGINS      : Run Process Form - Fixed List Grid and Form CSS issues. 
[ FIXED ]      PLUGINS      : Run Process Form - Fixed Rich Text Editor BuilderTheme Dark issue. 
[ FIXED ]      PLUGINS      : Database Wizard - Fixed the grouping column is not working as expected when using the Database Wizard. 
[ FIXED ]        CORE       : Web Filter - Scripts that are currently using the old header name do not work as expected
[ FIXED ]        CORE       : Aspect - Added postgres aspect
Created by Debanraj Ravindran Last modified by Debanraj Ravindran on Aug 05, 2026
Tags:
Previous Version 9.0.3 NextVersion 9.0.1