What's New in Joget DX 9.1

Feature Overview

Joget DX 9.1 introduces significant enhancements focused on UI/UX improvements, governance tooling, builder usability, and system maintenance controls.

This preview release is open for evaluation and feedback prior to the official 9.1 release.

Security & Platform Enhancements

User Session Management & Security Controls

A new session management framework strengthens platform security:

• Active sessions are automatically invalidated when:

  • A user changes their password
  • A user account is deactivated

• Administrators can:

  • Enforce a single active session per user
  • Trigger Force Logout All Users via SEDM

Impact: Eliminates unauthorized access risks from stale sessions. See Security Enhanced Directory Manager for more information.

Enhanced Audit Trail

Audit logs now provide deeper visibility:

• Tracks both old and new values for system setting changes
• Covers:
  • General Settings
  • SMTP
  • Marketplace
  • LDAP
• Sensitive values (e.g., passwords) are automatically masked

Impact: Improves compliance, traceability, and governance. See 

AI Capabilities (Enterprise)

• AI Agent Builder is now bundled by default.
• No manual plugin installation required.

Impact: Faster onboarding for AI-powered automation and workflows.

Process Enhancement Plugin Integration

The Process Enhancement Plugin is also bundled into this version by default. This plugin bundle contains 5 plugins:

• Process Form Modifier: Adds action buttons like Approve or Reject.
• Two Process Generators: Auto-generate the lists, UIs, process design, and mappings.
• Process List: Displays action buttons like Approve or Reject.
• Datalist Actions: For the items above
• Process Comments: Form Element to view and add comments.

Form Builder Enhancements

New Columns Element

A new Columns element has been introduced in the Form Builder to support multi-column layout design.

Purpose:

• Enable side-by-side field layouts
• Improve responsive form structuring
• Reduce dependency on layout workarounds

The Columns element in Form Builder:

The Columns element in Form Runtime:

See Columns for more information.

Enhanced Section Element

The Section element has been enhanced to support collapsibility within forms.

See more at Section.

New Read-Only Field Option

A new Write Permission option has been added to replace the Readonly option in Form Builder elements.

Unlike previous behavior, Write Permission has two options:

• Readonly
  • Prevents user modification of the field
  • Still allows the field value to be modified and saved to the database
• Disabled
  • Prevents user modification of the field
  • Prevents the modified field value from being saved to the database

Use cases:

• System-generated values
• Calculated fields
• Value updated by script

The Permission settings:

Advanced Tool – Visibility (Field-Level Control)

Advanced Tool now supports individual field-level visibility control.

This enables:

• More granular access control
• Cleaner UI for different roles
• Improved governance alignment
• Auto migration of section visibility control rules

Field-Level Visibility Configuration:

See more at Visibility Advanced Tool.

Custom Field Container Styling

Custom CSS styles can now be applied directly to a form field’s container element, independently of the label and input elements within it. A new inherit toggle in the style editor gives precise control over where styles are applied, making consistent, pixel-perfect form layouts easier to achieve without unintended side effects on child elements.

Inherit to label & input toggle:

Icon Position Control for Form Fields

Form fields (Text Field, Text Area, Select Box, Password Field, Date Picker, and Time Picker) now include an Icon Position property, allowing icons to be placed either before the input field or alongside the label only. This restores DX8-compatible icon behaviour and gives greater flexibility in form layout design.

Icon Position Configuration:

In Label Only:

Before Input:

Multi-Paged Form — Submit Button Control in Read-Only Mode

A new option, Enable Submit Button on Any Pages (Read-Only mode)?, has been added to the Multi-Paged Form advanced settings. When enabled, the Save button on a parent form is no longer locked until the user reaches the last page of a read-only multipage subform, removing an unnecessary navigation requirement for read-only workflows.

Submit button configuration:

See Multi Paged Form.

Form Builder Design Tab — Sample Data Display

The Form Builder’s Design tab no longer executes option binders (such as those used by Select Box and Checkbox fields) against the live database. Instead, sample placeholder data is shown with a note to switch to Preview Mode to see actual data, preventing slow or unresponsive builder experiences with large datasets.

Password field visibility toggle

The Password Field now includes the option to allow users to preview the passwords they key in, called Enable Password Visibility Toggle.

Icon Position Property for Form Field Labels

A new Icon Position Field has been introduced for form fields that support label icons, allowing users to choose whether to keep the icon in the label or display it as a prefix attached to the left side of the input field. This feature is available for Text Field, Text Area, Select Box, Password Field, Date Picker, and Time Picker elements.

Icon Position has two options:

• Before Input (Default): Keeps the icon in the label.
• In Label Only: Displays the icon as a prefix attached to the left side of the input field.

Inherit to label & input option

Custom CSS styles can now be applied directly to a form field’s container element, independently of the label and input elements within it. A new inherit toggle in the style editor gives precise control over where styles are applied, making consistent, pixel-perfect form layouts easier to achieve without unintended side effects on child elements.

See more at Default Styling.

Icon Position Control for Form Fields

Form fields (Text Field, Text Area, Select Box, Password Field, Date Picker, and Time Picker) now include an Icon Position property, allowing icons to be placed either before the input field or alongside the label only. This restores Joget DX 8-compatible icon behaviour and gives greater flexibility in form layout design.

Icon Position Configuration:

In Label Only:

Form Builder Design Tab — Sample Data Display

The Form Builder’s Design tab no longer executes option binders (such as those used by Select Box and Checkbox fields) against the live database. Instead, sample placeholder data is shown with a note to switch to Preview Mode to see actual data, preventing slow or unresponsive builder experiences with large datasets.

Password Visibility Toggle

• Show/Hide toggle for password fields
• Only appears during input
• Works across all themes and RTL layouts

Show password:

Hide password:

App Composer, Builder & UI Improvements

3-Dot Contextual Action Menu

New action menu for builder items:

• Duplicate
• Edit
• Delete

Benefits:

• Reduces accidental deletions
• Always visible on mobile/tablet

Contextual Action Menu:

See App Composer.

Cross-Platform Copy & Paste

• Copy elements across:
  • Browsers
  • Joget servers
• Includes:
  • JSON-based clipboard
  • New Style Painter tool

Impact: Faster UI building and consistency.

See Styles.

DX 9 Builder Theme Enhancements

UI refinements have been made to the Joget DX 9 Builder theme to improve clarity and usability.

File Restructuring:

For the Joget DX 9 Builder Theme (and effectively Theme Builder), it has been restructured into 4 categories:

• Form
  • Any form-related CSS
• List
  • Any list-related CSS
• UI
  • Any related UI CSS
• Components
  • Bootstrap components
• Base
  • CSS Variables, General CSS

Each category is further divided into multiple components. For example, the Form category includes files such as datepicker.css, adgrid.css, and others. The same structure applies to the remaining categories. In addition, there is a miscellaneous.css file, which contains styles for specific components that are not substantial enough to warrant their own dedicated CSS files.

Revamped numeric field and field icon picker:

New option called Enable Colored Tags:

New UI for date and time fields:

UI adjustment - Date Picker

The calendar icon is no longer present in the date picker field.

New UI for file upload and image upload:

New UI for Spreadsheet:

New Form & List grid UI design:

Form and List grid pop-ups now display a header that follows the field label:

New UI for Multi paged form:

Completed nodes turn green, the current node is orange, and upcoming nodes remain white:

New UI for Calendar:

UI adjustments have been made to improve the accordion component:

New UI for Classic Table:

UI adjustment - App Icon:

UI adjustment - Simple Card:

UI adjustment - Simple List:

UI adjustment - Column List:

UI adjustment - User Profile:

Improved Builder Interactions

Enhancements include:

• Save button added directly to UI Builder edit page components.
  
• Improved loading and saving behavior:
  • Showing loading status messages to improve visibility of loading progress:
    
  • Showing randomized short tip messages with KB links based on the builder type:
    

Removed UI-blocking behaviour so users can continue interacting with the builder while saving is in progress, and added a spinning icon and "Saving…" state to the Save button when saving is triggered:

• Fixed incorrect save button state after undo/redo
• Draggable builder pop-ups
  
• Click-outside-to-close popup support
• Removed auto-save behavior and introduced unsaved changes warning
• App Version Warning – banner alerts when editing an older app version, with a direct link to the newest version
  
• Save Failure Feedback – notification shown if saving fails, with Save button returning to its normal state
• Unsaved changes prompt when navigating between builders via quick navigation
  
• Enhanced Find Usages tool – improved search, sub-search, visual usage indicators, and direct navigation to configuration
  
  View Code Usage in builder JSON:
  
  Check element usage in builder:
  

• Launch and Delete buttons separated in App Composer to prevent accidental deletions
  

These changes improve predictability and control during development.

Improved Diff Checker for Readability and Git Compatibility

The Diff Checker in Advanced Tools has been enhanced to better surface changes to multiline string properties (such as BeanShell scripts, queries, and custom HTML) that were previously difficult to review due to line breaks being escaped and condensed into a single line from plugin property values.

Diff Checker enhancements:

• A collapsible cell is now shown in the Diff Checker tool whenever a multiline string property is added or modified, allowing side-by-side comparison of the script content.

In addition, App Composer now generates a .yaml copy of builder definitions alongside the existing .json files on every save. Multiline strings are stored in YAML literal block style, preserving line breaks and making diffs readable in external Git clients such as GitHub Desktop.

Use cases:

• Tracking BeanShell script changes across app versions
• Establishing CI/CD pipelines for Joget app development
• Easier auditing of builder definition changes via Git history

Diff Checker now supports multiline diff:

.yaml file generated for external Git clients:

Enhanced Property Editor Styling Options

New styling configuration options added:

• text-decoration
• word-break
• text-overflow
• white-space
• overflow

This allows more granular control over UI rendering without custom CSS.

Color Picker Upgrade

Integrated a new color picker library (Coloris) for an improved color selection experience.

1. Eye Dropper
   The changes include the Eyedropper feature, which users can activate by clicking the eyedropper button on the color picker dialog.
   
   After clicking the Eye dropper, the user can select any color on the browser to get that color, and it will update the color picker.
   Note
   The Eyedropper feature is limited, as not all browsers support it. Can check here for support.
   Custom Color Palette:
   
   Users can add a custom color palette through the JSON configuration by setting predefinedPalette.
2. Save and Remove Color
   
   The user can add a new color to the palette by choosing the color and clicking on the "Save" button. Users can also remove that color by hovering over that color, and a trash icon will appear.
3. Recent Colors
   Recently used colors will be saved. The maximum number of recently used colors at one time is 6.
   New Color Picker UI:
   

Enhanced alert and confirmation dialogs

Improved alert and confirmation pop-up UI consistency and replaced the browser default alert & confirm dialog.

Alert:

Confirmation:

Improved Loading Indicator

• Modern spinner design
• Contextual messages (e.g., “Loading…”)
• Fully responsive
  

X-Admin Theme Enhancement

Added sub-header field to the X-Admin theme configuration.

AJAX Callback

Ajax callbacks are now supported in the following themes in Joget DX 9.1:

• DX 8 Trimeda Theme
• DX 8 Angle Theme
• DX 8 Color Admin Theme
• DX 8 Plain Theme

Process Builder Improvements

Improved Canvas Navigation

• Shift + Drag: Pan canvas
• Shift + Scroll: Horizontal scroll
• New draggable control panel
  

See Process Builder.

Subflow Parameter Selector

• Replaces free-text input
• Uses structured variable selector
• Includes guidance tooltip

Impact: Reduces configuration errors.

Administrative & Enterprise Improvements

Slide-Out Record View

Opening a record in backend lists (such as Running Processes or Users) now launches a Slide-Out Panel:

• Search and filter results remain intact in the background
• Eliminates the need to re-run searches after viewing a record

Slide-Out Panel:

System Logs Enhancements

The System Logs page now includes:

• Search and filter capabilities
• Light and dark theme support

Light mode:

Dark Mode:

System Logs filter:

Manage Plugins Enhancements

Settings > Manage Plugins now offers improved visibility and control:

• Download Installed Plugins – download the JAR file of any individually installed plugin
• Plugin Filename & Marketplace Link – displays the plugin’s file name and Joget Marketplace origin link
• Quick Open & Copy Link – buttons for easy tracing and reference of installed plugins
  

See Manage Plugins.

Plugin Visibility in System Info

You can now see and download all plugins in your deployment for the Plugin Information page here by navigating to Settings > General > About > System Information. See details at General Settings. A new Plugin Information section on the System Information page lists:

• All files in the plugin folder
• File names and sizes
• Download option for diagnostics and support
  

See General Settings.

LDAP Directory Manager

LDAP Directory Manager now supports:

• System Manager role
• App Creator role

The new Role settings:

See LDAP Directory Manager - System Roles for more information.

Security Enhanced Directory Manager

Security Enhanced Directory Manager now has an Enforce Single Active Session setting. See Security Enhanced Directory Manager for more information.

Datasource and profile

The Datasource & Profile page is now in read-only mode. The only way to edit the fields now is through the app_datasource.properties and app_datasource-<profile_name>.properties files, respectively in the wflow directory.

Governance & System Health Improvements

Governance Health Check Enhancements

The Governance Health Check module has been expanded with new detection and cleanup capabilities.

Remove Orphaned Form Data Tables

Detects and removes unused form data tables no longer associated with active definitions.
Remove Orphaned Table Action:

See Remove Orphaned Form Data Table for more information.

Detect & Clear Unused Process Designs

Identify unused process designs and provide cleanup functionality.
Remove Unused Process Action:

See Detect Unclear Process Design for more information.

Action Buttons in Scan Results

Health Check now supports rendering actionable buttons directly in scan results, allowing administrators to execute cleanup operations immediately.
Governance Health Check Results with Actions:

See Governance Health Check.

Batch Delete Completed Process Instances

Under Monitor > Completed Processes, administrators can now batch delete process instances.

This improves system maintenance efficiency in high-volume deployments.

The Batch Deleting option:

Email & Hash Variable Enhancements

Hash Variable Support for Base64 Conversion

New ?data2base64 escape type added.

Allows conversion of image data (e.g., SVG, signature) into Base64 data URL format.

Automatic Base64-to-CID Conversion in Email

When sending emails:

• Base64 image data URLs are automatically converted into CID attachments

This improves:

• Email client compatibility
• Rendering reliability

Developer & Build Improvements

Java 17 & 21 Support

• Updated build configuration
• Supports:
  • JDK 17
  • JDK 21

CodeMirror Editor Upgraded to Version 6

The built-in code editor used throughout Joget’s builders has been upgraded to CodeMirror 6. The new editor is significantly faster when handling large volumes of text (such as complex XPDL process definitions) and brings several new capabilities to all code editing areas in Joget’s builders:

• Full-screen editing mode
• Adjustable font size control
• Improved syntax highlighting
• Java language support

Known Issues

• Activity remains stuck when a workflow variable is not declared in Process Builder in Joget DX 9.1.0.1. This is a known issue, and a workaround is to declare all workflow variables in Process Builder.
• Regression issue related to changes with the Readonly option, now being called Disabled in the new Write Permission dropdown. A temporary patch has been released to revert this, found here: Joget DX 9.1.0.1 Patch Announcement.
• Regression: Existing Spreadsheet Grid columns that previously had the “Readonly” option checked will be changed to “Disabled” Write Permission and will not have their value saved in DX 9.1-PREVIEW.
• Regression issues arising from the Confirm & Alert dialog enhancement.
• Regression issues arising from the Joget DX 9 Builder Theme enhancement.

Bug Fixes

This release resolves a number of regression and UI issues for a more stable experience across all supported themes and locales.

• Datepicker – Date and Time fields now load correctly when the first datepicker is set to read-only or disabled
• Property Editor – Editor no longer closes unexpectedly when clicking inside the Property Assistant in Undock mode
• Trimeda Theme – Multi-select dropdown is now fully visible when expanded, restoring multi-select field usability
• Alert & Confirm Dialogs – Fixed translations for Simplified Chinese, Traditional Chinese, and Arabic; corrected success/failure icons and button priority on unsaved-changes dialogs
• Joget DX 9 Builder Theme – Resolved UI defects with Datepicker (disabled-state styling, cursor), File Upload (‘Drop files here’ area after upload), and Calendar (event text overflow on mobile)
• Spreadsheet Grid – Formula column values are now preserved on submission when the column is set to Disabled
• Joget DX 9 Builder Theme (additional) – Fixed duplicate brand names, blocked ‘Show’ button in mobile filter view, non-functional font size control, and a console error
• Clone App produced empty components when the app contained tags or custom tables — Cloning an app that used tags or custom tables resulted in empty components instead of correctly copied content. Resolved.
• Calendar events and numeric controls displayed incorrectly in Joget DX 9 — Calendar events did not span date ranges correctly, and numeric input controls appeared misplaced in Progressive and Universal themes. Both corrected, including missing event borders across themes.
• Form section showed an unwanted border in "Always Visible" collapsible mode — A border was incorrectly rendered on form sections set to Always Visible (Cannot be Collapsed) across multiple themes. Borders now appear only on genuinely collapsible sections.
• Unnecessary database queries are triggered on every app load in Joget DX 8 — Redundant database queries are fired each time an app definition is loaded. The unnecessary operation has been removed.
• Form data table could be dropped on transient database errors — Under certain conditions (e.g., "Too many connections"), Joget could incorrectly drop and recreate a form data table, causing data loss. Now, only genuinely missing tables trigger a create operation.
• Kubernetes session replication caused users to be logged out across pods — In non-sticky session Kubernetes deployments, users were unexpectedly logged out or shown another user’s session. Session replication now works correctly across all nodes.
• Critical security fix: Remote Code Execution via Expression Hash Variable — A case-sensitivity flaw in the Expression Hash Variable security filter allowed bypassing protections to execute arbitrary code (CVSS 9.8). The filter now blocks all capitalisation variants of restricted keywords.
• File Manager failed to clear expired temporary files in cloud environments — The scheduled cleanup task initialised before it had permissions to access all tenant profiles, leaving expired files uncleaned. Corrected.
• Governance health check falsely reported "Secure Authentication - FAIL" for OpenID — Organisations using the OpenID Directory Manager saw a misleading security failure despite valid secure authentication. The check now recognises OpenID as a secure provider.
• Icons on form field labels were misaligned — Icons attached to form field labels appeared next to the input value rather than the label text. Positioning is now correct and configurable per field.
• Builders were slow to open and consumed excessive CPU and memory in the cloud — Opening any builder could take up to 48 seconds and 10 GB of memory due to inefficient plugin scanning. Scanning is now performed once per server session, and caching is far more efficient.
• "Existing Custom CSS" warning did not appear when switching themes in UI Builder — Changing the theme would not prompt about existing customisations unless the settings panel was reopened. Prompts now appear correctly and in sequence.
• Workflow variables were silently not saved when updated via API — The /completeWithVariable and /assignment/variable endpoints returned 200 OK but did not persist values. Both now correctly save variables on Joget DX 8 and Joget DX 9.
• Section visibility rules did not work inside subform repeaters — Show/hide rules for sections stopped working in newly added repeater rows. The rules cache is now refreshed for each new row.
• Process archive migration could not be reliably paused — The Pause button for the archived-process migration had no consistent effect. Pause and Resume now work reliably.
• Camera option missing when tapping image upload field on Android Chrome — On Android Chrome/Brave, tapping an image upload field did not offer the camera. The camera option now appears correctly on Android, iOS, and desktop.
• Subforms appeared detached or floated outside their parent section — In Universal, Progressive, and Janux themes, subforms were not contained within their parent section. Alignment corrected across all affected themes, including RTL and mobile.
• Form Builder element order was inconsistent after adding multiple elements at once — Adding several elements simultaneously could result in the saved order differing from the design layout. The ordering logic has been corrected.
• Joget DX 8 Trimeda theme form buttons were misaligned on mobile screens — Form action buttons overlapped or lacked spacing on mobile in LTR and RTL layouts. Spacing has been refactored to display correctly across all screen sizes.
• Users were redirected to a 404 error after logging in via Passkeys or MFA. After a successful Passkeys/MFA login, users were sent to a non-existent page. The post-login redirect now routes correctly to the designated home menu.
• "Sectors" tags in the Competitor Research app were overlapping — In X-Admin, Universal, and Progressive themes, sector tags were layered on top of each other. Tag display is now correctly aligned.
• UI Builder changes caused SQL errors and stale data on MSSQL databases — Saving changes produced SQL exceptions on MS SQL Server, and deleted pages were not fully removed. Database column types have been corrected to resolve both.
• Login error messages overlapped the login form on mobile in Trimeda and other themes. On mobile, login error messages are displayed on top of the form. Positioning is now correct across all themes, screen sizes, and layout directions.
• Form Builder Multi Tools configuration tabs did not appear for newly added rows — Adding a new tool row in the Post Processing Tool resulted in missing configuration tabs and an indefinitely loading field. Tab visibility now works for all rows.
• Plugin default properties with nested values caused errors at runtime — Nested Map and array values were incorrectly converted to plain text, causing failures. Nested property types are now preserved correctly.
• Special characters in form field labels were double-encoded when a label icon was present — Labels containing characters such as & displayed as & after saving when a font icon was attached. Encoding is now handled correctly.
• App Generator created duplicate list and UI builder entries when titles contained apostrophes — Titles with an apostrophe produced extra unwanted entries due to a JSON parsing error. Apostrophes and other special characters are now handled correctly.
• Process status columns triggered a separate request for every row in a data list — The Process Status formatter fired individual requests for every visible row, causing slowness on large lists. Requests now load lazily as rows scroll into view, max three at a time.
• Date hash variable shifted dates by one day in certain timezone configurations — The #date.DATE_FORMAT_TO# variable could be one day off when no timezone was specified, and the user’s timezone was behind the server’s. It now uses the user’s profile timezone when none is provided.
• Long brand names were truncated and not fully visible in the navigation menu — Long brand/organisation names were cut off in the menu header. The full name now shows on hover via a tooltip across all themes.
• Oracle database rejected large signature values with an ORA-12899 error — Saving a detailed signature field failed because the default column size was too small. The resolution is to change the signature column type to CLOB in Oracle; see documentation.
• Misalignment for ISR Status Column during RTL mode for Progressive/Universal Themes - Removed an unnecessary float: left on the badge element in RTL view.

Improvements

• Apache Tomcat upgraded to address multiple security vulnerabilities — Tomcat updated to 9.0.118 (DX 8) and 11.0.22 (DX 9) to resolve several CVEs, including a security constraint bypass and a digest authentication vulnerability.
• Spring Framework upgraded to address CVE-2026-22745 — Spring Framework updated to 6.2.18 for Joget DX 9 to patch a Denial of Service vulnerability affecting static resource serving on Windows.
• Multi-tenant host isolation strengthened for cloud deployments — Additional security hardening applied to cloud (multi-tenant) environments to further strengthen tenant isolation.
• Multiple third-party library vulnerabilities resolved — Several dependencies upgraded to patch known CVEs, including the PostgreSQL driver, Bouncy Castle, and Spring Security.
• Glowroot APM upgraded to version 0.14.6 — The built-in APM tool updated from 0.14.2 to 0.14.6, including a percentile display fix and general improvements.
• Workflow variable persistence is now significantly faster at scale — Variable writes are now batched into a single operation, reducing database round-trips from roughly 2,000 down to 300–400 per operation.
• App Git repository size is now managed automatically — Joget now runs scheduled Git maintenance, uses shallow fetches for temporary operations, and cleans up orphaned working directories, keeping storage under control.
• Transaction rollback events now produce actionable log entries — Rollbacks now log a warning with context; with debug logging enabled, the full call stack is shown, making transaction failures easier to diagnose.