​

Known issues

• FLEXDEPLOY-16366 - JWT OAuth tokens are malformed and not working in the initial 11.1.0.0 release. This issue affects several Oracle plugins when authenticating with JWT tokens. 11.1.0.1 version plugins are available on the plugins download page. Install them if you are affected.
• FLEXDEPLOY-16516 - FlexDeploy Functions - createPackage and updatePackage may leave an object out of the package when archive-based files are discovered in expanded format. This can occur for Oracle Integration Cloud integrations and other project types where many files and folders exist under a single discovered File Catalog path. The issue occurs when deleted files under the object cancel pending additions or modifications for the same object while processing Git change logs. A fix will be provided in FlexDeploy 11.1.0.4 and later, and 11.2.0.0 and later. Contact Flexagon Support if a backport is needed for an earlier version.
• CM-1923 - SSO Configuration
  • If FlexDeploy and Configuration Management are running without SSO, configuring SSO in only one application and restarting the other server may cause startup failure.
  • Error: There is no filter with name 'ssoFilter' to apply to chain [/faces/**] in the pool of available Filters
  • Workaround: Disable SSO, restart both servers, enable SSO on both servers, then restart both servers again.
  • Fix planned for 11.1.0.4+ and 11.2.0.0+.

​

Launch Webinar Recordings

​

FlexDeploy 11.1.0.4 (10-31-2026)

​

Security

• Node, Angular, Grunt, Oracle Visual Builder Plugin
  • FLEXDEPLOY-16676 - Plugin Node.js version selections v22, v24, and v26 now install the October 21, 2026 security releases (22.23.4, 24.22.1, and 26.12.1). Existing endpoint installs under installs/nodejs are keyed by major version and are not replaced automatically; delete those v22/v24/v26 folders to pick up the patched binaries on the next run.
• Flexagon SaaS Platform
  • FLEXDEPLOY-16676 - The node version shipped for SaaS customers is updated to 22.23.4+ for CVEs.
  • FLEXDEPLOY-16677 - Updated cacerts during Docker image builds to address security vulnerability CVE-2026-91403.
• FLEXDEPLOY-16620 - FlexDeploy and Configuration Management and HTTP Agent - Upgraded the version of Apache Tomcat to 9.0.0.123.
• FLEXDEPLOY-16538 - When HSTS is enabled via FLEXDEPLOY_HSTS, FlexDeploy applies the HSTS filter in Tomcat root conf/web.xml so Strict-Transport-Security covers the server root (/) and all applications.

​

System Settings

• FLEXDEPLOY-16594 - System Settings property value updates now apply the client’s version number for optimistic locking, so concurrent edits are detected instead of silently overwriting.

​

Plugin Updates

• Oracle Integration Cloud Plugin
  • FLEXDEPLOY-16409 - Added support to apply environment-specific values for Oracle Integration B2B Trading Partner transports and agreements using a Trading Partner Config Plan.
  • FLEXDEPLOY-16595 - Added a new input, Activation Retry Count (FDOIC_INP_ACTIVATION_RETRY_COUNT), to configure the wait time for an OIC integration to reach the ACTIVATED state before proceeding.

​

Resolved Issues

• Topology
  • FLEXDEPLOY-16560 - Resolved an issue where the Configuration Management Environment field on Topology Targets displayed a numeric ID instead of the environment name after login.
  • FLEXDEPLOY-16564 - Resolved an issue where saving Topology Target properties failed when a Configuration Management Environment was selected. The error displayed was: “Variable ‘properties’ has an invalid value: Expected a String input, but it was a ‘Integer’”.
• Outgoing Webhooks
  • FLEXDEPLOY-16673 - User Created outgoing webhook no longer fails with NPE when a new user is assigned groups missing from the FlexDeploy group cache (for example CSS default new-user groups).
• Groovy Functions
  • FLEXDEPLOY-16516 - When creating or updating a package from Git change logs, an Oracle Integration Cloud (OIC) integration is no longer dropped from the package if the same commit both adds or modifies files under that integration and deletes other child files (for example, renumbered resource groups).
• Oracle Integration Cloud Plugin
  • FLEXDEPLOY-16441 - OIC plugin schedule overrides for project integrations now use Project Identifier / Integration Identifier folder paths (consistent with lookup and connection overrides), with fallback to the previous Integration Identifier-only path.
  • FLEXDEPLOY-16546 - Resolved an issue where undeployment of trading partner transports was skipped when their status was FAILED during import.
• Oracle APEX Plugin
  • FLEXDEPLOY-16577 - Oracle APEX application and workspace static file export no longer fails with ORA-01427 when prior APEX schemas remain in the database after an upgrade. Export now reads files through a REF CURSOR instead of JDBC Array.getArray on PUBLIC.APEX_T_EXPORT_FILES.
• Oracle Visual Builder Plugin
  • FLEXDEPLOY-16683 - deployApplicationExtension now supports Oracle SaaS JWT Assertion accounts without requiring a password.

​

FlexDeploy 11.1.0.3 (10-4-2026)

​

Application Updates

​

Security

• FLEXDEPLOY-16528 - Upgraded Tomcat to version 9.0.122 for the HTTPS Agent, FlexDeploy, and Configuration Management to address security vulnerabilities, including CVE-2026-86350, CVE-2026-87022, CVE-2026-86248, and related Tomcat CVEs.
• FLEXDEPLOY-16549 - Updated Bouncy Castle to version 1.86 to address reported CVEs and support quantum-ready cryptography. This update also resolves issues loading passphrase-protected OpenSSH-format PEM private keys.

​

Salesforce

• FLEXDEPLOY-16494 - Upgraded the Salesforce plugin to API version 68.0 (Winter ’27) so deployments to Winter ’27 orgs succeed. New metadata types FlowValueMap, UiWidgetBundle, AiAgentDefinition, and AiAgentDefinitionVersion are supported. The default API version is 68.0; BASIC authentication remains limited to 64.0.
• FLEXDEPLOY-16408 - Salesforce metadata compare/listMetadata connections now enable TCP keep-alive to reduce Connection reset failures during long-running compares against large orgs.

​

Plugin Updates

• Oracle Cloud Plugins (Analytics Cloud, API Platform, Integration Cloud, EPM, Visual Builder)
  • FLEXDEPLOY-16527 - Allow selecting the JWT signature algorithm on OCI-related cloud accounts for OAuth JWT assertion.
• OTBI Plugin
  • FLEXDEPLOY-15664 - Added handling to resolve an OTBI display name to its corresponding catalog path when needed. This allows OTBI objects to be downloaded successfully when the display name is provided instead of the actual catalog path, including from incoming webhooks submitted by the FlexDeploy Browser Extension.
• Oracle Integration Cloud Plugin
  • FLEXDEPLOY-16539 - Resolved an issue where the Oracle API could return a null status while deactivating integrations. The plugin now handles the null status and continues polling, allowing the deactivation operation to complete successfully once a valid status is returned.

​

Resolved Issues

• Project
  • FLEXDEPLOY-15248 - Fixed an issue where the Trigger icon and Actions/Options were not enabled or disabled correctly based on the configured permissions.
  • FLEXDEPLOY-15842 - Fixed an issue where inactivating a Package and saving did not clear the dirty state or display a success snackbar.
  • FLEXDEPLOY-16083 - Improved package work-item validation so invalid items cannot be saved, and Cancel clears them.
• Git Integration
  • FLEXDEPLOY-3623 - On Windows endpoints, FlexDeploy Git operations no longer trigger the Git Credential Manager browser popup when authentication fails; users see a clear error instead.
  • FLEXDEPLOY-11178 - File catalog discover no longer hangs on Bitbucket LFS repositories when the git account has no username/password configured; git pull fails promptly instead of waiting for credentials.
• Incoming Webhooks / Scheduled Event
  • FLEXDEPLOY-16305 - Fixed an issue where Incoming Webhook Messages and Scheduled Event Messages columns were uneven in fixed layout.
  • FLEXDEPLOY-16307 - Fixed the unsaved changes warning when leaving a form with the browser Back button, such as Incoming Webhook Providers and Functions.
• Outgoing Webhooks
  • FLEXDEPLOY-16279 - Fixed an issue where default sorting was not displayed for the Active and Status fields when Fixed Layout was enabled.
• Reports
  • Weekly Commit Counts Report
    • FLEXDEPLOY-16282 - Fixed an issue where the Commit Count field did not display sorting by default when Fixed Layout was enabled.
• Oracle EBS Plugin
  • FLEXDEPLOY-16548 - When Fail if patching in progress is unchecked for EBS deployments, FlexDeploy now skips the adop status check. This allows deployments to continue when the endpoint user does not have permission to execute adop.
• Oracle Apex plugin
  • FLEXDEPLOY-16438 - Resolved a regression introduced in version 11.1.0.0 that caused exportApplications to fail when an Oracle Wallet ZIP was used.
• Oracle Integration Cloud
  • FLEXDEPLOY-16425 - Resolved an issue where a failed OIC Project Integration execution restored lookups from the source artifact. Lookups now keep their target (environment) values after a failed execution.
• Oracle EPM Plugin
  • FLEXDEPLOY-16519 - Resolved an issue where the exportNewSnapshot and downloadSnapshot operations could fail with an Invalid URL error after FlexDeploy stopped automatically removing trailing slashes from REST URLs.
    • Oracle EPM Cloud requires the /interop/rest/ endpoint to contain a single trailing slash. Older Oracle EPM plugin versions could generate /interop/rest//, which does not work with FlexDeploy 10.0.0.3 - 10.0.0.8 or 11.0.0.0 - 11.0.0.5, and 11.1.0.0 - 11.1.02.
    • Customers using affected Oracle EPM plugin versions should upgrade to the plugin included with FlexDeploy 10.0.0.9, 11.0.0.6, 11.1.0.3, 11.2.0.0, or a later plugin build for those release lines.

​

FlexDeploy 11.1.0.2 (9-7-2026)

​

Application Updates

​

Security

• FLEXDEPLOY-16365 - FlexDeploy and Configuration Management - Upgraded spring-core library to address reported CVEs, including CVE-2026-41838 through CVE-2026-41846, CVE-2026-41848, and CVE-2026-41850 through CVE-2026-41855.
• FLEXDEPLOY-16461 — Introduces a new JWT Issuer cloud account property for Oracle Cloud services, including OIC, OTBI, Oracle API Platform, FSM, OAC, OVB, and EPM. When configured, the specified value is used as the iss claim in the JWT user assertion sent to IDCS. If the property is not configured, FlexDeploy continues to use the default issuer (flexdeploy) to maintain backward compatibility.

​

Project

• FLEXDEPLOY-16153 - Added scheduled window validation for Deploy, Utility, and Pre-deploy requests submitted from the UI. If the requested start time is outside the folder’s scheduled window, a warning is now displayed. Users can either continue as an exception, which may require approval, or update the start time and resubmit the request.

​

Plugin Updates

• Azure PowerBI Plugin
  • FLEXDEPLOY-16094 - Enhanced the Azure Power BI plugin to support paginated report (RDL) connection and credential datasource updates during deployment using existing PBIX-style JSON inputs.

​

Resolved Issues

• Security
  • CM-1539 - Updated new user creation to assign default groups for both FlexDeploy and Configuration Management during the same create process when the corresponding settings are configured. This applies to users created manually by an administrator, through SSO just-in-time provisioning.
    Default group assignment uses the following settings:
    • FlexDeploy: Administration → System Settings → General → New User Role (FD_NEW_USER_ROLE)
    • Configuration Management: Administration → System Settings → General → New User Role (CSS_NEW_USER_ROLE)
  • FELXDEPLOY-16419 - (Password reset: anonymous password strength): Password reset links now open a working Reset Password page where you can set a new password and see an accurate strength indicator while you type.
• Credential
  • FLEXDEPLOY-16429 - Resolved multiple issues related to credential usage.
    • Hidden integration instance properties are now marked inactive, and any credential values stored in those properties are cleared. This ensures only credentials required for execution are loaded.
    • Credential reference usage now includes inactive properties, providing more complete visibility into where credentials are referenced.
    • Internal caches are now properly cleared when Email Communication settings are saved, preventing issues with email-related activity.
• Release and Pipeline Orchestration
  • FLEXDEPLOY-15864 - Added validation messages to the Edit Release Info screen to make validation behavior consistent with release creation.
  • FLEXDEPLOY-16280 - Resolved an issue where the release name validation error was not displayed below the Release Name field.
• Groovy Functions
  • FLEXDEPLOY-16381 - Resolved an issue where package create or update could fail with a duplicate file error when a Git changelog added, deleted, and re-added the same file path within a single webhook event.
• Oracle EPM Plugin
  • FLEXDEPLOY-16334 - Resolved an issue where Oracle EPM Discover from Snapshot failed when a snapshot contained empty parent resource XML files (for example, Data Load Mapping). Discover now skips those empty files and continues discovering the remaining artifacts.
• Azure Plugin
  • FLEXDEPLOY-7779 - Resolved a class exception in the buildARMTemplate operation. The executeARMTemplate operation now also removes decrypted parameter values from temporary files after deployment to reduce exposure of sensitive information.

​

FlexDeploy 11.1.0.1 (8-9-2026)

​

Application Updates

​

Security

• FLEXDEPLOY-16081 - Pipeline and Workflow Read permissions are now automatically assigned when a security group is granted Create or Update permission, either globally or on an individual pipeline or workflow with security override enabled.

​

Salesforce

• FLEXDEPLOY-15982 - Added a new FDSF_PACKAGE_XML_TYPE_LIMITS project property to customize how many items of each object type are included in each package.xml file during download. This helps prevent FlexDeploy from creating packages that are too large. The default limits have also been adjusted to use smaller package sizes for Report and Document metadata types.
• FLEXDEPLOY-16330 - Increased read and connection timeouts for Salesforce API calls to reduce timeout issues during longer-running operations.
• FLEXDEPLOY-16203 - A fast-fail better error message is shown when attempting to use the discover and commit trigger when the SCM is not setup properly.

​

Jira and Jira ITSM Integration

• FLEXDEPLOY-16265 - Jira and Jira ITSM integrations now support a new optional Jira API URL property. When configured, FlexDeploy uses the Jira API URL for REST API communication while continuing to use the Jira URL to generate user-facing ticket browse links. If the Jira API URL is not configured, the Jira URL is used for both API calls and ticket links. This is useful for Atlassian Service Accounts, which require API calls to use the Atlassian API URL format <https://api.atlassian.com/ex/jira/<cloudId>>/\{api\} instead of the standard https://<your-domain>>.atlassian.net/\{api\} Jira URL.

​

Https Agent

• FLEXDEPLOY-16379 - Updated JVM GC logging options to be compatible with Java 21 while maintaining support for earlier Java versions. This resolves HTTPS Agent startup failures caused by deprecated JVM options on newer JDKs.

​

Plugin Updates

• Oracle WebLogic Plugin
  • FLEXDEPLOY-16382 - WebLogic createOrUpdateWeblogicConfig now allows values like TwoPhaseCommit GlobalTransactionsProtocol for XA datasources.
• Oracle APEX Plugin
  • FLEXDEPLOY-16130 - Added a new ApexLang export format for Apex version 26.0 and later.
• Oracle Visual Builder Plugin
  • FLEXDEPLOY-16351 - Added a new FDOVB_INP_SKIP_TRANSPILE input to automatically skip JavaScript transpilation when needed during Oracle Visual Builder builds. This resolves an issue related to automatic JavaScript transpilation.
  • FLEXDEPLOY-16352 - Resolved an issue where exportApplication with a blank Application Version (latest) could fail when non-numeric version labels were present. Latest version selection now uses last-updated order so non-numeric version labels no longer cause selection issues.
• Various Plugins
  • FLEXDEPLOY-16350 - Added the latest supported Node.js versions (v22) for ( Oracle Visual Builder, Angular, and Grunt ) plugins and updated existing Node.js version download paths to the latest available patch releases.

​

Resolved Issues

• Security
  • FLEXDEPLOY-16363 - SSO logout now respects the configured logout.defaultUrl instead of always returning to the FlexDeploy home page.
  • FLEXDEPLOY-16164 - Added a User Read permission check to ensure only authorized users can access the Edit User page.
  • FLEXDEPLOY-16366 - Resolved a regression in 11.1.0.0 that broke OAuth connectivity when using JWT Assertion. The connection could fail with the error: “Invalid user assertion: A system error has occurred in Oracle Identity Cloud Service.”
• Projects
  • FLEXDEPLOY-15841 - Resolved an issue where creating a new project using a blueprint was sometimes failing to create with no visible error.
  • FLEXDEPLOY-15001 - Updated the workflow failure summary to include the error message from a failed subworkflow, making the failure reason easier to identify.
  • FLEXDEPLOY-15546 - Resolved an issue where the project deletion confirmation displayed incorrect messaging and did not delete associated standalone releases.
  • FLEXDEPLOY-16294 - Resolved an issue where the Run Groovy Step was not displaying as running during execution. The step status and duration now updates while executing.
• Workflow
  • FLEXDEPLOY-16166 - Resolved an issue where code editors were not displaying suggestions at times. It was occurring most frequently while editing workflow inputs and only observed for shell and markup languages.
• Topology
  • FLEXDEPLOY-16140 - Resolved an issue where the Show Target Statuses toggle displayed tags inconsistently. Limited the display to one tag for better visibility.
• Release and Pipeline Orchestration
  • FLEXDEPLOY-16303 - Resolved an issue where the release content actions menu was sometimes not being displayed when first accessing a release.
  • FLEXDEPLOY-15886 - Added documentation links to the Pipeline page tabs for easier access to relevant documentation.
  • FLEXDEPLOY-16154 - Resolved an issue where Approve and Reject buttons were displayed for users who were not assigned to the Override Role for an external gate. The actions were already blocked when clicked, but the options are now hidden unless the user has the required role.
  • FLEXDEPLOY-16353 - Pending Content on release approval and schedule gates now show Configuration Migration packages when they are in the snapshot.
• FlexDeploy - Configuration Management Integrations
  • FLEXDEPLOY-16284 - Resolved an issue where ClassCastException was being thrown when defining a Groovy expression for Process Definition on the Create Baseline operation.
  • FLEXDEPLOY-16323 - Resolved an issue where Configuration Management operations were sometimes not returning the Request Ids output value when a request failed in Configuration Management.
  • FLEXDEPLOY-16319 - Resolved an issue where internal Configuration Management workflow properties could be deleted. The delete option is now disabled.
• Value Stream Metrics
  • FLEXDEPLOY-16343 - Resolved an issue where table metrics could fail for tables with very large row counts. The failure produced an internal error indicating that a value was larger than the precision allowed for the column.
• System Settings
  • FLEXDEPLOY-14714 - Resolved an issue where testing the email configuration could fail with a “Cannot parse null string” error. A clearer validation message is now displayed when the email configuration is incomplete or invalid.
• Oracle APEX Plugin
  • FLEXDEPLOY-16185 - Resolved an issue where single quotes in APEX workspace names, application names, and schema names could cause export or import failures.
  • FLEXDEPLOY-16189 - Resolved an issue where the Export Workspace Static Files and Import Workspace Static Files operations did not validate required properties before execution. Required property validation is now performed during the validation phase, preventing runtime failures.
  • FLEXDEPLOY-16360 - Resolved an issue where the Run as Application Only target property was not honored during the Oracle APEX import operation.

​

FlexDeploy 11.1.0.0 (7-12-2026)

​

Application Updates

​

Security

• FLEXDEPLOY-16114 - FlexDeploy and Configuration Management and HTTP Agent - Upgraded the version of Apache Tomcat to 9.0.0.119.
• FLEXDEPLOY-16024 - Upgraded Lodash library version 4.17.21 to resolve vulnerability CVE-2021-23337.
• FLEXDEPLOY-14554 - Docker / SaaS - The FlexDeploy and Configuration Management Docker images no longer run as root. Instead, FD and CM run as 1283:1283. Non-SaaS customers will need to chown and/or chmod their docker volumes as a result of this change.
• FLEXDEPLOY-14642 - Added Password Expiry related columns to Users report.
• FLEXDEPLOY-14794 - API Tokens - Added an option to cache permissions for SSO users when using FlexDeploy API tokens. Caching is disabled by default to preserve the previous behavior, but can be enabled for up to 180 days. To use cached groups and permissions, the user must have logged in to FlexDeploy through the UI within the configured cache period.
• FLEXDEPLOY-15814 - The Shiro and related libraries were updated to address CVE-2026-23901 and CVE-2026-23903.
• FLEXDEPLOY-15922 - Update the version of PdfBox included with FlexDeploy to remediate vulnerabilities CVE-2026-23907 and CVE-2026-33929.
• FLEXDEPLOY-16059 - Adjusted the filters used to determine whether Groovy execution is allowed. The updated filtering restores support for some Groovy usage that was restricted in 11.0.0.2, while applying stricter controls to certain low-level utility methods.

​

Platform Update

• FLEXDEPLOY-15894 - FlexDeploy and Configuration Management - Improved browser caching for static UI resources, including .woff2 and .json files. These files are now cached more effectively instead of being served with no-cache headers, improving UI performance, especially for users accessing the application over VPN.

​

FlexDeploy - Configuration Management Integrations

​

FlexDeploy to Configuration Management

• FlexDeploy now includes a new project type that discovers available migration plans from Configuration Management. Customers can create separate FlexDeploy projects for CM EBS and CM Fusion Cloud, allowing each Configuration Management source to be managed independently.
• A new release step is also available to run a Utility Project for each migration associated with this project type. In addition, a new Groovy function object, CM, has been added to provide functions that allow FlexDeploy workflows and scripts to interact with Configuration Management.
• Workflow design now allows use of new Configuration Management operations like Create Baseline, Run Report, Compare Entity, Compare Environment, Build Migration, Deploy Migration, etc.

​

Configuration Management to FlexDeploy

• Configuration Management can now interact with FlexDeploy by adding migrations to a release and creating snapshots, enabling CM migrations to participate directly in FlexDeploy release orchestration.

​

Work Items

• FLEXDEPLOY-15936 - Work Items - When connecting to external work items for the first time, FlexDeploy now tracks the external creation date instead of the connection date. This helps generate more accurate DORA metrics.
• FLEXDEPLOY-15312 - Added an option to copy the Work Item Status Id.
• FLEXDEPLOY-15323 - Resolved an issue where activating or inactivating a work item status did not refresh the work item status list.
• FLEXDEPLOY-16103 - Work item Delete is now disabled in the UI when the user does not have Work Item Delete permission.

​

Plugin Updates

• Oracle APEX Plugin
  • FLEXDEPLOY-14558 - Added support for migrating APEX Workspace Static Files through the new exportWorkspaceStaticFiles and importWorkspaceStaticFiles operations.
  • FLEXDEPLOY-14830 - Resolved an issue where deployment failed during backup when the target application did not exist. Backup is now skipped for new applications.
  • FLEXDEPLOY-14831 – Updated the default value of the Export Report Subscriptions property to true for Oracle APEX exports.
  • FLEXDEPLOY-14829 - Resolved an issue where SCM metadata folders, such as .git, .svn, and CVS, could be included in generated artifact ZIP files. These metadata folders are now excluded during ZIP creation.

​

Resolved Issues

• Workflow
  • FLEXDEPLOY-16104 - Users with read-only access to a workflow, or without Update permission, can no longer change security settings, toggle Override Global Read and Update Permissions, or save changes on the Workflow Security tab.
• Release and Pipeline Orchestration
  • FLEXDEPLOY-15840: Newly created Pipeline shows up in the list even without a refresh.
• Salesforce
  • FLEXDEPLOY-15555 – FlexDeploy now correctly classifies tests when using the “Specified and Package Tests” test level . Tests are identified when their names start or end with “Test” (case-sensitive).
• Reports
  • FLEXDEPLOY-15977 - Resolved issue with Equals and Not Equal filters on Environment State and Users reports with various columns.
  • FLEXDEPLOY-15896 - Resolved an issue in the Configuration Audit report where permission display names were incorrect for Project and Release permission updates made at the folder level.

​

Installer

• The new installer version allows adding custom Docker Run arguments to handle user id mapping issues.

​

Incompatible Changes

• FLEXDEPLOY-14554 - Docker / SaaS - The FlexDeploy and Configuration Management Docker images no longer run as root. Instead, FD and CM run as 1283:1283. Non-SaaS customers will need to chown and/or chmod their docker volumes as a result of this change. Customers using Docker image may need to update ownership or permissions on Docker volume mount directories as a result of this change. For example, on the Docker host, you may create a matching user and update volume ownership:

useradd -Uu 1283 flexuser -m -s /bin/bash
chown -R 1283:1283 /root/Docker/Volume/Mounting/Folder