​

Known issues

• None

​

Launch Webinar Recordings

​

FlexDeploy 11.2.0.0 (11-08-2026)

​

Application Updates

​

Platform Update

• FLEXDEPLOY-8453 - Improved the Windows ZIP installation to verify that PostgreSQL is running and accepting connections before continuing the installation.
• FLEXDEPLOY-16374 - Windows StartWithPostgres.bat now initializes Postgres with UTF8 encoding so unicode characters can be saved in custom pipeline scripts.
• FLEXDEPLOY-14623 - Unix start scripts for FlexDeploy, Configuration Management, and the HTTPS agent now abort with a clear error if run as a user other than the install owner. Non-Docker upgrades also warn when run as a different user than the Tomcat directory owner.
• FLEXDEPLOY-15550 - HTTPS Agent start and stop no longer fail when CATALINA_HOME or CATALINA_BASE is already set by another Tomcat install.
• FLEXDEPLOY-11117 - Certificate expiry warnings are written to the HTTPS agent logs and plugin execution logs.
• FLEXDEPLOY-7682 - Added the ability to uninstall inactive plugin versions.
• FLEXDEPLOY-15839 - System Settings - Server Base URL no longer allows a trailing slash.
• FLEXDEPLOY-7074 - Number-typed properties now accept larger integer values (beyond 32-bit Integer range) by parsing as Long instead of Integer.
• FLEXDEPLOY-8309 - Increased INSTANCE table GROUP_CODE and SUB_GROUP_CODE column sizes to support longer integration provider codes.

​

Security

• FLEXDEPLOY-13906 - Added SCIM 2.0 provisioning so identity providers such as Okta can automatically create, update, and deactivate users, and push groups and group memberships, in FlexDeploy and Configuration Management without manual UI administration. SCIM supplants the existing group mapping, external group caching, and user just-in-time creation processes for managed identities, and supports a more easily managed user deprovisioning process.
• FLEXDEPLOY-11643 - Salesforce Security Token (FDSFCA_SECURITY_TOKEN) is now stored as an encrypted secret property.
• FLEXDEPLOY-12280 - Administrators can show a custom Markdown message on the login page, such as a security or legal notice, from System Settings under Security.
• FLEXDEPLOY-6420 - Password updates (including an administrator resetting another user’s password) now use a one-time email verification code instead of requiring the administrator’s FlexDeploy password. This allows SSO and other external-realm administrators to reset local user passwords.
• FLEXDEPLOY-16047 - Enabling or disabling two-factor authentication now verifies identity with a one-time email code instead of a password. Administrators can also disable another user’s 2FA from Administration → Security → Users.
• FLEXDEPLOY-15518 - Auto-refreshing screens now honor session inactivity timeout (polling stops after 15 minutes when the browser tab is inactive). Added a security setting to disable Remember Me, and a Session Lifetime Timeout setting for an absolute maximum session age from login.
• FLEXDEPLOY-15782 - Added validation to prevent credential names referenced in SSO configuration text from being modified.
• FLEXDEPLOY-16478 - Authenticated non-administrators who call configuration export or import REST APIs now receive HTTP 403 Forbidden instead of HTTP 401 Unauthorized. Configuration export and import remain administrator-only.
• FLEXDEPLOY-16398 - Pipeline Security now shows auto-added Read groups immediately after saving Update permissions, without requiring a page refresh.
• FLEXDEPLOY-16483 - The Group Permissions report now includes Create All grants for supported object types.
• FLEXDEPLOY-16512 - The Login Attempts Report now includes an Application column showing whether each login attempt was made to FlexDeploy or Configuration Management. The report can be filtered by one or more applications, and the column is included in exports.
• FLEXDEPLOY-16513 - Login Attempts Report now records authentications that succeed via the Remember Me cookie, with Login Source Remember Me, so those sessions appear alongside UI, REST, and SSO attempts.
• FLEXDEPLOY-15947 - Editing a user and updating the password no longer clears the Local User flag.
• FLEXDEPLOY-15542 - After initial registration, opening the registration page again no longer sends the user to the home page with a broken session.
• FLEXDEPLOY-8356 - Changing a user’s username now updates human tasks assigned to that user.
• FLEXDEPLOY-10522 - Last Online for user now displays in hours instead of minutes.
• FLEXDEPLOY-16259 - Release Insights Change History tab is disabled when the user does not have Reports view/read permission, preventing a 403 error.

​

Vulnerability Management

• FlexDeploy, Configuration Management, and HTTP Agent - Upgraded Apache Tomcat to 9.0.0.123.
• FLEXDEPLOY-16145 - Updated Shiro for CVE-2026-49268.
• FLEXDEPLOY-16177 - Updated Jackson Databind to 2.22.1 for CVE-2026-54512, CVE-2026-54513, CVE-2026-54516, and CVE-2026-54515.
• FLEXDEPLOY-16375 - FlexDeploy and Configuration Management - Updated the version of Nuxt used to build the UI to resolve reported vulnerabilities.
• FLEXDEPLOY-16476 - Upgraded Lodash to address CVE-2021-23337.
• FLEXDEPLOY-16487 - Apache HttpComponents Core (httpcore5) upgraded to address denial-of-service CVEs.
• FLEXDEPLOY-12040 - AWS jars updated to SDK2, resolving CVE-2024-23080.
• FLEXDEPLOY-16223 - Git plugin SSH library updated from unmaintained JSch 0.1.55 to the maintained mwiede JSch 2.28.6 fork.
• FLEXDEPLOY-16395 - Updated the FlexDeploy Gradle plugin to use Gradle 8.14.4, addressing CVE-2026-22816 and CVE-2026-22865.
• FLEXDEPLOY-16485 - Azure Power BI plugin - Azure Storage Blob SDK upgraded to address Netty CVEs.
• FLEXDEPLOY-16588 - Upgraded Apache PDFBox to 3.0.8 (FlexDeploy, CM and Salesforce plugin) to address CVE-2026-33929.
• FLEXDEPLOY-16589 - Upgraded the PostgreSQL JDBC driver for CVE-2026-42198 and CVE-2026-54291.

​

FlexDeploy - Configuration Management Integrations

• FLEXDEPLOY-16434 - FlexDeploy Configuration Management workflow steps can now use saved Run Option Sets and Entity Sets from CM Maintenance. Configure them in the workflow editor; at runtime FlexDeploy applies them when submitting CM requests. Affected steps: Create Baseline, Run Report, Compare Entity, Compare Environment.
• CM-1331 - Configuration Management allows configuring a manual migration, which becomes a manual package in a FlexDeploy release. At runtime the manual package becomes manual steps that pause the deployment process until completed.
• FLEXDEPLOY-16300 - FlexDeploy now shows a clear error when Configuration Management is unreachable, including the registry URL and guidance when the app is down or returns HTTP 404.
• FLEXDEPLOY-16410 - Approval and Schedule Gates reports after execution now display Configuration Management packages and other packages that do not support change detection, as well as projects and packages that failed to deploy or were aborted.

​

Projects

• FLEXDEPLOY-16508 - Introduced a new Blueprint project type for Oracle Process Automation projects.
• FLEXDEPLOY-6367 - The Copy Project and Copy Release dialogs now show the description and allow you to edit it before creating the copy.
• FLEXDEPLOY-13065 - Copying a Package now includes Copy Options checkboxes for Tags and Work Items (both default to enabled).
• FLEXDEPLOY-15674 - Evaluate and Evaluate All on File Catalog and Package Files now open a popup to select a branch (defaults to main) and optionally Ignore Errors. With Ignore Errors unchecked, files are evaluated together in one transaction; with Ignore Errors checked, files are evaluated one at a time and failures are collected at the end.
• FLEXDEPLOY-13331 - Project template CSV applies Branch Name and Version Name Syntax even when SCM is None.
• FLEXDEPLOY-13372 - Deploy/Build/Utility row actions show why they are disabled when the workflow has no active version.
• FLEXDEPLOY-9021 - PreDeploy deploy requests now preserve the selected deploy workflow version and pass it to the follow-on Deploy request after PreDeploy review completes.
• FLEXDEPLOY-9395 - After a successful post refresh, system-generated Clone and Refresh packages are automatically marked Complete for partial deploy projects.
• FLEXDEPLOY-15745 - Package rollback no longer includes Not Attempted files by default (same as Skipped).
• FLEXDEPLOY-15846 - Files Discover now defaults to the last environment/SCM branch used for discovery.
• FLEXDEPLOY-16498 - Improved performance of the Project Source Control configuration page when many SCM instances are configured.
• FLEXDEPLOY-14424 - Project Configuration Triggers create and update actions are now recorded in the Change History Report.
• FLEXDEPLOY-16697 - Resolved an issue on the project request/execution tasks page where task icons were sometimes not matching the type of task.

​

Release and Pipeline Orchestration

• FLEXDEPLOY-7028 - Pipeline Notifications template script now have access to pipeline properties.
• FLEXDEPLOY-15927 - When a release pipeline is changed, project groups on release content are remapped by name. Groups that exist on the new pipeline with the same name are kept; groups with no matching name are cleared.
• FLEXDEPLOY-11298 - Build Request now defaults the standalone release name using only allowed characters, replacing disallowed characters (such as slashes in branch names) with underscores.
• FLEXDEPLOY-11415 - Release dashboard Test and Scan gate details now show the package name.
• FLEXDEPLOY-16168 - Pipeline version notes that exceed 255 characters are truncated to the supported length so save/activate no longer fails.
• FLEXDEPLOY-16637 - Resolved an issue with transparent panel rendering with certain workflow and pipeline editor panels when the Panel Style in profile settings was set to Transparent.

​

Webhooks

• FLEXDEPLOY-8491 - Added support for authenticated Incoming Webhook functions. When authentication is required, callers must provide a valid API token and have Execute permission through their security group for specific function. The function executes under the authenticated user’s identity, ensuring workflow audit records accurately identify the caller.
• FLEXDEPLOY-15974 - Incoming Webhook Functions now support GET requests in addition to the previously supported POST requests. Functions can also return custom HTTP responses, including status codes, headers, and response bodies, using the RESPONSE helper. GET requests are always processed synchronously, while POST requests can return custom responses when flex-sync-webhook is enabled.
• FLEXDEPLOY-14447 - FlexDeploy now publishes a Server Started outgoing webhook event when the server finishes startup.
• FLEXDEPLOY-14484 - Webhook configuration screens now support searching by ID from logs: outgoing listeners via Ctrl+K search (name, ID, description), and incoming providers/functions by provider ID or function ID. When a provider matches the search, all of its functions remain visible.

​

Groovy Functions and Code Editor

• FLEXDEPLOY-9468 - Added access to the currentUser variable (previously available only in Work Item groovy scripts) to many other Groovy scripts.
• FLEXDEPLOY-14278 - Groovy editor class suggestions are now case-sensitive and exclude scope variables that differ only by case.
• FLEXDEPLOY-15436 - Improved Groovy editor suggestions for variables that start with capital letters, existing groovy bindings, and java.util.Object.
• FLEXDEPLOY-13586 - Shell code snippet highlighting no longer treats later lines as a string after matched quotes.
• FLEXDEPLOY-16492 - Breaking change - FlexDeploy2Functions search-by-tags methods now return a SearchResponse instead of a PaginatedList of a single SearchResponse. SearchResponse extends PaginatedListSearchResult.

​

Topology

• FLEXDEPLOY-14935 - Target Test Connection for Database credentials now supports Oracle Wallet. When testing a database password on a target, you can select an Oracle Wallet credential so wallet-based JDBC URLs are validated the same way as during execution

​

Salesforce

• FLEXDEPLOY-16406 - Improved Salesforce metadata conversion reliability by handling intermittent ENOENT errors from sf-cli during Metadata API operations.
• FLEXDEPLOY-16518 - Salesforce deploy and validate continue when Salesforce returns unexpected coverage fields in the deploy result.
• FLEXDEPLOY-16691 - Salesforce package creation and deployment now recognize AI Authoring Bundle (AiAuthoringBundle) and API Named Query (ApiNamedQuery) metadata. (Also in FlexDeploy 11.1.0.5)

​

ServiceNow

• FLEXDEPLOY-15618 - The default ServiceNow Additional Info Script now tries several datetime formats before failing, so common ServiceNow date display changes no longer cause an unparseable-date error.
• FLEXDEPLOY-15619 - New ServiceNow Change Management instances now show the default Approved Check Script and Rejected Check Script in the UI instead of leaving those fields blank.

​

Scheduling

• FLEXDEPLOY-6004 - Cron UI validation now requires Quartz field count and exactly one of day-of-month/day-of-week to be ?, reducing UI vs API confusion.
• FLEXDEPLOY-8235 - Cron help text uses Quartz day-of-week numbering so numeric DOW descriptions match the scheduled day.

​

Other Updates

• FLEXDEPLOY-14445 - PDF exports now include a document title derived from the query and active filters.
• FLEXDEPLOY-11679 - Added a Previous button on Tours so users can go back to earlier tour steps.
• FLEXDEPLOY-14604 - Added a Global Search tour that introduces the header search bar and explains that an empty search shows Recently Accessed objects.
• FLEXDEPLOY-16509 - Introduced a new Oracle Process Automation action for the Browser Extension.

​

Plugin Updates

All plugins support up to Java 25.

​

Oracle Process Automation

• FLEXDEPLOY-4643 - Introduced a new plugin to manage Process and Decision Applications across environments in Oracle Process Automation.
• FLEXDEPLOY-16508 - Introduced a new Blueprint project type for Oracle Process Automation projects.
• FLEXDEPLOY-16509 - Introduced a new Oracle Process Automation action for the Browser Extension.

​

Oracle Integration Cloud

• FLEXDEPLOY-16421 - Resolved an issue where Robots could be skipped during the packageDeploy operation when deploying an entire Project or individual Robot objects. Project imports now execute asynchronously with work-request polling to ensure the import completes before proceeding with the remaining deployment steps.

​

Git

• FLEXDEPLOY-15187 - Git commit returns the commit SHA through FDGIT_OUT_COMMIT_ID when changes are committed. Push operations return the SHA that was pushed.
• FLEXDEPLOY-16506 - Git clone now fetches only the selected branch at the configured depth instead of downloading full repository history.
• FLEXDEPLOY-16217 - Git clone project sources now reports a clear error when a configured revision cannot be found after deepening the clone.
• FLEXDEPLOY-16222 - Git Add File List now supports quoted paths and skips blank entries from extra whitespace.
• FLEXDEPLOY-16219 - Docker Git operations now receive SSH private key and passphrase instance properties for Git authentication.
• FLEXDEPLOY-16220 - Docker Git operations now accept the FDGIT_INP_TREELESS_CLONE input so treeless clone can be configured via Docker environment variables.
• FLEXDEPLOY-16221 - Docker Git clone operations now expose the Treeless Clone input in the UI, matching non-Docker Git clone behavior.
• FLEXDEPLOY-16223 - Git plugin SSH library updated from unmaintained JSch 0.1.55 to the maintained mwiede JSch 2.28.6 fork.

​

File

• FLEXDEPLOY-3072 - File Create no longer grants Read permission to other users by default.
• FLEXDEPLOY-5180 - Added saveReports and saveTestResults operations to copy files from temp into workflow reports and test-results folders.
• FLEXDEPLOY-10884 - Added diffFiles operation to compare two text files and write unified or HTML diff reports to the reports folder.
• FLEXDEPLOY-16211 - Unzip no longer crashes when the archive filename has no extension; the extract folder uses the full archive name.
• FLEXDEPLOY-16212 - Unzip no longer attempts to unzip subdirectories when the source path is a folder; only files matching the include/exclude filter are processed.
• FLEXDEPLOY-16214 - FlexMultipleStringReplacement now reports FDFIL-00003 when a replace-list line is missing the = separator, instead of failing with an internal exception.
• FLEXDEPLOY-16215 - Partial file deploy no longer throws an error when the EXECUTE attribute is not set on a deployed file.

​

Nexus

• FLEXDEPLOY-1240 - Added retrieveArtifactGAV and retrieveArtifactGAV2 operations to download a Nexus artifact by Maven groupId, artifactId, and version.

​

Ansible

• FLEXDEPLOY-3008 - Added an Ansible plugin operation to run ad-hoc commands from a code snippet.

​

MSBuild

• FLEXDEPLOY-3858 - MSBuild auto-select prefers .sln and skips Visual Studio Backup project files.
• FLEXDEPLOY-3859 - MSBuild artifacts prefer FolderProfile publish output when present.
• FLEXDEPLOY-16249 - MSBuild plugin now quotes paths in generated Windows batch scripts so builds work when paths contain spaces.
• FLEXDEPLOY-16250 - MSBuild plugin now space-separates command-line arguments when Pass Arguments as Properties is disabled.

​

Helm

• FLEXDEPLOY-7142 - Helm plugin now uses the selected Kubernetes context when a kubeconfig file contains multiple contexts.
• FLEXDEPLOY-7732 - Helm plugin now surfaces helm CLI error output instead of reporting msg:null on failed install operations.
• FLEXDEPLOY-8484 - Helm plugin logs now show the default kubectl context instead of null when no context is explicitly configured. An empty Chart Path defaults to the current working directory (.).
• FLEXDEPLOY-14423 - Fixed Helm Build Dependencies so selecting the option correctly runs helm dependency build, and updated documentation to reference Chart.yaml (Helm 3).

​

Kubernetes

• FLEXDEPLOY-14187 - Added executeKubectlCommand operation (context + free-form kubectl commands, with optional Stop on Error for multi-line snippets).

​

REST

• FLEXDEPLOY-6566 - REST DELETE now supports an optional request body for APIs that require one.

​

XPath

• FLEXDEPLOY-12349 - Added a new YAML parsing operation.

​

JDBC

• FLEXDEPLOY-11008 - JDBC compile-invalid safely handles unknown database product names.
• FLEXDEPLOY-16227 - FlexJDBCExport now correctly matches and exports the first column when requested by name.
• FLEXDEPLOY-16229 - JDBC compile-invalid operations now escape single quotes in schema names used in SQL owner clauses.
• FLEXDEPLOY-16230 - JDBC operations no longer require a password during validate when Oracle wallet or Kerberos authentication is configured.
• FLEXDEPLOY-16231 - Import operation now fails with a clear error when CSV headers do not match any table columns.
• FLEXDEPLOY-16232 - JDBC export and script execution now read and write files using UTF-8 for consistent cross-platform character handling.

​

Docker

• FLEXDEPLOY-10327 - Fixed Argument list too long error when running Docker plugins over SSH with many properties.
• FLEXDEPLOY-16195 - Docker createContainer now fails immediately when an image pull fails, with an optional Continue on Error setting to preserve prior behavior.
• FLEXDEPLOY-16197 - Docker runContainer now removes orphaned containers using the actual assigned container name when a deployment fails.

​

Maven and Gradle

• FLEXDEPLOY-16242 - Maven plugin throws a clearer error if the Maven install fails.
• FLEXDEPLOY-16246 - Fixed failures when Maven home paths contain spaces.
• FLEXDEPLOY-16248 - Maven FDMVN_ARGS and Gradle FDGRD_INP_SWITCHES input descriptions now correctly document comma-, semicolon-, or space-delimited argument parsing.
• FLEXDEPLOY-16395 - Updated the FlexDeploy Gradle plugin to use Gradle 8.14.4, addressing CVE-2026-22816 and CVE-2026-22865.

​

JUnit

• FLEXDEPLOY-16238 - Ant operations now honor the optional FDJU_RUN_TARGET input (defaults to main when unset).
• FLEXDEPLOY-16239 - Ant operations now honor FDJU_ARGS (semicolon-delimited key=value pairs) when passed as workflow operation inputs.
• FLEXDEPLOY-16240 - XML report parsing now uses an XXE-safe path when detecting report format and unmarshalling results.

​

Oracle EBS

• FLEXDEPLOY-13931 - Fixed EBS AOL WF_ROLE FNDLOAD download to use ROLE_NAME filter. See EBS Object Types - Application Object Library (AOL).

​

Oracle Database

• FLEXDEPLOY-14613 - Oracle Database discover no longer includes identity ISEQ$$ sequences.

​

Oracle WebLogic

• FLEXDEPLOY-321 - Resolved issues with EIS entry creation when the data contains backslashes.
• FLEXDEPLOY-11589 - Restart Domain now honors Skip Admin Server so the admin server is not stopped when that option is selected.

​

AWS

• FLEXDEPLOY-11390 - upsertLambdaAlias now applies the Description input when creating or updating a Lambda alias.
• FLEXDEPLOY-12040 - AWS jars updated to SDK2, resolving CVE-2024-23080.

​

Azure Power BI

• FLEXDEPLOY-16485 - Azure Storage Blob SDK upgraded to address Netty CVEs.

​

UFT

• FLEXDEPLOY-14888 - executeUFTBatch now accepts a UFT test directory as well as an .mtb file. HTML run results are copied into FlexDeploy reports for both sources.

​

Resolved Issues

​

Security

• FLEXDEPLOY-16583 - Fixed an issue where the 2FA recovery code field on the login page was read-only. Users with two-factor authentication enabled can now enter a recovery code and sign in. This applies to both FlexDeploy and Configuration Management.

​

Projects

• FLEXDEPLOY-10392 - FLEXDEPLOY.buildProject now returns a clear error directing users to use buildPackage for package-based projects instead of a confusing partial-project failure.
• FLEXDEPLOY-10492 - CSV bulk project creation now reports accurate success and error counts when Stop on Error is selected.
• FLEXDEPLOY-15348 - Upload Avatar Confirm is disabled until an image is selected.
• FLEXDEPLOY-15787 - Post Refresh drag-and-drop no longer drops files that are not on the current page when resequencing a Refresh Package.
• FLEXDEPLOY-15996 - On Utility project executions, project Version is no longer shown on the list, and project Branch and Version are no longer shown on the details header.
• FLEXDEPLOY-16547 - Package Name Script evaluation now always returns a String, so creating a package from File Catalog succeeds when the package name script returns a numeric value (for example return 123).
• FLEXDEPLOY-6013 - Corrected recent average duration shown on project execution summary when more than 50 executions had occurred in the last week.

​

Release and Pipeline Orchestration

• FLEXDEPLOY-13841 - Snapshot creation no longer fails when release properties have an empty required multiselect drop-down.
• FLEXDEPLOY-15386 - Fixed saving when copying a Notification Template (incorrect unsaved-changes warning and GraphQL notifTemplateId validation error).
• FLEXDEPLOY-16283 - Notifications Show More now loads notifications in pages (20 at a time) so the UI stays responsive when many notifications exist.
• FLEXDEPLOY-16415 - Fixed GraphQL error when opening a Release snapshot from Tasks or the Release Dashboard tour.

​

Groovy Functions

• FLEXDEPLOY-16148 - Deleting a Groovy library from fullscreen mode now exits fullscreen correctly.
• FLEXDEPLOY-16226 - The Groovy execute partial validation error now directs users to choose a different operation instead of incorrectly suggesting executeFile.
• FLEXDEPLOY-16278 - Groovy library list items now show the full library name on hover when the name is truncated.

​

UI

• FLEXDEPLOY-15434 - Resolved an issue where tours could appear on incorrect screens after navigation.
• FLEXDEPLOY-15891 - Improved the Adding Release Work Items tour so it does not skip steps or stop on an empty Add Work Items popup.
• FLEXDEPLOY-16126 - Fixed Customize Search Bar navigation so Profile Settings opens the Search section.
• FLEXDEPLOY-16426 - Fixed More Tours button so it returns to Profile - Tours.
• FLEXDEPLOY-16437 - Resolved an issue where REST API errors were sometimes ignored and not displayed through the normal error banner.
• FLEXDEPLOY-12851 - Fixed Saved Query Test Export email link when saved query id is missing.

​

API

• FLEXDEPLOY-16358 - GraphQL calls for CMS tickets, CMS Fields, Issue Tracking Systems, or Tasks now return total count correctly.

​

Incompatible Changes

• FLEXDEPLOY-3072 - File Create no longer grants Read permission to other users by default. Existing workflows that relied on the previous default permissions may need an explicit permission setting.
• FLEXDEPLOY-16492 - Breaking change for Groovy scripts: FlexDeploy2Functions search-by-tags methods now return a SearchResponse instead of a PaginatedList of a single SearchResponse. Update scripts that assumed the previous return type.
• FLEXDEPLOY-13906 - SCIM provisioning can replace existing group mapping, external group caching, and user just-in-time creation for identities managed through SCIM. Plan the migration of identity management before enabling SCIM in production.