9.0.80 (8 Dec 2025)
[AR-3167] - add support for X-MS-Exchange-Organization-BCC
[AR-3174] - PST doesn't import directly from zip
9.0.79 (28 Nov 2025)
[AR-3159] - zip PDF and PST large file export to speed up download
9.0.78 (30 Oct 2025)
[AR-3146] - Thread exhaustion due to blocking on blob insertion
[AR-3147] - Fix index and display of single part messages
9.0.77 (23 Oct 2025)
[AR-3144] - java.io.BufferedReader shows up in the subject line.
9.0.75 (21 Oct 2025)
[AR-3140] - multitenant: fix missing cleanup of processed queue blobs
9.0.73 (15 Oct 2025)
[AR-3128] - Better handling of Google Workspace rate limiting (revised)
9.0.72 (10 Oct 2025)
[AR-3124] - Wrong part is rendered in message view (reworked)
[AR-3125] - Render inline images with Content-Type of application/octet-stream (reworked)
9.0.71 (4 Oct 2025)
[AR-3129] - Unable to write large blobs to Backblaze B2 due to FileAlreadyExistsException status (904)
[AR-3126] - security enhancement: OWASP santization of message view
9.0.70 (3 Oct 2025)
[AR-3119] - ejected volume when mounted stays ejected
[AR-3124] - Wrong part is rendered in message view
[AR-3125] - Render inline images with Content-Type of application/octet-stream
[AR-3126] - security enhancement: OWASP santization of message view
[AR-3127] - Remove orphaned blobs from central queue
[AR-3116] - Additional Google rate limiting fixes
[AR-3122] - Timeout parsing of large and complex attachments
9.0.69 (29 Sep 2025)
[AR-3116] - Google get users Code:429 "Too Many Requests "
[AR-3118] - java.lang.NoSuchMethodError: 'void kotlin.io.path.PathsKt.deleteRecursively
9.0.68 (18 Sep 2025)
[AR-3111] - hang on PDF export due to Aspose parsing issue. Upgrade Aspose 25.4
[AR-3112] - Harden AWS S3 region and endpoint resolution logic
9.0.65 (14 Jul 2025)
[AR-2814] - Archive rule not applied as expected
9.0.64 (4 Jul 2025)
[AR-3099] license threshold adjustment
9.0.62 (16 Jun 2025)
[AR-3097] unbounded recursion on malformed MIME structure occurs during attachment size count
9.0.61 (16 Jun 2025)
[AR-1618] - unbounded recursion on malformed MIME structure causes file handle exhaustion
[AR-3096] - Indexing may throw MalformedInputException due to use of InputStreamReader with default charset
9.0.54 (5 Jun 2025)
[AR-3089] Fix indexing issue where the index grows in size uncontrollably
9.0.53 (4 Jun 2025)
[AR-3094] blank screen on export
9.0.51 (30 May 2025)
[AR-1618] - resolve .office file & file handle leaks
[AR-1618] - receive queue is not restoring all queued items from restore folders
[AR-3093] - Index startup fixes
9.0.50 (16 May 2025)
[AR-3090] - minimize index commits
9.0.48 (2 May 2025)
[AR-3089] - Fix indexing issue where the index grows in size uncontrollably
9.0.47 (1 May 2025)
[AR-3083] - exchange journal report duplicate cc when bcc exist
[AR-3084] - failed to generate server requests
[AR-3085] - not all attachments are listed on blob view
[AR-3086] - FieldValueUtils parse could skip some addresses
[AR-3088] - Upgrade tomcat: Apache Tomcat is prone to a remote code execution (RCE) vulnerability
9.0.46 (11 Mar 2025)
[AR-3081] - fix license ldap query {earlier fix didn't work, really fixed now!)
9.0.45 (8 Mar 2025)
[AR-3082] - schedule index merges for size reduction
9.0.44 (25 Feb 2025)
[AR-3081] - fix license ldap query
9.0.43 (18 Feb 2025)
[AR-3077] - export single file cause UI blankpage with issue
[AR-3078] - tika 3.1 upgrade
9.0.41 (28 Jan 2025)
[AR-3076] - mailarchiva.service should use /bin/bash not /bin/sh
9.0.39 (17 Jan 2025)
[AR-3074] - add subject alternate name (SAN) in certificate request generation
9.0.38 (10 Jan 2025)
[AR-3073] - bulk export from V2 volume (null pointer): Cannot invoke com.stimulus.archiva.og.a(String)
9.0.37 (9 Jan 2025)
[AR-3071] - unable to generate certificate due to bouncycastle library conflict
[AR-3072] - office 365 connection certificate generate (manifest removed)
9.0.34 (7 Nov 2024)
[AR-3066] - multitenant: login to central: Problems calling function [fn:length] (intermittant)
[AR-3067] - multitenant: insufficient permissions on session redirect
9.0.32 (22 Oct 2024)
[AR-3062] - export fails if analytics report enabled
[AR-3063] - AD license count query should include remote mailboxes
9.0.30 (10 Oct 2024)
[AR-3060] - certificate import: chain verification fails with varying order of DN components
9.0.28 (3 Sept 2024)
[AR-3055] - remove Microsoft Graph superfluous error log entries in Tomcat logs
[AR-3057] - failed set time via drop down search wizard, always resets to 01.00 as time
[AR-3058] - failed to index body text (rarely)
9.0.26 (15 July 2024)
[AR-3056] - add subject alt name to cert generation
9.0.25 (26 June 2024)
[AR-3052] - export search results to HTML: zip END header not found
[AR-3054] - PDF export sort order incorrect
[AR-3050] - logback.xml: <level> element is deprecated
[AR-3051] - search interface may break when the wrong datatables settings are loaded
9.0.24 (28 May 2024)
[AR-3049] - failed load users.conf of version < 9
9.0.23 (8 May 2024)
[AR-3048] anti clickjacking and HTTP strict transport security headers
9.0.22 (6 May 2024)
[AR-3047] - failed to execute method. Cause: Evicting queue null
9.0.21 (2 May 2024)
[AR-3046] - new volume format switching back to V3
9.0.20 (24 April 2024)
[AR-3041] - retention rule and logs: setting keep days to non-numeric character sets field value to zero
[AR-3044] - failure to parse dtSettings: Unexpected token LEFT BRACE({
[AR-3045] - basic authentication users go missing in rare circumstances
[AR-3042] - validate custom retention rule filter query on save
[AR-3043] - failed to execute method in searchform.do
9.0.18 (19 April 2024)
[AR-3038] - custom retention rule on archive date lowers the case of TO operator
[AR-3039] - refactor autosearch service with test coverage
[AR-3040] - some attachments can't be downloaded
9.0.17 (26 March 2024)
[AR-3037] - PST export: ArrayIndexOutOfBoundsException: arraycopy: last destination index
9.0.15 (19 March 2024)
[AR-3012] - EwsXmlReader cannot access class com.sun.org.apache.xerces.internal.impl.XMLErrorReporter
9.0.14 (15 March 2024)
[AR-3031] - JMX provides applications queue information
[AR-3035] - Add REST API function to delete multiple blobs
9.0.13 (13 March 2024)
[AR-3030] - smtp send: sometimes retry on 5xx return code
[AR-3033] - clarify invalid license notifications
[AR-3034] - out-of-memory processing word doc
9.0.12 (5 March 2024)
[AR-3025] - export: The request object has been recycled and is no longer associated with this facade
[AR-3026] - add domain verification failed notification
[AR-3027] - shows cursor pointer on hover audit clickable entries
[AR-3028] - failed view blobs from audit log
[AR-3029] - SAML authentication broken due to token length constraints
[AR-3020] - create new volume NPE
[AR-3021] - cant view emails in V1 volumes
9.0.9 (21 Feb 2024)
[AR-3016] - body tip proper view
[AR-3017] - possible mount second ACTIVE volume
[AR-2594] - can't download log files
[AR-3015] - failed parse plain/text body
[AR-3018] - initial date range: before date shouldn't be set
[AR-3019] - PST import: database instance is not set in the current thread
10.0.0 (4 Sept 2025)
[AR-2974] Authentication overhaul — replaced the entire authentication system with Pac4j security framework for standardized, modern, and extensible security handling.
Core Changes
AR-2983 Replaced legacy security filter with pac4j filters (security and callback).
AR-2984 Integrated role and authorization mapping into pac4j profiles and authorizers.
AR-2986 Added support for AD, LDAP, Azure, and Google authentication providers through pac4j clients.
AR-2989 Migrated in-memory login handling to pac4j session and profile management.
AR-2991 Replaced legacy session management with pac4j ProfileManager.
AR-2992 Migrated custom MailArchivaPrincipal to pac4j CommonProfile.
AR-2993 Re-implemented two-factor authentication using pac4j client chaining.
AR-2994 Added multi-tenancy support to authentication flows.
AR-2995 Replaced legacy BASIC authentication
Fixes and Adjustments Post-Migration
AR-3104 Multi-tenant: fixed issue where tenant certificate imports were incorrectly stored in central config.