Skip to main content

Version 10.2.9.3

Release date

January 30, 2025

The patch aims at improving cross-domain security, enhancing Kibana performance, and addressing several reported issues.

CORS policy updates to enhance cross-domain security​

The Application server's cross-origin resource sharing (CORS) policy is updated to address vulnerabilities caused by overly permissive cross-domain configurations. The update restricts cross-origin requests to only explicitly trusted domains, mitigating potential security risks, such as the injection of malicious payloads via man-in-the-middle (MiTM) attacks.

By ensuring that all cross-origin requests are carefully validated, the updated policy protects you from potentially harmful content that might otherwise appear to originate from trusted sources.

Static content caching to improve Kibana performance​

Navigation in Kibana is now significantly faster due to the caching of the static content, such as JavaScript, CSS, fonts, and so on. The new caching mechanism stores these resources locally, eliminating the need for repeated downloads during navigation.

With the loading times decreased and data display delays minimized, your user experience with Kibana will get still better and the productivity will grow further.

Bug fixes​

  • Resolved the security issue associated with executing a specific server-side command while creating a Business Process on the Design tab. The Control Tower and Manual Task Renderer components are fixed by updating the FreeMarker dependency to v2.3.31.

  • Fixed the issue when a Business Process launched via API failed to start if the data file length exceeded 20,000,000 characters.

  • Resolved the issue where a Manual Task containing the Select component with Allow adding custom value configured conditionally caused the Renderer view to crash upon opening.

  • Resolved the issue in the Manual Task Builder where scrollbars disappeared for large PDFs when zoomed in in Internet Explorer.

  • Resolved the issue with the footer margin in Manual Tasks, where zooming in caused the scrollbar to disappear due to the footer being positioned too low.

  • Resolved the issue with the eventual destruction of dynamic agents. Marathon now ensures that the rules-builder-rest, input-connector-rest, connectors-api, and genai-rulesbuilder apps are not launched on dynamic agents.

  • Fixed the issue where selecting From Input Contract as the message type caused a null message for Generic Connector components other than Rest Client and Custom. The request is now properly configured to process the message correctly.

Last updated on