Skip to main content

5.5.18

Version publiée le 01/10/2026​

Changelog published on October 1st 2026​

Calendar​

  • BM-23989: Fixes: Inconsistency in notification emails for modified events.
  • BM-23996: Fixes: Incorrect month in an event’s recurrence in an ICS export.
  • Fix: The BYDAY for weekly recurrences is now derived independently of the JVM language. On a non-English system (e.g. fr_FR), it previously remained empty.

Mobile Devices (EAS)​

  • BM-24078: Fixes: Error when deleting or updating the status of an ‘all-day’ event from an Android mobile device.

Administration / Architecture​

  • BM-24181: Fixes: After a password change in AD, the old password is not immediately invalidated for logging into the BlueMind online app. 
  • BM-24214: Fixes: Inconsistency during the connection test in GC mode; the test button does not take the mode into account.
  • BM-24217: Fixes: A standard domain administrator was able to change the import type — only ‘admin0’ should be authorised to make this change.
  • BM-24218: Fixes: The label for the ‘split domain’ field remains visible in GC mode even though the field is hidden.

core​

  • BM-24010: Fixes: The cache is not invalidated when a user is deactivated; consequently, a deactivated user can still send emails via SMTP.

IMAP​

  • BM-24170: Performance improvement: avoid a complete reordering of folders at the checkpoint when the container version remains unchanged.

MAPI​

  • BM-23941:
    • Loading address book entries from KeyDB no longer blocks Vert.x workers, thereby eliminating blocks lasting 100 to 180 seconds in MAPI/EWS.
      • Loading is asynchronous, with a time limit (keydb.load.timeout.seconds, 15 s).
      • The timeout for KeyDB commands is also limited (keydb.command.timeout.seconds, 10 s).
    • OAB generation no longer overloads KeyDB. It no longer performs a full read of the index to resolve the initiator’s email address, and scans the directory in batches of 256 records.

Packaging​

  • Fix: The import packages bm-lifesize and simpleaccount now contain their plugins again.
  • Fix: The RPM package bm-tbird-autoconf can now be installed again.

Security​

  • (Critical): Sorting of emails and conversations now only accepts known columns. An unknown column is rejected with the error INVALID_PARAMETER.
  • (High): the resolution of external entities and DTDs is disabled in the XML parsers of the DAV server (CalDAV/CardDAV), in net.bluemind.utils.DOMUtils (CAS, MAPI), in the MAPI tags and in the BigBlueButton client.
  • (Critical): Queries on scheduled jobs pass the domain as a bound parameter. A domain administrator can now only see runs within their own domain.
  • (Medium): The directory (AD/LDAP) password cache is cleared every time a password is changed in BlueMind. It now stores an HMAC hash instead of the plaintext password. Its duration can be set using core.security.directory-password-cache-ttl (maximum 20 minutes). (BM-24181)
  • (Minor): Only the global administrator can change the AD import type (DC/GC). (BM-24217)
  • (Medium): The BM* identity headers sent by the client are removed before processing.
  • (Hardening): requests for file sharing and password expiry now use related parameters.
  • Upgrades:
    • bm-JDK 25.0.4.1 (with a fix for the update-alternatives configuration).
    • Netty 4.1.138
    • Tika 3.3.2
    • Vert.x 4.5.34