Sharper production monitoring, broader platform support, and hardened security
Hello Team,
We are pleased to announce xDI 2026.1.3, our most Analytics-focused release yet. Production teams get clearer session visibility, faster day-to-day delivery management, and a proper link between runtimes and their log databases. This release also broadens certified backends to SQL Server 2025 and PostgreSQL 17/18, adds new SAP Send IDOC actions and a dedicated RDBMS-to-Parquet template, and delivers pentest-driven security hardening, including a stricter runtime password policy that needs your attention before upgrading.
Why this matters
Production monitoring you can finally act on
• Full session visibility: see who executed each delivery, drill into session details and steps for restarted deliveries, and get Start Delivery steps and statistics back in the Session Detail view
• Faster daily operations: reorder environments, delete multiple deliveries at once, auto-refreshed delivery lists on deployment, and an explicit runtime-to-log-database link in Administration
• Broader certified platforms: SQL Server 2025 and PostgreSQL 17 & 18 are now supported as Analytics and Runtime backend databases
•Action required before upgrading: runtime account passwords must now comply with a stricter policy (see the details below)
• SAP: two new palette actions, Sap ECC Send IDOC and Sap S/4 HANA Send IDOC, to send an IDOC without having to build a mapping • Parquet: new template to write from a source RDBMS directly to a Parquet file • PostgreSQL: the Load File template now supports remote loading through the psql \copy metacommand • SAP: the Rdbms to Sap (IDOC) integration template gains an option to sort data •Security, runtime password policy (breaking change): every runtime account password must now be at least 12 characters long and combine uppercase, lowercase, digits, and special characters, following ANSSI and OWASP recommendations for high-impact accounts (16 characters or more is encouraged) •How it is enforced: the runtime validates all configured account passwords during its startup sequence and fails to start if any of them falls short, with an explicit error naming the policy. The policy is enabled by default •How to postpone it: set the new enablePasswordSecurityPolicy parameter to false in engineParameters to keep your runtimes up while you plan password rotations across your integrated systems, then re-enable it once done • Security: fixed an authenticated SQL injection in the Log Databases admin settings, a Viewer role able to delete Analytics packages, and default exposure to MitM attacks • Analytics: fixed the display issue on Delivery projects with more than 9 environments, and deployment statuses now refresh when the browser tab is refreshed • Runtime: fixed Scripting action failures with the JSON functions and toISOString() in Rhino code (Rhino engine upgraded) • Microsoft Excel: fixed the RDBMS-to-Excel mapping generating an .xlsx file that errored when opened • Connectors: Hadoop connector upgraded, NoClassDefFoundError fixed in the AMQP Operation action, HTTP REST reverse fixed when the response has no content, and a NullPointerException fixed in Xml to Rdbms with SAP IDOC as source • Security: upgraded Spring Security, Apache Tomcat, Eclipse Jetty, Jackson, PostgreSQL JDBC, Log4j, commons-fileupload2, and json-smart libraries
Yohan Petit
Sap ECC Send IDOCandSap S/4 HANA Send IDOC, to send an IDOC without having to build a mapping• Parquet: new template to write from a source RDBMS directly to a Parquet file
• PostgreSQL: the Load File template now supports remote loading through the psql
\copymetacommand• SAP: the Rdbms to Sap (IDOC) integration template gains an option to sort data
• Security, runtime password policy (breaking change): every runtime account password must now be at least 12 characters long and combine uppercase, lowercase, digits, and special characters, following ANSSI and OWASP recommendations for high-impact accounts (16 characters or more is encouraged)
• How it is enforced: the runtime validates all configured account passwords during its startup sequence and fails to start if any of them falls short, with an explicit error naming the policy. The policy is enabled by default
• How to postpone it: set the new
enablePasswordSecurityPolicyparameter tofalseinengineParametersto keep your runtimes up while you plan password rotations across your integrated systems, then re-enable it once done• Security: fixed an authenticated SQL injection in the Log Databases admin settings, a Viewer role able to delete Analytics packages, and default exposure to MitM attacks
• Analytics: fixed the display issue on Delivery projects with more than 9 environments, and deployment statuses now refresh when the browser tab is refreshed
• Runtime: fixed Scripting action failures with the
JSONfunctions andtoISOString()in Rhino code (Rhino engine upgraded)• Microsoft Excel: fixed the RDBMS-to-Excel mapping generating an
.xlsxfile that errored when opened• Connectors: Hadoop connector upgraded,
NoClassDefFoundErrorfixed in the AMQP Operation action, HTTP REST reverse fixed when the response has no content, and a NullPointerException fixed in Xml to Rdbms with SAP IDOC as source• Security: upgraded Spring Security, Apache Tomcat, Eclipse Jetty, Jackson, PostgreSQL JDBC, Log4j, commons-fileupload2, and json-smart libraries