From fdc46bef457ec1d55c82fa7a80f76bfa601a954f Mon Sep 17 00:00:00 2001 From: mayankmendix <60148863+mayankmendix@users.noreply.github.com> Date: Fri, 23 Oct 2026 22:57:23 +0530 Subject: [PATCH 1/2] Release 2026-10-23 (#921) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * added the metering code * added logging * added the sap metering sidecar * updated the auth token usage * updated the comments * updated the env vars * fix: update cryptography to 46.0.7 to address CVE-2026-39892 - Updated cryptography from 46.0.5 to 46.0.7 - Fixes buffer overflow vulnerability in non-contiguous buffer handling - Regenerated requirements.txt with Python 3.10 - All unit tests passing (184 passed) - All linting checks passing * Bumped the cryptography module version to latest 47.0.0 * Fix CVE-2026-25645 and CVE-2026-34073 by upgrading requests and cryptography Updated requests from 2.32.5 to 2.33.1 to address CVE-2026-25645. Updated cryptography from 46.0.5 to 47.0.0 to address CVE-2026-34073. Co-Authored-By: Claude Sonnet 4.5 * Security/upgrade requests urllib3 CVE fix (#894) * Security: Upgrade requests to 2.34.2 and urllib3 to 2.7.0 Fixes high-severity CVEs: - CVE-2026-25645 (requests): Fixed in 2.33.0+ - GHSA-mf9v-mfxr-j63j (urllib3): Streaming API decompression issue - GHSA-qccp-gfcp-xxvc (urllib3): Cross-origin redirect header leakage Changes: - requests: 2.32.5 → 2.34.2 - urllib3: 2.6.3 → 2.7.0 - charset-normalizer: 2.0.3 → 3.4.7 (transitive) - idna: 3.10 → 3.15 (transitive) Co-Authored-By: Claude Sonnet 4.5 * Fixes high-severity CVEs: - CVE-2026-25645 (requests): Fixed in 2.33.0+ - GHSA-mf9v-mfxr-j63j (urllib3): Streaming API decompression issue - GHSA-qccp-gfcp-xxvc (urllib3): Cross-origin redirect header leakage --------- Co-authored-by: Claude Sonnet 4.5 * (fix) add typing extension lib (#898) * Update requirements.txt * Update requirements.in * Expand static files caching (#901) Support static files caching * Security: Fix CVE-2026-45409 (idna) and GHSA-537c-gmf6-5ccf (cryptogr… (#902) Security: Fix CVE-2026-45409 (idna) and GHSA-537c-gmf6-5ccf (cryptography) Upgrades dependencies to address high-severity vulnerabilities: - cryptography 47.0.0 → 48.0.1: Fixes vulnerable OpenSSL in wheels - idna 3.10 → 3.15: Fixes DoS vulnerability in IDNA encoding CVE-2026-45409: idna versions prior to 3.15 were vulnerable to DoS attacks via specially crafted inputs to idna.encode() function. GHSA-537c-gmf6-5ccf: cryptography wheels prior to 48.0.1 included a statically linked copy of OpenSSL with security vulnerabilities. * Security: Upgrade nginx from 1.26.1 to 1.30.4 to fix CVE-2025-23419 a… (#909) Security: Upgrade nginx from 1.26.1 to 1.30.4 to fix CVE-2025-23419 and CVE-2026-42945 Co-authored-by: bhavin.shah * Fix CVE-2026-69247(cryptography)andCVE-2026-59939(httplib2) (#907) Co-authored-by: Piyush Co-authored-by: mayankmendix <60148863+mayankmendix@users.noreply.github.com> * Add deprecation warning for Cloud Foundry Buildpack (#910) Added a warning about the deprecation of the Cloud Foundry Buildpack for Mendix 12 and future Runtime versions. * Fix PostgreSQL metrics query to filter by application database (#914) Co-authored-by: Bhavin * Feature/sap hana client jar stage (#915) Added SAP HANA client JAR staging support * Skip staging SAP HANA client JAR if already present in userlib or vendorlib (#916) Skip staging SAP HANA client JAR if already present in userlib or vendorlib * Add RDS ap-southeast-7 support (#917) * Add RDS ap-southeast-7 support * Fix cert vulnerability (#920) * Update requirements.in for certifi * Update requirements.txt for certifi * Update dependencies.yml for JDK patch versions --------- Co-authored-by: bhavin.shah Co-authored-by: priyal.chawda@mendix.com Co-authored-by: Piyush Co-authored-by: Claude Sonnet 4.5 Co-authored-by: Bhavin Shah <162097397+bhavinshah-mendix@users.noreply.github.com> Co-authored-by: Sanny Ramirez Co-authored-by: EnasAbdelrazek <96430281+EnasAbdelrazek@users.noreply.github.com> Co-authored-by: Bhavin Shah <162097397+bhavinshahM@users.noreply.github.com> Co-authored-by: PiyushTiwari-LowCode <106152452+PiyushTiwari-LowCode@users.noreply.github.com> Co-authored-by: Mário Serrador <61971372+mruiserrmendix@users.noreply.github.com> Co-authored-by: Priyal Chawda <86288192+Pri1235@users.noreply.github.com> --- dependencies.yml | 8 ++++---- requirements.in | 2 +- requirements.txt | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/dependencies.yml b/dependencies.yml index 2fb38101f..ec75c74d2 100644 --- a/dependencies.yml +++ b/dependencies.yml @@ -40,10 +40,10 @@ dependencies: - jdk vendor: Adoptium version: - - "8": 8u392 - - "11": 11.0.23 - - "17": 17.0.9 - - "21": 21.0.3 + - "8": 8u511 + - "11": 11.0.33 + - "17": 17.0.21 + - "21": 21.0.13 logs: mendix-logfilter: artifact: logs/mendix-logfilter-{{version}}.tar.gz diff --git a/requirements.in b/requirements.in index d92647def..e12ed1f7f 100644 --- a/requirements.in +++ b/requirements.in @@ -1,5 +1,5 @@ backoff==2.2.1 -certifi==2024.8.30 +certifi==2026.10.19 cryptography==50.0.0 distro==1.9.0 httplib2==0.32.0 diff --git a/requirements.txt b/requirements.txt index 3b55f07ed..d2ef9284f 100644 --- a/requirements.txt +++ b/requirements.txt @@ -8,7 +8,7 @@ antlr4-python3-runtime==4.9.3 # via omegaconf backoff==2.2.1 # via -r requirements.in -certifi==2024.8.30 +certifi==2026.10.19 # via # -r requirements.in # requests From c3b8428b549a011b8a90d8fc28803beed2ad20e2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rio=20Serrador?= <61971372+mruiserrmendix@users.noreply.github.com> Date: Mon, 26 Oct 2026 10:37:16 +0100 Subject: [PATCH 2/2] Revise supported Mendix versions in README Updated supported Mendix versions in the README to include version 11 and removed end-of-support information. --- README.md | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 15be897e1..972a2fe43 100644 --- a/README.md +++ b/README.md @@ -63,17 +63,18 @@ Additionally, we recommend a base level knowledge of Cloud Foundry. You should a ## Supported Mendix Versions -The latest [buildpack release](https://github.com/mendix/cf-mendix-buildpack/releases/latest) supports all [officially-supported](https://docs.mendix.com/releasenotes/studio-pro/lts-mts) Mendix versions (7, 8 and 9). +The latest [buildpack release](https://github.com/mendix/cf-mendix-buildpack/releases/latest) supports all [officially-supported](https://docs.mendix.com/releasenotes/studio-pro/lts-mts) Mendix versions. The following table shows which specific buildpack release introduced or removed support for specific Mendix versions. -| Mendix Major Version | Supported | End-of-Support | -| -------------------- | --------- | -------------- | -| `10` | `v4.24.0` | - | -| `9` | `v4.24.0` | - | -| `8` | `v3.4.0` | - | -| `7` | `v3.1.0` | - | -| `6` | `v1.0` | `v4.16.0` | +| Mendix Major Version | Supported | +| -------------------- | --------- | +| `11` | `v5.0.15` | +| `10` | `v4.24.0` | +| `9` | `v4.24.0` | +| `8` | `v3.4.0` | +| `7` | `v3.1.0` | +| `6` | `v1.0` | We recommend using a [maintained (LTS / MTS)](https://docs.mendix.com/releasenotes/studio-pro/lts-mts) Mendix version. Additionally, we recommend to always [use / "pin to" a specific buildpack release](#buildpack-releases-and-version-pinning).