August 2026 (version 2.26.08.24)

Reviewed: 24 August 2026

This release focuses on concurrency stability, security hardening, and quality-of-life improvements across document processing, file operations, email infrastructure, and developer experience.

🚀 New Features

DOCX Space Preservation

Automatic support for space preservation in <@docx/text> content, ensuring that expected formatting is maintained throughout documents.

Word documents naturally trim leading, trailing, and consecutive spaces in text runs. By default, CaseMaster now wraps text content in xml:space="preserve" so that spaces you intend to keep, such as indentation, padding between words, or trailing whitespace, are honoured exactly as written in your templates.

<@docx/text
    'Hello, world!'
    preserveSpace: true() // Default
>

Lazy Loading Images

Introduced support for lazy loading images, improving page performance when rendering HTML with multiple images.

By default, browsers load all images on a page as soon as it renders, even those below the fold that the user may never scroll to see. Lazy loading defers image loading until the image enters the viewport, reducing initial page weight and speeding up render times.

<@page/image
    src: script.call('web/router/static:resolveUrl', 'img/example.png')
    lazy: true()
>

Auto-Directory Creation

The system now automatically creates destination directories when copying or moving files and directories, streamlining file operations and reducing manual setup requirements.

// No longer needed, fileSystem.copy will create the directory
// if not(filesystem.directoryExists([directory]))
//     filesystem.createDirectory([directory])
// end-if

fileSystem.copy(
    document.filePath([document]),
    fileSystem.buildPath([directory], 'copy.docx')
)

Both fileSystem.copy and fileSystem.move will create any missing parent directories in the destination path automatically, so you no longer need to check and create them manually beforehand.

Test Email from Profile

Users can now send test emails directly from an email out profile, simplifying configuration verification before deployment.

If you have not already done so, we recommend updating your application maintenance entry for Email Out Profiles to use the dedicated maintenance page application/maintenance/email/outProfile:main instead of the entity-based view. This ensures you have access to the new test email functionality and future enhancements.

🛡️ Security & Compliance

Account Enumeration Prevention

We've tightened the Forgot Password flow to prevent attackers from determining if an email address exists in the system. All password reset attempts now return the same generic "sent" message, regardless of whether the account is active or exists.

Updated Microsoft SQL Driver

Migrated from System.Data.SqlClient to Microsoft.Data.SqlClient, ensuring alignment with the latest security patches and ongoing support from Microsoft.

As part of this migration, CaseMaster now logs a warning when a compatibility fallback is applied, alerting you to unencrypted database connections that may expose sensitive data in transit.

Migrated SMTP Handler to MailKit

Migrated the SMTP handler to MailKit, aligning with a actively maintained and security-focused library for email transport. MailKit provides better support for modern TLS standards and ongoing security updates.

This change is fully backwards compatible, and existing email out profiles should continue to work without any configuration changes. However, as with any infrastructure-level change, we strongly recommend testing your email profiles in a staging environment before deploying to production.

Parameter Encoding

Improved parameter encoding for <@page/link/target/modal> and <@page/link/target/window> specifications to guard against injection. User-supplied values passed to modals and windows are now encoded before being interpolated, preventing malicious input from executing in the rendered page context.

⚙️ Performance & Reliability

Concurrency & Thread Safety

We’ve refactored core internal data structures to guarantee stability and prevent race conditions during high-concurrency operations.

Property Bags & Collections

Push and pop operations on property bags, along with access to underlying collections, are now fully thread-safe. This eliminates potential errors when multiple threads manipulate shared state simultaneously.

Context Entries

Setting both property context entries and Query String (QS) context entries is now thread-safe, ensuring reliable state management across concurrent access.

Resource Cleanup

Word and Excel cleanup routines have been hardened to handle garbage collection in any order. This prevents resource leaks and unexpected application pool crashes in long-running or high-volume processing.

Critical Fixes

Finally Statement Execution

Fixed an issue where finally blocks were prematurely truncated if a return statement appeared in the preceding try block. Previously, only the first line of the finally block would execute, silently ignoring subsequent cleanup logic.

HttpRequest Header Validation

Added support for disabling automatic header validation on httpRequest.

This enables the use of custom or non-standard headers that would otherwise trigger a validation error, such as the AWS Signature Authorization header.

httpRequest.setHeader(
    [request],
    'Authorization',
    'AWS4-HMAC-SHA256 Credential=id/yyyymmdd/eu-west-1/execute-api/aws4_request, SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date;x-api-key, Signature=signature',
    validate: false() // Disable validation
)

🔧 Developer & UX Updates

Log Maintenance

The application maintenance log viewer now displays the filename in the modal title when tailing a log file, making it easier to identify which log you're currently viewing.

Validation Metadata

Added default string length metadata to date-based attributes on business objects. This ensures that external validation schemas receive the correct length constraint (e.g., 10 for YYYY-MM-DD) when consuming CaseMaster resources.

boDesc.getAttrLength(bo.user(), 'cmCreatedWhen') // 20

📝 Upgrade Recommendations

All users should upgrade to benefit from the security fixes, including the account enumeration prevention in the password reset flow, parameter encoding hardening, and the SQL driver migration.

We strongly recommend explicitly applying Encrypt=True in your production database connection strings ahead of a future release where encryption may become the default.

If you are integrating with AWS or other services requiring custom headers, update your httpRequest calls to take advantage of the new header validation bypass.

While the SMTP handler migration to MailKit is backwards compatible, we advise testing your email out profiles in a staging environment before deploying the runtime to production.