logo
26.2
Follow us on
Developed by webswing.org

© 2012 - 2026 Webswing Ltd. All Rights Reserved.

list
logo
avatar
expand_more

Release Notes

Webswing 26.2 focuses on more efficient server-rendered graphics, more resilient Admin Console and cluster connections, independently deployable example applications, a maintained Kubernetes deployment example, and improved documentation tooling.

26.2

Release date: To be announced

New Features

  • #1208: Added Webswing Linux Web Launcher support for running Linux desktop applications through Webswing, including a Linux Applications drop-in with a browser chooser for GIMP and XClock
  • #1317: Added QOI encoding for server-rendered ARGB images when DirectDraw is disabled, using a multithreaded Java encoder and a WebAssembly decoder in the browser.
  • #1337: Added configurable Admin Console reconnect policies with interval, retry, and delay limits, plus optional JVM termination when every configured server connection is exhausted. Session-pool reconnect settings now consistently support 0 to disable a limit.
  • #1334: Replaced the aggregate Standard-with-examples, Cluster-with-examples, and security-modules downloads with separately downloadable application, containerization, and security-module packages; application ZIPs copied into a configurable drop-in directory are now extracted and registered automatically, while evaluation distributions retain Webswing Demo as their single bundled drop-in application.
  • #1345: Added a local Kubernetes cluster example with Kustomize manifests, Docker and Buildah image builds, persistent configuration, a static session pool, autoscaled session pools, and an NGINX entry point.
  • #1386: Added built-in PROPERTIES Security Module.

Enhancements

  • #1311: Replaced the legacy PNG encoder and added the webswing.pngCompressionLevel setting, supporting compression levels from 0 to 9 with a default of 2.
  • #1332: Improved the OpenAPI definition with relative global and application-scoped server paths and clearer descriptions for session, recording, thread-dump, heap-dump, statistics, and log-level operations.
  • #1344: Improved class-modification blacklist scalability and warmup reliability. Warmup now resolves custom configuration paths and applies each application's webswing.classModificationBlacklist setting.
  • #1330: Added a customization example for capturing a picture from a webcam.
  • #1143: Expanded the Oracle Forms demo with user-information and prompt-button integrations.

Bug Fixes

  • #1394: Fixed concurrent configuration access and cached HTTP security headers
  • #1399: Fixed a race condition when registering local and session pool Swing instances
  • #1296: Fixed OIDC logout behavior when the identity provider is unavailable or the OIDC client cannot initialize.
  • #1314: Removed hidden download iframes after a configurable timeout when direct download is disabled, preventing iframe accumulation in long-running browser sessions.
  • #1348: Disposed the LightweightFrame peer used by JavaFX SwingNode across supported Java versions.
  • #1351: Fixed subdomain mapping when multiple applications are deployed at the root context on different domains behind a reverse proxy.
  • #1337: Fixed reconnect attempt accounting after a CANNOT_ACCEPT response and a race when the configured websocket URL changes during reconnect.

Configuration and Behavior Changes

The standalone server and Session Pool now include built-in XHeadless for running applications on headless Linux without a separate XHeadless executable or Xvfb service. It starts automatically when no display is configured or a configured local display is missing. Existing displays remain in use. Set webswing.xheadless.enabled=false to require an external X server.

  • webswing.encodingFormat now accepts QOI in addition to PNG and WEBP when DirectDraw is disabled.

  • The new serveDownloadIframeCleanupInterval bootstrap option controls the maximum lifetime of a hidden download iframe and defaults to 300 seconds.

  • The default value of webswing.enforcePeerPaintsFromDirtyQueueOnly is false. Set it explicitly to true to retain dirty-queue-only peer painting.

  • Admin Console reconnects indefinitely by default. Use admin.reconnect.interval, admin.reconnect.retries, admin.reconnect.delay, and admin.reconnect.terminateServerOnReconnectExhausted to customize failure handling.

  • Property-file Security module is now implemented by the built-in PROPERTIES module. Replace security.module: "org.webswing.security.modules.property.PropertySecurityModule" with "PROPERTIES", retain security.config.file, and remove the external Shiro jars from security.classPath. Existing user files and $hashed$ passwords require no conversion; Database authentication remains an external Shiro module.

  • The external Database security module now uses Apache Shiro 3.0.1 and requires Java 17 or newer for the Webswing server process.

Distribution Changes

Webswing 26.2 changes several distribution names and replaces aggregate downloads. Existing automated deployments must make the following changes:

  • Package names: Published ZIPs now follow webswing-<package>-<version>.zip without the former -distribution suffix. Replace webswing-<version>-distribution.zip with webswing-standard-<version>.zip.
  • Examples: The webswing-examples-<version>-distribution.zip and webswing-examples-cluster-<version>-distribution.zip aggregates are no longer published. Download the required example ZIPs separately and copy them into the Standard or Cluster apps/ directory.
  • Security modules: The webswing-security-modules-<version>-distribution.zip aggregate is no longer published. Download and install the required webswing-security-<type>-<version>.zip package separately. Database deployments that reference security/database+property/ must use security/database/ instead; Property-file authentication is now built in and requires no separate security package.

Fixed 3rd party vulnerabilities