Merge remote-tracking branch 'upstream/development' into development

Author: github-actions[bot]

content/en/docs/control-center/security/certificate-management.md

@@ -13,9 +13,13 @@ This feature is in Public Beta. For more information, refer to [Release Status](
 
 ## Introduction
 
+{{% alert color="warning" %}}
+For detailed information about how Mendix Admins can use the **Certificate Management** page to upload, configure and manage centralized certificates, refer to [Centralized Certificates](/developerportal/deploy/certificates/centralized-certificates/).
+{{% /alert %}}
+
 In Mendix Cloud, SSL/TLS certificates enable secure HTTPS communication for incoming connections to applications that use custom domains.
 
-The **Certificate Management** page provides Mendix Admins with a centralized view of all company-wide certificates. From this page, you can upload, replace, renew, and monitor certificates that can be reused across multiple applications and environments.
+The **Certificate Management** page provides Mendix Admins with a centralized view of all company-wide certificates. From this page, you can [upload](/developerportal/deploy/certificates/centralized-certificates/#uploading-central-certificate), [replace](/developerportal/deploy/certificates/centralized-certificates/#replacing-existing-central-certificate), [renew](/developerportal/deploy/certificates/centralized-certificates/#renewing-central-certificate), and monitor certificates that can be reused across multiple applications and environments.
 
 After a certificate is added:
 
@@ -57,8 +61,6 @@ Each configured certificate is shown in a table with the following fields:
     {{% alert color="info" %}}You cannot delete a certificate that is currently in use.
     {{% /alert %}}
 
-For detailed information about how Mendix Admins can use the **Certificate Management** page to upload, configure and manage centralized certificates, refer to [Centralized Certificates](/developerportal/deploy/certificates/centralized-certificates/).
-
 ## Read More
 
 * [Certificates](/developerportal/deploy/certificates/)

content/en/docs/marketplace/platform-supported-content/modules/oidc.md

@@ -233,40 +233,27 @@ Ensure that you have allocated the following user roles to the OIDC module and U
 | User Role | OIDC Module Role |
 | --- | --- |
 | Administrator | OIDC.Administrator, UserCommons.Administrator |
-| Anonymous | OIDC.Anonymous (for multiple IdPs only) |
 | User | OIDC.User |
 
-{{< figure src="/attachments/appstore/platform-supported-content/modules/oidc/user-roles.png" class="no-border" >}}
+{{< figure src="/attachments/appstore/platform-supported-content/modules/oidc/user-roles.png" >}}
 
-### User Roles for Single IdP
+### End User Login When Using Single or Multiple IdPs
 
-If a single Identity Provider (IdP) is configured in the OIDC SSO module, end-users can be authenticated via the URL `https://<your-app-url>/oauth/v2/login` This means you do not need to configure the *Anonymous* user role for a single IdP.
+If a single Identity Provider (IdP) is configured in the OIDC SSO module, end users can be authenticated via the URL `https://<your-app-url>/oauth/v2/login`. When accessing the URL, users are automatically redirected to the configured IdP for authentication.
 
-### Allowing Anonymous Users for Multiple IdPs (Optional)
+If multiple IdPs are configured in the OIDC module, the following two mechanisms are supported for selecting the IdP:
 
-The OIDC module supports multiple OIDC/OAuth-compatible IdPs. Optionally, if you allow your end-users to choose from multiple IdPs, or to have the option to log back into the app after they have logged out, you will need to give them access to the app before they have signed in to the app. Therefore, you need to give anonymous users access to your app.
-
-In the **Anonymous** tab of the app security settings, do the following:
-
-1. Set **Allow anonymous users** to **Yes**
-2. Select *Anonymous* as the **Anonymous user role**
-
-{{< figure src="/attachments/appstore/platform-supported-content/modules/oidc/anonymous-user.png" class="no-border" >}}
+1. Depending on deeplink, your application logic may redirect to a IdP-specific endpoint.
+2. In this mechanism, your end users make the selection. Your app logic can use the same URL (`<your-app-url>/oauth/v2/login`) to initiate authentication. End users will first be redirected to an IdP selection page, where they can choose the IdP they want to use for authentication.
 
 {{% alert color="info" %}}
-For multiple IdPs, you may have to add the *Anonymous* user role if it does not exist already.
-{{% /alert %}}
-
-{{% alert color="warning" %}}
-Enabling anonymous users introduces a broader attack surface. If you choose this option, follow Mendix guidelines for [setting up anonymous user security](/howto/security/set-up-anonymous-user-security/) to mitigate potential risks.
+In OIDC SSO version 4.1.0 and above, you do not have to enable anonymous users for multiple IdPs. Additionally, check whether `Anonymous` user role can be removed from the app. If your application does not require anonymous access, removing the role is recommended as a security best practice.
 {{% /alert %}}
 
 ### Configuring Navigation{#configure-nav}
 
 The OIDC SSO module works without a specified sign-in page. Therefore, in the navigation section of your app, set **Sign-in page** (in the **Authentication** section) to *none*.
 
-If you are configuring navigation for web/responsive apps and want to allow your end-users to choose from a number of different IdPs (multiple IdPs), or to have the option to sign in back into the app after they have signed out, set a **Role-based home page** for role **Anonymous** to **OIDC.Login_Web_Button**. When configuring navigation for PWA apps, set the **Role-based home page** for the **Anonymous** role to `OIDC.Login_PWA_Online_Button` for online apps and `Login_PWA_Offline_Button` for offline apps. See [Role-Based Home Pages](/refguide/navigation/#role-based) in *Navigation* for more information.
-
 In addition, administrators will need to have access to configure OIDC and also manage end-users. You can do this by including the pages `Administration.Account_Overview` and `OIDC.OIDC_Client_Overview` into the app navigation, or a separate administration page.
 
 If you are testing phone web and phone web offline locally, use the URLs `http://localhost:8080/?profile=Phone` and 

content/en/docs/releasenotes/studio-pro/9/9.24.md

@@ -11,6 +11,26 @@ lts: true
 This is the [LTS](/releasenotes/studio-pro/lts-mts/#lts) version 9 release for apps in production.
 {{% /alert %}}
 
+## 9.24.42
+
+**Release date: March 20, 2026**
+
+{{% button color="info" href="https://marketplace.mendix.com/link/studiopro/9.24.42" text="Go to Marketplace" title="Download version 9.24.42 from the Marketplace" %}}
+
+### Improvements
+
+- Studio Pro has been updated to run on .NET 10 instead of .NET 8. As a result, .NET 10 is now a required prerequisite for the application. For more information, see [System Requirements](/refguide9/system-requirements/#software-specifications)
+- We updated the .NET runtime version installed with Studio Pro to .NET 10.0.3.
+- We improved the performance of session cleanup.
+- We changed the level of log messages on the **SystemTask** log node to debug. For non-development deployments this log node was set to info, which was causing too many messages.
+
+### Fixes
+
+- We fixed an issue where an import mapping would not read JSON attribute values when a JSON attribute was preceded by another attribute with an attribute name that is a prefix. For example `StatusId` and `Status`. We also improved how JSON objects were read when one object name was a prefix of another object name. (Ticket 266571)
+- We fixed an issue where changing the queue parallelism through a microflow constant was not working correctly for cluster-wide queues. (Ticket 267097)
+- We fixed an issue where a long-running after startup microflow causes the node to be assumed crashed by other nodes. (Ticket 269993)
+- We fixed an issue in import/export mapping in Studio Pro where elements except first of the child array in JSON were omitted.
+
 ## 9.24.41
 
 **Release date: January 13, 2026**
@@ -36,7 +56,7 @@ This is the [LTS](/releasenotes/studio-pro/lts-mts/#lts) version 9 release for a
 * We fixed an issue that caused slow serialization of Mendix objects in microflow responses when entity access was not applied during retrieval. Serialization speed is now comparable as when entity access is applied. (Ticket 226097)
 * We fixed an error in the Studio Pro installer when the installer is checking if the .NET version is already installed or not. (Ticket 253218)
 * We fixed an issue where trying to delete a huge amount (millions) of anonymous sessions during startup would cause OOM errors. We now delete sessions and anonymous users in batches to avoid this problem. (Ticket 257047)
-* We fixed an issue where JSON Import mappings stopped finding objects. (Ticket 258507)
+* We fixed an issue where JSON import mappings stopped finding objects. (Ticket 258507)
 * In the logic editors, we fixed a performance issue that affected locally running projects containing several microflows. (Ticket 259254)
 * We fixed an issue where unsaved changes of the **System Text** editor would be committed when running the app locally. (Ticket 259664)
 * We fixed an issue that prevented some users to authenticate in Studio Pro. (Ticket 259700)
@@ -74,7 +94,7 @@ This is the [LTS](/releasenotes/studio-pro/lts-mts/#lts) version 9 release for a
 
 ### Fixes
 
-* We fixed an issue where **Import Mappings** using **Find an object (by key)** or **Call a microflow** did not create an object for valid input. (Tickets 255130, 260462)
+* We fixed an issue where import mappings using **Find an object (by key)** or **Call a microflow** did not create an object for valid input. (Tickets 255130, 260462)
 
 ## 9.24.39
 
@@ -102,7 +122,7 @@ This is the [LTS](/releasenotes/studio-pro/lts-mts/#lts) version 9 release for a
 ### Fixes
 
 * Dependencies for a portable version of Studio Pro (WebView2, OpenJDK, and Gradle) are now placed inside the application's installation folder. Installing or removing a specific version of portable Studio Pro no longer affects the dependencies of other installed versions. (Ticket 244240)
-* We fixed an issue in Import Mappings where object properties were not connected correctly to mapped attributes, resulting in empty import values. (Tickets 254351, 256716, 256726)
+* We fixed an issue in import mappings where object properties were not connected correctly to mapped attributes, resulting in empty import values. (Tickets 254351, 256716, 256726)
 * We fixed an issue where keyboard shortcuts could not be used when editing JSON or SCSS files. (Ticket 256301)
 * We fixed an issue in the interactive documentation (Swagger UI) page for published OData services which indicated it did not support OpenAPI version 3.0.4. (Tickets 256982 and 257611)
 * We fixed an issue in offline synchronization (using the **Synchronize unsynchronized objects** and **Synchronize all** actions) that could result in error log statements and `System.SynchronizationError` objects containing a text *"Changing member failed for security reasons, no write access for changed member"*. That was caused by the offline client trying to synchronize a change for a member that was inaccessible by that user.

content/en/docs/support/submit-support-request.md

@@ -137,6 +137,7 @@ Attachments are uploaded via SendSafely, a secure file transfer service. SendSaf
 To resolve that error, please make sure that the following URLs are allowlisted in your network's security settings:
 
 * `https://mendix.sendsafely.eu`
+* `https://mendix.sendsafely.com`
 * `https://static-mendix.sendsafely.eu`
 * `https://sendsafely-dual-region-eu.s3-accelerate.amazonaws.com`