OpenDJ 5.0.4, OpenAM 16.0.6, OpenIG 6.1.0 release notes

Author: maximthomas

_posts/2026-03-23-opendj-5-0-4-released.md

@@ -0,0 +1,30 @@
+---
+layout: home
+landing-title: "OpenDJ 5.0.4 Released"
+landing-title2: "OpenDJ 5.0.4 Released"
+description: OpenDJ 5.0.4 with security fixes, a temp directory fallback improvement, dependency upgrades, and documentation updates
+keywords: 'OpenDJ, LDAP, directory server, release, 5.0.4, security update, CVE-2025-24970, CVE-2025-12194, Netty, logback, caffeine'
+imageurl: 'opendj-og.png'
+share-buttons: true
+---
+# OpenDJ 5.0.4 Released
+[Download](https://github.com/OpenIdentityPlatform/OpenDJ/releases/tag/5.0.4)
+
+## What's new
+* Addressed security vulnerabilities:
+    * [CVE-2025-24970](https://nvd.nist.gov/vuln/detail/CVE-2025-24970) - Netty `SslHandler` does not correctly validate packets, which can lead to a native crash when using the native SSLEngine
+    * [CVE-2025-12194](https://nvd.nist.gov/vuln/detail/CVE-2025-12194) - JVM garbage collector overrun related to the use of the disposal daemon under Java 17 and Java 21
+* Added fallback to `$HOME/tmp` as a temporary directory when the instance root is mounted as `noexec`
+* Migrated cache library from Guava to Caffeine 3
+* Updated `commons` dependency from version 3.0.2 to 3.0.4
+* Fixed short version number in the upgrade guide documentation
+
+Full changeset ([more details](https://github.com/OpenIdentityPlatform/OpenDJ/compare/5.0.3...5.0.4))
+
+## Thanks for the contributions
+
+<i id="vharseko"><i>1. <a href="https://github.com/vharseko" target="_blank">Valery Kharseko</a></i>
+<br/>
+<i id="maximthomas"><i>2. <a href="https://github.com/maximthomas" target="_blank">Maxim Thomas</a></i>
+<br/>
+<i id="prthakre"><i>3. <a href="https://github.com/prthakre" target="_blank">prthakre</a></i>

_posts/2026-03-24-openam-16-0-6-released.md

@@ -0,0 +1,34 @@
+---
+layout: home
+landing-title: "OpenAM 16.0.6 Released"
+landing-title2: "OpenAM 16.0.6 Released"
+description: OpenAM 16.0.6 with critical security fixes including a pre-authentication RCE vulnerability patch, denial-of-service fixes, and a SameSite cookie attribute improvement
+keywords: 'OpenAM, access management, SSO, release, 16.0.6, security update, CVE-2026-2391, CVE-2026-32141, CVE-2026-33228, CVE-2026-33439, RCE, deserialization, SameSite cookie'
+imageurl: 'openam-og.png'
+share-buttons: true
+---
+# OpenAM 16.0.6 Released
+[Download](https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.0.6)
+
+## What's new
+* Addressed security vulnerabilities:
+    * [CVE-2026-2391](https://nvd.nist.gov/vuln/detail/CVE-2026-2391) - `qs` library `arrayLimit` bypass in comma parsing allows denial of service
+    * [CVE-2026-32141](https://nvd.nist.gov/vuln/detail/CVE-2026-32141) - `flatted` library vulnerable to unbounded recursion denial of service in `parse()`
+    * [CVE-2026-33228](https://nvd.nist.gov/vuln/detail/CVE-2026-33228) - Prototype pollution via `parse()` in Node.js `flatted` library
+    * [CVE-2026-33439](https://nvd.nist.gov/vuln/detail/CVE-2026-33439) - Pre-authentication remote code execution via `jato.clientSession` deserialization in OpenAM
+* Fixed inability to set the `SameSite` cookie attribute in XUI
+* Updated embedded OpenDJ dependency to version 5.0.4
+
+Full changeset ([more details](https://github.com/OpenIdentityPlatform/OpenAM/compare/16.0.5...16.0.6))
+
+## Thanks for the contributions
+
+<i id="vharseko"><i>1. <a href="https://github.com/vharseko" target="_blank">Valery Kharseko</a></i>
+<br/>
+<i id="maximthomas"><i>2. <a href="https://github.com/maximthomas" target="_blank">Maxim Thomas</a></i>
+<br/>
+<i id="IvanAndrukh"><i>3. <a href="https://github.com/IvanAndrukh" target="_blank">IvanAndrukh</a></i>
+<br/>
+<i id="iamnoooob"><i>4. <a href="https://github.com/iamnoooob" target="_blank">iamnoooob</a></i>
+<br/>
+<i id="hacktronai-research"><i>5. <a href="https://github.com/hacktronai-research" target="_blank">hacktronai-research</a></i>

_posts/2026-03-25-openig-6-1-0-released.md

@@ -0,0 +1,30 @@
+---
+layout: home
+landing-title: "OpenIG 6.1.0 Released"
+landing-title2: "OpenIG 6.1.0 Released"
+description: OpenIG 6.1.0 with new AI gateway filters for LLM prompt injection protection and token usage control, MCP policy enforcement, JWT building, OpenAPI validation, a security fix, and JDK 26 support
+keywords: 'OpenIG, identity gateway, release, 6.1.0, LLM, AI gateway, prompt injection, MCP, Model Context Protocol, JWT, OpenAPI, Swagger, CVE-2026-24308, JDK 26'
+imageurl: 'openig-og.png'
+share-buttons: true
+---
+# OpenIG 6.1.0 Released
+[Download](https://github.com/OpenIdentityPlatform/OpenIG/releases/tag/6.1.0)
+
+## What's new
+* Added [JwtBuilderFilter](https://doc.openidentityplatform.org/openig/reference/filters-conf#JwtBuilderFilter) — creates a JSON Web Token (JWT) from runtime data and injects it into the request context
+* Added [OpenApiValidationFilter](https://doc.openidentityplatform.org/openig/reference/filters-conf#OpenApiValidationFilter) — validates inbound HTTP requests and outbound HTTP responses against an OpenAPI specification (Swagger 2.x or OpenAPI 3.x)
+* Added [LLMPromptGuardFilter](https://doc.openidentityplatform.org/openig/reference/filters-conf#LLMPromptGuardFilter) — intercepts outgoing LLM API requests and scans every prompt for prompt-injection attacks before the request reaches the downstream model; implements mitigations for OWASP LLM Top 10 (2025) risks LLM01 (Prompt Injection) and LLM07 (System Prompt Leakage)
+* Added [LLMProxyFilter](https://doc.openidentityplatform.org/openig/reference/filters-conf#LLMProxyFilter) — controls LLM token usage per user
+* Added [MCPServerFeaturesFilter](https://doc.openidentityplatform.org/openig/reference/filters-conf#MCPServerFeaturesFilter) — enforces allow/deny policies for Model Context Protocol (MCP) features exchanged as JSON-RPC payloads; inspects both incoming requests and outgoing responses and removes or rejects features according to configured rules
+* Added JDK 26 support to the build pipeline
+* Updated OpenAM dependency to version 16.0.6
+* Addressed security vulnerability:
+    * [CVE-2026-24308](https://nvd.nist.gov/vuln/detail/CVE-2026-24308) - Apache ZooKeeper improper handling of configuration values
+
+Full changeset ([more details](https://github.com/OpenIdentityPlatform/OpenIG/compare/6.0.2...6.1.0))
+
+## Thanks for the contributions
+
+<i id="maximthomas"><i>1. <a href="https://github.com/maximthomas" target="_blank">Maxim Thomas</a></i>
+<br/>
+<i id="vharseko"><i>2. <a href="https://github.com/vharseko" target="_blank">Valery Kharseko</a></i>