3.6

3.6.7-funcrel

Note

  • An in-place update from previous 3.x releases is supported for Linux via Docker installations - see the documentation.

Components included in this release:

  • Embedded CAST Imaging Core release: 8.4.12 with internal analysis engine 3.2.6-funcrel.

New Features

Summary Details
Administration > Roles A new "AI Features Access" role has been added which governs the AI-driven features: AI Summary and Bulk AI Summary, Explain with AI and Explain Object Context with AI, the CAST Imaging Assistant chatbot, the Functional Documentation and Executive Summary reports, GraphRAG analysis jobs, and automated module generation. The role is not granted by default and must be added to a profile explicitly. Users without it can still open the AI screens and consult results generated previously, but any action that produces new AI output is blocked. See Default profiles and roles. Note that this new role replaces the previously available " Bulk AI Summary" and "Generate Automated Module" roles - if a user was assigned one of these roles, post update to 3.6.7-funcrel (or later), the user will be assigned the "AI Features Access" role.
Administration UI > Manage custom extensions from the UI A new "Custom Extensions" section is available in the admin left panel for managing the lifecycle of custom extensions: upload a custom extension in ".nupkg" format, validate it to report problems such as a missing dependency, and delete it when it is no longer used by any application. Uploaded extensions are placed in the shared extensions folder used by all analysis nodes and are available for use in an analysis as soon as the upload completes, with no refresh or node restart required. Administrators therefore no longer need access to the file system of the CAST Imaging servers in order to deploy a custom extension - previously the only method available. Extensions with an id beginning "com.castsoftware.ac.am" are listed but cannot be modified here, because they are managed in Architecture Studio. See the documentation. Note that this is a beta release of the feature that will be improved in future CAST Imaging releases.
Results > AI Mode in Global Search and Custom Aggregation (beta) Describe the objects you want in plain English and CAST Imaging generates and runs the query for you. Available from the new AI Mode tab; the generated query can be viewed, edited and rerun, and in Custom Aggregation it is saved as the custom node's rule. Requires an AI provider configured in AI Settings, the `AI Features Access` role, and MCP Server 3.1.0-beta4 or later. See the documentation.

Feature Improvements

Summary Details
Installation > Prechecks for an external PostgreSQL instance Where CAST Imaging is installed against your own external PostgreSQL instance, the installer now validates that instance before making any change to the machine. It connects and authenticates with the credentials you configured, checks the release (Linux only), and verifies that the login role is SUPERUSER or holds both CREATEDB and CREATEROLE, that the role can CREATE on the pg_default tablespace, and that the database uses the UTF8 encoding. A failed connection, an unsupported release or insufficient role privileges stop the installation before anything is changed; the tablespace privilege and the encoding are reported as warnings and the installation continues. The checks run only where an external instance is configured - DB_MODE=external on Linux, or a resolvable host on Microsoft Windows. See the documentation.
Installation > Precheck messaging improvements Each result line in the report is now split into columns: `STATUS | Check name | Result detail`. Every failure and warning message is now documented in the Precheck message reference.
Installation > Prechecks for shared storage The prechecks now also validate shared storage - that the `common-data`, `delivery` and `deploy` folders resolve from your configuration, are writable by the installing account and have enough free space - and a new kernel check covers `fs.file-max`. See the documentation.
Installation > Windows > Java For installations on Microsoft Windows requirements a Java JDK, release 25 is now supported. The supported range is now ≥ 17 LTS and ≤ 25 (previously ≤ 21). See the documentation.
Analysis Configuration > Consistent "New scan" dialog box The "New scan" button on the application Overview page now displays the same "Scan a new application" dialog box that is used when onboarding an application, replacing the two separate dialog boxes previously shown depending on how the application's source code was originally delivered. See the documentation.
Documentation > Interrupted source code uploads Documented the 422 "fileUploadError" returned when a source code archive is uploaded again immediately after an upload was interrupted - for example by a browser refresh or a dropped connection. Explains why the analysis node still holds the file name. See the documentation.
Application name validation > trailing dot no longer accepted Application names can no longer end with a dot. Dots remain valid elsewhere in the name, so "cobol_app.test" is accepted while "cobol_app." is rejected with the message: "Application name can only contain letters, numbers, underscores (_), hyphens (-), dots (.), and spaces, and cannot end with a dot. Please try again with a valid name." The rule is enforced both when onboarding a new application and when renaming an existing one. See Rules around application naming.
Analysis Configuration > Security Dataflow blackboxes before the first analysis You can now upload Security Dataflow blackbox files (.blackbox.xml) after onboarding and the initial fast scan and before running the first full analysis, when JEE or .NET source code is present in the application. Blackboxes are therefore taken into account by the initial analysis, without needing to run a second analysis for them to take effect. In all earlier releases blackbox files can only be added after an initial analysis has completed. See the documentation.
Admin UI > Enhanced Users list "The "Users" tab in "Settings > User Permissions" now displays the last name, first name, email address and group membership of each user." The list can be searched by name or email, filtered by type, group, profile and status, and sorted on any column. See documentation.
Admin UI > Enable or disable a user account "A new 'Enabled' toggle in the 'Users' tab of 'Settings > User Permissions' allows an administrator to enable or disable a user account." The change is applied directly to the user in Keycloak. The default 'admin' account cannot be disabled. See documentation.
Results > Add and remove tags from the contextual menu, structural flaws and Advisor Tags can now be added and removed from a new "Manage Tags" submenu in the view's right click contextual menu, using the "Add" and "Remove" options. The "Add" dropdown lists only the tags that can still be applied to the selection: for a single item, tags already applied to it are excluded; for a multiple selection, only tags applied to every selected item are excluded, so a tag held by some of the selection remains available for the rest. You can select an existing tag or create a new one. "Remove" lists the tags currently on the selection so you can clear one or more of them. Both actions work on a single item or in bulk. The same add and remove options are now also available for objects selected in the structural flaws table and in the "Advisor for modernization" results, where they are presented as separate sections. See the documentation.
Results > Custom aggregations: show the objects not covered by a custom node When you build a custom aggregation, any object that does not match one of your custom nodes is absent from the view, so the aggregation is an incomplete representation of the application. A new "Unassigned" toggle in the canvas toolbar adds a special grey "Unassigned" node grouping all these objects, with its badge showing the object count. The toggle is disabled by default, and its state at the moment you publish determines whether the node is included in the published view - there is no separate publish option. The node is read-only: it cannot be renamed or cloned, "Unassigned" is a reserved name that cannot be used for your own nodes, no links are calculated between it and your custom nodes, and authorization links cannot be drawn to or from it. Its contents are recalculated automatically whenever you add or remove a custom node. Double click it to switch the canvas to list mode showing only those objects; above 100,000 objects it cannot be explored and you are asked to create custom nodes to refine the view. Available in both creation modes. See the documentation.
Results > Custom aggregations: canvas display options The custom aggregation canvas toolbar now offers the display options already available when exploring results - object label, relationship label, badge count, isolated nodes and tooltips - together with a switch between the graph and list representations of the aggregation, previously available in published views only. See the documentation.
Results > GraphRAG: business rule extraction A new "Business Rule Extraction" stage has been added to the GraphRAG pipeline, so that the knowledge graph can contain consolidated business rules alongside the functional context. A "Run Scope" option at the top of the GraphRAG tab controls this: "Functional Context" builds the knowledge graph as in previous releases, while "Functional Context + Business Rules" adds the Business Rule Extraction stage. Choosing the second option automatically selects the "Business Rule Purpose" AI summary content option - regenerate the AI summaries so that this content is produced, then run the pipeline. Cost estimates now account for the additional Business Rule Purpose content and are shown for each individual content option, for the total content generation, and for each pipeline stage. Querying the resulting knowledge graph requires the latest CAST Imaging MCP Server 3.1.0-x release. See Query your application with GraphRAG.
Results > GraphRAG: configuration page improvements The "Beta info" banner at the top of the GraphRAG tab now links directly to the GraphRAG documentation. In addition, the "AI Summary Run History" section is now collapsible and is collapsed by default, keeping the focus on the run configuration. See Query your application with GraphRAG.

Other Updates

Internal Id Details
IMAGKSL-4874 Standardized the ApplicationName property across all PostgreSQL connection pools to improve traceability in pg_stat_activity.

Resolved Issues

Customer Ticket Id Details
59543 Fixed a stability issue that caused Neo4j to crash when generating the "Relation between transaction and datasources" report for certain applications.
59682 Fixed an import failure that occurred during the remodeling of Cobol Data/File Link nodes. The process is now more memory-efficient, preventing "transaction limit reached" errors on large datasets.
59719 Resolved a bug where rotating Neo4j passwords would break the App-to-App dependency view. The system now handles password updates more gracefully without triggering authentication errors in the UI.
59760 Fixed a regression where "Redirect" type links between applications weren't being created. These links are now correctly generated during analysis, matching the behavior seen in previous versions.
59852 When looking at a single object's interactions, users will no longer be overwhelmed by the entire application's dependency map. The view now correctly filters to show only the relevant interactions.
59538 When viewing the source code for a Cobol Program, the main program code is now displayed first. Previously, copybooks might appear first, making it tedious to find the actual program logic.
59675 Adjusted the color gradients for Imaging nodes to make them easier to differentiate, especially on laptop displays where the blue shades previously looked too similar.
59741 Fixed a scenario where the App-to-App link generation process could get stuck or aborted during complex queries.
59826 To prevent performance degradation, we've improved the guardrails for global Cypher searches. Users will now see a clear "query not supported" message instead of a generic error page when a query is too broad.
59847 The "Relation between Objects and Datasources" report now correctly reflects KB updates. Previously, deleted links were still showing up in the report; this has been fixed to ensure your reports match the latest snapshot data.
59165 Addressed a security vulnerability where a debug utility (/static/default.html) in the dashboards service allowed unauthenticated access to application metadata and database schemas. This utility has been secured, and the REST API now correctly validates authentication tokens, returning a 401 Unauthorized for unauthenticated requests.
59893 Fixed an issue where the "App to App" dependency icon wouldn't appear when objects were added via the "Add dependencies" option. The system now correctly retrieves the necessary labels to display these icons consistently.
59517 Resolved a security vulnerability where world-writable files were present in CAST Imaging Docker images.
59142 Fixed a broken access control issue that allowed read-only users to download job log packs via the API.
59141 Addressed a security flaw involving a hardcoded auth-service token that enabled cross-realm Keycloak user enumeration.
59140 Corrected an Insecure Direct Object Reference (IDOR) vulnerability that allowed unauthorized modification or exposure of user notification preferences.
59713 Fixed a display issue in the Console GUI where the .ctl file extension was missing despite successful analysis.
59679 Resolved an issue where the Imaging Viewer page failed to load and incorrectly redirected users back to the Console page.
59595 Addressed a Whitelabel error encountered when accessing the CAST Imaging console.
59444 Documented a mandatory 90-day cyclic credential rotation procedure for service accounts.
59146 Fixed a security vulnerability that allowed unauthenticated modification of user emails via the Keycloak API endpoint.
59144 Resolved a broken access control issue where administrative features were accessible to low-privilege users.
59600 Fixed an issue where the Reference Finder was non-functional for Assembler components.
59615 Resolved a configuration issue where the K8 Extend URL was being overwritten during redeployment.
59392 Enhanced user account lifecycle management and identification capabilities for Keycloak integrations.
59145 Addressed failures caused by duplicate and concurrent measurement upload attempts. A new scheduler in the Admin Center manages the queue, executing pending jobs one at a time. Applies to computing flaws, removing snapshots, publishing snapshots, and removing applications. Note that the measurement schema is still automatically created by the first task if not already present.

Known Issues

Internal Id Details
IMAGKSL-5884 Imaging Control Panel fails to access shared folders mapped to a network drive, causing Import/Export failures and disabling audit trail/telemetry features; use UNC paths as a workaround.
IMAGKSL-5979 In specific scenarios, re-executing an application analysis after removing source code exclusions or tests filters may result in the application incorrectly reporting a "No Code" status. If this occurs, the user must perform a new scan to ensure that the application size is reported correctly.

Bug Fixes

Details
Fixed container network subnets (Linux via Docker/Podman) > CAST Imaging container networks now use fixed subnets: 172.20.238.0/24 for "imaging-services", "analysis-node" and "dashboards", plus the existing 172.22.238.0/28 and 172.22.239.0/28 for "imaging-viewer". Check these ranges are free on each host before installing or updating, otherwise the containers will fail to start. See Software requirements and In-place component update.
Removed the unnecessary 'noexec' mount check for INSTALL_DIR during Linux system prechecks.
A CAST Highlight token issued by CAST Highlight 6.0 can now be saved in the CAST Highlight Settings. These tokens are generated with Keycloak and are significantly longer than those issued by earlier releases of CAST Highlight, so saving one previously failed with a value too long for type character varying(255) database error and the analysis of any application relying on the token failed. A token of up to 1024 characters is now accepted. See the documentation.
The file extension lists in the analysis configuration options are now aligned with the extensions supported by the installed discoverers. Previously the lists held only a subset, so files processed during the initial analysis (for example .ec, .sqc and .pgc for C/C++, .cbl38 and .sqlcbl for Cobol, .ctl for JCL, .fxml for XML) were dropped from subsequent analyses of the same unchanged source code. See the documentation.
Fixed an issue where changes to file extensions were not correctly applied during configuration.
Resolved inconsistencies in file extension lists between DMT and CMS to ensure correct packaging behavior.
Fixed a PSQL error ("value too long") that caused highlight settings updates and analysis to fail.
Added support for the file extensions mechanism within J2EE technology.
Fixed a cross-platform import crash caused by incorrect deployment folder path concatenation between Windows and Linux.
Resolved analysis failures after Windows-to-Linux imports caused by missing or unsupported extensions in the Linux environment.
Optimized cross-platform application imports to prevent anomalous 3x increases in application size compared to fresh onboarding.
Fixed analysis failures for applications following cross-platform imports due to missing quality standards extensions.
Addressed an issue where analysis completed with zero files analyzed across all technologies on Windows.
Fixed a failure when importing imaging viewer data into Podman environments.
Added a new filter for the 'Migration in progress' status to improve tracking visibility.
Resolved a content discovery failure on Windows for applications with names ending in a period.
Fixed an issue where saving Extend server settings resulted in the loss of the API key.
Resolved a viewer accessibility issue for applications with names containing underscores and spaces.
Fixed analysis failures following imports where the target instance database name differed from 'postgres'.
Enforced Postgres version compatibility checks between export and import processes.
Added administrative notifications when a user account is enabled or disabled.
Resolved a 401 Unauthorized error when updating snapshot dataflows via the Dashboards REST API.
Fixed a security vulnerability where global imaging resource permission checks bypassed role validation.

3.6.6-funcrel

Note

  • An in-place update from previous 3.x releases is supported for Linux via Docker installations - see the documentation.

Components included in this release:

  • Embedded CAST Imaging Core release: 8.4.11 with internal analysis engine 3.2.3-funcrel.

Feature Improvements

Summary Details
Technical > Keycloak service account password is now randomly generated A fresh installation now generates a random password for the Keycloak "admin" internal service account instead of using the default "admin". Applies to Linux via Docker/Podman and Kubernetes deployments. On Linux via Docker/Podman the generated value is written to <INSTALL_DIR>/installation/imaging-services/.env. Microsoft Windows deployments are unchanged: the password remains "admin".
Results > Improved "Explain with AI" workflow Updated the "Explain with AI" feature to improve the user experience when requesting detailed explanations. Once a user selects the "Get More Detailed Explanation" option for an object, the button is now hidden to prevent redundant requests. The "Save as Post-it" action remains available for users to capture the generated explanation.
Results > Improved Tag discovery Added a new Tag option to the "Show Details" right click contextual menu. Selecting this option now opens the "Filter By" panel directly on the tag list, allowing for faster navigation and better discoverability of tags. See all the documentation.
Technical > Claude AI support in AI Settings CAST Imaging now supports Claude AI as a provider for "built-in" AI related features (e.g. Generate AI Summary, CAST Imaging Assistant chatbot etc.). Users can enable AI features by configuring the required API key and Model Name in the AI settings page, see the documentation.
Technical > Updates to Export/Import API The following updates have been introduced: 1)URL Path Change: The database field is removed from the request body; the domain must now be specified in the URL path (/domains/{domainName}/), 2)New Upload Endpoint: Added POST …/import/upload for direct ZIP archive uploads, 3) Export Response: Now includes the zipPath required for downloads. Note that users will need to update all integration endpoints to the new path-based format. See the documentation.
Results > Improved "Explain with AI" workflow for "Save as Post-it" This update improves the efficiency of saving AI-generated explanations by consolidating the "Save as Post-it" process into a single action. Previously, users had to manually confirm the save within the Post-it editor after selection; now, the Post-it is created and saved immediately upon clicking the option.
Analysis Configuration > Maven Dependency Settings This update introduces new extraction settings for the com.castsoftware.jee-mavenhttp extension, enabling the configuration of extraction parameters directly within the UI. These settings (previously hidden) can now be defined at both the global and application levels, with CAST Imaging automatically applying the values to the extension configuration for versions 4.1 and 4.2. See the global settings documentation and the application level documentation.
Installation > Prechecks The installer now validates the target environment before making any change to the machine. Checks cover the operating system and CPU architecture, required software and CLI tools, the container engine (Linux), filesystem rights, hardware resources, port availability, and reachability of CAST Extend, the Control Panel, Docker Hub and the default Maven repositories. The checks run automatically each time the installer is launched and cannot be skipped. Results are grouped by area and reported as `OK`, `WARN` or a blocking failure, each with a remediation hint. A blocking failure stops the installation before anything is changed; a warning allows it to continue. See Installation prechecks.
Documentation > Keycloak accounts and passwords explanation A dedicated page explaining each account provided with a CAST Imaging installation - the "kcadmin" Keycloak UI account, the "admin" internal service account, and CAST Imaging local users - what each is for, and the correct procedure for changing each password on every deployment type. Includes troubleshooting for the Whitelabel Error Page that follows an incorrect service account password change. See the documentation.
Results > GraphRAG Generation is now document-first: the knowledge graph is built from the application's active documents - Transaction and Data Call Graph AI summaries, the functional-purpose documents and source code for the objects in those views, and user post-its. In addition, the LLM and embedding providers are now configured separately in "AI Settings" and may differ. Reruns are incremental, and the GraphRAG tab now shows run history, AI token consumption and downloadable run logs. Querying requires MCP Server 3.1.0-beta3. See Query your application with GraphRAG.
Technical > Export and import an application between environments You can now move a complete application from one CAST Imaging environment to another from the UI. Use the "Exports "section in "View Details" (Admin option) to export an application, then Add an application > Import an exported application in the target environment to import it. Unlike an imported application view, which contains analysis results only, the imported application retains its analysis configuration and can be re-scanned. The export packages the application's delivery folder and schemas, results, Architecture Models, extensions, and configuration into a single .imagingexport file. Both environments must run 3.6.6-funcrel, and Windows and Docker deployments are supported in any combination. Podman and Kubernetes deployments, applications delivered from a source folder location, and automation via API or CLI are not supported. See the documentation.
Technical > Support for OAuth authentication for AI-aware clients using MCP servers AI-aware clients can now authenticate to the CAST Imaging and CAST Gatekeeper MCP Servers using OAuth. Claude Code and Visual Studio Code sign in through the browser against Keycloak, so no CAST Imaging API key is held in the client configuration, and downstream API calls carry the permissions of the signed-in user. API key authentication remains supported and unchanged. See Authenticate MCP clients with OAuth.
Admin UI > Domain filtering A new "no domain" filter has been added to the application list, allowing users to easily identify and manage unassigned applications.
Technical > AI Settings - GraphRAG configuration The "AI Settings" panel now includes GraphRAG in the "AI Features" section, together with the embedding configuration it requires. In addition to the primary AI provider used by all AI features, GraphRAG needs an embedding model to create the semantic representations that make the knowledge graph searchable. Once the primary AI provider is configured, you can either: use the primary AI provider and select an embedding model, where that provider supports embedding generation, or use a different AI provider specifically for GraphRAG embeddings, supplying its own credentials. OpenAI, Google Gemini and Ollama AI are supported for embedding generation. Note that embeddings are specific to the provider and model that created them - after changing either, rerun the GraphRAG pipeline before using semantic search again. See AI Settings.
Documentation > Disabling the Neo4j usage data report Documented how to disable Neo4j's Usage Data Collector (dbms.usage_report.enabled), which is enabled by default, on Windows and on Linux via Docker/Podman. On Windows your setting is preserved across updates. See Disabling the Neo4j usage data report.
Results > Custom aggregations: define and validate your target architecture When creating a custom aggregation you can now choose between two modes. Map the real architecture behaves as in previous releases: CAST Imaging computes and draws the actual dependencies between your custom nodes. The new "Define & validate your target architecture" mode draws no links for you - instead you add the authorization links your design allows, then click Validate Aggregation to compare that design against the code. Links that comply are shown in green as Allowed, links that break a rule are shown in red as Violation and grouped as escalated links; both can be ungrouped or drilled down. Shared links are excluded from the checks. An aggregation in this mode cannot be published until it has been validated. See the documentation.
Results > Filter third-party components by CVE severity The Third party components screen has a new Severity filter. Select one or more of Critical, High, Medium, Low or Advisories to list only the components carrying CVEs at those levels. It combines with the existing Technical roles filter and the Exclude unused components toggle. See the documentation.

Other Updates

Internal Id Details
IMAGKSL-5521 The Windows installer console output has been polished for a cleaner and more professional installation experience.

Resolved Issues

Customer Ticket Id Details
59319 Internal service-to-service communication is decoupled from public hostnames to support Kubernetes deployments with strict egress policies.
59091 A pre-flight port availability check is added to the Docker installer to prevent failed installations and inconsistent states.
58931 Added new Imaging API endpoints to allow users to download standard reports directly.
58922 Fixed inconsistencies in application import results and historical timeline displays when multiple instances of the same application exist.
58996 Resolved a failure in generating Imaging views for specific applications by addressing underlying database memory transaction issues.
59213 Fixed a bug where ignored Data Link Managers (DLMs) continued to appear in Imaging Viewer despite being excluded from the export.
59298 Resolved performance issues and errors when loading or displaying saved views in Imaging.
59405 Fixed an issue where the GraphRAG pipeline failed silently on AI provider rate-limit exhaustion; the UI now provides appropriate signals for quota issues.
59427 Fixed a JavaScript error (TypeError) that caused a blank page when navigating categories in the Green tab after a browser refresh.
59245 Addressed identified vulnerabilities in the 3.6.5 release of Dashboards for Linux Podman environments.
59468 Remediated critical, high, and medium vulnerabilities in Dashboards 3.6.5 Linux container images to meet deployment security requirements.
59453 Data access through the MCP Server is now strictly blocked immediately upon license expiration to ensure compliance.
59309 Fixes an issue where the App-To-App dependencies view was incorrectly restricted to only owned applications for non admin users.
59355 Application deletion logic is optimized to handle large number of applications without buffering errors.
59287 Log4j is upgraded to version 2.25.4 in the Analysis Node to ensure SSL hostname verification is correctly enforced.
38831 OpenID Connect issuer registration is restricted to trusted, predefined sources to prevent unauthorized access via spoofed providers.
38834 Strict path validation and canonicalization are implemented across onboarding endpoints to protect sensitive system files.
38841 Absolute path prefixes are disabled in server-folder operations to eliminate unrestricted filesystem browsing.
58892 Spring-related vulnerabilities in the Imaging Console components are patched to address security risks in Windows environments.
59245 Core dependencies including Spring Framework, Tomcat, and ActiveMQ are updated to resolve multiple high-severity vulnerabilities.
58892 Updated OpenSSL to version 3.6.3 to address newly identified vulnerabilities in the Windows OS environment.

Known Issues

Internal Id Details
IMAGKSL-5737 After Importing an exported applicatuin , users are unable to download detailed reports from the Reports section on the overview page because the report files are stored in a folder that is not yet included in the export process..
IMAGKSL-5712 Postgres version should be compatible between export and import. Import an application export may fail Postgres between the source and destination are not compatible, as the system currently lacks a compatibility check or warning for users.
IMAGKSL-5672 [Windows]Content discovery fails if application name has '.' at the end.
IMAGKSL-5586 When report contains analyzed files that are not displayed (other than programming and markup languages), the workflow is not stopped.

Bug Fixes

Details
Special characters in a customized Keycloak service account password are now handled correctly during an update: where the admin service account password had been changed through the Keycloak UI and contained special characters, the update process could fail to read it. Passwords enclosed entirely in quotation marks, containing a blank space followed by a hash, or containing backslashes or forward slashes are still not supported.
The kcadmin Keycloak UI login account is now created on updated installations: on installations updated from 3.5.9-funcrel to any release from 3.6.0-funcrel to 3.6.5-funcrel, the init.sh file that creates the kcadmin account was created as a directory rather than a file, so the account was never created. Updating to 3.6.6-funcrel recreates it correctly and creates the account.
Syntax highlighting for COBOL source files is restored in the Source Code Viewer for better readability.
Global configuration now allows adding DLM files even when no analysis nodes are currently available.
The application outcome display is updated to show the latest fast scan progress instead of being stuck on previous rename actions.
CORS configuration in the auth-service is hardened by replacing wildcard patterns with explicit gateway hostnames to prevent unauthorized cross-origin requests.
The Keycloak initialization script is improved to correctly handle special characters in environment variables, ensuring robust automated setup.
Analysis now stops and alerts the user if zero objects are analyzed, preventing "silent success" when technologies are unsupported or extensions are missing.
The onboarding process is now more resilient to interruptions, allowing users to re-upload and scan the same source without errors.
View details for named applications now correctly display Backups, Database Schemas, and Node sections even without a P1 license.
Gateway configuration is updated to ensure the console remains reachable after enabling SSL certificates.

3.6.5-funcrel

Note

  • An in-place update from previous 3.x releases is supported for Linux via Docker installations - see the documentation.

Components included in this release:

  • Embedded CAST Imaging Core release: 8.4.11 with internal analysis engine 3.2.3-funcrel.

New Features

Summary Details
Technical > GraphRAG knowledge graph generation GraphRAG is a new AI capability, included and enabled by default in this release. Via the GraphRAG tab under "Customize the results" you can run a pipeline that builds a semantic knowledge graph of the application - embeddings of source code and generated content, extracted relationships, and optional entity-topic clustering - stored in the Neo4j database. Generation uses the AI provider configured in Admin → AI Settings. Once generated, the knowledge graph can be queried with natural-language, business-oriented questions through the CAST Imaging MCP Server. See Query your application with GraphRAG. Note: querying GraphRAG requires CAST Imaging MCP Server 3.1.0-beta1 or above. In addition, GraphRAG runs as a new service for both Microsoft Windows (CAST Imaging GraphRAG Server) and Docker/Podman (embedded in the existing "open_ai_manager" container) on port 8286.

Feature Improvements

Summary Details
UI results > Post-it improvements Post-Its open on the canvas: Clicking a Post-It badge, or choosing "Show details > Post-it" from the context menu, now opens the note directly on the canvas in addition to the right panel.
Installation > Mandatory admin password change To align with security best practices (STIG, CIS, OWASP), CAST Imaging no longer allows the default admin/admin credentials to remain active after a fresh installation. On first login, the administrator is redirected to a mandatory password-change screen and must then complete their user profile (first name, last name, and email address) before accessing the platform. This applies to all installation methods.
Installation > Windows installer logging The Windows installer now timestamps its console output and saves it to a log file at %PROGRAMDATA%\CAST\CAST\.install, using the naming convention YYYYMMDDHHmm_cast-imaging-[install|update|remove].log, making installation issues easier to diagnose.
New documentation - trusting custom or self-signed certificates on Docker/Podman Added a guide covering how to build a Java trust store from the hardened image, import an internal or self-signed certificate, and mount it into the Imaging Services and Analysis Node containers so CAST Imaging trusts internal CAs for repositories, proxies, SSO, and Extend - see the documentation.
Dashboard Action Plan > Enable controlled violation exclusion via Exclusion Manager flag Action Plan Exclusion allows users to mark certain action plan items, so they are not included in quality calculations. Any authorized user can request an exclusion, and an Exclusion Manager will review and either approve or reject it. See the documentation.
Dashboard > Support for OWASP 2025 and CWE Top 25 2025 reports The dashboard now supports OWASP 2025 and CWE Top 25 2025 reports.

Other Updates

Internal Id Details
IMAGKSL-5495 Upgraded Keycloak to version 26.6.4.

Resolved Issues

Customer Ticket Id Details
58895 In rootless Podman deployments with an HTTPS reverse proxy (nginx) used for HTTPS requirements, the SSO-Service (Keycloak) now correctly records the originating client IP address in authentication and security event logs. Previously, all events showed the internal Podman container network gateway IP (e.g. 10.89.0.1) instead of the real client IP, limiting the usefulness of logs for audit and forensic analysis. Note: This fix applies only to HTTPS environments with a trusted reverse proxy in front of the SSO-Service. It must not be enabled in non-HTTPS or no-proxy configurations, as doing so could allow callers to spoof X-Forwarded-* headers.
58869 Fixed an import failure at the "Link object property with rules" step caused by Neo4j exceeding the dbms.memory.transaction.total.max threshold during Advisor rule creation.
59034 Fixed an issue where table columns were not marked as sensitive data in the Imaging Viewer when the Data Column Access extension was applied - sensitive tables were displayed but column-level sensitivity information was missing from the additional details section.
56618 Fixed an issue where application log files remained blank during and after analysis completion.
58796 Fixed an issue where Extend proxy/configuration was not applied after machine reboot or analysis-node container restart until settings were manually re-saved.
58793 Fixed an issue where user role assignments were randomly reset.
58786 Fixed an error thrown when using the –exclusion-templates parameter. Now a message is displayed in the pop up window when wrong pattern is entered. ("The value assigned is not valid" on ignorePatterns).
58885 Fixed the Artifacts page not loading data inside the Size indicator in the Management Dashboard.
59130 Fixed an issue preventing the email notifications.

Known Issues

Internal Id Details
IMAGKSL-5533 When upgrading from 3.6.0-funcrel, the "admin" user may lose access to "imaging-viewer" for applications created by other users. A SQL workaround is available as detailed in Known Issues.

Bug Fixes

Details
Fixed Keycloak default language changes not being found after upgrading from 3.6.3 to 3.6.4.
Fixed a NullPointerException in getSnapshotReport that prevented data from being sent to Extend.
Fixed SSO failing to start on Linux when DB_DATABASE is not set to "postgres" and the database name contains a hyphen. Use only lowercase letters (a-z), numbers (0-9), and underscores (_) for the database names.
Fixed a regression where the renaming job displayed an incorrect node in logs and progress.
Fixed a regression where database/node selection was lost when requesting an advanced analysis.
Fixed a security issue where JWT tokens were parsed without signature verification in RefreshTokenServiceImpl.
Fixed a regression where the status of an imported application incorrectly showed "Ready to View" during import.
Fixed domain renaming allowing empty or duplicate names.
Fixed the NET Assemblies label being truncated in Global Configuration when the options list exceeds one page.

3.6.4-funcrel

Note

  • An in-place update from previous 3.x releases is supported for Linux via Docker installations - see the documentation.

Components included in this release:

  • Embedded CAST Imaging Core release: 8.4.10 with internal analysis engine 3.1.26-funcrel.

New Features

Summary Details
Installation > Neo4j dedicated machine installation Added support for deploying Neo4j on a dedicated separate instance using split-mode installation flags (–neo4j and –viewer <neo4j-host>) in the Linux installer scripts (Docker and Podman). See the documentation for Docker and Podman.
UI > New "Filter by" panel in the right sidebar The right panel now includes a dedicated "Filter by" section, providing a clearer and more organised way to filter objects in a view. As part of this change, "Tags" have been reorganised into the new section - Custom tags are displayed under "Tags", while property-based tags (e.g., Modules, Services) are now shown as distinct, separate filter sections, resolving previous inconsistencies between custom tags and property tags. In addition, "Technical roles" (previously under "Object and links in view") are now grouped within the "Filter by" section. The same improvements apply to the A2A view, surfacing Application Object properties and Technologies alongside Tags. See the documentation
Technical > Support OAuth 2.0 Configuration in AI Settings The AI Settings page now supports OAuth 2.0 as an authentication method in addition to the existing API Key authetnication method. Administrators can configure an OAuth Gateway provider by specifying the token URL, client credentials, scopes, endpoint URL, and custom headers. A "Reset Configuration" option has also been added. If an API Key or OAuth configuration is already saved, resetting triggers a confirmation dialog before deleting the stored credentials; otherwise it simply clears the local form state. See the documentation.
UI > Japanese Language Support (i18n/L10n) CAST Imaging now provides full Japanese language support across the entire product (front-end, administration, results consultation). Japanese-speaking users can navigate the entire onboarding and analysis workflow in their native language, including UI labels, menus, notifications, and configuration screens. Japanese can be enabled per-user via the "Preferred Language" menu option within the "Profile" settings see the documentation. Note that CAST Imaging will also detect Japanese language set in the browser (or via system defaults) and will display the CAST Imaging login page in Japanese (on login, users will still need to manually set the preferred language).

Feature Improvements

Summary Details
Installation > Support for changing the cast-imaging-db-data volume mapping path (Docker/Podman) It is now possible to modify the default "install_dir" path used for the "cast-imaging-db-data" volume mapping in the Docker Compose configuration as part of a fresh installation of CAST Imaging via the CAST_IMAGING_DB_DATA_VOLUME_PATH variable in the "configuration.conf" file. This allows database storage (when using the embedded PostgreSQL instance) to be redirected to a different path for infrastructure or compliance reasons. See the documentation.
Technical > Refactor Neo4j data migration tool Internal Neo4j data migration tool rewritten in Go - now a single self-contained binary with versioned, resumable migrations and no Python dependency.
UI > Consistent user menu across all pages in "viewer" The user menu in the "viewer" results pages now displays a unified set of options regardless of which section the user is viewing. Previously, the menu showed different options depending on whether the user was on a viewer page (Overview, Config) or an admin page. All required menu options are now available consistently across all sections of the application.
UI > Visual Grouping for drill-down on Links in custom aggregation Introduced multi-level grouping(visual grouping) when drilling down on links between aggregated nodes: CAST Imaging will now visually group resulting objects to show which aggregated node they belong to. See the documentation.
Windows install/update > Improved password handling for Windows services The installer now uses system-based encryption for Windows service user/password credentials - passwords are now prompted for during installation or update, temporarily encrypted, used, then cleaned up. This change applies to the XXX_START_AS_USER and XXX_START_AS_PASSWORD variables defined in the installation .conf file: the value of XXX_START_AS_PASSWORD variables is always ignored and the installer will prompt for a password whenever XXX_START_AS_PASSWORD is defined. This improves security and also means that passwords with special characters ($, !, @, etc.) no longer cause service creation failures during install or update. See the documentation.
Technical > Snapshot Strategy maintenance scheduling now uses UTC time zone The maintenance scheduling feature in the Global Configuration Settings (Snapshot Strategy section) now exclusively uses UTC time. This change eliminates inconsistencies that could arise from time zone differences - all scheduled maintenance windows are now interpreted and executed in UTC. See the documentation.
Technical > Improved Action Menu behaviour during in-progress jobs When a job is in progress on an application, users can now open the application "action" menu and perform actions that are independent of the running job - such as "View Details" and "Change Domain". Actions that are blocked by the in-progress job are disabled, and hovering over them displays a tooltip: "Action is blocked as application is in progress."
Technical > "blackbox" files relocated to shared storage Blackbox files (.blackbox.xml) are now stored in a shared folder ("common-data/dataflow/&lt;appGuid&gt;/blackbox") instead of in a folder located on the "analysis-node". This ensures that CAST Imaging can access blackbox configuration files independently, without requiring the "analysis-node" to be running and to ensure that changing an "analysis-node" for a given application does not "lose" the blackbox" files. Note that if you are updating to 3.6.4-funcrel or above and you have existing blackbox files configured for your application, you must re-upload all the .blackbox.xml files using the Security Dataflow interface described in the documentation(../../../interface/analysis-config/security-dataflow/) - existing files will not be taken into account during a new analysis post update.
Technical > Snapshot Strategy maintenance scheduling now available without an "analysis-node" The Snapshot Strategy maintenance scheduling options (see the documentation available to administrators are now accessible even when the "analysis-node" is not available or has not been installed (read-only installation).
Technical > AI support for Google Gemini CAST Imaging now supports Google Gemini as a configurable AI provider. Users can configure Gemini in the AI settings page by providing an API Key and Model Name (both required fields) to enable Gemini for AI features within CAST Imaging. See the documentation.
UI (viewer) > Post-It use in custom aggregations Introduced enhanced Post-It behavior in custom aggregations: it is now possible to add Post-Its to aggregated nodes, have those Post-Its persist after saving, use them in search and filter options where applicable and access Post-Its options from the custom aggregation toolbar. Note that Post-Its on custom nodes are searchable only once the custom aggregation is published. See the documentation.
Results viewer > URL route improvements URLs across CAST Imaging views are now consistently lowercase and hyphen-separated, stale route names have been updated (e.g. "Componentupgrades" > "third-party-components"), and redundant URL segments have been removed.
Results > History & Compare > Direct linking via URL You can now open a specific historical state (date parameter) or comparison state (from/to parameters) of an application directly from the view URL, without selecting dates manually. Values use UTC ISO 8601 timestamps and must be URL-encoded (e.g. : as %3A). See the Compare and History documentation.
UI > Alert improvements Added an alert notification when a PostgreSQL database connection becomes unavailable.

Other Updates

Internal Id Details
IMAGKSL-4787 Settings/ Configuration/ Snapshot retention strategy configuration is accessible even when node is down
IMAGKSL-4598 Dataflow blackboxes are stored in shared folder and are available for any nodes, user need to add again its blackbox in the security configuration
IMAGKSL-4633 Added warnings and disabled database-dependent actions in Dashboard Standalone mode when a tenant's database connection is unavailable.
IMAGKSL-4620 Allowed admin users to access job-independent menu items (e.g., View Details) on applications in Admin Center even while a job is running.
IMAGKSL-4625 Improved import application performance by avoiding unnecessary calls to the all-applications API.

Resolved Issues

Customer Ticket Id Details
58516 Fixed App2App dependency link generation failing with exit status 1 after onboarding new applications, which also caused previously generated links to be deleted.
58330 Fixed saved views failing to load due to gateway timeout, where query_timeout changes in .env were not being applied.
58125 Removed unexpected and duplicate columns (Object Full Name, Object File Name) from the module Excel report export.
58085 Improved application deletion performance, which previously took significantly longer than importing (e.g. 12 hours vs 2 hours).
57899 Fixed call link bookmarks in the source code viewer being displayed in random order instead of ascending line number.
57868 Fixed App-to-App link generation failure after upgrade caused by a SQL UNIQUE constraint violation.
57425 Fixed SVG report export failing to zoom in correctly, where nodes appeared oversized and content was unreadable.
58655 Fixed missing Transactions, Modules, and Data Call Graphs in the "Associated To" section for SQL Server Table Column objects.
56985 Fixed incorrect taxonomy classification where DAO interfaces inheriting from JpaRepository were inconsistently typed as "Java Class DAO" instead of "Java Interface".
58654 Fixed SQL Server Table Column objects not being visible when opening saved views.
58646 Fixed search filter by name not working for SQL Server Table Column objects.
58650 Fixed impact analysis (Call hierarchy) being unavailable for SQL Server Table Column objects due to missing Graph navigation menu.
58645 Fixed reports still including deleted objects from a previous version due to stale cached report files being served instead of regenerated ones.
58492 Fixed tags not being searchable for SQL Server Table Column objects.
58335 Added OWASP 2025 and CWE Top 25 2025 to dashboard reports.
58368 Documented dashboard domain changes in V3 where AAD is renamed to AAD_Default after upgrade.
58730 Fixed intermittent failure when uploading a large application zip in the Imaging due to a multipart request timeout.
58483 Fixed multiple issues in Windows update batch scripts including help instructions, syntax errors, incorrect script references, typos, and variable corruption.
58610 Fixed security data flow results not being displayed in the Console front-end despite a successful data flow analysis.
58355 Fixed security data flow results not being displayed in the Console front-end despite a successful data flow analysis.
58299 Fixed incorrect help instructions across Imaging update scripts, including wrong script names, misleading terminology, and garbled messages.
57890 Fixed the Analysis Report incorrectly flagging .py, .js, and .ts files as “Not Analyzed” despite successful parsing.
58204 Fixed the “.NET Project and Resources Discoverers” extension not being installed automatically when the code scanner detects required plugins.
58527 Fixed upgrade from v3.5.7 to v3.6.2 failing with an SSO detection error despite an existing SSO installation.
58446 Fixed upgrade from Imaging Console 3.4.1 to 3.6.2 failing with a “schema keycloak does not exist” error due to database naming mismatch.
58245 Fixed analysis failure caused by adding an unsupported or incompatible extension in V3.
58174 Fixed license expiry alerts still displaying in the Imaging Console after updating the application license without re-running analysis.
58805 Fixed license expiry alerts still displaying in the Imaging Console after updating the application license without re-running analysis.
57949 Fixed Security Data Flow for JEE not being automatically enabled in V3 after migration from V2.
56043 Fixed updated source path in Global Configuration not being reflected during rescan of migrated applications. When changing the source folder location, user should run a new scan on the application before analysing
50373 Fixed source code extraction failing when file names contain French special characters.
54762 Fixed inability to set priority/execution order for KB Tools in the Imaging Console. KB Update tool order is maintained with the order of creation.
58605 Fixed analysis units not loading in the config tab for .NET applications migrated from V2 to V3.
58596 Fixed capacity and throughput bottleneck during parallel scan processing caused by PostgreSQL connection saturation at scale. The number of connections are now optimized.
58235 Fixed spurious I/O error messages in the analysis-node logs caused by intermittent timeouts when fetching Extend Proxy settings during routine health checks.
58499 [PB]Imaging cypher search : bad management of malformed cypher queries, time lost for the user
58338 [PB]Clarification Required on Imaging Audit Logs - V3

Known Issues

Internal Id Details
IMAGKSL-5384 DLM file upload in global configuration fails when no node has been started, because the required upload/dlm folders are only created at first node startup.
IMAGKSL-5369 On Linux multi-node environments, the selected node reverts to “any” when analysis starts, causing the job to run on a different node than chosen.
IMAGKSL-5364 Database and node selections are reset in the UI when switching to advanced analysis mode.
IMAGSYS-24606 User language preference set in one browser is not applied when opening the Viewer in a different browser; the /user API locale is not fetched by the Viewer.
IMAGKSL-5348 On Linux, SSO service fails to start with an authentication error when DB_DATABASE contains a hyphen; workaround is to set DB_DATABASE=postgres.
IMAGKSL-5347 Upgrading from a previous release does not automatically add the default languages (English/Japanese) in Keycloak, unlike a fresh installation. A workaround exists: log in to the Keycloak authenticataion system and within the "aip-realm" choose "Realm Settings" > "Localization" and add both English and Japanese into the "Supported locales" field.
IMAGSYS-24609 When importing an application, the status briefly shows “Ready to View” instead of “In Progress” for the first few seconds.

Bug Fixes

Details
Fixed NuGet extractor failing on Linux due to an incompatible nuget CLI wrapper in the Docker image.
Fixed Highlight analysis failing on Debian 13 hardened analysis node due to a missing Perl XML::LibXML library.
Fixed analysis findings not being displayed for JEE data flow sources on Linux despite a successful deep analysis.
Fixed PL/1 discovery incorrectly generating multiple analysis units instead of a single one for mixed PL/I and PLC source deliveries.
Fixed the "Use Source File Name" mainframe option not being correctly persisted due to a wrong API property name.
Fixed Extend proxy settings being lost after the initial configuration wizard on a fresh install, causing the first scan to fail.
Fixed "Exclude Files" step failing on Windows due to the missing 7za.exe utility in the 8.4.10 package.
Fixed update and fresh install failing to create the Windows service when the service user password contains special characters.
Fixed source code not displayed in DLM config view despite being present in the Viewer.
Fixed one-hour offset when setting the maintenance schedule time.
Fixed analysis node hanging indefinitely on deep analysis submission when the dashboards service is registered in Eureka but not responding.
Fixed update from 3.5.x/3.6.0 failing at the "control-panel-service" step due to a PostgreSQL/Liquibase sequence mismatch.
Fixed analysis node failing with "Malformed input or input contains unmappable characters" when source files contain Chinese characters in their names (in-place analysis).
Fixed SAML authentication failing with a "Cookie not found" error when the Console sits behind a reverse proxy.
Fixed fast scan failing to unzip source archives containing file names with unmappable characters.
Fixed fast scan failing when the uploaded ZIP contains files with special characters (e.g., German umlauts).
Fixed update failing when the Console service is configured with SSL, due to missing secured connection settings in the update script.
Fixed login page not displaying an error message when invalid credentials are entered.
Fixed renaming job logs not being displayed when viewed from the job status page.
Fixed load balancing not distributing onboarding jobs across multiple analysis nodes when nodes share the same host.
Fixed the About page showing the console version instead of the actual analysis node version when only the node is updated.
Disabled application actions (upgrade, rename, delete, optimize) when the associated CSS database connection is unavailable.
Fixed the Windows update script unnecessarily prompting for the CSS password when updating the Viewer or Dashboards packages.
Fixed the Windows update script failing at the Dashboards step due to incorrect command syntax.

3.6.3-funcrel

Note

Components included in this release:

  • Embedded CAST Imaging Core release: 8.4.10 with internal analysis engine 3.1.26-funcrel.

Resolved Issues

Customer Ticket Id Details
58404 A vulnerability scan identified several critical and high-severity CVEs in the "dashboards" component that blocked production deployment due to regulatory requirements. These CVEs have now been resolved via the upgrade of dependencies to patched versions.
58170 Fixed app-to-app exclusion rules not deleting links as expected - when users defined exclusion rules in the app-to-app configuration (e.g. to exclude links where the callee object type matched specific criteria), the rules were not being applied and links that should have been removed were still present after running app-to-app link generation. Exclusion rules now correctly delete matching links during app-to-app processing.
58317 A vulnerability scan identified critical and high-severity CVEs in Tomcat and Netty that blocked production deployment due to regulatory requirements. Fixed critical and high CVEs by upgrading Tomcat to 10.1.55. The Netty 4.1.133.Final upgrade is being addressed by Keycloak.

3.6.2-funcrel

Note

Components included in this release:

  • Embedded CAST Imaging Core release: 8.4.10 with internal analysis engine 3.1.26-funcrel.

Feature Improvements

Summary Details
UI > New application dropdown list A new application dropdown has been added to the header bar, allowing users to quickly switch between onboarded applications without navigating back to the landing page.

Other Updates

Internal Id Details
IMAGKSL-3232 Analysis > The "com.castsoftware.java.internal.grep" extension (see the documentation is now automatically installed for new application onboardings, deactivating legacy grep-based dynamic links to database objects in favor of more accurate Java Persistence links. Existing applications are unaffected by this change.
IMAGSYS-23878 Results > Removed the following obsolete boolean fields from the "viewer" SQL Exporter output: is_dao, is_ws, is_thread, is_richclient, is_mvc_m, is_mvc_c, is_transac_cics, and is_transac_ims. These fields are no longer relevant and this cleanup reduces unnecessary data in the export and simplifies the schema.
IMAGSYS-24140 Results > Fixed an issue where the "Export Objects and Links"feature was not working. The export functionality has been restored and operates correctly.

Resolved Issues

Customer Ticket Id Details
56864 Fixed an issue where the application status incorrectly displayed "Actions Pending" after deleting an old snapshot; the status now only changes to "Actions Pending" when the latest snapshot is deleted. Secondary admin jobs such as backup do not impact the application status on the landing page but can be followed on the settings page.
57283 Fixed an issue where Fast Scan and Deep Analysis failed due to an application management conflict when source code contained only COBOL-related file extensions (.jcl, .prc, .ctl) that were not listed in the analyzer configuration.
57433 Fixed an issue where migrated applications could not be deleted in CAST Imaging V3 when the Viewer component was not installed.
56898 Fixed an issue where the C/C++ analysis unit was not created after migration from V2, causing .cpp files to remain unanalyzed.
56486 Fixed an issue where the Generate View step failed during full workflow execution but succeeded when run independently.
57024 Fixed an issue where resuming a failed analysis via the cog wheel did not correctly set the resume parameter, causing a "Duplicated Package" error instead of properly cleaning up residual data from the previous run.

Known Issues

Internal Id Details
IMAGKSL-4807 After a fresh installation, the first application onboarding may fail with a 403 error and the message 'Unable to perform action, please try again later'. Clicking 'Run Scan' will successfully trigger the scan. This will be fixed in a future release.

Bug Fixes

Details
Fixed an issue in the Job Status log viewer where clicking on a completed step's tab while a job was still running would automatically switch back to the in-progress step, preventing users from reviewing earlier logs during execution. Additionally, the tab section has been redesigned with clearer visual indicators - status icons now show whether each step is completed, in progress, pending, or interrupted, along with corresponding tooltip messages. This makes it much easier to understand overall job progress at a glance while navigating between steps.
Removig some inconsistence job steps labels having capitalization. The job step naming are consistent now.
Fixes an issue where the module option ONE_PER_AU used by console tool CLI was not taken in account.
Fixes an issue where, after migration and upgrading the Imaging Core, the “New Scan” button remained disabled on the Overview page, while the same option was enabled on the Landing page.
Fixes an issue where importing results for an existing viewer-only application failed if the application had been previously renamed.
Fixes an issue where for package wise installation, when using remove batch all console folders were not completely removed.
Fixes an issue on the Landing page where the size was displayed as N_A while importing application results. It now displays .. initially and updates with the correct size indicator once the information becomes available.

3.6.1-funcrel

Note

Components included in this release:

  • Embedded CAST Imaging Core release: 8.4.10 with internal analysis engine 3.1.26-funcrel.

Other Updates

Internal Id Details
IMAGSYS-23852 Resolved three OpenSSL CVEs (1 Critical – CVE-2025-9230, 2 High) in the AI service component by upgrading OpenSSL libraries.
IMAGSYS-23899 Ongoing CVE remediation for all Imaging Viewer components based on scan reports. Addresses known vulnerabilities.
IMAGSYS-23892 Fixed a regression where the Roles feature (role-based filters in global search, third-party components, Characteristics, and transaction search) was non-functional after upgrading to 3.6.0-funcrel. The root cause was build scripts referencing outdated 3.5.0-funcrel PackageReference artifacts; scripts now dynamically resolve the correct artifacts.
IMAGSYS-23897 CAST Imaging Viewer services containers have been migrated to Docker Hardened Images (DHI) - "distroless" base images that eliminate package managers, shells, and root users - to strengthen security posture across all backend services.
IMAGSYS-23915 Upgraded the bundled Neo4j database to version 2026.03.1, picking up the latest fixes and security patches from the upstream graph database.
DASHBOARDS-5532 Addressed known CVEs in the Dashboards identified via scan reports, ensuring all critical and high-severity vulnerabilities are resolved for the 3.6.1-funcrel release.
IMAGKSL-4531 CAST Analysis Node containers have been migrated to Docker Hardened Images (DHI) based on Debian 13 - "distroless" base images that eliminate package managers, shells, and root users - to strengthen security posture across all backend services.
IMAGKSL-4144 CAST Imaging Services containers have been migrated to Docker Hardened Images (DHI) - "distroless" base images that eliminate package managers, shells, and root users - to strengthen security posture across all backend services.
IMAGKSL-4673 Addressed known CVEs (Common Vulnerabilities and Exposures) identified through daily security scans across multiple CAST Imaging backend services. Affected services: SSO Service, Gateway, Auth Service, Control Panel, Console.

Resolved Issues

Customer Ticket Id Details
57967 Fixed an issue where the ETL import would fail during the "Identification of deleted Transaction Links" step with a MemoryPoolOutOfMemoryError from Neo4j. The APOC iterate query could exceed the transaction memory limit on large applications, causing the entire import to abort.
58035 Fixed inconsistencies where the number of callers/references for an object differed between downloaded reports (e.g. Most Referenced Objects) and CSV exports from the Advanced Search UI. Counts are now consistent across all export paths.
57956 Fixed a bug where API key authentication only worked for GET requests against the Dashboard REST APIs (tags, common-categories) but failed for PUT operations, forcing users to fall back to cookie-based authentication. API key authentication now works for both GET and PUT operations.
58032 Fixed: Offline Podman installation fails due to missing container images and documentation gaps.
57532 Fixed: Offline Podman installation fails due to missing container images and documentation gaps.
57529 Fixed: Offline Podman installation fails due to missing container images and documentation gaps.
57801 Fixes the Reference pattern detection missing for Go technology, causing absent links to PostgreSQL databases.

3.6.0-funcrel

Note

Components included in this release:

  • Embedded CAST Imaging Core release: 8.4.10 with internal analysis engine 3.1.26-funcrel.

Shared folder access requirements updated:

The console service (part of "imaging-services") now requires direct read/write access to shared folders (delivery, deploy, common-data) alongside the "analysis-node" component/service. Please verify your deployment. For Kubernetes deployments both services must now share a File Storage (RWX) volume and run with the same container UID. Note that when updating to 3.6.0-funcrel on Kubernetes deployments, a specific migration process for File Storage settings may need to be actioned before the update is run: see Migrate to FileStorage (RWX) for Imaging Kubernetes deployments. See also Software requirements, Disk space requirements and Storage locations.

New Features

Summary Details
Technical > Resume failed "viewer" results import from the last completed step Introduced "viewer" result import checkpoint mechanism that stores the last successfully completed pipeline step and a ZIP content checksum in Neo4j, allowing failed or interrupted import processes to resume instead of restarting from scratch. If a different ZIP is uploaded (checksum mismatch) or the checksum file is missing, the checkpoint is automatically cleared and a full import is run to avoid stale data. A "?force=true" parameter is also available to explicitly clear any existing checkpoint and force a full re-import.
Technical > Audit trail for key application/domain lifecycle events Added an audit trail that records JSON-based events for key application operations (delete, rename, fast scan, deep analysis, and import to Viewer) along with domain operations (create, update, delete, attach), logging who performed the action, when, the result (CREATED/SUCCESS/FAILURE/CANCELED), and application details. Events are written to an audit file with automatic rotation and configurable retention, improving traceability and compliance. See the documentation.
UI (viewer) > Application executive summary report Introduced a new "Application Executive Summary" report in the Reports dialog, offering a concise, executive-level overview of the application. This report complements existing CAST Imaging Discovery and AI Functional reports, providing key insights for stakeholders without requiring navigation through detailed technical sections. Users can access it by opening the Reports dialog and selecting Application Executive Summary. An AI provider API key is required to use this report. See the documentation.
UI > Configure analysis options pre-analysis After onboarding and the initial fast scan, CAST Imaging now lets you adjust key analysis options before running the first full analysis: enable/disable Security Dataflow, choose how modules are created (full content, per technology, or per analysis unit), and configure technology‑specific options for Mainframe, JEE, and C/C++. These options apply only to applications scanned in this release (not applications that were created in previous releases) and currently exclude adding Security Dataflow black boxes or changing ignored file extensions.
UI (viewer) > Guided graph tour to explain graph elements Introduced an in‑app Guided Graph Tour that helps users understand key elements of the application graph. The tour appears as a non‑blocking panel in the bottom‑right of the graph view, launches automatically for first‑time users (and can be reopened from the icon), and walks through nodes (with all seven node sub‑types), direct and indirect links, and node badges (Post‑it, Count, A2A, Start/End Point). Each step highlights the relevant elements on the graph and provides controls to navigate the tour while continuing to interact with the graph. See the documentation.
Technical > Swagger API documentation Added an authenticated Swagger UI for CAST Imaging at "/api-docs/index.html", providing interactive documentation for Public API, Console, and Control Panel endpoints. Users can browse all available APIs and execute requests directly from Swagger (including authenticated calls), ensuring the documentation always reflects the deployed APIs.

Feature Improvements

Summary Details
Technical > neo4j configuration It is now possible to configure Neo4j by adding supported parameters directly to the "imaging-viewer" ".env" file, which are then applied to "neo4j.conf" at container startup. This aligns with Neo4j’s official Docker configuration guidance. See the documentation.
Technical > NO_OF_PARALLEL_JOBS_IN_NODE option Added a NO_OF_PARALLEL_JOBS_IN_NODE option to the installer "configuration.conf" file to control how many jobs run in parallel per "analysis-node". See the install variable documentation or Configure parallel analyses.
Technical > Separate Keycloak admin login and service account Introduced a dedicated Keycloak UI admin user "kcadmin" (can be customized during a fresh install using a KEYCLOAK_LOGIN_ADMIN_USER variable) with a forced password change on first UI login, while keeping the existing "admin" account as an internal service account only. Also added configuration to customize the Keycloak "admin" service account password during a fresh install via a KEYCLOAK_SERVICE_ACCOUNT_PASSWORD variable (available in the installation configuration.conf file) improving security and avoiding default-credential usage. See the documentation.
Technical > Use external PostgreSQL instance during installation It is now possible to configure a "from scratch" installation to use your own PostgreSQL instance (and not use the PostgreSQL instance provided by CAST) via the ""DB_MODE (embedded &#124; external) variable and related parameters ("DB_HOST", "DB_PORT", "DB_NAME", "DB_USER", "DB_PASSWORD", "DB_ENCRYPTED_PASSWORD", "DB_DATABASE") available in the "configuration.conf" file. In embedded mode, CAST Imaging manages a local PostgreSQL container (with configurable settings except "DB_HOST"), while in external mode users must supply full connection details. See the installation variables.
Technical > Change to Keycloak data handling in installer Keycloak database handling has been updated: new installs now use a dedicated "keycloak" schema within the "postgres" or other custom database (in previous releases a "keycloak_v3" database was created with required tables stored in the "public" schema). Updates to this release and any future release from a previous 3.x release preserve the existing Keycloak related database. See database requirements and installation variables.
UI (viewer) > Transaction search (start/end point role) New Start Point Role and End Point Role filters for transaction searches have been added, using the same hierarchical parent–child role structure as the CAST Imaging global search. Users can select parent roles (which automatically include all child roles) or individual child roles, and the transaction list will show only transactions whose start or end points are associated with the selected roles. Roles information is available for applications imported with ≥ 3.6.0-funcrel. See the documentation.
UI (viewer) > Role filters for search and other modals A "Role" filter has been added across various features within CAST Imaging (global search modal, third-party components list, Characteristics (right-panel), Application Discovery Report), allowing users to filter results by functional roles (parent and child roles, with multi‑select and parent‑select‑all behavior) so that only objects matching the selected roles are returned. See the global search modal documentation or the Third-party components feature as an example.
UI (viewer) > Characteristics improvements A new Link Category property under "Characteristics" (right-panel) has been added, showing how links are classified as Static, Dynamic, or Remote based on link type and how each category maps to its corresponding sub‑category (for example, "Link Category: Static – inherit"). This is available for application results generated with 3.6.0-funcrel or later.
UI (viewer) > Exclude unused third‑party components A new quick filter has been added to the Third‑Party Components view that hides components detected in the application but not used by any application objects, helping users focus on relevant, actually‑used components. See the documentation.
UI (viewer) > AI generated report The AI generated functional report has been updated to enhance the AI-based Functional Report by providing clearer and more actionable insights. The revised version emphasizes summarization of key application workflows derived from transaction summaries and refines the Inputs/Outputs section to include relevant third-party components. The overall structure and presentation have been aligned with the latest documentation and visualization standards to ensure consistency across modules. See the documentation.
UI (viewer) > Data Sensitivity tiles Added dedicated tiles in the Overview/Welcome page for CAST Sensitive Data, GDPR Sensitive Data, PCI‑DSS Sensitive Data, and Custom Sensitive Data, plus a Sensitivity Level filter (Highly sensitive / Very sensitive / Sensitive) so users can quickly locate and review sensitive tables across their applications. See the documentation.
UI (viewer) > Rename transactions and data call graphs It is now possible to edit and rename Transactions/Data Call Graphs, with changes reflected across the left/right menus and searchable via both original and custom names. See the documentation.
UI (viewer) > Search modal improvements A series of UI/UX improvements have been added in this release to CAST Imaging's search modals used throughout the product, addressing collected user feedback to make searching faster and more intuitive. See example global search documentation.
UI (viewer) > Transaction/Data Call Graph search improvements A new "Transaction Status" column has been added to the Transaction/Data Call Graph search modal, indicating whether each transaction is Added, Modified, or Unchanged compared to the immediately previous analysis, with a multi‑select status filter and support for past analysis dates (for applications imported with ETL ≥ 3.2.0). See the documentation.
UI (analysis configuration) > Use exclusion templates in file filter The File Filter option available in the Analysis Configuration - Overview page now lets users apply predefined exclusion templates created in Admin > Global configuration, making it easier to reuse standard exclude patterns instead of configuring them manually per application. See the documentation.
UI (viewer) > Right panel: About this view Introduced a new "About this view" section in the right panel, consolidating existing view information and the AI-generated summary into dedicated tabs ("What’s this view" and "AI summary"), with support for generating/regenerating summaries, saving them as post-its, and viewing the content in an expandable window. See the documentation.
UI (viewer) > Optional Endpoint URL for OpenAI provider in AI Settings Added an optional Endpoint URL field when registering OpenAI as an AI provider. This allows users who self-host OpenAI-compatible models (e.g., GPT OSS 120B) to point to their own server endpoint. When no endpoint URL is provided, the standard OpenAI API endpoint is used by default.
UI (viewer) > Characteristics panel community node naming helper A "More Info" popup for Community objects in the Characteristics panel has been added, explaining how each Community is formed and grouped (per technology such as Java, ABAP, or COBOL). The popup is available only for "Community" nodes and is accessed via the info icon next to the Community name. See the documentation.
UI (viewer) - Structural Flaws UI improvements A new step‑based (accordion) representation of multiple violation paths has been introduced for the Structural Flaws UI, replacing the existing object graph view. See the documentation.
UI (viewer) > App to App Dependencies search improvements The App‑to‑App Dependencies search behavior has been improved: search results list all applications with a "Visualize" option and a checkbox next to each application, allowing users to select one or more applications directly from either the full or filtered results list. See the documentation.
UI (viewer) > Third-party components Updated the Third‑party components table to show an "Impacted objects column" (with tooltip) (the existing generic "Object count" column has been removed), and sort the table by impacted object count by default so users can immediately see which components affect the most objects. See the documentation.
UI (viewer) > Status column and filters for transaction and data call graph search modals Added a Status column and filters to the Transaction and data call graph search modals to show how items have changed between analyses (Added / Modified / Unchanged). The column includes tooltips explaining each status for transactions and data call graphs, and a multi‑select Status filter is now available in the data call graph search modal to quickly focus on specific change types.
UI (viewer) > Compare feature enabled for saved views Added historic comparison for saved views: users can load read‑only historical versions for a given analysis date, see only views valid on that date, and compare the latest saved view with any previous version. Differences in objects and links are highlighted (added/modified/deleted) within the saved view, with states automatically updated when underlying analyses are deleted. See the documentation.
UI (viewer) > Tag use in custom aggregations Introduced enhanced tagging behavior in custom aggregations: it is now possible to add tags to aggregated nodes, have those tags persist after saving, use them in search and filter options where applicable and access tag options from the custom aggregation toolbar.Note that tags and post‑its on custom nodes are searchable only once the custom aggregation is published. See the documentation.
Technical > Improvements to feature availability when no "analysis-node" is available When no analysis-nodes are available, CAST Imaging now disables only job‑related actions (onboarding, rescan, run analysis, etc.) with a tooltip explaining the service is unavailable, while keeping other admin features (Global configuration, Extensions strategy, System settings, etc.) accessible (in contrast to previous releases). However, certain sections of the UI that rely on the node (e.g., Black Box in Security Dataflow, Snapshot strategy, application support log downloads) are hidden or disabled to avoid confusion.
Technical > Support for in-place updates for Podman Support has been added for in-place updates to new releases of CAST Imaging when using the Podman container system. Support is available for updating from 3.5.x-funcrel (or later) to a newer release of CAST Imaging. See the documentation.
UI (viewer) > Application Discovery Report content Updated the Application Discovery Report content, including: a Programming Languages overview (files, LOC, sizes by language), Impacted Objects Count for third‑party components, a Database Inventory summary table, an Actionable Insights section (top performance, security, Green IT, and cloud issues), clickable "View in Imaging" links for each graph, grouped multi‑link interactions, offloaded detailed tables to Excel/CSV, and focusing the Word report on Critical and High CVEs only. See the documentation.
UI (viewer) > triggeredBy link property A new "triggeredBy" property will be shown in link characteristics for SQL queries, indicating which element or event triggers a given link, so users can better understand and analyze link behavior. See the documentation.
UI (viewer) > Application Report styling improvements Refined the Application Discovery Report styling and layout, including a redesigned cover page (header, date format, alignment), improved index (leader dots, indentation, clickable navigation), modernized tables (colors, padding/margins, sticky headers), standardized font sizes and heading conventions, removed unnecessary page breaks for a continuous flow, and expanded section descriptions for clearer explanations of each view. See the documentation.
UI > About dialog improvements Updated the About dialog to display package names, versions, and build numbers for key components (Imaging Services, Analysis Node, Imaging Viewer, and Dashboards), making it easier to verify installed versions for support and troubleshooting.
UI (viewer) > .NET Modernization Rules for Advisor Introduced support for .NET Modernization Rules within the Advisor. This enhancement provides guidance and recommendations to help modernize .NET applications - see the documentation.

Other Updates

Internal Id Details
IMAGSYS-23831 When running an in-place update to 3.6.0-funcrel only (for Docker/Podman installations), you can optionally pass the "–skip-neo4j-migration" parameter to skip the entire imaging-viewer Neo4j migration step during the update (i.e. the update process for the database itself). This can significantly reduce update time for installations with large Neo4j databases. See the documentation.
IMAGSYS-21880 UI (viewer) > Updated App‑to‑App view terminology so the scope previously labelled "Search in CAST Imaging" is now called "Search Applications", improving clarity and consistency in the search UI. See the documentation.
IMAGSYS-22923 UI (viewer) > Reintroduced the ability to bulk add tags and post‑its to multiple objects by uploading a filled‑in template from the "Upload" tab in "Bulk Tag / Post-it" on the "Customize Results" page, including options to link or unlink post‑its to modules through Advanced Configuration. This feature was disabled in previous releases. See the documentation.
IMAGSYS-22008 UI (viewer) > Switched the UI from "sidebar drawers" to floating dialogs for Call Hierarchy, Start/End points, and Update Transaction features, plus revised fallback pop-up messages when no results are available.
IMAGSYS-23145 / IMAGKSL-4346 UI > Aligned the CAST Imaging branding with current marketing guidelines by updating the logo and font.
IMAGSYS-22499 UI (viewer) > Historic analysis deletion: users can now select and delete up to five analyses at once via the updated UI, with a confirmation prompt before final removal, while ensuring at least one base analysis always remains for each application.
IMAGSYS-21887 UI (viewer) > Refined context‑menu labels and tooltips in the App‑to‑App Dependency view for application nodes, including renaming options like "View external libraries" to "View external objects" and "View orphans" to "View orphan objects," and using "application" instead of "object" where applicable. Mixed selections that include non‑application nodes continue to use the original "objects" terminology.
IMAGKSL-4523 Shared folders > Requirements have been updated to ensure that the "console" service (part of "imaging-services") has direct read/write access to shared folders (delivery, deploy, common-data) alongside the "analysis-node" component (see the documentation. For Linux/Kubernetes deployments, both services must share a File Storage (RWX) volume and run with the same container UID. For Windows deployments, both services must run under the same service account with appropriate ACLs and mapped network drives, and the installer now warns if shared-folder access is not correctly configured.
IMAGSYS-22396 UI (viewer) > Enabled bulk "Tag all" and "Download all" actions for Cypher search results, allowing users to tag or export all returned items in a single operation. These options were disabled in previous releases.
IMAGSYS-22160 UI (viewer) > Multi-selection of transactions for defining aggregated nodes has been enabled (previously only single transactions could be selected) .Selecting multiple transactions (i.e. X and Y) will return all objects from transaction X + all objects from transaction Y and selections can be combined with other filters. This is particularly useful for customers that want to create a functional group comprised of multiple entry-points (of multiple transactions). NOT, AND and OR operators are provided in the custom node dialog to further filter the required transactions.
IMAGSYS-21913 UI (admin) > Refined the Admin Center panel for App‑to‑App dependency settings, updating section and table headings and adding previously missing table headers so the UI terminology and help content are clearer and fully aligned. See the documentation.
IMAGSYS-22955 UI (viewer) > Improvements made to predefined views so they now have dedicated, persistent URL routes (instead of redirecting to a generic search view) and a read‑only Type field in the Investigate menu, covering views such as RDBMS Object Inventory, Database Storage Objects, Database Access View, and the various Sensitive Data views.
IMAGSYS-21886 UI (viewer) > Updated right‑panel labels and tooltips in the App‑to‑App Dependency view to better describe applications and their interactions, including renamed tag subsections (Application Object Properties, Application Technologies, User Defined) and improved guidance in header, tags, and characteristics sections. These changes apply only to the App‑to‑App Dependency view, not to other predefined scopes.
IMAGSYS-21980 UI (viewer) > Added new tooltips for Level 1 - Level 5 in the left navigation panel, clarifying the meaning of each level to improve usability and discoverability.

Resolved Issues

Customer Ticket Id Details
56215 Improved Services view performance and timeouts so large customer datasets now load reliably within acceptable time.
57701 Removed the confusing “version name” in Dashboard v3 for scans/rescans, hiding internal technical versioning from end users.
48610 Fixed inconsistencies in LOC figures between the Management Dashboard and the “Module’s Complexity” report.
56722 Ensured data sensitivity indicators are consistently available at column level, not just at table level.
57350 Fixed failures in generated views, ensuring views can be created successfully.
55489 Standardized “M lines of code” labelling across products to remove “m/M” typography inconsistencies.
56711 Clarified and corrected relationship counts between v2 and v3.5.2 migrations, aligning CAST Imaging UI with exported link counts.
57094 Fixed "viewer" history deletion so analysis history can now be reliably purged without backend errors.
56958 Fixed "viewer" upgrade failures related to Neo4j 5 "–update" flag handling, improving reliability of viewer upgrades.
56674 Corrected missing table‑column children and enabled “open in new view” from table columns to support deeper drill‑downs.
56312 Now, System Settings and Extend Strategy are accessible independently from the Analysis Node.
57540 Fixed export of objects and links from drilled‑down app‑to‑app dependency views to CSV/XLSX so large exports no longer fail.
55050 Ensured updated object names are correctly synchronized after re‑imports or rescans, so CAST Imaging reflects latest analysis results.
57595 Fixed an issue where uploading configuration rule files containing "type=Generic sets" could fail with a "NoResultException" during analysis. Custom TCCSetup files using Generic Sets (including add, delete, and import) are now fully supported restoring the behavior available in Imaging Console V2.
56935 Fixed incorrect C# - SQL mappings and ensured CAST Imaging reflects updated relationships after DLM changes.
56673 Improved Imaging import performance for medium and small applications, significantly reducing import and generate‑views times.
56685 Resolved missing SQL query details when clicking JPQL links so that underlying queries are now visible in CAST Imaging views.
54965 Users can now configure mainframe technology options before running the first analysis.
56541 Addressed failures in “Generate Views” caused by Neo4j memory‑limit issues, improving robustness for large databases.
56730 Resolved an issue where searching for objects of type "SQL Server Table Column" returned no results even when the "Table columns as objects/nodes" option was enabled. The underlying Neo4j search query now correctly includes the TableInfo label, ensuring table column objects appear in search results as expected.
57018 A new icon in the File Filter (next to the expression field) allows to apply predefined exclusion templates to exclusion patterns.
57069 Corrected the contributed‑indicator tooltip for ISO 5055 CWEs so it now lists the correct contributing indices and criteria, aligned with standalone dashboards.
56219 Restored missing JPA entity objects in Level‑5 drill‑downs so all JPA entities are visible according to their correct level and type.
56489 Fixes the issue preventing users from adding file extensions to Mainframe AU and having them analyzed.
56350 Ensured Green IT tiles are enabled by default in Dashboard Docker images by updating initialization scripts to inject the required panels automatically.
57656 Reworked the exporter to use streaming reads instead of loading all data in memory, reducing exporter memory usage to ~140 MB for most tasks and improving reliability on very large datasets.
55364 Provided and fixed support for running v2 Standalone Dashboards on Google Cloud SQL Proxy without a database password, including configuration updates for domain and application properties.
57020 Corrected missing links in complex search views when adding objects via regex, so all expected relationships are displayed.
56973 Fixes the issue preventing the Analysis Node from being updated when using a secure connection.
56844 Enabled adding tags to applications directly from the V3 Infrastructure Dashboard, ensuring the tag button and flow work as expected.
54010 Fixes an out‑of‑memory error when installing on a FIPS‑enabled PostgreSQL database.
57572 Fixed missing drop‑down controls in the Management Dashboard’s module treemap so users can consistently navigate module views.
52834 Reduced app‑to‑app dependency link‑generation time for very large environments by optimizing long‑running REST‑scanning steps.
57098 Resolved cases where imported applications showed “No object found” at all levels despite successful analysis, ensuring objects appear correctly in dashboards.

Known Issues

Internal Id Details
IMAGKSL-4656 Microsoft Windows > When upgrading from a previous version installed at a custom location, the upgrade process incorrectly looks for ProgramData at the default path (C:\ProgramData\CAST\Imaging) instead of the custom location specified in the .install folder, causing the upgrade to fail. This will be addressed in a future release.
IMAGSYS-23833 Docker/Podman > Custom port configuration is not supported. This will be addressed in a future release.
IMAGKSL-4439 For migrated applications that are not managed, the analysis options are not available prior to running the first analysis. This will be addressed in a future release.
IMAGKSL-4655 When uploading a configuration file containing custom rules, all previously defined custom rules are removed. For example, uploading a file with a "Generic set" custom rule will delete any existing custom rules such as transaction entry points. This will be addressed in a future release.
IMAGKSL-4525 Microsoft Windows > When performing an uninstallation in a distributed installation,folders under "ProgramData" and "Program Files" are not completely removed. A manual cleanup of these folders is required before performing a fresh installation. This only impacts uninstallation of 3.6.0-funcrel and will be addressed in a future release.
IMAGKSL-4535 Microsoft Windows > If the service account (used to run the Microsoft Windows services) password contains special characters (e.g. !), the installer or updater may fail to create the service correctly. As a workaround, the service password must be updated manually after installation. This will be addressed in a future release.
IMAGKSL-4464 Changes made to file extensions under Analysis Configuration are not taken into account. This will be addressed in a future release.
IMAGKSL-4677 The update process to 3.6.0-funcrel may fail at the control-panel-service step for some early V3 customer installations (particularly environments created before the move of "analysis_node" schema to "control_panel"). The failure is triggered by a PostgreSQL/Liquibase error with duplicate key violation on properties_pkey (e.g., Key (id)=(2) already exists) during the update process. Workaround: run the following SQL query against the "control_panel" schema to resynchronize the "control_panel.properties.id" sequence, then re-run the update: SELECT setval(pg_get_serial_sequence('control_panel.properties', 'id'), COALESCE((SELECT MAX(id) FROM control_panel.properties), 0) );

Bug Fixes

Details
Technical > The authentication service no longer requires certificate files when using basic SSL mode.
Technical > Improved admin‑center responses so monitoring data remains available even when some nodes are down.
Technical > Corrected user permission handling so rights are revoked when a profile is downgraded.
UI (admin) > Updated icons so admin groups and the admin user are visually distinct in the User Permission/ Users section.
Technical > Optimized snapshot indicators generation to reduce database disk usage and prevent “disk full” errors.
Technical > Removed spurious session reload warnings when accessing the Engineering Dashboard.
UI (admin) > Improved the Extension Strategy page UI for better readability and usability.
UI (viewer) > Aligned the header submenu on admin pages rendered by the Imaging Viewer with other admin pages so that "Profile" opens the correct user page, "About" shows version information, and "Logout" uses the standard sign‑out flow, ensuring consistent and context‑relevant options across all admin pages.
Technical > Fixed the “Refresh extension cache” operation so extension data is properly refreshed.
Technical > Fixed inconsistencies in the “Logout from all sessions” feature.
3.6 — Security fixes