These release trains are planned and subject to change — scope and timing are not commitments.
Release
Status
Feat.
Enh.
Fixes
Sec.
Total
Release Train S QPP NextGen milestone
In QC
1
0
3
0
4
Release Train T QPP NextGen milestone
In QC
6
0
1
0
7
Release Train U QPP NextGen milestone
Planned · backlog
2
0
0
0
2
Release Train V QPP NextGen milestone
Planned · backlog
1
0
0
0
1
Subtotal
10
0
4
0
14
Quark Publishing Platform · QPP NextGen
QPP NextGen — 5.8.3
Released · 25 May 2026
QPP NextGen 5.8.3 release.
2Features
0Enhancements
2Fixes
0Security
New Features 2
The out-of-the-box EPUB publishing channel now supports reflowable output, so EPUB content adapts to screen size and zoom instead of being fixed-layout — meeting responsive e-reading expectations.
New
Product
Quark – QPP NG
Reference
ka#60389634
Status
Released
In the DOCX Converter, the Destination Collection can now be typed or pasted directly, in addition to selecting it via the asset picker — streamlining automated conversion workflows.
New
Product
Quark – QPP NG
Reference
ka#60394049
Status
Released
Fixes 2
Fixed cross-references failing to resolve when a section containing them (or the set of sections they span) is reused in another document. Cross-references now resolve correctly in the destination document.
Fix
Product
Quark – QPP NG
Reference
ka#60387667
Status
Released
Resolved severe slowness when browsing large collections, where the Browse view could wait around 90 seconds before showing results. Browse now returns results promptly.
Fix
Product
Quark – QPP NG
Reference
ka#60387585ka#60399539
Status
Released
Quark Publishing Platform · QPP NextGen
QPP NextGen — 5.8.4
Released · 21 Jun 2026
QPP NextGen 5.8.4 release.
1Features
0Enhancements
1Fixes
0Security
New Features 1
The out-of-the-box EPUB publishing channel now supports reflowable output, so EPUB content adapts to screen size and zoom instead of being fixed-layout — meeting responsive e-reading expectations.
New
Product
Quark – QPP NG
Reference
ka#60389634
Status
Released
Fixes 1
Fixed a failure when creating content models caused by a content-length mismatch during file synchronization. Content-model creation now completes reliably.
Quark XML Author 11.x is now supported on the Microsoft 365 Monthly Enterprise Channel, giving organizations on that Office update channel a supported QPP NextGen authoring configuration.
New
Product
Quark – QPP NG
Reference
ka#60406015
Status
Released
Fixes 7
Fixed an intermittent failure in QPP NextGen routing to Docurated caused by stale endpoint reconciliation, which could cause a blank page after login and make preview and search fail. Access, preview, and search are now reliable.
Fix
Product
Quark – QPP NG
Reference
ka#60387487
Status
Released
Fixed the Quark Author navigation pane (Document Structure) continuing to show stale text after a Smart Document or Smart Section title was deleted or edited quickly. The pane now refreshes to reflect the current title.
Fix
Product
Quark – QPP NG
Reference
ka#60390015
Status
Released
Fixed Web Author removing spaces inside MathType/MathML equation text after a document was reopened. Equation text now retains its spacing.
Fix
Product
Quark – QPP NG
Reference
ka#60401342ka#60409265
Status
Released
User enable/disable actions and max-login lockout events now publish with complete audit and webhook context, improving auditability and downstream integrations.
Fix
Product
Quark – QPP NG
Reference
ka#60413930
Status
Released
Fixed a 500 error when exporting search results with a language-only browser locale (for example, “de”). Exporting saved search results from Workspace now works regardless of locale format.
Fix
Product
Quark – QPP NG
Reference
ka#60410605
Status
Released
Fixed the AFTER_SAVE_REVISION_SUBMIT event not firing when creating a document version via “Update Revision” from Workspace. The event now fires reliably so downstream integrations run as expected.
Fix
Product
Quark – QPP NG
Reference
ka#60387595
Status
Released
Fixed repeated “Too Many Requests” errors in Author when opening large documents containing many bibliography attachment links. Such documents now load without throttling errors.
The BEFORE_SAVE callback payload now includes createMinorVersion for the “Done Editing” action (previously only for Save), so integrations can apply the correct validation before a minor or major version is created.
New
Product
Quark – QPP NG
Reference
ka#60387900
Status
Released
Metadata fields and content variables now support both a Description (business purpose, usage, and governance detail for content-model design) and Author Help Text (concise guidance shown to authors at the point of content creation).
New
Product
Quark – QPP NG
Reference
—
Status
Released
The Quark Author component-save callback payload now exposes the Workflow dialog attributes before component versioning/check-in completes, enabling integrations to act on the author's workflow selections.
New
Product
Quark – QPP NG
Reference
ka#60387881
Status
Released
Provision QPP NG synthetic-monitor Keycloak client (login enablement for future synthetic monitoring)
New
Product
Quark – QPP NG
Reference
—
Status
Released
When adding a section, Quark Author now prompts for the content type's required metadata right at creation time, instead of requiring users to find and open a separate layout blade afterward.
New
Product
Quark – QPP NG
Reference
ka#60387630
Status
Released
Quark Author now supports one-way mapping from Section Type to Title during editing when bidirectional mapping is disabled, giving content models more control over how titles are derived.
New
Product
Quark – QPP NG
Reference
ka#60387701ka#60387846
Status
Released
Added an out-of-the-box event/callback that fires when a user discards the currently open document in Quark Author, so custom services can run after a discard completes.
New
Product
Quark – QPP NG
Reference
ka#60387905
Status
Released
Fixes 7
When creating a new document from an Authoring Template, each section now receives the Layout Options defined for the corresponding template section (previously the first section's options were applied to every section).
Fix
Product
Quark – QPP NG
Reference
ka#60387902
Status
Released
Fixed custom Workspace asset actions configured with a parent (for example under the Branching menu) appearing as top-level context-menu items instead of nested under the intended parent menu.
Fix
Product
Quark – QPP NG
Reference
ka#60396915
Status
Released
Fixed document/section metadata (meta properties) being lost when a layout option was applied. Metadata is now preserved when changing layout options.
Fix
Product
Quark – QPP NG
Reference
ka#60387596
Status
Released
Fixed search not returning correct results in the asset picker when it was launched with a filter ID. Filtered asset-picker searches now work as expected.
Fix
Product
Quark – QPP NG
Reference
ka#60387592
Status
Released
Fixed “Edit All Components” hanging in an infinite loading state when a document included a video component. Such documents now open in Edit All Components.
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Fixed search results showing “No One” under Assigned To / Routed To for published assets that have no routed-to value; the display is now consistent with the asset view.
Fix
Product
Quark – QPP NG
Reference
ka#60387939
Status
Released
Fixed failures when exporting certain content-type packages from Admin › Import & Export. Content-type export now completes for the affected models.
Authors can now create cross-references that point directly to lists and paragraphs. Quark Author generates addressable IDs for these elements automatically, so there's no longer any need to wrap content in a region just to reference it.
New
Product
Quark – QPP NG
Reference
ka#60387653
Status
Released
You can now see and save into your Favorites collection directly from the Save As dialog, filing assets into frequently used or personal collections without navigating the full collection hierarchy.
New
Product
Quark – QPP NG
Reference
ka#60387924
Status
Released
Duplicating a whole publication — including all subfolders and files — now behaves predictably with respect to asset identity, so you can copy publications with confidence and without unintended duplication side effects.
New
Product
Quark – QPP NG
Reference
ka#60387564ka#60389945
Status
Released
The component context menu in Quark Author is now customizable — entries such as “Pin Component” and “Close” can be hidden or removed to streamline the authoring experience for your users.
New
Product
Quark – QPP NG
Reference
ka#60387899
Status
Released
Enhancements 2
[qpp-deployment] Add Helm lint + template CI check
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
[qpp-deployment] Add Terraform fmt + validate CI check
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
Fixes 7
Fixed an error that occurred when updating properties of a branch document whose status differed from its origin branch. Property updates now succeed regardless of the origin branch status.
Fix
Product
Quark – QPP NG
Reference
ka#60387588
Status
Released
Fixed an issue where auto-bursting Smart Sections applied the last section's metadata value to the Title attribute of every created section asset. Each generated section now retains its own metadata.
Fix
Product
Quark – QPP NG
Reference
ka#60387684
Status
Released
Fixed duplicate component creation during auto-burst for nested sections, so deeply nested structures no longer produce duplicated components.
Fix
Product
Quark – QPP NG
Reference
ka#60400152
Status
Released
Fixed a case where using Override Checkout on a Company Page component could leave it in an inconsistent edit state and block workflow status changes. Components now return to a consistent, editable state.
Fix
Product
Quark – QPP NG
Reference
ka#60387609
Status
Released
Resolved an issue where publishing could fail when a PDF attachment reference could not be resolved. Publishing now handles unresolved PDF attachment URIs gracefully.
Fix
Product
Quark – QPP NG
Reference
ka#60387816
Status
Released
Fixed an issue where the Create screen for PCR, LFA, and SFA item types displayed a “Recommendations-Collection” element that was marked hidden. The Create screen now shows only the intended fields.
Fix
Product
Quark – QPP NG
Reference
ka#60387763
Status
Released
Fixed a problem where opening a document containing a video component could hang with components loading indefinitely. Documents with video components now open reliably.
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Security 3
Hardened HTML rendering by replacing a trusted-HTML bypass with proper sanitization in the rendering pipeline, reducing cross-site scripting (XSS) exposure when rendering content.
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Added server-side enforcement of content sanitization for Author content — comments, notes, track-changes, and revisions — strengthening protection against cross-site scripting (XSS).
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Fixed a data-exposure issue where advanced search could return assets to users whose access to the containing collection had been revoked. Search results now respect current collection access permissions.
Authors can now control table cell and row dimensions — column width and row height (and individual cell sizing where applicable) — with changes reflected on the authoring canvas as well as in the rendered output.
New
Product
Quark – QPP NG
Reference
ka#60387618
Status
Released
Table cells now support horizontal (left / center / right / justify) and vertical (top / middle / bottom) alignment, settable per cell and reflected on the canvas and in output. Available in Quark Author and Quark XML Author.
New
Product
Quark – QPP NG
Reference
ka#60387627
Status
Released
Ordered lists now support “Continue numbering” (resume from the previous list of the same type) and “Start from” (begin a list at a specific number chosen by the author). Both behaviors are reflected live on the authoring canvas.
New
Product
Quark – QPP NG
Reference
ka#60387628
Status
Released
Authors can now control table borders at the table, row, and cell level — turn borders on or off, set thickness, and apply different settings to specific edges (top, right, bottom, left). Border choices are reflected on the authoring canvas and in the rendered output.
New
Product
Quark – QPP NG
Reference
ka#60387617
Status
Released
Quark Author now supports pre- and post-create callbacks for images — to validate inputs before creation and trigger actions (metadata, status, integrations) afterward — along with a configurable default content type for newly created images.
New
Product
Quark – QPP NG
Reference
ka#60387650
Status
Released
Enhancements 1
The QPP NextGen Adapter for Microsoft Excel now persists and renews the Smart Content / Smart Document pane session, so users are no longer forced to re-authenticate after the pane is inactive or reopened.
Improved
Product
Quark – QPP NG
Reference
ka#60414161ka#60425686
Status
Released
Fixes 9
Fixed an issue where workflow status changes in Quark Author could fail to persist and draft actions (save / discard) did not work correctly. Status changes now save reliably, and drafts can be discarded or completed without errors.
Fix
Product
Quark – QPP NG
Reference
ka#60387807
Status
Released
Fixed a Company Page bulk-update issue where changing a bulk workflow to “Submitted” could take several attempts and still show components as authoring. Bulk status updates now apply consistently in a single pass.
Fix
Product
Quark – QPP NG
Reference
ka#60387723
Status
Released
Fixed branch version numbering so that, when a content type is configured for major versions only, a new branch starts at the next major version (e.g. 1.0) instead of always being created as a minor version (0.1).
Fix
Product
Quark – QPP NG
Reference
ka#60387656
Status
Released
Fixed an extra, unwanted bullet point appearing after inserting a table inside a list item in Quark Author.
Fix
Product
Quark – QPP NG
Reference
ka#60387892
Status
Released
Fixed the Insert Cross Reference screen showing blank entries for sections whose title is optional and left empty. Such sections now display appropriately in the cross-reference picker.
Fix
Product
Quark – QPP NG
Reference
ka#60387910
Status
Released
Resolved slow browsing of very large image collections, where the Images view could take roughly 40–50 seconds to load. Large collections now load substantially faster.
Fix
Product
Quark – QPP NG
Reference
ka#60399539
Status
Released
Fixed intermittent failures when publishing tracked-content PDFs after a long render, caused by an authentication token expiring mid-upload. Long-running tracked-content PDF publishes now complete reliably.
Fix
Product
Quark – QPP NG
Reference
ka#60420729ka#60430459ka#60439450
Status
Released
Fixed a JavaScript error shown in Workspace after successfully creating a branch or sub-branch from a superseded document. Branch creation now completes without the spurious error.
Fix
Product
Quark – QPP NG
Reference
ka#60403899
Status
Released
Fixed metadata values not being retained for inline tag content properties and paragraph-level keywords after navigating away from and back to the Metadata pane in Quark Author.
Partner-artifacts renderer advertises unresolvable @quark package scopes and no versions for QPP NG web components
New
Product
Quark – QPP NG
Reference
—
Status
Released
Distribution channel for QPP NG partner npm packages.
New
Product
Quark – QPP NG
Reference
—
Status
Released
Enhancements 1
Privileged users can now check out a document assigned to another user directly into editable mode, with an optional confirmation prompt — removing the extra manual “Edit” step when taking ownership of a document.
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
Fixes 3
Fixed missing icons for PDF publishing options in the Publishing Channels panel, so each option now displays its icon correctly.
Fix
Product
Quark – QPP NG
Reference
ka#60387772
Status
Released
Fixed the asset-version attribute service omitting custom (user-defined) attributes, or returning an error, for non-origin branches. Custom attribute values are now returned correctly across all branches.
Fix
Product
Quark – QPP NG
Reference
ka#60387641
Status
Released
Fixed check-in occasionally failing asynchronously after an accepted upload while returning an error with no diagnostic detail. Check-in status now reports actionable results.
Fix
Product
Quark – QPP NG
Reference
ka#60398009
Status
Released
Security 1
Strengthened sanitization of rendered research-assistant content to reduce cross-site scripting (XSS) exposure when previewing and displaying generated content.
[Quark NextGen] Author toolbar Save wedges in loading state on qaeu — Save As dialog never opens, check-in impossible
New
Product
Quark – QPP NG
Reference
—
Status
Released
Revision comparison now detects and highlights changes to images, figures, and attachments between document revisions, so non-textual assets are reviewed alongside text in regulated workflows.
New
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG rtd deploy path builds from default-branch HEAD — a release CR can ship a newer version than it names (R-2026.07.23 would have deployed ~5.8.9)
New
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG: refresh qpp-devops.yml model options to current Claude generation
New
Product
Quark – QPP NG
Reference
—
Status
Released
dbmigrator hardcodes "quark" database name in entrypoint.sh — blocks Aurora DB consolidation (database-per-tenant)
New
Product
Quark – QPP NG
Reference
—
Status
Released
Enhancements 1
Search results can now remember your preferred columns and sort order as a personal default — globally and per saved search — so you no longer have to reconfigure the view each time you search.
Improved
Product
Quark – QPP NG
Reference
ka#60387880ka#60424879
Status
Released
Fixes 13
Quark Author now enforces mandatory metadata (the required Property Reference List) on Save As and versioning, preventing documents from being saved with incomplete required metadata.
Fix
Product
Quark – QPP NG
Reference
ka#60404478
Status
Released
QPP NG DOCX omits MathML equation in second paragraph of numbered-list item
Fix
Product
Quark – QPP NG
Reference
ka#60441477
Status
Released
Fixed pasted text not being inserted into the Figure Title and Figure Description fields after inserting or replacing a figure. Pasting into these fields now works as expected.
Fix
Product
Quark – QPP NG
Reference
ka#60387687
Status
Released
QPP NG deploy has no cache-invalidation step when a release changes a serialized DTO's serialVersionUID — tenants degrade silently after reporting green (queryquestservice, 5.8.8)
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Saved-search CSV export fails when the search name contains `/`
Fix
Product
Quark – QPP NG
Reference
ka#60443106
Status
Released
Auto-burst leaves Title blank for mapped Section Type on GTC Smart Sections
Fix
Product
Quark – QPP NG
Reference
ka#60448063
Status
Released
queryquestservice invalidate-cache hardcodes legacy GitHubCICDQuarkQPPDeploy role — fails in every IaC-managed account, marks a successful deploy failed
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
ci-actions.yml: deploy-to-eks always fails — 'account' input omitted yields a malformed role ARN
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG: PDF publish fails with QxpsModifyRender 500 on aipoc + rivacorp (blocks AI pipeline export)
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Quark Author clears Person tag content properties after Metadata tab/focus changes
Fix
Product
Quark – QPP NG
Reference
ka#60441004
Status
Released
Element-scope metadata dropped client-side before save - follow up 2118
Fix
Product
Quark – QPP NG
Reference
ka#60441004
Status
Released
Fixed metadata values not being retained for inline tag content properties and paragraph-level keywords after navigating away from and back to the Metadata pane in Quark Author.
Fix
Product
Quark – QPP NG
Reference
ka#60441004
Status
Released
qcpdbmigrator cannot migrate a consolidated-Aurora tenant: DB_NAME discarded, tenant role owns nothing
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Security 1
Added protection against cross-site request forgery (CSRF) in the platform's service layer and tightened session cookie handling (SameSite), reducing the risk of unauthorized cross-site requests.
QPP NG Shared Env P2.2 — Multi-tenancy starter library (commonmodules/auth-token-manager)
New
Product
Quark – QPP NG
Reference
—
Status
Released
[Metadata & Variables] Use the metadata/variable Description as AI context for meta tagging during unstructured->structured conversion
New
Product
Quark – QPP NG
Reference
—
Status
Released
[00118833] Preserve and auto-restore section pinning information on Discard, and allow pinning (or replacing the linked version of) a section directly from the authoring experience
New
Product
Quark – QPP NG
Reference
ka#60387654
Status
Released
[00118835] Multiple unordered and ordered list types (incl. nested levels), rendered on the canvas
New
Product
Quark – QPP NG
Reference
ka#60387652
Status
Released
Administrators can now hide or show individual out-of-the-box menu actions — such as Insert Above, Insert Below, Delete, and Replace Components — in the Quark Author Navigation tree, for tighter control of governed authoring solutions.
New
Product
Quark – QPP NG
Reference
ka#60387648ka#60441034ka#60441047
Status
Released
[00118758] Prompt the user to check-in or discard checked-out sections when the document is saved or discarded
New
Product
Quark – QPP NG
Reference
ka#60387657
Status
Released
Reliable save-revision check-in from any context, with dismissals and destinations visible to callers
New
Product
Quark – QPP NG
Reference
—
Status
Released
A stable, editor-agnostic contract for blade-to-canvas document operations
New
Product
Quark – QPP NG
Reference
—
Status
Released
Enhancements 2
Improve workspace differentiation of authoring templates vs documents (list & thumbnail views)
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
The component References pane is now resizeable and shows the full collection path, making long reference lists easier to read and navigate.
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
Fixes 4
Office Adapter MSI packages PowerPoint configuration for Excel and Word modules
Fix
Product
Quark – QPP NG
Reference
ka#60450815
Status
Released
QPP NG: Current assets become unsearchable when an index record omits `is_latest_version`
Fix
Product
Quark – QPP NG
Reference
ka#60448139
Status
Released
Quark Author appends stale partial Row Filters members when a collection member is edited incrementally
Fix
Product
Quark – QPP NG
Reference
ka#60451890
Status
Released
Workspace: opened right-hand pane is not retained when switching to the details view
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Security 1
Tightened the application's Content Security Policy and confirmed HTML sanitization wiring, further reducing the surface for cross-site scripting (XSS).
ENH-010 Increment 2: Live sync — Canvas→Blade change events
Improved
Product
Quark – QPP NG
Reference
ka#60387634ka#60441040
Status
Released
The QPP NextGen Adapter for Microsoft Excel now persists and renews the Smart Content / Smart Document pane session, so users are no longer forced to re-authenticate after the pane is inactive or reopened.
Improved
Product
Quark – QPP NG
Reference
ka#60414161ka#60425686
Status
Released
Fixes 8
FT Data JSON Meta Cleared on Editing Existing Fundamental Table
Authors can now create cross-references that point directly to lists and paragraphs. Quark Author generates addressable IDs for these elements automatically, so there's no longer any need to wrap content in a region just to reference it.
New
Product
Quark – QPP NG
Reference
ka#60387653
Status
Released
XML Author SmartContent ribbon not rendered — combineRibbons emits >100 ribbon tabs past the MS-CUSTOMUI 100-tab (CT_Tabs) schema limit
New
Product
Quark – QPP NG
Reference
—
Status
Released
Content Copilot UI component library
New
Product
Quark – QPP NG
Reference
—
Status
Released
[QPP NextGen] Add pre-/post-asset-creation callbacks for local-file image uploads
New
Product
Quark – QPP NG
Reference
ka#60387650
Status
Released
Authors can now see a content variable's assigned value directly on the authoring canvas instead of only a placeholder, previewing how the content will actually read before publishing.
New
Product
Quark – QPP NG
Reference
—
Status
Released
Enhancements 4
Support of shapes in the DOCX Converter — migrate shape content and convert chart/image shapes to images
Content variables now display their assigned values on the authoring canvas, with context-aware resolution and a toggle between values and placeholders, so authors can preview how content will read before publishing.
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
Fixes 7
Fixed removing a role-level status transition override in the Admin Workflow UI, so deselecting a role now correctly clears its overrides and removes it from the list of overridden roles.
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NextGen: Automated Save As can fail MC Teaser replacement with null `getAddress` error
QPP NG Update Revision Workflow shows blank or stale mapped Section Type and Section Depth values
Fix
Product
Quark – QPP NG
Reference
ka#60387846ka#60469090
Status
Released
QPP NG Excel adapter — Excel hangs / must be force‑closed when publishing (Update Components) QPP Smart Content; long publishes fail with "Invalid context Id" because the server publishing‑context TTL (300s) expires mid‑publish
Fix
Product
Quark – QPP NG
Reference
ka#60436955ka#60463189
Status
Released
Consecutive spaces between words are silently dropped from Smart Document XML (words concatenated)
Fix
Product
Quark – QPP NG
Reference
ka#60468076
Status
Released
QPP NG — Blank Preview and permanently Failed indexing: thumbnail/rendition generation fails silently and persists incomplete rendition sets (REINDEX cannot recover) — uction asset 592271 v87.1
QPP NG webapplications: 'Build platform-components-ng' OOMs on the 4cpu runner — raise the tier (and check whether Node's heap cap is the real limit)
New
Product
Quark – QPP NG
Reference
—
Status
Released
[00119272] Duplicate toolbar for figure in Quark Author
New
Product
Quark – QPP NG
Reference
ka#60387598
Status
Released
Health endpoints report peer health, not own health — decouple CustomHealthIndicator from readiness across all services
New
Product
Quark – QPP NG
Reference
—
Status
Released
Authors can now see a content variable's assigned value directly on the authoring canvas instead of only a placeholder, previewing how the content will actually read before publishing.
New
Product
Quark – QPP NG
Reference
—
Status
Released
Enhancements 4
As a Content Architect, I want to link a content model property to a QPP NextGen attribute from the UI, so that I can map metadata without backend configuration
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
As a Content Architect, I want to link a content variable to a QPP NextGen attribute from the UI, so that I can map variables without backend configuration
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
qaservice: make the startup pipeline (contentservice preflight → S3 config fetch → model migration → cache build) tolerate an unavailable dependency
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
Asset-type content variables now show navigable links on the authoring canvas, along with a tooltip revealing each variable's type and its underlying name and value, so authors can inspect and reach the assets a variable points to.
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
Fixes 7
uction asset 40211187 stuck in an unclearable locked/checked-out state — no user, administrator, or super-admin can cancel checkout, override, or discard (ASSET_LOCKED_BY_OTHER)
Fix
Product
Quark – QPP NG
Reference
ka#60458276
Status
Released
qaservice: exit the JVM when the Spring context fails to start (currently lingers as a live process with no listener)
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Fixed the “Publish – Force Collect Third Party Package” output emitting duplicate XML id attributes across the generated document set. IDs are now unique across the output.
Fix
Product
Quark – QPP NG
Reference
ka#60389945
Status
Released
UAS config export: Qaservice.zip missing — transient-blob GET to contentservice fails 500 ACCESS_DENIED (deveu)
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[QPP NextGen] Real-time auto-refresh of Workspace saved-search / search results (regression from QPP Legacy)
Fix
Product
Quark – QPP NG
Reference
ka#60387874
Status
Released
qaservice cannot start on a greenfield tenant: createMetaType casts a serialized null description to String
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[QPP NextGen] Insert local images into articles without the initial platform Save/upload dialog (silent save)
Ship DiffX behind qpp.comparison.engine — execution spec for the DeltaXML replacement (QPP NG)
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
Fixes 14
QPP NextGen — Insert Cross Reference inserts the previously selected reference after switching Reference Type (Insert stays enabled; selection not cleared)
Fix
Product
Quark – QPP NG
Reference
ka#60470615
Status
Released
Quark Author (QPP NG): rendition Preview after pasting Word content fails with HTTP 500 "Publishing Failed" — server throws TransformerException: Empty expression! on an empty currentSectionXPath
Fix
Product
Quark – QPP NG
Reference
ka#60473335
Status
Released
Empty inline formatting tags (e.g. `<b/>`) are written into Smart Document native XML when pasting from Word
Fix
Product
Quark – QPP NG
Reference
ka#60469254ka#60470297
Status
Released
Quark Author (QPP NG): deleting tables leaves empty paragraph nodes that persist in the saved Smart Document XML but are hidden on the canvas, producing unremovable blank space in renditions
Fix
Product
Quark – QPP NG
Reference
ka#60466350
Status
Released
Company Page components auto-pinned to a fixed version after Bulk Workflow Update (Authoring→Submitted) + publish — regression from bulk-submit versionInfo propagation
Fix
Product
Quark – QPP NG
Reference
ka#60477940
Status
Released
QPP NG login-screen custom branding silently fails when following the SDK docs — sample/README use folder "authservice" but the deployed service reads "authenticationservice"
Fix
Product
Quark – QPP NG
Reference
ka#60475898
Status
Released
Quark Author (QPP NG): "Accept and Move to Next" / "Reject and Move to Next" silently advance on read-only content with no warning (change not applied)
Fix
Product
Quark – QPP NG
Reference
ka#60470520
Status
Released
QPP NG Admin > Workflow: content-type privilege overrides at a status for a subset of privileges (e.g. Edit Text) are silently not persisted — admins cannot view or revert them after save
Fix
Product
Quark – QPP NG
Reference
ka#60477043
Status
Released
Preview renders only the first page and REINDEX does not recover it; the shipped #3737 fix left the lost-preview-page race (Defect B) and the already-damaged-version repair path unfixed — asset 88181 / SUP-391.pdf v1.0
Fix
Product
Quark – QPP NG
Reference
ka#60473343
Status
Released
Company Page: newly-added component fails "must have some content" validation on move to Submitted despite containing content (clears after close/reopen)
Fix
Product
Quark – QPP NG
Reference
ka#60474661
Status
Released
QPP NG Workspace: Asset Details Pane branch pill does not refresh when selecting a different component
Fix
Product
Quark – QPP NG
Reference
ka#60470276
Status
Released
Quark Author (QPP NG): after deleting a fully Keyword‑tagged paragraph and retyping, new text inherits residual bold/underline formatting in the Smart Document XML while "Apply Tag" shows Normal
Fix
Product
Quark – QPP NG
Reference
ka#60470591
Status
Released
[QPP NG] Author missing UI-capture primitive `openConrefReferenceMenu` — B2-design 030-analyze-spec hard-blocks without it
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
AI content generation ("Generate/Regenerate Content") writes to non-checked-out (read-only) sections lacking a mapped data source
[00119068] Document corruption when cross-referencing non-smart table with custom type
New
Product
Quark – QPP NG
Reference
ka#60387639
Status
Released
Fixes 5
QPP NG keycloak-extensions: master build broken — 'apt-get upgrade' then a ca-certificates pin forces a downgrade (do not fix with --allow-downgrades)
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] automationservice (dev): QXPS success-path INFO logs (HTTP 200) misclassified as unhandled_exception because the render URL carries appenderrors/annotateerrors params; the real defect at those lines is a per-request CloseableHttpClient that is never closed
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG Workspace: saved search's "of type" and "In location" revert to All in Edit Search after a Discard/Cancel, so the saved scope is not retained
Fix
Product
Quark – QPP NG
Reference
ka#60481462
Status
Released
[stability] aiintegrationservice (qa): Not an aiintegrationservice fault: the filebeat log-shipping sidecar cannot publish to the Logstash ingest VIP (172.20.253.254:4712), which resets the connection — logs are mis-attributed to this service
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
UAS configuration export (exportConfigurations) fails with "Read timed out" for a content type with a large dependency closure; QA-service config cannot be exported, no workaround
Fix
Product
Quark – QPP NG
Reference
ka#60485364
Status
Released
Security 35
Update quark-qpp-automationservices to resolve CVE-2026-39983, CVE-2026-41324, CVE-2026-44240
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-automationservices to resolve CVE-2026-33870, CVE-2026-33871, CVE-2026-75595
You can now see and save into your Favorites collection directly from the Save As dialog, filing assets into frequently used or personal collections without navigating the full collection hierarchy.
New
Product
Quark – QPP NG
Reference
ka#60387924
Status
Released
New Document metadata screen ignores selector-level DomainValuePicker component
New
Product
Quark – QPP NG
Reference
ka#60437512
Status
Released
[00108689] Find by Name functionality within Searches
New
Product
Quark – QPP NG
Reference
ka#60387877
Status
Released
Unvalidated attacker-supplied URI forwarded to internal Automation Service for remote fetch (SSRF)
New
Product
Quark – QPP NG
Reference
—
Status
Released
The Quark Author component-save callback payload now exposes the Workflow dialog attributes before component versioning/check-in completes, enabling integrations to act on the author's workflow selections.
New
Product
Quark – QPP NG
Reference
ka#60387881
Status
Released
Workspace and Author host the Content Copilot for people with the AI assistant privilege on tenants where it is deployed
New
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG XML Author: table refresh crashes on modern Word ('w16du' undeclared prefix) — same defect as trilogy-group/Quark#2095
New
Product
Quark – QPP NG
Reference
—
Status
Released
Define formatting retention for QPP NextGen data-doc tables after source-row insertion
New
Product
Quark – QPP NG
Reference
ka#60388006
Status
Released
platformservices Quartz: selectWithLockSQL override drops FOR UPDATE, cluster lock is a no-op on PostgreSQL
New
Product
Quark – QPP NG
Reference
—
Status
Released
Fixes 19
(QPP NG 5.8.11 / QXPS 22.1.0-60311): PDF-Layout channel publish/preview fails with PUBLISHING_EXCEPTION — root cause FileNotFoundException on ContentModel.xml during ResolveLayoutOptions activity
Fix
Product
Quark – QPP NG
Reference
ka#60483359
Status
Released
[QPP NextGen] Favorites missing in the mandatory-workflow Save As dialog (parity with #547)
Fix
Product
Quark – QPP NG
Reference
ka#60387924
Status
Released
QPP NG v5.8.14: inserting a local image aborts with a JavaScript error (silent image check-in) when the content type has a default workflow/status configured
Fix
Product
Quark – QPP NG
Reference
ka#60452082
Status
Released
Auto-save Bypasses Revision Restriction in Published Status
Fix
Product
Quark – QPP NG
Reference
ka#60387940
Status
Released
[stability] queryquestservice (qa): queryquestservice fails Spring context refresh at boot across 3 qa tenants; unguarded Redis cache reads in the @PostConstruct initCache methods are the most likely uncaught throw site
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG deploy workflows have no Helm concurrency guard — overlapping dispatches fail on the release lock
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] contentservice (qa): Startup 'IsDocument' migration thread retries forever at 1s intervals when the automation-service getChannels call fails, flooding logs with an opaque UNHANDLED_SERVER_EXCEPTION
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Flaky authoring/qppng REST API failure: AssetCases indexing-retry timeout cascades via DeleteQuery name collision
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Quark Author (QPP NG): Semantic Search result Preview hangs indefinitely with blank content and spinning loader
Fix
Product
Quark – QPP NG
Reference
ka#60485160
Status
Released
[stability] notificationservice (qa): The cebqa ActiveMQ broker (cebqa-activemq:8161) is refusing connections, but the real defect is how NotificationServiceTopicListener reacts to it. On every failed poll the listener swallows the ResourceAccessException, then dereferences a null `response`, throwing an NPE that escapes past the `Thread.sleep(100)` pacing call — so the 100ms poll loop degrades into an un-paced hot retry loop that re-attempts the broker and re-logs the stack trace as fast as the TCP refusal returns. 617 events in a 32.8s burst (~19/sec) is that spin, not 617 independent incidents. Note the mechanism is connection-refused (broker absent/not listening), not a timeout; the coarse `dependency_timeout` label is the closest member of the enum but reads as more benign than it is.
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] queryquestservice (qa): Not a runtime fault: the service is crash-looping at startup. The context is torn down on thread [main] because SpringApplication.run failed mid-refresh, and 'meterRegistryCloser' is only the artifact that teardown emits. 39 hits across 3 tenants in ~3h is the restart loop, not 39 distinct errors. Root cause is a hard-fail dependency check at boot (Redis or Keycloak) whose real exception never reached the log feed. NOTE: the coarse type 'unhandled_exception' is kept because it is known-valid, but this is really a startup-abort/crash-loop; retype it if the enum has a better value.
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] applicationservice (qa): During brief authenticationservice restarts, applicationservice's JWT public-key bootstrap fails and every in-flight request is answered with a spurious 401 "Login expired. Invalid token." — auth-middleware.ts reads the key into a local before kicking off the (unawaited) refetch, then verifies against that stale undefined value. Each such request also spawns its own unbounded 1/sec retry loop against the dependency that is already down.
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] aiintegrationservice (qa): AssetEventsListener logs ERROR on every Kafka asset event for tenants with semantic search unconfigured — expected control flow logged at ERROR, plus a process-local config cache that never refreshes
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Randomly canvas becomes unresponsive during publish/unpublish actions when closing the article using "Done Editing"
Fix
Product
Quark – QPP NG
Reference
ka#60387721
Status
Released
[stability] aiintegrationservice (qa): The ConversionPackInfoSyncManager background thread re-authenticates against ContentServices on every sync tick, and the impersonateUser POST is an unguarded, untimed RestTemplate call. When ContentServices is unreachable the exception is thrown before the loop's Thread.sleep, so the thread re-tries with zero backoff and emits one stack per iteration. Mechanism is NOT a timeout: the cause is java.net.ConnectException 'Connection refused' (immediate TCP RST), i.e. nothing is listening at the resolved host:port. Note the logged URL 'http://<tenant>-contentservice/api/v3/...' carries NO port, while CLAUDE.md:70 documents the endpoint as 'http://${TENANT_ID}-contentservice:61400' — so the deployed content.platform.services.url is a strong suspect for missing its ':61400' suffix and hitting port 80.
[stability] authenticationservice (qa): SAML strategy bootstrap cannot reach the Platform REST service in qa: PlatformFacade.getSamlConfig's axios GET is refused (ECONNREFUSED to a ClusterIP on :80), so SamlStrategy.configureStrategy falls into its unbounded 10s self-retry and logs once per attempt. Mechanism is connection-refused, not a timeout (see suggested_fix) — I kept the coarse type because the finding schema was outside this session's sandbox and I could not confirm a better enum member exists.
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] qaservice (qa): qaservice pod for tenant lumentecqa crash-loops: QppCollectionConfiguration.postConstruct retries a permanent config-collection failure for 300s, then throws and kills the Spring context
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG Excel Office Adapter crashes Excel on opening a document (OOTB 5.8.13, adapter 5.8.269.4) — unhandled cross-thread Window.Close in AppProgressDialog.ShowProgressTaskAsync
Fix
Product
Quark – QPP NG
Reference
ka#60486850
Status
Released
Security 4
[stability] automationservice (qa): automationservice crashloops at boot when Keycloak is slow to become ready: SecurityConfig.jwtDecoder gives up after a fixed ~100s retry budget and throws IllegalStateException, aborting the Spring context
queryquestservice's log4j2 %replace masking converter is mis-parsed, corrupting file-logged messages
New
Product
Quark – QPP NG
Reference
—
Status
Released
The Content Copilot in Author reads and edits the open document through structure-safe canvas tools
New
Product
Quark – QPP NG
Reference
—
Status
Released
The Content Director Agent answers a message in a chat opened while another chat's reply is still running
New
Product
Quark – QPP NG
Reference
—
Status
Released
[QPP NG] In-document note cross-reference — target notes (footnote/endnote/table/section) with a cross-reference (QWA-first)
New
Product
Quark – QPP NG
Reference
ka#60477657
Status
Released
[00114613] Warning Prompt for Same-Named Document Uploading in Docx convertor
New
Product
Quark – QPP NG
Reference
ka#60387815
Status
Released
Fixes 13
[stability] eventrecorder (qa): Events for tenant qa arrive on the Kafka all-events topic with no OBJECT_NAME message property. KafkaRecord2EventRecordMapper only sets objectName when that key is present, so the DTO field stays null, and ng_all_event.objectname is declared NOT NULL (V2 migration), which the per-tenant partition ng_all_event_t_qa inherits. The INSERT fails with a 23502 not-null violation. The DAO catches it, logs this line and returns null; EventPersistService ignores the null and KafkaStreamProcess discards the return value entirely, so the Kafka offset advances and the audit event is silently and permanently lost from ng_all_event. The 'unhandled_exception' type is the SQL regex's guess and is wrong in the literal sense — the exception IS caught (AllEventAuditLogDaoImpl.java:131) — but it is unhandled in the sense that matters: there is no recovery, no retry and no dead-letter path, only a log line. The real defect is silent data loss, not the exception itself.
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Creating or checking in any asset whose name contains a colon (":") fails with HTTP 500 — tenant-namespaced Redis key (Shared Env P3, PR #220) rejects colon in the asset-name uniqueness check
Fix
Product
Quark – QPP NG
Reference
ka#60489624
Status
Released
QPP NG : Published articles silently missing from `advanceSearch` API — FTS index document frozen at `Indexing status=Pending`/`Text Indexing status` absent after a no-content-change publish (~1,763 latest-version LFAs)
Fix
Product
Quark – QPP NG
Reference
ka#60486245
Status
Released
BEFORE_LOCAL_IMAGE_UPLOAD_PREFILL override ignored: Save-As dialog keeps the original picked file name instead of the value returned by the handler
Fix
Product
Quark – QPP NG
Reference
ka#60485274
Status
Released
[stability] notificationservice (prod): The notificationservice topic-poll thread goes into a retry loop with no sleep when prod's ActiveMQ broker refuses connections. This is not a timeout: the TCP connect to prod-activemq:8161 was refused, so the broker was down or not listening. Only one tenant hit it, for about 37 seconds on 2026-09-22 07:44 UTC. The 8644 lines come from a code defect. After catching the RestClientException, checkForNotificationServiceMessage dereferences the null response and throws a NullPointerException. That NPE skips the loop's 100ms sleep, so run retries immediately (8644 lines in ~37s is about 234/s; with the sleep working the most one pod could log is 10/s). Each failed poll also logs a second error line for the NPE. signal_type is left as the SQL guess, dependency_timeout, because the schema enum could not be read to pick a closer value such as an unavailable-dependency or retry-storm type.
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] notificationservice (prod): Several threads write to the same Tomcat WebSocket session at once, with no locking. The second write fails with IllegalStateException [TEXT_PARTIAL_WRITING], and the notification it was carrying, already taken off ActiveMQ, is lost. One channel has one WS session but can have many subscriptions. Each subscription gets its own GetMessageTask, and all of them share that raw session on a 16-thread pool. ClientWebSocketHandler also replies on the same session from Tomcat threads. The exception is caught and logged twice rather than crashing anything, so the real impact is lost notifications, not instability. It shows up on 3 tenants, which points to a code defect rather than one tenant's config.
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG — "Change Workflow Status" popup clipped on left edge in Browse asset-detail view (text unreadable)
Fix
Product
Quark – QPP NG
Reference
ka#60489577
Status
Released
[stability] contentservice (uat): Readiness probes cannot borrow a JDBC connection in uat, and because the probe reuses the boot-time fatal gate DatabaseVerifier.verifyDatabaseVersion, every failed poll logs 'FATAL:Exiting server' while nothing exits. The pod stays alive but permanently NOT READY for both tenants, re-running an uncached SELECT against QPP_SCHEMA_CONTROL on every poll for 24h straight. The connection acquisition failure itself is environmental (the Quartz sibling shows SQLTransientConnectionException from an unrelated HikariPool), but the code turns one DB blip into a sustained, self-amplifying log flood and a readiness outage.
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG Excel Office Adapter (v5.1.0.0 / file 5.1.4.0, 2025 build) intermittently fails on document open — unhandled NullReferenceException in `WorkbookService.ValidateLinks` from `AddInHost.Application_WorkbookOpen`; first open fails, reload needed
Fix
Product
Quark – QPP NG
Reference
ka#60486945
Status
Released
Quark Author (QPP NG): residual bold/underline after delete+retype also occurs in the Notes pane — canvas fix does not reach it
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG Author — Pin to Version picker loads only the newest ~20 versions; older versions are unreachable and cannot be pinned (components with >20 versions)
Fix
Product
Quark – QPP NG
Reference
ka#60488338
Status
Released
Two flaky test failures from the R-2026.09.23 QA run: TC-413943 audit-log race (REST API), WebDriver teardown race (Web)
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG My Assignments: branched (non-origin) component versions show blank Status, Assigned To, Last Modifier and Workflow
Fix
Product
Quark – QPP NG
Reference
ka#60491359
Status
Released
Security 95
Update quark-qpp-analytics to resolve CVE-2026-41707, CVE-2026-47838, CVE-2026-47842, CVE-2026-59276
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Arbitrary file read via unsanitized filePath in downloadConfigurationsFromFilePath
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-quarkauthor to resolve CVE-2026-44249, CVE-2026-50010, CVE-2026-62243, CVE-2026-75595
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-quarkauthor to resolve CVE-2026-41284, CVE-2026-43512, CVE-2026-53434, CVE-2026-55955
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-quarkauthor to resolve CVE-2026-54512, CVE-2026-54513, CVE-2026-59889
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-quarkauthor to resolve CVE-2026-41855
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-quarkauthor to resolve CVE-2026-66257, CVE-2026-66273, CVE-2026-66274, CVE-2026-66275, CVE-2026-66276, CVE-2026-66277
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-quarkauthor to resolve CVE-2026-40983, CVE-2026-40984, CVE-2026-59295, CVE-2026-59296
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-quarkauthor to resolve CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-59903
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-quarkauthor to resolve CVE-2026-71290
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-tools to resolve CVE-2026-40971, CVE-2026-40974
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-tools to resolve CVE-2026-54512, CVE-2026-54513
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Reflected XSS in createSubscriber error response via unescaped channelId
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-tools to resolve CVE-2026-44249, CVE-2026-75595
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-auth-token-manager to resolve CVE-2026-62243
QPP NG Shared Env P3 Wave 2 (entry+mid-tier) — appservices/webapps/queryquest/etc.
New
Product
Quark – QPP NG
Reference
—
Status
Released
Fixes 4
QPP NG Workspace saved searches over 250 results cannot load their next page (queryquest/getNextResultSet returns 500): Refresh after a live-added row shows "Something went wrong." and scrolling stops at row 250
Fix
Product
Quark – QPP NG
Reference
ka#60492971
Status
Released
Quark Author (QPP NG): Phrase tag dropdown shows Normal after Enter (display-only; tag stored correctly)
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
automation service rejects tenant classpath templates from automationservice/ext with DISALLOWED_URI_SCHEME — custom PDF/JPEG/HTML publishing fails
Fix
Product
Quark – QPP NG
Reference
ka#60493474
Status
Released
uction Company Page "Guala Closures SpA" (asset 40217652) is invalidated and unrecoverable — duplicated/cross-labeled component structure fails Company Page validation; save and in-app Discard both return 400
Fix
Product
Quark – QPP NG
Reference
ka#60487591
Status
Released
Security 40
Update quark-qpp-analytics to resolve CVE-2026-66257, CVE-2026-66273, CVE-2026-66274, CVE-2026-66275, CVE-2026-66276, CVE-2026-66277
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-auth-token-manager to resolve CVE-2026-47857, CVE-2026-47863
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-analytics to resolve CVE-2026-47857, CVE-2026-47863
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-auth-token-manager to resolve CVE-2026-41711, CVE-2026-41721
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-auth-token-manager to resolve CVE-2026-41695, CVE-2026-41716
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-analytics to resolve CVE-2026-59949
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-commonmodules to resolve CVE-2026-47857, CVE-2026-47863
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-commonmodules to resolve CVE-2026-13006
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-commonmodules to resolve CVE-2026-68497, CVE-2026-89425, CVE-2026-91777
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-docuratedservice to resolve CVE-2026-34478, CVE-2026-34479, CVE-2026-34480
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-analytics to resolve CVE-2026-47874
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-docuratedservice to resolve CVE-2026-59295, CVE-2026-59296
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-analytics to resolve CVE-2026-87795, CVE-2026-87823, CVE-2026-87824, CVE-2026-87825, CVE-2026-87877
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-docuratedservice to resolve CVE-2026-47886, CVE-2026-59283
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-features to resolve CVE-2026-66257, CVE-2026-66273, CVE-2026-66274, CVE-2026-66275, CVE-2026-66276, CVE-2026-66277
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-docuratedservice to resolve CVE-2026-59280
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-features to resolve CVE-2026-40984, CVE-2026-59295, CVE-2026-59296
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-docuratedservice to resolve CVE-2026-89425, CVE-2026-91777
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-features to resolve CVE-2026-13006
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-messaging to resolve CVE-2026-66257, CVE-2026-66273, CVE-2026-66274, CVE-2026-66275, CVE-2026-66276, CVE-2026-66277
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-automationservices to resolve CVE-2026-59295, CVE-2026-59296
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-messaging to resolve CVE-2026-47857, CVE-2026-47863
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-automationservices to resolve CVE-2026-47857, CVE-2026-47863
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-messaging to resolve CVE-2026-40973, CVE-2026-40975
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-messaging to resolve CVE-2026-13006
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-automationservices to resolve CVE-2026-13006
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-messaging to resolve CVE-2026-47874
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-automationservices to resolve CVE-2026-59889
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-licensemanager to resolve CVE-2026-13006
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-automationservices to resolve CVE-2026-69854
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-automationservices to resolve CVE-2026-90711
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-automationservices to resolve CVE-2026-100655, CVE-2026-100656, CVE-2026-93488, CVE-2026-93491
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Quark Author (QPP NG): Preview ignores unsaved edits in checked-out component (conref) sections — publishing payload keeps the conref because the HTML sanitizer strips data-qxe-checkedout (regression since qaservice 5.8.7)
Security
Product
Quark – QPP NG
Reference
ka#60470479
Status
Released
SQL injection via selectprops in GET /analytics/auditlogs/extended (raw column projection/alias)
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Full tenant database export and import exposed without the enableConfigurationMigration privilege on the v3 trustee endpoints
Security
Product
Quark – QPP NG
Reference
—
Status
Released
SQL injection via time/date query-condition values inlined into generated WHERE clause (POST /api/v1/queryService/getQueryResultForConditions)
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-notificationservice to resolve CVE-2026-42583, CVE-2026-42587, CVE-2026-59901
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-notificationservice to resolve CVE-2026-45674, CVE-2026-47691
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-notificationservice to resolve CVE-2026-42587, CVE-2026-56819
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-notificationservice to resolve CVE-2026-42579
aiintegrationservice spins on empty Redis queues — ~1 core per tenant and ~30k Redis ops/s, 24x7, in UAT and prod
New
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG Shared Env P3 Wave 3 (leaf+licensemanager) — features/filescan/unifiedaccess
New
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-automationservices to resolve CVE-2026-19693
New
Product
Quark – QPP NG
Reference
—
Status
Released
The Content Director Agent adds content at the end of a section after its table, not inside the table's last cell
New
Product
Quark – QPP NG
Reference
—
Status
Released
[QPP NextGen] Improve revision-comment visibility in the Version History panel
New
Product
Quark – QPP NG
Reference
ka#60417754
Status
Released
QPP NG: Decommission datasheetservice (orphaned Azure-era service, zero consumers)
New
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG Shared Env P4.2 — Shared ActiveMQ (tenant-prefixed destinations)
New
Product
Quark – QPP NG
Reference
—
Status
Released
Enhancements 2
Support Microsoft Word modern comments (threaded replies) in Quark XML Author with full metadata integrity and round-trip
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
shared releases: route each tenant's log lines to its own log store with one collector per pod
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
Fixes 23
+ regression: FetchContentModel ignores ASSET_ID for tenant layout-option process copies without the new asset bindings, ContentModel.xml silently not written, PDF-Layout publishing fails at ResolveLayoutOptions ( down)
Fix
Product
Quark – QPP NG
Reference
ka#60495780
Status
Released
[stability] qpp-contentservice (dev): NotificationEvaluator's background run publishes notifications with an empty TenantContext: executeWithCapturedTenant fails to bind a tenant onto the worker thread, so the per-tenant ActiveMQ broker lookup (TenantBrokerBundles.forCurrentTenant) hits requireTenantId and throws, escaping Runnable.run uncaught on every evaluation cycle. NOTE: the service repo at /task/workspace was empty, so this diagnosis is read from the stack trace alone and no file or symbol below has been verified against the code.
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] qpp-contentservice (dev): System-session creation fails in multi-tenant dev: createSystemSession is called on a thread with no tenant bound, so TokenManager cannot choose between tenants automationdev and perfdev and throws TenantResolutionException (~8/min, likely a background job)
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] queryquestservice (dev): The ce-cdc-attribute-domain-values-v1 consumer throws an exception on individual records. The exception is caught and logged, the consumer keeps running, and the tenant's in-memory and Redis domain-value cache misses those records. The most likely trigger is the substring tenant filter key.contains(tenantId) in AttributeDomainValuesEventsProcessor.processMessage. On a topic shared by several tenants, it lets through keys from any other tenant whose id contains this tenant's id. The key parse then throws NumberFormatException. Because the listener replays the whole compacted topic from offset 0 on every start, the error keeps repeating on the one affected tenant. The SQL type 'unhandled_exception' overstates it: the exception is caught per record and nothing crashes. It is kept only because the schema enum could not be read to pick a closer value.
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Quark Author (QPP NG): figure shows a duplicate reference toolbar after the first Auto Burst On Save of a new Smart Document — still occurs with the Quark#374 fix
Fix
Product
Quark – QPP NG
Reference
ka#60387598
Status
Released
QPP NG: Complete searchservice retirement (superseded by queryquestservice) — remove stale scripts, dead code paths, repo
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
A disabled platform user 1 silently wedges four services: boot-time impersonation fails, the JVM stays up, and pod status reports healthy
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Quark AI (Content Copilot): Markdown renderer mis-renders prices, escapes, tables and paragraphs. Replace it with markdown-it
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Quark Author canvas: nested ordered lists render with bullet markers after a saved document is reopened
Fix
Product
Quark – QPP NG
Reference
ka#60437562
Status
Released
Asset Audit tab takes ~15 min for long-history assets: out-of-the-box Audit_Asset_Dashboard workbook joins its two Custom SQL relations on the whole JSONB message
Fix
Product
Quark – QPP NG
Reference
ka#60419161
Status
Released
qpp-devops §5.5 operator follow-up hardcodes https://<tenant>.app.quark.com — wrong for tenants with a non-slug host
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[QPP NextGen] Admin preference for the Document Structure toggle default (one setting, all document types; default = current behavior)
Fix
Product
Quark – QPP NG
Reference
ka#60387741
Status
Released
[QPP NextGen] Remove or increase the 100-template limit in the Authoring Template (New Document) picker
Fix
Product
Quark – QPP NG
Reference
ka#60417747
Status
Released
Failed-login lockout permanently disables the account with no recovery path — use temporary lockout with exponential backoff
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] eventrecorder (uat): ASSET CHANGED events for one tenant (partition ng_all_event_t_caclm) arrive with no messageProperties.OBJECT_NAME. The recorder binds that null into ng_all_event.objectname, which is NOT NULL, so the insert fails and the event is silently dropped from ng_all_event: no retry, no DLQ, no normalization. The exception is caught and logged once per event; it is permanent audit-log data loss, not a crash.
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] webapps (dev): Misclassified: this is not an exception. nginx writes a routine 404 for the browser's automatic GET /favicon.ico at [error] level because the landing page declares no icon and the image ships no /webapps/landing/favicon.ico. It is harmless log noise, not a stability fault; the true severity is low, not high. It is not tenant-specific: every tenant runs the same image and config. Only automationdev shows up because automated UI test runs keep opening fresh browsers on the root landing page (~50/hour; referrer '/'). Kept signal_type as the supplied 'unhandled_exception' only because the schema enum file was unreadable in this run; reclassify to the enum's not-found/noise category if one exists.
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] contentservice (dev, uat): Not an exception and not a failure: TextIndexingStatusListener logs ERROR on an expected Redis miss. It treats every CONTEXT_ID coming back on QCP_TEXT_INDEXING_STATUS_QUEUE as a bulk attribute-update context. But only AssetServiceImpl.updateAssetAttributes ever writes an AssetUpdateStatus. Reindex-job UUIDs and upload contextIds also travel on indexing messages, never have one, and so always miss. The indexing status attribute is still written after the miss, so nothing is lost. The severity 'high' is overstated; this is log noise.
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG Workspace: with "Search all versions" checked, search results list each matching asset version 2–4 times (count correct, rows duplicated; ad-hoc and saved searches)
Fix
Product
Quark – QPP NG
Reference
ka#60498895
Status
Released
[QPP NextGen] Paste plain text (without source formatting) on the authoring canvas
Fix
Product
Quark – QPP NG
Reference
ka#60387876
Status
Released
[stability] contentservice (qa): AsposeFilterImpl.generateRendition eagerly resolves an Aspose manager from the asset's FILE_EXTENSION before checking whether it even handles the requested rendition type, so it throws and logs once per unsupported rendition type per indexed asset. NOTE ON TYPE: the SQL guess 'unhandled_exception' is retained only because it is a confirmed member of the enum (the schema file is outside this sandbox and could not be read). It is not accurate — the exception IS handled: it is caught by `catch (Exception e)` at AsposeFilterImpl.java:414, logged, and swallowed. The thread does not die and the asset is never marked FAILED. If the enum has a config/mapping-error member, this should be re-typed to it. The real fault is a configuration/lookup mismatch that degrades silently: renditions go missing and nothing but this log line records it.
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG configuration import applies one content type's attribute mappings to another when a new content-type ID equals a later source ID (CANNOT_MAP_MULTI_VALUED_ATTRIBUTE / ATTRIBUTE_NOT_FOUND)
Fix
Product
Quark – QPP NG
Reference
ka#60500367
Status
Released
QPP NG configuration import fails a workflow with DUPLICATE_STATUS_TRANSITION, or saves wrong transitions, when a newly assigned status ID equals another status's source ID in the same workflow
Fix
Product
Quark – QPP NG
Reference
ka#60500394
Status
Released
[stability] queryquestservice (dev, uat): Log noise, not a crash: when an asset version has no TEXT rendition, bulk text indexing logs a full RenditionNotFoundException stack trace at WARN. The asset is still indexed with metadata only. The exception is actually caught and handled in DocBuilder.build, so the coarse 'unhandled_exception'/'high' label overstates it. The two sibling messages are the same single logger.warn(msg, e) call: the 'Error while downloading text rendition' line plus its attached trace.
Update quark-qpp-quarkauthor to resolve CVE-2026-45416, CVE-2026-45674, CVE-2026-47691, CVE-2026-56819, CVE-2026-59901
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-quarkauthor to resolve CVE-2026-41695, CVE-2026-41711, CVE-2026-41716, CVE-2026-41721
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-quarkauthor to resolve CVE-2026-78254
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-tools to resolve CVE-2026-42587
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Stored XSS: getDomainValueXml returns attacker-stored XML as a raw String, served as text/html under Accept negotiation
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Role license type and privilege rows mutable by any authenticated user via setLicenseOfUserClass
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Publishing channel-to-content-type mappings mutable by any authenticated user
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Publishing channel-to-content-type mappings and preview channels can be rewritten without the CreateModifyChannel / DeleteChannel privileges the platform defines
Security
Product
Quark – QPP NG
Reference
—
Status
Released
SQL injection via primary-key values in uploaded migration JSON (TrusteeService importCustomisations)
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Migration export/import endpoints on TrusteeService v3 require only authentication, no privilege
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Arbitrary file read via unvalidated `path` query parameter on GET /qaservice/smartcontent/loadimg
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-translationservice to resolve CVE-2026-54399, CVE-2026-54428
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-translationservice to resolve CVE-2026-40973, CVE-2026-40975
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-translationservice to resolve CVE-2026-42579
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-translationservice to resolve CVE-2026-41710
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-translationservice to resolve CVE-2026-68497
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-translationservice to resolve CVE-2026-78254
Security
Product
Quark – QPP NG
Reference
—
Status
Released
SQL injection: `selectprops` query param is concatenated verbatim into the audit-log SELECT list
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Asset bytes and pre-signed blob URLs served without the content privilege and collection ACL that sibling asset-download handlers enforce
Security
Product
Quark – QPP NG
Reference
—
Status
Released
FetchExternalTokenApi /external/accessToken: attacker-chosen URL plus unrestricted ${ENV} substitution exfiltrates server environment secrets (SSRF)
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-webhookinvocation to resolve CVE-2026-68497, CVE-2026-89425, CVE-2026-91777
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-webhookinvocation to resolve CVE-2026-93488, CVE-2026-93491
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-notificationservice to resolve CVE-2026-41840, CVE-2026-41841, CVE-2026-41842, CVE-2026-41843
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-notificationservice to resolve CVE-2026-41695, CVE-2026-41711, CVE-2026-41716, CVE-2026-41721
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-notificationservice to resolve CVE-2026-34478, CVE-2026-34479, CVE-2026-34480
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-notificationservice to resolve CVE-2026-68494
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-notificationservice to resolve CVE-2026-47857, CVE-2026-47863
Security
Product
Quark – QPP NG
Reference
—
Status
Released
deleteIndexedAssets: any authenticated user can evict arbitrary assets from the tenant search index without any collection-permission check
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-notificationservice to resolve CVE-2026-54399, CVE-2026-54428
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-notificationservice to resolve CVE-2026-40973, CVE-2026-40975
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-notificationservice to resolve CVE-2026-13006
Security
Product
Quark – QPP NG
Reference
—
Status
Released
recreateAssetsIndex lets any authenticated user wipe the whole shared assets index; the only gate is a caller-supplied confirmDestroy boolean, not an authorization check
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-notificationservice to resolve CVE-2026-68497
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-webhookregistration to resolve CVE-2026-41841, CVE-2026-41842, CVE-2026-41843
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-webhookregistration to resolve CVE-2026-40973, CVE-2026-40975
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-webhookregistration to resolve CVE-2026-13006
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-webhookregistration to resolve CVE-2026-47874
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-automationservices to resolve CVE-2026-47874
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Export CSV temp-file path is derived from a caller-controlled query name instead of the unique export contextId, so concurrent exports collide and one user's ACL-filtered rows can be uploaded into another user's blob
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-automationservices to resolve CVE-2026-68497, CVE-2026-89425, CVE-2026-91777
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-features to resolve CVE-2026-78254
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-authservice to resolve CVE-2026-88932
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Query-based asset export bypasses ARCHIVE_RESTORE_ASSETS_PRIVILEGE because the gate is keyed on caller-declared serviceNames, not on the work actually scheduled
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-tools to resolve CVE-2026-68497
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-auth-token-manager to resolve CVE-2026-68497, CVE-2026-89425, CVE-2026-91777
Security
Product
Quark – QPP NG
Reference
—
Status
Released
XXE: unhardened DocumentBuilderFactory parses attacker-supplied PromptRequest content on /quarky endpoints
Security
Product
Quark – QPP NG
Reference
—
Status
Released
recreateAssetsIndex: any authenticated user can wipe and rebuild the shared, all-tenant Elasticsearch index; the only guard is a caller-supplied boolean
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Any authenticated user can wipe the shared multi-tenant Elasticsearch assets index via POST /queryquest/api/v4/recreateAssetsIndex
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Any authenticated user can wipe and rebuild the shared Elasticsearch assets index via recreateAssetsIndex
Security
Product
Quark – QPP NG
Reference
—
Status
Released
generateTranslation clones assets under a hardcoded admin session (userId=1) because the caller's SecurityContext is clobbered by the config fetch
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-webhookregistration to resolve CVE-2026-59889
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-webhookregistration to resolve CVE-2026-68497, CVE-2026-89425, CVE-2026-91777
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-webhookregistration to resolve CVE-2026-93488, CVE-2026-93491
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Admin session elevation is never rolled back, so the caller's request finishes (and clones assets) as system user 1
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-translationservice to resolve CVE-2026-47857, CVE-2026-47863
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-translationservice to resolve CVE-2026-13006
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-translationservice to resolve CVE-2026-33558
Update quark-qpp-translationservice to resolve CVE-2026-68525, CVE-2026-68569, CVE-2026-68763
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-translationservice to resolve CVE-2026-89425, CVE-2026-91777
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-translationservice to resolve CVE-2026-47874
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-quarkauthor to resolve CVE-2026-40682, CVE-2026-42027, CVE-2026-42440
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-quarkauthor to resolve CVE-2026-47857, CVE-2026-47863
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-quarkauthor to resolve CVE-2026-50734, CVE-2026-53917
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-quarkauthor to resolve CVE-2026-13006
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Unrestricted server-side request forgery via attacker-supplied authTokenUrl in POST /external/accessToken, with server environment-variable exfiltration
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-quarkauthor to resolve CVE-2026-45292
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-quarkauthor to resolve snyk:lic:maven:org.languagetool:english-pos-dict:GPL-3.0, snyk:lic:maven:org.languagetool:hunspell-native-libs:(GPL-3.0_OR_LGPL-2.0_OR_MPL-2.0)
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-quarkauthor to resolve CVE-2026-75140
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-quarkauthor to resolve CVE-2026-68497
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-quarkauthor to resolve CVE-2026-41710
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-quarkauthor to resolve CVE-2026-68525, CVE-2026-68569, CVE-2026-68763
Security
Product
Quark – QPP NG
Reference
—
Status
Released
DB migrator licence steps call the retired Nalpeiron SaaS and clear users' licence types; skip them for QPP NG targets (blocks Lumen migration)
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-webhookregistration to resolve CVE-2026-69854
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-analytics to resolve CVE-2026-69854
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-analytics to resolve CVE-2026-89425, CVE-2026-91777
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-analytics to resolve CVE-2026-93488, CVE-2026-93491
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-analytics to resolve CVE-2026-90560
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-messaging to resolve CVE-2026-68497
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-messaging to resolve CVE-2026-74761
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-messaging to resolve CVE-2026-69854
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-applicationservices to resolve CVE-2026-90711
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-applicationservices to resolve CVE-2026-93435
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-notificationservice to resolve CVE-2026-68525, CVE-2026-68569, CVE-2026-68763
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-notificationservice to resolve CVE-2026-69854
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-notificationservice to resolve CVE-2026-89425, CVE-2026-91777
The Content Director Agent keeps every conversation working in the background and shows each one's status in every window
New
Product
Quark – QPP NG
Reference
—
Status
Released
[00044529] [QPP NG Adapters] PPT enhancement - Replace component from server
New
Product
Quark – QPP NG
Reference
ka#60388203
Status
Released
licensingservice: per-pod seat counter drifts across replicas and refuses checkouts Nalpeiron would allow
New
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] qaservice (prod): OfflineHelper casts LAST_CONTENT_UPDATE (a DateTimeValue) to TextValue, so /offline/smarthtmlinfo never returns lastContentUpdate or draft info for any qpp:// asset
New
Product
Quark – QPP NG
Reference
—
Status
Released
Fixes 27
[stability] aiintegrationservice (uat): A DNS failure resolving the tenant's contentservice host turns into a hot retry loop: ConversionPackInfoSyncThread.run places Thread.sleep inside the try block after the two calls that can throw, so the 5-minute pacing is skipped entirely on the failure path. 30,015 errors in a 22-minute window is ~22.4/sec (one attempt every ~45ms) against a configured interval of 300,000ms - about 6,700x the intended attempt rate. The dependency outage is the trigger; the misplaced sleep is the defect that made it a stability signal.
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] contentservice (qa): AsposeFilter accepts assets by MIME type but dispatches handlers by file extension, so lumentecqa's '.xas' assets route into the filter and fail every rendition stage, leaving them INDEXING_STATUS=FAILED
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] queryquestservice (uat): For merckuat, the scheduled retry DocBuilder.retryFailedAssets throws an NPE on every run (every 2 min) and retries the same assets forever. The cause is that DocBuilder.build(long,long,long,long) catches its own failure, logs the sibling 'Error indexing asset metadata and text rendition for FTS' line and returns null, and the retry loop calls indexedAsset.setProperty on that null. Because of the NPE, removeFailedAssetId is never reached. The asset stays in the Redis 'failedAssetIds' set, and while it is there ElasticSearchProvider.upsertDocument skips its live index updates, so its search document stays stale. The three merged messages are one fault: build failure, then NPE, then the retry catch-block log. The NPE is caught and logged, and it does not kill the scheduler thread.
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG Author/Workspace: tenant label overrides from conf/localization are intermittently discarded on load, so the Workflow pane shows "Submit" instead of the configured "Save"
Fix
Product
Quark – QPP NG
Reference
ka#60500509
Status
Released
[QPP NG][Web E2E] Flaky `TestCaseID_240984` ("Verify duplicating workflow"): no visibility wait in `Admin.verifyWorkflowDuplicated`
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG UAS configuration export can omit an attribute assigned to an exported content type without reporting any failure (Attributes.log shows Failed: 0)
Fix
Product
Quark – QPP NG
Reference
ka#60500456
Status
Released
QPP NG UAS configuration export omits attributes used only by the parent content types it auto-adds to the package; Attributes.log reports 0 failures
Fix
Product
Quark – QPP NG
Reference
ka#60500456
Status
Released
Translation instances API returns HTTP 500 (NullPointerException) when cloneMapping omits checkInAttributes
Fix
Product
Quark – QPP NG
Reference
ka#60501325
Status
Released
Smart Document save silently drops spaces next to bold/italic text, in list items and between spell-flagged words (words concatenated; worsens with each edit)
Fix
Product
Quark – QPP NG
Reference
ka#60501365
Status
Released
Quark Author (QPP NG): Insert Table stays enabled right after a table is inserted, so repeated clicks create nested tables
Fix
Product
Quark – QPP NG
Reference
ka#60501507
Status
Released
QPP NG Quark Author: MathType (WIRIS) equation cannot be inserted on the canvas — WIRIS editor fails to load (ERR_CONTENT_DECODING_FAILED) on deveu/qaeu
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Failed createDocument (Smart JSON) deletes a pre-existing Smart Section it reused by Name/Collection/Content Type with override:false
Fix
Product
Quark – QPP NG
Reference
ka#60501233
Status
Released
Failed createDocument (Smart JSON) leaves the new revision it wrote on a pre-existing Smart Section matched with override:true or with override omitted
Fix
Product
Quark – QPP NG
Reference
ka#60501250
Status
Released
[stability] contentservice (dev, uat): Not a crash, and not really unhandled: GET .../assetService/getAssetRenditionDownloadInfo asks for a rendition that the asset version does not have (type 6 = DefaultRenditionTypes.TEXT in the exemplar). AssetServiceLocalImpl throws the checked RenditionNotFoundException, and RestExceptionHandler returns it to the caller as HTTP 400 RENDITION_NOT_FOUND. The generic ServiceCallAroundAdvice logs every QppServiceException at ERROR, so an expected 'no such rendition' answer shows up as a high-severity error roughly 1,460 times a day on 6 tenants. The severity is overstated; the real problems are log-level noise plus a caller that keeps asking for renditions that don't exist. The type was kept as the SQL value because the schema enum could not be read in this sandbox. The signature normalizes #Argument3, so the same line also covers other rendition types; see the office-service note in suggested_fix.
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG Author: open Smart Document keeps showing a section component as checked out after the same user discards it in another tab; section Refresh does not clear it
Fix
Product
Quark – QPP NG
Reference
ka#60501526
Status
Released
QPP NG Browse leaks one watched query result per collection opened after the tab's watch session ends, until the user is blocked with TOO_MANY_USER_WATCHED_QUERIES
Fix
Product
Quark – QPP NG
Reference
ka#60500442
Status
Released
[stability] aiintegrationservice (uat): ConversionPackInfoSyncThread.run puts Thread.sleep inside the try block after the two calls that can throw, so any sync failure skips the 5-minute delay and the while(running) loop re-enters immediately. A steady-state fault becomes an unthrottled retry loop: observed volume is ~38 errors/min/tenant (one per ~1.6s) versus the 0.2/min the configured 300000ms interval allows — ~190x amplification. The log line is a symptom of the missing backoff; the underlying trigger is most likely Utility.createValidSessionContext failing, which is undetermined without a trace.
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] notificationservice (dev, prod, qa, uat): ClientWebSocketHandler.handleTextMessage throws a NullPointerException in the keepAlive branch. It unboxes the nullable Integer channel owner into a long when the socket has no listening channel, or when that channel's Redis key has expired or been deleted. The handler's catch-all catches the NPE and logs it as INVALID_TEXT_MESSAGE. The process never crashes, so the 'high' severity overstates the availability impact. But the handler has already replied "OK" before it throws, so the client never recovers and repeats the failing keepAlive on every interval. That explains the steady volume across 9 tenants and all four environments: this is a code defect, not tenant data. There is no stack trace, so the exact throw site is inferred from the code. It is the only null-unboxing on a per-interval path in this handler.
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG Admin > Workflow: Redefine Privileges dialog scopes a role's privileges to the wrong license — in-use Contributor roles get the Consumer list and their saved status overrides are hidden (regression from #24219)
Fix
Product
Quark – QPP NG
Reference
ka#60502551
Status
Released
QPP NG Workspace: "edit in context" from a branched Smart Section opens the non-branched parent document on the section's branchId — assetdetail returns BRANCH_NOT_FOUND and Quark Author stays blank
Fix
Product
Quark – QPP NG
Reference
ka#60502541
Status
Released
Quark Author: choosing any Bullet Style / Numbering Style option invalidates the document on save for document types whose grammar does not allow list types
Fix
Product
Quark – QPP NG
Reference
ka#60502857
Status
Released
automationservice: QXPS health indicator fails readiness closed, so QXPS cannot be made optional per tenant
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] contentservice (prod): AssetDraftUploadListener has no UPLOAD_SCAN_INFO handler: every virus-scanned draft upload logs ERROR and the draft context keeps its 120s TTL through the scan
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] automationservice (dev, prod, qa): AssetUtil (external qcep-common-utils 5.8.14) parses non-XML asset/response bytes as XML on publish request threads; Xerces prints bare '[Fatal Error]' lines to stderr and AssetUtil then logs 'Not a valid XML' at ERROR. The exception is caught and logged, so it is not really unhandled; the type is kept only because no better enum value could be checked. The AssetUtil method involved and whether publishes fail are not visible in this clone.
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Quark Author (QPP NG): with "Prompt to Resolve Checked-Out Sections on Discard" on, leaving the Author home or New Document page stalls ~2 s and shows the page being left again
Fix
Product
Quark – QPP NG
Reference
ka#60501557
Status
Released
[stability] contentservice (prod, uat): AssetDraftUploadListener has no UPLOAD_SCAN_INFO branch: every virus-scanned draft upload logs ERROR and the draft context TTL is not suspended during the scan
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Quark Author (QPP NG): Delete in the Document Structure ⋮ menu of the "+ Add Section" entry removes it, leaving no way to add a section until the document is reopened
Fix
Product
Quark – QPP NG
Reference
ka#60502654
Status
Released
Security 50
SQL injection via date/time query condition values in POST /api/v1/queryService/getQueryResultForConditions
Security
Product
Quark – QPP NG
Reference
—
Status
Released
setLicenseOfUserClass mutates a role's license and strips its enabled privileges without createModifyUserClasses
Security
Product
Quark – QPP NG
Reference
—
Status
Released
getAssetPublicUrl hands out a directly fetchable blob URL for any asset id without an accessibility check
Security
Product
Quark – QPP NG
Reference
—
Status
Released
WS-session override leaves a stale reverse mapping; the old session's close then tears down the live client's channel
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-analytics to resolve CVE-2026-76183
Security
Product
Quark – QPP NG
Reference
—
Status
Released
createGetMessageTask checks for an existing task under lock but adds the new one outside it, so concurrent entrants create duplicate pollers/listeners for one subscriptionId
Security
Product
Quark – QPP NG
Reference
—
Status
Released
importConfigurations performs a privileged, destructive configuration overwrite with no privilege check, unlike its sibling export endpoint
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Zip-manifest path traversal: attacker-controlled `chunkedFiles` names in uploaded import package resolve outside the temp dir and are read/forwarded (arbitrary local file read)
Security
Product
Quark – QPP NG
Reference
—
Status
Released
GET /analytics/auditlogs/assetlogs/{assetid} ignores the asset id and returns every audit log for the tenant
Security
Product
Quark – QPP NG
Reference
—
Status
Released
GET /analytics/auditlogs/assetlogs/{assetid} ignores assetid and returns the tenant's entire unfiltered audit log
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Audit-log `limit` is uncapped and `limit <= 0` drops the LIMIT clause entirely, materialising and JSON-serialising the whole table on the request thread
Security
Product
Quark – QPP NG
Reference
—
Status
Released
HMAC request authentication is hard-coded off, making the privileged webhook endpoint fully unauthenticated despite the documented `hmac.validation.enable` control
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Script service REST API (create/update/execute/delete server-side scripts) is authenticated but has no authorization check anywhere
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Any authenticated caller can zero out license/metering consumption via the client-supplied `reset` flag on PUT /license/constraints[/{id}]
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Any authenticated caller can enumerate and delete other users' license activations via GET /license/getLicenseCodeActivity + GET /license/deleteUserForLicenseCode
Security
Product
Quark – QPP NG
Reference
—
Status
Released
updateAsset writes asset metadata through the unproxied local bean, skipping the attribute-change privilege gate its setAttributeValues siblings enforce
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Constraint quota check is a non-atomic read-check-write; concurrent PUTs to /license/constraints/{id} (or the bulk endpoint) each pass the availability guard and then overwrite each other's absolute consumption write, granting N× the licensed units while the meter records 1×
Security
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] applicationservice (dev, uat): The WARN means an exception reached ControllerErrorHandler.catch after the response had already been sent. guardAgainstSentResponse then swallows that exception without logging it or the route. Three code paths in applicationservice do this. (1) @Res handlers return the Express `res` into the global JsonStringInterceptor, whose JSON.stringify(res) throws a circular-structure TypeError on every successful call. (2) BlobFacade.downloadBlob calls response.end and then reject when a blob download fails. (3) Every CsrfGuard 403: the guard writes the response and Nest then throws ForbiddenException, which is the path this guard was built for. The type label and 'high' severity overstate it. The client has always already had its response, so this is mostly log noise hiding real errors. The user-visible part is path (2), where a failed blob fetch returns an empty 200. The dominant producer cannot be read from the line and needs the split in evidence_query.
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Unvalidated sourceDataUri/templateUri in ChartingService reaches automation-service fetch (SSRF), while sibling Publishing/Office paths validate the same sink
Security
Product
Quark – QPP NG
Reference
—
Status
Released
getAssetBlob streams raw asset bytes with neither the collection ACL nor the content-type privilege its sibling getAssetDownloadInfo enforces
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-automationservices to resolve CVE-2026-76183
Security
Product
Quark – QPP NG
Reference
—
Status
Released
filterBy left-operand column name is spliced into SQL behind a blocklist instead of an allow-list
Security
Product
Quark – QPP NG
Reference
—
Status
Released
reassignQuery transfers ownership of any user's saved query without the ownership check every sibling query mutator enforces
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-commonmodules to resolve CVE-2026-76183
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-docuratedservice to resolve CVE-2026-68525, CVE-2026-68569, CVE-2026-68763, CVE-2026-76183
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-features to resolve CVE-2026-68525, CVE-2026-68569, CVE-2026-68763, CVE-2026-76183
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-licensingservice to resolve CVE-2026-76183
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-licensemanager to resolve CVE-2026-76183
Security
Product
Quark – QPP NG
Reference
—
Status
Released
ConfigurationManager.updateChannel mutates channelMap and ChannelConfig-ext.xml under only a READ lock — it is missing from getMethodsForWriteLock
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Publish/status-change handler acts on an attacker-supplied OBJECT_ID under a hard-coded impersonated userId=1 session, and its error path rewrites the asset's workflow and status even when publishing fails
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Hardcoded API bearer tokens committed to the repo are the sole authentication for every v3 HTTP endpoint
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Arbitrary OS command execution via unsandboxed script create/execute endpoints (Rhino GlobalScope exposes runCommand/spawn)
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Mutable action tag on privileged image-build/push step (build-multiarch-docker@main) violates the file's own SHA-pinning invariant
Security
Product
Quark – QPP NG
Reference
—
Status
Released
ChartingService URI parameters (sourceDataUri, templateUri) reach the Automation Service fetch with no scheme/host validation and no privilege gate, unlike the Publishing and Office siblings
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Authentication middleware for /export/configs is bypassable: Express matches routes case-insensitively, the guard matches the URL case-sensitively
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Per-asset lock taken during collection push is never released; async unlock checks isHeldByCurrentThread on a different thread
Security
Product
Quark – QPP NG
Reference
—
Status
Released
SQL injection through the left-operand column name of the `filterBy` expression on /analytics/auditlogs/extended
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Un-parenthesized caller-supplied filter expression on /analytics/auditlogs/extended turns the mandatory tenant predicate into one disjunct, exposing every tenant's audit events
Security
Product
Quark – QPP NG
Reference
—
Status
Released
SQL injection via filterBy column operand in GET /analytics/auditlogs/extended (raw identifier)
Security
Product
Quark – QPP NG
Reference
—
Status
Released
SQL injection via unvalidated `selectprops` tokens concatenated into audit-log JSON query
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Filter column-name (left operand) concatenated raw into SQL in validateFilterExpression with only substring blocklist
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Config-mutating v5 translation endpoints have no authorization check and write global config with a hardcoded admin token
Security
Product
Quark – QPP NG
Reference
—
Status
Released
SQL injection via unvalidated `selectprops` column list in GET /analytics/auditlogs/extended
Security
Product
Quark – QPP NG
Reference
—
Status
Released
GET /api/product/all wipes every product's UDF definitions from the database
Security
Product
Quark – QPP NG
Reference
—
Status
Released
createGetMessageTask emits one unconditional INFO log per existing task while holding the lock the message-dispatch loop needs, and startSubscribers calls it once per subscription
Security
Product
Quark – QPP NG
Reference
—
Status
Released
createGetMessageTask logs one INFO line per existing task while holding the global getMessageTasks monitor, on the WebSocket container thread
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Override of a channel's listening WebSocket leaves a stale reverse mapping, so the old session's close tears down the new session's live channel
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Unescaped attacker-supplied CUSTOM changeType is interpolated into the deployment-global SNS filter-policy JSON / Service Bus SQL rule
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Authenticated tenant can inject into the Azure Service Bus SQL-92 rule filter via a CUSTOM webhook changeType (registerWebhook)
Security
Product
Quark – QPP NG
Reference
—
Status
Released
WebSocket close unconditionally deletes the channel's listening-session binding, tearing down a channel that a newer session has already rebound (and scheduling its subscribers for unsubscription)
Changes in this release that may require action on your side before or after upgrading.
⚠ When defining a publishing process programmatically, the HTML-to-SmartHTML home must be referenced via its environment variable rather than a hard-coded path. New in 5.8.22
Impact / needed checksIf your integration creates or updates publishing processes, point the HTML-to-SmartHTML home at the provided environment placeholder; a literal file path is now rejected and the create/update call will fail.
WorkaroundUpdate any publishing-process definitions that use a literal path to use the environment placeholder.
⚠ Known issues 4
Known issues identified for this release, with the checks to run. This list is a permanent record for the release.
⚠ Comments added in Microsoft Word on a document body may not be retained after the document is saved back unchanged. Pre-existing
Impact / needed checksAfter saving, re-verify that Word-authored comments and their replies are still present.
WorkaroundRe-add any missing comment before publishing; contact Quark support if it recurs.
⚠ Restoring an asset immediately after deleting it (keeping the same asset ID) can, in rare cases, remove the restored file. Pre-existing
Impact / needed checksAfter restoring a just-deleted asset with its original ID, confirm the restored file is present; re-upload it if it is missing.
WorkaroundLeave a short gap between deleting and restoring the same asset, and verify the file opens after the restore.
⚠ Edits made to a component opened in context are not auto-saved while the parent document is read-only. Pre-existing
Impact / needed checksWhen editing a component in context, save it explicitly (or open the component directly) — don't rely on autosave while the parent is read-only.
⚠ Inserting content from Excel can merge adjacent empty cells into a single spanned cell. Pre-existing
Impact / needed checksAfter inserting an Excel table, check for unintended merged/empty spanned cells and correct them before publishing.
WorkaroundRe-split or re-enter the affected cells manually.
New Features 18
contentservice: MIME-type and XA document config edits reach only the pod that made them
New
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG: automationservices is pinned to commonmodules 5.8.14, six releases behind — adopt the current release
New
Product
Quark – QPP NG
Reference
—
Status
Released
authenticationservice can't scale past 1 replica: login session state is held in per-pod memory
New
Product
Quark – QPP NG
Reference
—
Status
Released
Switch ConvertCsvToHtmlUsingFtl and GetQPPAssetContent off the XML-parsing asset download
New
Product
Quark – QPP NG
Reference
—
Status
Released
notificationservice / web client: a tab whose notification channel expires stays connected but never receives live updates again until reload (INVALID_TEXT_MESSAGE NPE, no client recovery)
New
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] applicationservice (prod, uat): BFF sends empty attributeIds lists to platformservices (attribute facades have no empty-list guard), which rejects them with 400 NO_ATTRIBUTE_SPECIFIED
New
Product
Quark – QPP NG
Reference
—
Status
Released
The Content Director Agent delivers messages sent while the Content Author works, and stays responsive with a long sub-agent thread open
New
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] authenticationservice (qa): qa SAML config has no certificate, so SamlStrategy.configureStrategy throws 'idpCert is required' and retries every 10s forever, leaving SSO permanently unregistered
New
Product
Quark – QPP NG
Reference
—
Status
Released
[QPP NextGen] DiffX Compare Revisions pairs a deleted list item with a distant, weakly similar item instead of its positional neighbour (DeltaXML pairs positionally)
New
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG Shared Env P4.4 — Shared qaservice (one Quark Author service per cell)
New
Product
Quark – QPP NG
Reference
—
Status
Released
contentservice: remove unused SECRET_KEY injection that blocks startup without <tenant>-jwttoken
New
Product
Quark – QPP NG
Reference
—
Status
Released
licensingservice: NalpeironIntegration JSON-parses a plain-text 404 body from the license manager, producing 150-line stack traces
New
Product
Quark – QPP NG
Reference
—
Status
Released
[QPP NextGen] PDF/AI/EPS previews route to QXPS regardless of content type (Aspose path disabled) — blocks per-tenant QXPS retirement
New
Product
Quark – QPP NG
Reference
—
Status
Released
[00109684] Alert should come when demoting any section which may have nested section and document structure will convert it automatically to Region
New
Product
Quark – QPP NG
Reference
ka#60387861
Status
Released
docuratedservice: scheduled pushes and status polling run once per replica (in-memory Quartz, no lock)
New
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG: move GitHub-hosted Linux CI jobs to FleetRunner
New
Product
Quark – QPP NG
Reference
—
Status
Released
The web apps' health poll renews a lapsed access token instead of reporting the server lost or ending the session
New
Product
Quark – QPP NG
Reference
—
Status
Released
Hand MCP sign-in to the tenant's regular QPP sign-in page through a Keycloak plugin
New
Product
Quark – QPP NG
Reference
—
Status
Released
Enhancements 5
[QA Gap][P0] Web Author comments coverage end-to-end — wire existing tests, add API round-trip, cover threaded replies
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG shared releases: startup config sync from S3 does not scale with tenant count
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
licensingservice: verify each configured Nalpeiron licence code matches its role (profilename) at startup
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
[QA Gap][P1] API authoring cert run stops early on a dangling setNextRequest: 19 folders of the 5.x collection never run
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
[QA Gap][P0] Wire publishing OUTPUT verification into the cert — API_Publishing pytest suite exists but runs nowhere
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
Fixes 23
[stability] eventrecorder (prod): Prod eventrecorder predates the V24 fix: ng_all_event.objectname NOT NULL silently drops ASSET CHANGED audit events that carry no OBJECT_NAME
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
applicationservice can't scale past 1 replica: bulk asset download hangs and config imports reach only one pod
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] webapps (prod): Locksmith editor plugin re-POSTs the same leaked undo-lock stack to /smartcontent/logError every 30s and never stops, even after the editor is destroyed
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] queryquestservice (prod, uat): DocBuilder.cleanup swallows its XML-parse failure and leaks a tmp_updated_*xml temp file per occurrence; its success path leaks the raw rendition temp file
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] webapps (prod): Spell-check dialog CSS loads error-icon.png from root /assets/, but the author app is served under /author/, so the icon 404s and nginx logs [error]
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Quark Author (QPP NG): Insert Document Cross Reference silently does nothing when the target Smart Document has no Global ID / Title (DITA) value — picker stays open and further Open clicks are ignored
Fix
Product
Quark – QPP NG
Reference
ka#60504119
Status
Released
Fix 3 failing quark-qpp-automation web E2E tests from release 5.8.21 validation run (not product regressions)
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Change Workflow of Checked In Asset (3000006): UI checks the asset's current status but the server checks the target status, so status changes are offered then rejected, or hidden although allowed
Fix
Product
Quark – QPP NG
Reference
ka#60505067
Status
Released
QPP NG Workspace: users signed in with SSO are redirected to the "Manage password" page when they click Share on a saved search
Fix
Product
Quark – QPP NG
Reference
ka#60505024
Status
Released
QPP NG Workspace searches return 0 or unrelated results when the Text "matches" term contains '&' or '#' (term truncated before it reaches queryquestservice)
Fix
Product
Quark – QPP NG
Reference
ka#60505021
Status
Released
Quark Author (QPP NG): saving a Smart Document appends "px" to every non-px table column width (1.172in → 1.172inpx, 2.5cm → 2.5cmpx, 2* → 2*px), corrupting the stored XML and breaking PDF preview of those tables
Fix
Product
Quark – QPP NG
Reference
ka#60506180
Status
Released
[stability] notificationservice (qa): The ActiveMQ REST poll loop in NotificationServiceTopicListener has no backoff on its failure path, so a ~33s outage of the qa-activemq broker turned into a hot spin at ~17 requests/second. Note the error is 'Connection refused' (broker not listening), not a read timeout: the broker being briefly down in one QA tenant is the trigger, but the defect worth fixing is the amplification -- Thread.sleep(100) is skipped whenever the poll throws, and a swallowed exception then guarantees a second, empty-message NullPointerException on every failed iteration.
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] translationservice (prod): TranslationServiceImpl.getTranslations swallows featureservice config-read failures as 'no translations', silently skipping auto-translation and logging 3 traces per asset event
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
automationservice can't scale past 1 replica: channel changes reach only the pod that made them
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[QPP NextGen] PdfRenderer activity depends on QXPS (no Aspose fallback) — inline-PDF publish/preview fails when QXPS disabled
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG shared releases: startup config fetch missing in contentservice/qaservice and inconsistent across services
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] webapps (prod, uat): QppSharedModule app initializer GETs applicationconfigservice/config before the pwt token is refreshed, so the nginx gateway 401s it and logs ERROR
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG SSO: /auth/forcelogin shows the non-forced SSO button, so forced re-authentication never sends ForceAuthn to the IdP
Fix
Product
Quark – QPP NG
Reference
ka#60507725
Status
Released
Quark Author (QPP NG): attribute-linked content variables that get their value after a document's first save always show placeholders on the canvas with Show Variable Values on (Variables tab and PDF show the value)
Fix
Product
Quark – QPP NG
Reference
ka#60507678
Status
Released
[QPP NextGen] DiffX Compare Revisions flags images as deleted+inserted when only the image pin/version state changes (DeltaXML does not)
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
5.8.21 webhook service silently deactivates existing CUSTOM-event webhooks whose changeType contains a space (Quark#4449/#4450 cleanup): customer automation broken on upgrade with no notice
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[QPP NextGen] Pre- and post-generation extension points for Excel-to-Smart-Table conversion (per-range outcome reporting)
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
publishCustomEvent accepts CUSTOM change types that webhook registration rejects (e.g. 'CC EVENT20'), so the events are silently dropped
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Security 40
POST /importConfigurations performs no privilege validation while its sibling export handler does
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Concurrent export/import requests clobber each other's temp and backup paths held in static fields
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Any authenticated user can terminate any other user's or any OAuth client's sessions via /api/v3/sessionService/invalidate*
Security
Product
Quark – QPP NG
Reference
—
Status
Released
canPushAsset privilege check runs under a hard-coded impersonated session (userId 1) instead of the caller, neutralising the only per-asset authz gate on the push endpoints
Security
Product
Quark – QPP NG
Reference
—
Status
Released
PostgreSQL credentials and RDS endpoint hardcoded in tracked deployment config
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Authenticated RCE: /publisher/api/v*/createProcess parses attacker-supplied Spring bean XML, instantiating arbitrary classes (e.g. ProcessBuilder) with arbitrary constructor args and init-method
Security
Product
Quark – QPP NG
Reference
—
Status
Released
DELETE /attribute-link removes persisted content-model attribute bindings with no privilege check
Security
Product
Quark – QPP NG
Reference
—
Status
Released
SSRF via unvalidated nextLink query param in queryservice getNextResultSet
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Expired-channel cleanup thread drains at most one channel per 60 s, so ActiveMQ consumers and the Redis cleanup list grow without bound
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Arbitrary file read via attacker-chosen `file:` URI scheme on GET /attachmentservice/attachment
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Arbitrary file write/overwrite via attacker-chosen `file:` URI on POST /smartcontent/content
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Channel-expiry cleanup drains at most one channel per 60 seconds while producers push one entry per channel creation and per WebSocket close
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Indexed document content readable outside the caller's accessible collections via getDocuments + getDocumentFragments
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Expired-channel cleanup drains exactly one channel per 60s, so ActiveMQ subscribers for expired channels accumulate without bound
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Reflected XSS: /smartcontent/unpinneduri (and /pinneduri) echoes raw request parameter into a String response body whose Content-Type is negotiated from the browser's Accept header (text/html)
Security
Product
Quark – QPP NG
Reference
—
Status
Released
getAllDomainsValue issues one hierarchy query per domain value, unbounded and unpaginated
Security
Product
Quark – QPP NG
Reference
—
Status
Released
GET /modelling/models/linkToContentType performs a model update without the CREATE_MODIFY_CONTENT_MODELS check its POST equivalent enforces
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Late close of a superseded WebSocket session revokes the reconnected session's live channel: expiry is set and all its ActiveMQ subscribers are queued for unsubscribe
Security
Product
Quark – QPP NG
Reference
—
Status
Released
setChannelWithContentTypeMappings wipes every other publishing/delivery channel mapping of the targeted content types
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Reflected XSS in closeChannel error response via unescaped channelId
Security
Product
Quark – QPP NG
Reference
—
Status
Released
SQL injection via importCustomisations JSON primary-key values concatenated unescaped into WHERE clause (numeric-column branch)
Security
Product
Quark – QPP NG
Reference
—
Status
Released
No per-caller authorization scope: tenant/product filtering on v3 licence endpoints is an optional caller-supplied query parameter, and activation-client tokens carry the same privilege as admin tokens
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Kafka CDC consumer deserializes untrusted payloads with Spring JsonDeserializer trusted-packages set to "*", allowing attacker-chosen target classes via the __TypeId__ record header
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Cookie-borne JWT accepted while CSRF protection is explicitly disabled for /queryquest/api/v*/**, allowing cross-site invocation of the destructive index-wipe endpoint
Security
Product
Quark – QPP NG
Reference
—
Status
Released
/external/accessToken lets any authenticated user read arbitrary server environment variables and ship them to an attacker-chosen URL
Security
Product
Quark – QPP NG
Reference
—
Status
Released
A thrown exception during author import skips the backup restore and the lock cleanup, leaving configuration half-applied
Security
Product
Quark – QPP NG
Reference
—
Status
Released
A failed preference read silently wipes the user's entire proofreader dictionary
Security
Product
Quark – QPP NG
Reference
—
Status
Released
User-dictionary failures log a bare string: SLF4J arg dropped, no userId, no exception
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Referenced sections lose their citation types, so POST /models/dependentContentTypes silently omits citation-burst dependencies
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Concurrent exports of the same saved query collide on one shared temp CSV path, corrupting or destroying each other's export
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Recursive multi-collection search silently drops all but the last collection's accessible-collection map
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-licensemanager to resolve CVE-2026-89425, CVE-2026-91777
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Every advanced-search request opens an Elasticsearch point-in-time with a 300-minute keep-alive that is never closed
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Trustee/group caches are plain HashMaps mutated by the Kafka listener thread while every search request reads them, causing intermittent 500s and wrong access filtering
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Client-supplied forceMerge=true triggers a whole-index force-merge to one segment on the shared assets index, fire-and-forget
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Every attribute-domain-value CDC message rewrites the entire domain cache to Redis one field per round-trip, making startup replay quadratic
Security
Product
Quark – QPP NG
Reference
—
Status
Released
createAttributeValueArray dereferences a null array for multi-valued domain attributes, guaranteeing a NullPointerException
Security
Product
Quark – QPP NG
Reference
—
Status
Released
PublishAssetOnAssetChange_SOP throws ArrayIndexOutOfBoundsException on a zero-length array, 500-ing the endpoint whenever the asset actually qualifies for publishing
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Webhook returns 202 Accepted before the handler is resolved — unknown handlerId or an unparseable message silently drops the event
Security
Product
Quark – QPP NG
Reference
—
Status
Released
[QA Gap][P0] Author serialization round-trip pack — the sanitizer regression class (4 of 14 confirmed regressions)
Known issues identified for this release, with the checks to run. This list is a permanent record for the release.
⚠ A content type created immediately before a configuration export can be left out of the export package, and the resulting import can time out. New in 5.8.23
Impact / needed checksWhen moving configuration between environments, a content type added just before the export may be missing its model in the package; importing such a package can fail with a timeout.
WorkaroundCreate new content types a little ahead of the export (not immediately before it), and confirm the export package includes their models before importing.
⚠ On certain documents, PDF publishing can hang instead of completing. New in 5.8.23
Impact / needed checksA specific document can cause a PDF publish to run until it times out rather than finishing. The underlying rendering component is unchanged in this release.
WorkaroundCancel and retry the publish; if the same document hangs again, report it to Quark support so the content can be examined.
⚠ A user whose license type is "admin" (not the built-in Administrator account) cannot be revoked through the normal license check-in. New in 5.8.23
Impact / needed checksLicense revocation protects the built-in Administrator by account, but also skips any user assigned an "admin" license type, so that user's license cannot be revoked by the standard check-in.
WorkaroundIf you need to revoke such a user, contact Quark support to complete the revocation.
New Features 24
contentservice JMS queue consumers do not resume consuming after the tenant ActiveMQ broker restarts, stalling every check-in and draft save until contentservice is restarted by hand
New
Product
Quark – QPP NG
Reference
—
Status
Released
updateAsset bypasses all attribute-level privilege checks that gate setAttributeValues/setAttributeValuesForAssetVersion
New
Product
Quark – QPP NG
Reference
—
Status
Released
[Low] Workspace: asset Links pane sub-option not retained when expanding to details view
New
Product
Quark – QPP NG
Reference
—
Status
Released
Office adapters: Create Branch / Switch Branch stay disabled after Save to Server until the ribbon is refreshed (regression from quark-qpp-integrations#111)
New
Product
Quark – QPP NG
Reference
—
Status
Released
publishing-extended REST tests depend on tenant settings that no publishing-extended seed applies (13 quarantined tests)
New
Product
Quark – QPP NG
Reference
—
Status
Released
PowerPoint adapter: Insert Slide(s) / Insert Deck stay disabled in Reuse Slides from Server after a deck is picked (regression from quark-qpp-integrations#111)
New
Product
Quark – QPP NG
Reference
—
Status
Released
Quark Author: edits to a component opened inside a read-only parent document are never autosaved (TestCaseID_309775, bug 141289)
New
Product
Quark – QPP NG
Reference
—
Status
Released
Web test TestCaseID_239877 is timing-dependent: verifyCollectionQuickAction checks the collection panel without waiting for it to open
New
Product
Quark – QPP NG
Reference
—
Status
Released
qpp-devops §6: transient-startup retry is withheld on every tenant re-deploy because infra-bootstrap is idempotent-skipped
New
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG importCollections with override=false still updates existing collections and replaces Home's users
New
Product
Quark – QPP NG
Reference
—
Status
Released
Author: host answerCheckoutGateRequest holds its own 2000 ms engine lookup on engine-less routes
New
Product
Quark – QPP NG
Reference
—
Status
Released
Author: dirty-path discard on a home route waits up to 2 x ENGINE_LOOKUP_TIMEOUT_MS for an engine the route never publishes
New
Product
Quark – QPP NG
Reference
—
Status
Released
Web Author Excel table insert merges empty cells into colspan=2 (DefectsRegression 309768)
New
Product
Quark – QPP NG
Reference
—
Status
Released
5.8.22 QA: REST test TC-426520 createPublishingProcess rejected with 400 by the process-definition guard (htmlToSmartHtmlHome)
New
Product
Quark – QPP NG
Reference
—
Status
Released
PowerPoint: Smart Content pane "Update All" does nothing when a newer version exists
New
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG: Replace WIRIS MathType with an open-source math stack (MathLive + MathJax) — assessment & migration plan
New
Product
Quark – QPP NG
Reference
—
Status
Released
Pin applicationservice token verification to the tenant realm's internal issuer
New
Product
Quark – QPP NG
Reference
—
Status
Released
Pin authenticationservice token verification to the tenant realm's internal issuer
New
Product
Quark – QPP NG
Reference
—
Status
Released
Pin the per-tenant Quark Author service decoder to the tenant realm's internal issuer
New
Product
Quark – QPP NG
Reference
—
Status
Released
Pin the docuratedservice token decoder to the tenant realm's internal issuer
New
Product
Quark – QPP NG
Reference
—
Status
Released
The Copilot's inserted sections keep the section type's default "Section Body" text
New
Product
Quark – QPP NG
Reference
—
Status
Released
Opening a Copilot conversation does not wait on its sub-agent transcripts, and finished sub-agent cards show no loading
New
Product
Quark – QPP NG
Reference
—
Status
Released
regression-web search scenarios depend on qaeu tenant settings that no web seed applies (TestCaseID_311593, 356868, 356908)
New
Product
Quark – QPP NG
Reference
—
Status
Released
Asset restore with retainAssetId=true loses content when the asset was deleted moments earlier: pending async blob deletes remove the restored file (TC410003, TC410010)
New
Product
Quark – QPP NG
Reference
—
Status
Released
Enhancements 5
[QA Gap][P1] Quarantine governance + newly-failing gate — stop disabled/dropped tests from silently outliving the defects they detect
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
[QA Gap][P1] UAS config export/import round-trip — the UAT→prod promotion path has zero coverage and fails silently
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
[QA Gap][P0] Partner / tenant-custom (ext/) template publishing scenario in every cert
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
[QA Gap][P1] Privilege matrix per license tier — save → reopen → re-display round-trip
[QPP NextGen] DiffX Compare Revisions drops a newly inserted equation (content loss) — DeltaXML shows it
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
qaservice can't scale past 1 replica: content-model changes reach only the pod that made them
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
[QPP NextGen] DiffX Compare Revisions mis-draws merged-row tables (adds a spurious column, shifts cells) — DeltaXML does not
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
qcpeventrecorder writes every audit event three times; reporting still reads the legacy pair, so 63 GB cannot be reclaimed
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Quark Author canvas and PDF output show different numbers for a Continue Numbering list when the list above uses a different numbering style
Fix
Product
Quark – QPP NG
Reference
ka#60510148
Status
Released
QPP NG Workspace: attribute ids sent to queryservice/assetsVersionAttributes (e.g. when a branch is picked in Browse) become hidden columns of every later search and collection browse on the same applicationservice process
Fix
Product
Quark – QPP NG
Reference
ka#60510576
Status
Released
Quark Author (QPP NG): REFERENCE NOTES pane and table-note cross-references letter table notes continuously across tables (a, b, c, d) when the tables have no id, while the canvas restarts at "a" in each table
attribute-link save/remove deletes the content-model Redis keys and nothing re-creates them; Layout Options PDF publishing then fails with FETCH_CONTENT_MODEL_CACHE_MISS until the model is re-saved
Fix
Product
Quark – QPP NG
Reference
ka#60510397
Status
Released
Word-authored body-level comment and its replies are dropped when qaservice html is saved back unchanged
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Quark Author: opening a reference-heavy document triggers HTTP 429 "Too many Requests" and sections whose requests were rejected stay on "Loading section..." indefinitely
Fix
Product
Quark – QPP NG
Reference
ka#60513762
Status
Released
QPP NG search fails with DATA_INTEGRITY_VIOLATION ("Showing 0 results") when a multi-valued list column's joined values exceed 2048 characters; with "Search all versions" the values of all older versions are joined together
Fix
Product
Quark – QPP NG
Reference
ka#60510558
Status
Released
Quark Author (QPP NG): document Layout Options and attribute-linked root variables are silently dropped on every save when the stored document has no root <meta> (root auxiliary sent as <undefined name="undefined">)
Fix
Product
Quark – QPP NG
Reference
ka#60510396
Status
Released
(QPP NG 5.8.2): search-index documents for component 330690 lack Workflow, Collection and Content Type for every version since 2026-08-25 while core is correct — Company Page 341734 cannot publish
Fix
Product
Quark – QPP NG
Reference
ka#60479914
Status
Released
averyqa on shared services: layout-option publishing broken — ContentModel.xml written outside the tenant publishing folder (automationservice shared mode)
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Layout Options publishing fails at ResolveLayoutOptions on a shared (multi-tenant) automationservice: FetchContentModel writes ContentModel.xml outside the tenant temp folder that ResolveLayoutOptions reads
Fix
Product
Quark – QPP NG
Reference
ka#60515471
Status
Released
Node 20 deprecation across QPP NG deploy and cicd workflows — estate-wide failure when the runner fallback is removed
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Security 37
hmac.validation.enable is injected and documented but hard-overridden to false, leaving the public webhook endpoint unauthenticated
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Manifest-controlled model name traverses out of conf/structure, giving arbitrary-location writes of attacker-supplied file content
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-licensingservice to resolve CVE-2026-89425, CVE-2026-91777
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-licensingservice to resolve CVE-2026-93491
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-messaging to resolve CVE-2026-93491
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-quarkauthor to resolve CVE-2026-93491
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Live SendGrid API key hardcoded in source and used on the POST /aiintegration/api/v4/quarky request path
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-webhookregistration to resolve CVE-2026-76183, CVE-2026-79677
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-tools to resolve CVE-2026-93491
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-automationservices to resolve SNYK-JS-DOMPURIFY-21460653, SNYK-JS-DOMPURIFY-21460657
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-features to resolve CVE-2026-101296
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Credit gate keys on the tenant's *default* provider, but the request body can name a different provider — unmetered use of Quark's internal, credit-metered provider
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Prompt endpoints discard the caller's principal: validateCredits replaces the request thread's SecurityContext with a hard-coded userId=1 admin system token
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Live SendGrid API key hardcoded in source, reached from every prompt request that consumes credits
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-licensingservice to resolve CVE-2026-101296, CVE-2026-101356
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-licensemanager to resolve CVE-2026-101296, CVE-2026-101356
Security
Product
Quark – QPP NG
Reference
—
Status
Released
POST /analytics/mappings/default lets any authenticated tenant write a global field mapping applied to every other tenant
Security
Product
Quark – QPP NG
Reference
—
Status
Released
invalidateClientSessions only revokes the first 100 Keycloak sessions but reports success
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Licensing RestClient is built without a read timeout, so every prompt request can block its Tomcat thread forever
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-notificationservice to resolve CVE-2026-101296, CVE-2026-101356
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-quarkauthor to resolve CVE-2026-101296, CVE-2026-101356
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Any authenticated user can read and overwrite tenant service configuration as the admin user (user_id 1) via the ungated /features/register endpoints
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-webhookregistration to resolve CVE-2026-18036, CVE-2026-71891
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-authservice to resolve CVE-2026-110816
Security
Product
Quark – QPP NG
Reference
—
Status
Released
CsrfGuard's unconditional HEAD exemption bypasses CSRF enforcement on every unmarked (mutating) GET route, because Express dispatches HEAD to the GET handler
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Client-supplied URL path spliced onto a trusted service base URL escapes host confinement (SSRF from inside the cluster, with the caller's bearer token attached)
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Attacker-controlled `upload-url` request header drives an outbound PUT with arbitrary body in CheckinService.uploadAsset
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Unencoded serviceName/configPath injected into admin-impersonated outbound URL in FeatureFacade (SSRF / internal authz bypass)
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Any authenticated user can replace the live application configuration directory (and its cloud copy) by uploading a ZIP to POST /import/configs
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Config import writes arbitrary files into the served config directory with no authorization, and extensibility/loadImg serves .svg from it inline as image/svg+xml
Security
Product
Quark – QPP NG
Reference
—
Status
Released
kubesService/getPodsInfo?dbg returns raw Kubernetes deployment manifests (container env, cluster topology) to any authenticated user
Security
Product
Quark – QPP NG
Reference
—
Status
Released
[stability] aiintegrationservice (qa): SecurityConfig.jwtDecoder aborts boot with IOException("Keycloak is not healthy") when Keycloak is not ready within the 5x10s retry budget, so the pod fails startup instead of waiting for its dependency
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Every outbound AI/licensing call builds a new RestTemplate and a new Apache HttpClient connection pool that is never closed
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Content-extractor GET endpoints (v4/v5) return stored provider credentials (api_key) to any authenticated caller
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Any authenticated tenant can permanently delete the global '__default__' field mappings and calc fields every other tenant depends on
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Independent per-input AI generations run strictly serially, so v5 datasource latency is N × a full LLM round trip
Security
Product
Quark – QPP NG
Reference
—
Status
Released
ConfigService exposes an unrestricted read/write primitive over the entire shared Redis keyspace, letting any user redefine a named asset filter for all users
Author: Close Document with preference 6020 on can wait up to 2 s on the engine lookup after resetEngine
New
Product
Quark – QPP NG
Reference
—
Status
Released
getParentAssetRelationsVersionOfType returned no pinned relations for a freshly-restored asset in one qaeu run — not reproduced in isolation (4/4 clean)
New
Product
Quark – QPP NG
Reference
—
Status
Released
[QPP NextGen] Add the "Allow MCP" application privilege to the role permission set
New
Product
Quark – QPP NG
Reference
—
Status
Released
Grant offline access for cloud-hosted MCP agents to holders of the "Allow MCP" privilege (time-boxed, revocable)
New
Product
Quark – QPP NG
Reference
—
Status
Released
About dialog: name and describe a service from its Deployment annotations, and take its build from BUILD_VERSION
New
Product
Quark – QPP NG
Reference
—
Status
Released
Stop the tenant web edge from passing client-sent forwarded headers through, and match whitelist entries as path prefixes
New
Product
Quark – QPP NG
Reference
—
Status
Released
Excel: ribbon "Update All Components" shows the component URN instead of the reason when a component's sheet is renamed, deleted or hidden
New
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG API_Publishing archive tests expect archivedWorkflowsByCollection, absent in 5.8.x
New
Product
Quark – QPP NG
Reference
—
Status
Released
Workspace search all versions: older-version rows show Edit, Delete and Update Revision because watched results carry no latestVersion
New
Product
Quark – QPP NG
Reference
—
Status
Released
Wire up CMSAdapters.Tests.Office E2E suite to CI
New
Product
Quark – QPP NG
Reference
—
Status
Released
Shared automationservice: a tenant's own classpath: template is refused (DISALLOWED_URI_SCHEME) or replaced by the packaged copy
New
Product
Quark – QPP NG
Reference
—
Status
Released
"Asset matches search" (SubQueryCondition) query returns HTTP 500: subquery has too many columns
New
Product
Quark – QPP NG
Reference
—
Status
Released
qpp-regression-web runners: Windows "Networks" panel takes keyboard focus and breaks 18 web tests
New
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG API_Publishing branch tests expect 0.1 as the first branch version
New
Product
Quark – QPP NG
Reference
—
Status
Released
[QA Gap][P3] API regression: log coverage gaps and restore config/defaults (#6820 review follow-up)
New
Product
Quark – QPP NG
Reference
—
Status
Released
Release CRs close green while cluster-shared and out-of-band pinned components are never deployed
New
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG watched all-versions search drops older-version rows when a string condition value contains 'a.'
New
Product
Quark – QPP NG
Reference
—
Status
Released
Keep every block the Content Copilot places in Author inside a section body
New
Product
Quark – QPP NG
Reference
—
Status
Released
Show a Content Copilot specialist's name and what it needs once, on its dock pill and card
New
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG: standardise commonmodules version propagation across the six consumers (REQ 1, 3, 4, 5)
New
Product
Quark – QPP NG
Reference
—
Status
Released
Enhancements 8
[QA Gap][P1] Cert depth fixes — upgrade-testing on patch/hotfix, single-execution in "all", full_matrix pass-through, nightly schedule
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG qaservice: model build takes 2–4 min per tenant on every container start
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
unifiedaccessservice: retry a qaservice import answered 503 with Retry-After (precondition for qaservice replicaCount > 1)
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
[QA Gap][P1] Search assertion hardening — duplicate rows, index freshness, BFF path, wire the 25 unwired scenarios
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
webapplications: retry qaservice modelling writes answered 503 with Retry-After, reload on 409 (precondition for qaservice replicaCount > 1)
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
[QA Gap] Quark#6605 follow-up: bring back the switched-off pin guard and WorkFlowMandatory tests
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
[QA Gap][P1] qpp-regression-web runners keep the Windows network discovery prompt open, which swallows Robot keystrokes
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
[QA Gap][P1] Search: special-character terms and oversized multi-value columns — two production escapes with no coverage
Improved
Product
Quark – QPP NG
Reference
—
Status
Released
Fixes 28
unifiedaccessservice: Qaservice config import step times out at 300 s since qaservice 5.8.23 (admin/roundtrip tc002/tc003 fail on qaeu)
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Quark Author (QPP NG): after Edit on a document opened Read Only, ordered lists with Start Numbering From are drawn from 1 on the canvas although the saved value is kept
Fix
Product
Quark – QPP NG
Reference
ka#60514008
Status
Released
Quark Author (QPP NG): Start Numbering From / Continue Numbering on a nested ordered list produces schema-invalid XML — "Invalid Content.", save fails or document is invalidated
Fix
Product
Quark – QPP NG
Reference
ka#60513017
Status
Released
report's web-artifact download step hides its own errors ("2>/dev/null") and has no retry — a one-off GitHub Actions blip produced an untraceable incomplete report
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
PowerPoint adapter: updating a linked deck whose source gained a slide fails (TaskCanceledException in InsertSlides); check remaining non-blocking ShowProgressAsync sites
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Quark Author stores empty tracked-change markers (adjacent deleteStart/deleteEnd) that the editor hides, so Accept/Reject all cannot remove them
Fix
Product
Quark – QPP NG
Reference
ka#60513764
Status
Released
QPP NG Author Discard: an asset attribute that was empty in the last saved version keeps the deleted autosave's value (attribute no longer matches the document)
Fix
Product
Quark – QPP NG
Reference
ka#60512785
Status
Released
Quark Author (QPP NG): Start Numbering From / Continue Numbering stay enabled in a bulleted list nested in a numbered list, and applying them renumbers the parent numbered list
Fix
Product
Quark – QPP NG
Reference
ka#60513855
Status
Released
Layout Option PDF fails for the whole document when one table cell has align="both" (Word's justified value): the publishing XSLT forwards it to QXPS as ALIGNMENT="BOTH", which QXPS rejects (Error 10111)
Fix
Product
Quark – QPP NG
Reference
ka#60514397
Status
Released
REST API regression: PDF visual-comparison tests have stale benchmarks (rendered with older QuarkXPress Server versions than qaeu's current 22.12)
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Quark Author (QPP NG): uncaught TypeError in _getCurrentElementXPath when the editor selection has no start element — Preview dies client-side with no request and no server log
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Quark Author (QPP NG): an ordered list with Start Numbering From inside a Smart Section component is drawn from 1 on every document open, although the saved value is kept
Fix
Product
Quark – QPP NG
Reference
ka#60514008
Status
Released
QPP NG Author: "Edit in context" of a branched Smart Section opens the Smart Document fully read-only — the section is not editable or checked out
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
QuarkXPress Server: renderer enters a CPU-bound loop and never completes on certain content, fails with error code 10073 after the configured request timeout
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
translationservice: creating a translation rule returns an id when the Translations.json write fails; the rule is not stored
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
cleanup-tenant-data resets qaeu users but not their license records on licensemanager-deveu, so the admin license counter drifts to 0 and user deletes fail with UNABLE_TO_REVOKE_LICENSE
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
QPP NG API_Publishing fixture configurations_bug424330.zip lists a missing Forms.part1.zip
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Web test TestCaseID_309779 cannot pass on qaeu: user8 has no "Get Original Assets" privilege, and the test opens the section in the context of a parent user8 cannot access
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Office Adapter (QPP NG) installer and add-ins report 5.8.0.0 for every build — no build or release version is stamped, so builds cannot be told apart in Add/Remove Programs or in Office
Fix
Product
Quark – QPP NG
Reference
ka#60518222
Status
Released
26 quarantined web tests need a qaeu run to find why they fail
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Web automation: 5 quarantined tests have stale benchmarks or an out-of-date step
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
7 web tests switched off before Quark#6601 have no fix ticket
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Quark Author (QPP NG): Apply Tag with no text selected leaves an empty inline tag that is invisible in the editor, is stored as a blank tag in Smart Section XML, and can move into the section title
Fix
Product
Quark – QPP NG
Reference
ka#60517931
Status
Released
QPP NG publishing API never reports why an automationservice delivery failed: contentservice cannot load the returned exception type and substitutes a generic PUBLISHING_EXCEPTION
Fix
Product
Quark – QPP NG
Reference
ka#60513764
Status
Released
Quark Author (QPP NG): Create Branch / Switch Branch on a Smart Section breaks cross-references to it; switching back and Synchronize Cross Reference / Synchronize All leave them red
Fix
Product
Quark – QPP NG
Reference
ka#60518515
Status
Released
Quark Author (QPP NG): Preview of an equation-heavy document freezes the browser at "Preparation…" ("Pages Unresponsive") — WIRIS initParse over the full document grows quadratically with document size (17.5 s at 482 equations)
Fix
Product
Quark – QPP NG
Reference
ka#60520026
Status
Released
GET /auth/api/v1/loadCustomCss crashes the whole auth service when content.css is absent (missing existence guard + unhandled stream error)
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
automationservice reports healthy after its startup config registration fails, then rejects publishes with INVALID_CHANNEL
Fix
Product
Quark – QPP NG
Reference
—
Status
Released
Security 25
Update quark-qpp-webhookregistration to resolve CVE-2026-110879
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-webhookinvocation to resolve CVE-2026-110879
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-automationservices to resolve CVE-2026-102554
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Bulk asset download has no rejection handler: a failed download or zip leaves the job stuck on "pending" forever, with nothing logged to identify it
Security
Product
Quark – QPP NG
Reference
—
Status
Released
GET /favourites hangs for 5 minutes when filterHiddenCollection=true and a favourited asset lives in a hidden collection (promise never resolves)
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-automationservices to resolve CVE-2026-110816
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-tools to resolve CVE-2026-110879
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-translationservice to resolve CVE-2026-101296, CVE-2026-101356
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-translationservice to resolve CVE-2026-110879
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-analytics to resolve CVE-2026-101296, CVE-2026-101356
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-analytics to resolve CVE-2026-110879
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Piped fs read streams in extensibility-service have no 'error' listener — a directory path in ?path= crashes the whole BFF process
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Concurrent config import/export clobber each other's temp/backup paths held in mutable static fields, destroying the live config on rollback
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Publishing download request drops assetBranchId because of a missing '=' in the form body, so branch versions download mainline content
Security
Product
Quark – QPP NG
Reference
—
Status
Released
transformTableToChart rejects with no reason, crashing the exception filter and hanging the request until the 5-minute server timeout
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-auth-token-manager to resolve CVE-2026-110879
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-automationservices to resolve CVE-2026-101296, CVE-2026-101356
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-automationservices to resolve CVE-2026-110879
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Every prompt request pays three uncached blocking HTTP round-trips for credit validation while a Redis credit cache sits unread
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-commonmodules to resolve CVE-2026-101296, CVE-2026-101356
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-commonmodules to resolve CVE-2026-110879
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Hidden-collection filtering in convertToEntities makes serial per-row privilege calls with no memo
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-docuratedservice to resolve CVE-2026-101296, CVE-2026-101356
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Update quark-qpp-docuratedservice to resolve CVE-2026-110879
Security
Product
Quark – QPP NG
Reference
—
Status
Released
deploy.yml uses a non-existent `queue: max` concurrency key, making the whole workflow file invalid and un-dispatchable
Security
Product
Quark – QPP NG
Reference
—
Status
Released
Quark Publishing Platform · QPP NextGen
QPP NextGen — Release Train S
In QC
Planned release.
1Features
0Enhancements
3Fixes
0Security
New Features 1
[QPP NextGen] Silent save — auto-append unique suffix to avoid duplicate filenames
New
Product
Quark – QPP NG
Reference
ka#60452082ka#60488189
Status
In progress
Fixes 3
QPP NG Author: second document cannot be closed — Check In/Discard prompt loops for a reused section already resolved in another open document
Fix
Product
Quark – QPP NG
Reference
ka#60387657ka#60387721
Status
In progress
Child model's section metadata settings (e.g. Mandatory) apply at only one position when the same child model is placed at several positions in a parent model
Fix
Product
Quark – QPP NG
Reference
ka#60520864
Status
Ready for QC
UAS configuration import cannot create channels whose exported process shares a definition file with other processes: createProcess refuses the exported processConfig since 5.8.22
Request for custom blade revisit event in QPP NextGen Workspace
New
Product
Quark – QPP NG
Reference
ka#60388151
Status
In progress
[00055509] QPP User list: provide audit trail of adds/updates to users
New
Product
Quark – QPP NG
Reference
ka#60388189
Status
Backlog
[00118941] Re-ordering of elements should only be allowed within the same parent
New
Product
Quark – QPP NG
Reference
ka#60387635
Status
Backlog
[QPP NG] Publish in-document note cross-references to PDF-LO and DOCX — correct rendering & clickable links
New
Product
Quark – QPP NG
Reference
ka#60477657
Status
Backlog
[QPP NextGen] Silent save for attachments & other uploaded file types
New
Product
Quark – QPP NG
Reference
ka#60488154ka#60452082
Status
Backlog
[QPP NextGen] Saved-search auto-refresh — product decision on removal behaviour (greyed tombstone row + duplicate on re-match)
New
Product
Quark – QPP NG
Reference
ka#60492972ka#60387874
Status
In progress
Fixes 1
Quark Author (QPP NG): a refused Edit check-out leaves the editor in edit mode — typed changes cannot be saved and the refusal reason is not shown
Fix
Product
Quark – QPP NG
Reference
ka#60507671
Status
Backlog
Quark Publishing Platform · QPP NextGen
QPP NextGen — Release Train U
Planned · backlog
Planned release.
2Features
0Enhancements
0Fixes
0Security
New Features 2
[00119094] Support for text direction (rotated text) in table cells
New
Product
Quark – QPP NG
Reference
ka#60387614
Status
Backlog
Quark Author does not block Save/versioning when a mandatory property-reference tag's Property Reference List is empty (document root and in-section)
New
Product
Quark – QPP NG
Reference
ka#60404478
Status
Backlog
Quark Publishing Platform · QPP NextGen
QPP NextGen — Release Train V
Planned · backlog
Planned release.
1Features
0Enhancements
0Fixes
0Security
New Features 1
Para Display Style / paragraph layout-option metadata is retained in the document XML after the associated paragraph is deleted (orphaned metadata not removable in Author)