These release trains are planned and subject to change — scope and timing are not commitments.
Release
Status
Feat.
Enh.
Fixes
Sec.
Total
Subtotal
0
0
0
0
0
Quark Publishing Platform · QPP Legacy
QPP Legacy — 16.7.5
Released · 24 Jun 2026
QPP (Legacy) maintenance release 16.7.5.
0Features
1Enhancements
1Fixes
0Security
Enhancements 1
Quark XML Author for Microsoft Word now loads and runs correctly on the Microsoft 365 Monthly Enterprise Channel, so users are no longer blocked as older Office update channels are retired and the add-in stays available across Word sessions.
Improved
Product
Quark – QPP (Legacy)
Reference
ka#60389300ka#60391286ka#60399600
Status
Released
Fixes 1
Fixed intermittent LDAP user search and import failures that surfaced a misleading "Enter a valid base string" message when the directory returned referral or connection errors, so administrators get clearer, more reliable directory lookups.
Fix
Product
Quark – QPP (Legacy)
Reference
ka#60387521
Status
Released
Quark Publishing Platform · QPP Legacy
QPP Legacy — 16.7.6
Released · 6 Jul 2026
QPP (Legacy) maintenance release 16.7.6.
0Features
0Enhancements
1Fixes
1Security
Fixes 1
Fixed an intermittent sign-in failure in which the validation provider could not be discovered during user lookup after the server had been running for an extended period, restoring reliable authentication without requiring a service restart.
Fix
Product
Quark – QPP (Legacy)
Reference
ka#60403272
Status
Released
Security 1
Addressed a Java vulnerability in the Quark License Administrator package by moving to a patched runtime.
Security
Product
Quark – QPP (Legacy)
Reference
ka#60387832ka#60404472
Status
Released
Quark Publishing Platform · QPP Legacy
QPP Legacy — 16.7.7
Released · 28 Jul 2026
QPP (Legacy) maintenance release 16.7.7.
0Features
0Enhancements
2Fixes
8Security
Fixes 2
Fixed an intermittent Linux server startup failure caused by conflicting logging libraries on the classpath, so the server now starts reliably on every deployment.
Fix
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Fixed an exception raised when updating an existing attribute through the administration API, so attribute updates complete successfully.
Fix
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Security 8
Fixed a stored cross-site scripting vulnerability where an asset or component name containing markup could run script when opening the relationship (Where-used / Refers-to) information dialog; such names now display as inert text.
Security
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Hardened collection saving to reject names containing markup or script characters, reducing the stored cross-site scripting attack surface while still allowing valid international names.
Security
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Fixed a stored cross-site scripting vulnerability by output-encoding collection names wherever they are displayed, so names containing markup render as inert text without breaking valid names during copy or rename.
Security
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Fixed a stored cross-site scripting vulnerability where a section or document title containing markup could run script when opening the Quark Author editor notes pane.
Security
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Fixed a stored cross-site scripting vulnerability where a username containing markup could run script in the component reference information dialog in web author.
Security
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Fixed a stored cross-site scripting vulnerability where user preference values were rendered unescaped inside a script block, allowing script to execute on page load; these values are now safely encoded.
Security
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Added validation of the editor background color and related user preference values on save, rejecting malformed input as defense-in-depth against stored cross-site scripting.
Security
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Fixed a stored cross-site scripting vulnerability where an asset or template name containing markup could run script when opening the New Document from Server Template picker; names now render as inert text.
[00102034] Product review needed: table row insert/delete changes are not reflected on the QXA canvas until save/reopen
Fix
Product
Quark – QPP (Legacy)
Reference
ka#60387992
Status
Released
Security 6
Fixed a stored cross-site scripting vulnerability where a section or document title containing markup could run script when opening the Quark Author editor notes pane.
Security
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Added security response headers, including Content-Security-Policy, X-Frame-Options, and X-Content-Type-Options, to strengthen defense against clickjacking and cross-site scripting.
Security
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Fixed additional stored cross-site scripting sinks on the user home page where certain preference values were rendered unescaped inside a script block.
Security
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Fixed additional stored cross-site scripting sinks across WebEditor dialogs and shared grid renderers where asset, collection, and user-field values were displayed without proper encoding.
Security
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
[Security/XSS 2A · store] Collection-name '<' validation is WebEditor-only — native/SOAP clients (Windows, Mac) bypass it (follow-up to trilogy-group/Quark#1114)
Security
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Added application-wide anti-CSRF protection and hardened session cookies so state-changing operations, such as password and preference changes, can no longer be forged by cross-site requests.
QPP Legacy Windows client installer packages 115 of 408 files and the job still reports `success`
New
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Enhancements 1
Added an opt-in lightweight reconnect path that skips expensive session-rebuild work when it is not needed, improving Quark Author reconnect performance and platform stability during releases and load-balancer failovers.
Improved
Product
Quark – QPP (Legacy)
Reference
ka#60387535
Status
Released
Fixes 2
XML Author: spreadsheet table selection can shift table into page margin and right-click fails
Fix
Product
Quark – QPP (Legacy)
Reference
ka#60434892
Status
Released
XML Author comments are not retained after save, close, and reopen
[00110594] Quark software's compatibility with Windows Server 2022
New
Product
Quark – QPP (Legacy)
Reference
ka#60387528ka#60414610ka#60462223
Status
Released
QPP Legacy macOS client installer ships hollow QuarkXPress/QuarkCopyDesk XTension bundles and the job still reports success
New
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
QPP Legacy: five version surfaces still off the product version — Mobile WAR, SDK + schema installers, MSI downgrade floor (release decision needed)
New
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
QPP Legacy build-number stamping aborts at entry 8 of 68 and the step still reports success
New
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Windows client installer build never stamps a build number (server build stamps the client files and discards them)
New
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
QPP Legacy: Windows server build forces a full repo re-clone every run — long-path ${BinariesRoot} residue from multiple modules breaks git clean (follow-up to trilogy-group/Quark#2062)
New
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
QPP Legacy: Server XDK is built every run but never published — no S3 path, and its residue breaks git clean on the Windows runner
New
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Upgrade QPP Legacy version to 16.8.2
New
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Enhancements 2
[00110594] QLA (Quark License Administrator) certification with Windows Server 2022
Improved
Product
Quark – QPP (Legacy)
Reference
ka#60387528ka#60414610ka#60389354
Status
Released
Added an opt-in lightweight reconnect path that skips expensive session-rebuild work when it is not needed, improving Quark Author reconnect performance and platform stability during releases and load-balancer failovers.
Improved
Product
Quark – QPP (Legacy)
Reference
ka#60387535
Status
Released
Fixes 2
XML Author: spreadsheet table selection can shift table into page margin and right-click fails
Fix
Product
Quark – QPP (Legacy)
Reference
ka#60434892
Status
Released
QXA: deleting a table row/column fails with 0x800A16C4 Bad bookmark name when the cell carries a comment (pre-existing)
Fix
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Security 1
Update quark-qpp-legacy to resolve CVE-2015-4852, CVE-2015-6420, CVE-2015-7501
QxpsManager: benign errors ignoreList the only render host ("Appropriate host could not be found", 73x in 4 days); health probe inherits 3h requesttimeout (, ka 60430330)
Fix
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
XML Author: tracked-change and formatting boundaries shift by one character after document check-in/reopen (reproduced in OOTB build)
Fix
Product
Quark – QPP (Legacy)
Reference
ka#60456164
Status
Released
XML Author: spreadsheet table still shifts into page margin and document freezes on OOTB 7.1.191.1 (16.8.2) — trilogy-group/eng-maintenance#23448 fix (trilogy-group/quark-qpp-legacy-xml-author#37) incomplete
Fix
Product
Quark – QPP (Legacy)
Reference
ka#60434892
Status
Released
Security 32
Update quark-qpp-legacy to resolve CVE-2026-75140
Security
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Update quark-qpp-legacy to resolve CVE-2023-7272, CVE-2026-9563
Security
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Update quark-qpp-legacy to resolve CVE-2022-45685, CVE-2023-1436
Security
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Update quark-qpp-legacy to resolve CVE-2025-48924
Security
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Update quark-qpp-legacy to resolve CVE-2014-0002, CVE-2014-0003
Security
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Update quark-qpp-legacy to resolve CVE-2026-40682, CVE-2026-42027, CVE-2026-42440
Security
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Update quark-qpp-legacy to resolve CVE-2006-2758, CVE-2009-4611, CVE-2020-27216
Security
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Update quark-qpp-legacy to resolve CVE-2015-0254
Security
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Update quark-qpp-legacy to resolve CVE-2026-59869, CVE-2026-84375
XML Author 7.1.211.1 (QPP Legacy 16.8.3): spreadsheet table still jumps to the page edge and Word stops responding after move-handle select and outside click — Quark#5059 fix (PR #43) does not resolve it
Fix
Product
Quark – QPP (Legacy)
Reference
ka#60434892
Status
Released
Security 6
Update quark-qpp-legacy to resolve CVE-2026-89425, CVE-2026-91777
Security
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Update quark-qpp-legacy to resolve CVE-2026-59889
Security
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Update quark-qpp-legacy to resolve CVE-2026-68497
Security
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
WebEditor INSERT TABLE Preview broken — CsrfTokenFilter 403s the read-only getExcelRendition.qsp (regression from trilogy-group/Quark#1112)
Security
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Upgrade the Node.js runtime bundled in Highstock (charting export) — Node 10.15.3/10.16.3 are EOL
Security
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
[Security/Hardening] Missing security headers on /qxpsmadmin + HSTS not enforced site-wide (QPP Legacy — outside WebEditor scope)
QPP Legacy publishing: unresolvable references (inaccessible, removed version, empty file) are silently dropped and the publish still ends Publishing=END
New
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Enhancements 1
Centralize QPP Legacy release version to a single source of truth
Improved
Product
Quark – QPP (Legacy)
Reference
—
Status
Released
Fixes 3
XML Author: Track Changes is switched off when comment text is typed or edited in the comments pane (reproduced on OOTB 7.1.222.1, QPP Legacy 16.9.0)
Fix
Product
Quark – QPP (Legacy)
Reference
ka#60487371
Status
Released
XML Author 7.x: Word's modern Comments pane is shown and editable in XML Author documents although XML Author does not support modern comments (OOTB 7.1.222.1)
Fix
Product
Quark – QPP (Legacy)
Reference
ka#60501295
Status
Released
[QPP XML Author] Unable to delete individual comments using Review ribbon in OOTB build 7.1.222.1