Explanatory writing from the team building Airtool — product releases, architecture notes, opinions.
A result set writes to Parquet and a Parquet file loads back, through one small library with no Hadoop. Types, sizes and nullability travel in the footer, and SNAPPY files from pandas, Spark and DuckDB import as shipped.
Read the postA browser SSH terminal joins the platform tools. Jump hosts, keystore credentials, SFTP behind a per-grant switch, a cap on concurrent terminals, and every command typed is sanitised and written to the audit log.
An application sets minimum, maximum or fixed widths per grid column and listens for resizes. Users reset saved widths from the context menu, group rows gain select-all, and tables gain a standalone insert page.
Every night four projects run their suites in sequence. Engines are probed first, results are compared test by test against the previous run, and a run that saw its classpath change declares itself invalid.
An agent connects to one of four endpoints, each sized to what it may touch. Every tool carries a risk class, a grant chooses within what a role opens, five gates run again on each call, and the audit keeps the commands.
A user may act as another and borrow that user's roles, databases and menu. The session shows an Alias or Admin tab, a delegation merges or supplants, and the admin login, MCP and the chat assistant serve the caller.
The observability catalog gains session and scripts tiers. A cursor shows what it asked, a running script shows its code and line, a delete on the row cancels it, and an hour of metrics is kept every five seconds.
The in-memory database behind the observability catalog gains string functions, searched CASE, arithmetic, CAST and typed computed columns, and its columns keep labels, content types and colours through every SELECT.
The storage advisor now proposes a target layout: where each large table and its indexes should sit, the statements to run and the dbspaces to create or extend, sized for growth. Informix 15 formats are understood.
A new MCP tool searches the text and CLOB columns of business data and answers with primary keys. The engine searches where it can, memory takes the rest, row-level security applies, and what was not searched is named.
Each database server now chooses the JDBC driver build it connects with. Several builds of the same driver run side by side in one process, and the startup log records which one each server uses.
Quiescing a connection pool now refuses new work at once but lets connections in use finish within a window, five minutes by default, before any are forced closed. A forced close is logged as such.
Informix, PostgreSQL, SQL Server, Oracle and MySQL now answer the same storage questions: space by container, a table's partitions and indexes, sizing before a table exists, and a review with fixes.
An agent now starts with a short tool list and loads more by name or keyword when a task needs them. MCP prompts and resources reach agents as tools, under the same access gates as over MCP.
Agents can now search and read the platform manual over MCP and, with an editor's grant, write pages that are validated against the manual's schema and versioned like any page edited by hand.
One export service now renders a result set to eleven formats, from spreadsheets to PDF, applies the row ceiling in one place and records every export, successful or not, in the audit log.
Image models join chat and embedding models in the platform's AI configuration. OpenAI and Google Imagen are supported, calls are audited without storing the image, and scripts can generate images directly.
Users mint API tokens with a name and an expiry and revoke them all at once, read the commands to connect over NFS, FTP and MCP, manage printers, search their notifications, and see every mail sent for them.
The component library, the OS tools and the application client moved to Vue 3 and Vuetify 4. The build moved to Rolldown, the last Vue 2 dependency left, and a Storybook now covers 328 of 333 components with 752 tests.
Posts with comments, tags, companies and groups, scheduled publication, a reading list and statistics. Bodies are validated against a schema on save, covers are generated from the post, and searches export to PDF.
An agent developing on a layered application is told at connect what it may write, reads across every layer, edits where a definition is found, and can now read and author the application's REST endpoints.
A single theme and density engine serves every Studio client. Dark mode follows the operating system, a user chooses a theme under a role while another role edits them, and twelve entry points share one shell.
A table, report or view object is served as one JSON document with a version token. An agent applies changes in one transaction with a dry-run diff, and authoring rules are harvested from proven specimens.
Every stored code body is parsed per language and never executed. An object runs through six probe stages on a budget and rolls back. Presentation, colour, translation and security are censused per run.
A new view type renders any hierarchical cursor as a tree with a node pane. Previews cover markdown, HTML, images, PDF, video, code, email, 3D models and spreadsheets; seven optional events turn it into a file manager.
Every MCP refusal now carries a kind from a closed list, hidden tools are logged by name, the MCP service can be switched per node without a restart, and each call records its tokens in both directions.
Path-based tools gave way to typed families with five verbs each. A tool is done when its schema matches the code, its tables are declared, its taxonomy is generated and a refusal is proven.
A diff function runs inside the engine, as a C routine on Informix and PL/pgSQL on PostgreSQL, emitting the RCS script the platform already replays. A trigger can call it, so no write escapes versioning.
A tab may observe several parent tabs and join their selections, render query fields inside the form, dispatch named events that run server-side scripts, size itself to the screen, and fill the remaining height.
A rename is analysed read-only with a digest, JavaScript bodies are rewritten by lexing and SQL under a prepare gate, and apply runs only with a token a person types from the plan. A campaign renamed 64 columns.
Conversation memory is now bounded by tokens, not messages; token counts are estimated per provider and can be confirmed before a request is sent; and every provider call shares one retry policy.
The demo dictionary is rebuilt from an empty database by a test suite in three stages, mapped to a taxonomy of 158 capabilities extracted from the client's configurable surface, and documented in 1,333 help pages.
One build task writes an inventory of every third-party artifact the product ships, the bundle it travels in and its licence, beside the notices file. It covers the main classpath and the four side-loaded sets.
Each text column is searched at the best tier its engine offers: a text index, a LIKE scan, or nothing rather than an error. A descriptor per engine drives the query form, the escaping and the help shown.
A page that opens inside a group restates the group path in its head. Group boundaries are drawn heavier than row lines, chips and fills print as on screen, and the reader's density travels into the PDF.
Each node now prints a grouped startup report covering configuration, security, mail, cache, Redis, microservices and MCP, verifies what it can, and offers an optional in-process console for live administration.
A portal fetches its own channels, offers live read-only preview cards that run only while on screen, accepts a card dragged onto the canvas, and undoes a placement for eight seconds.
One mailer sends every system mail, with per-message sender and per-group SMTP. The log keeps the body and the attachment list, states an error as a sentence, and records mail that never reached a transport at all.
Quality tools classify every statement, fingerprint duplicates, prove each by prepare only, apply twelve rules served as data, scan the schema for drift and missing indexes, and read plans unrun.
Databases and engine users are created, granted, revoked and dropped through the driver interface, plan then apply then verify, dry-run by default and journalled with passwords masked.
Horizontal joins fold into one lateral statement per page, action gates evaluate as one SELECT, key descriptions resolve lazily, and a per-request ledger records statements, rows and time by cost centre.
A query becomes a Gantt with editable tasks, a timeline with grouping, a kanban, a calendar whose events are dragged, or a D3 dendrogram, flowchart, graph or org chart, through JSON view configuration rather than code.
Push notifications from Informix smart triggers and PostgreSQL LISTEN and NOTIFY reach the node directly. Capture is queryable as SQL, suspendable for DDL, and the watch set derives from the cache annotations.
The XML dialect, the scripting library and the 4GL grammar are served as resources generated from the running server. SQL is proved by prepare, scripts by parse, and no proof ever runs a statement.
A browser abort rarely reaches the server over keep-alive, so a cancelled query ran on holding its locks. Requests now carry an id a client can cancel through, and progress streams over SSE.
Pools, connections, statements, databases and servers declare the actions they support. SQL triggers and JMX operations route through one service with one audit trail, and rates are sampled at three windows.
Every cursor action, DML route, thread and editor route arrives in a standard Link header with a URI template. The client stops composing addresses, so a route can move on the server without a client release.
Every authoring write records a changeset inside the caller's transaction, deletes keep the full document, and tools list history, show a diff, report status and emit a restore plan that never writes.
Agent runs now emit a live turn lifecycle to any registered observer, stream the model's reasoning as it arrives, and record their plan as a stored file the agent ticks off step by step.
A new analytical editor composes a cube query from a dimension and measure tree, compiles it to the platform's SQL layer, runs it against the database, and returns the result as a grid, a chart or an exported report.
The platform now ships an Informix 4GL language implementation on Truffle, a peer of JavaScript, Python and Groovy in the same GraalVM runtime. Original 4GL business logic runs unchanged, in the caller's transaction.
The platform generates an OpenAPI specification from its REST API definitions and ships a rebuilt API explorer: endpoints in a sidebar, request beside response, a dark appearance, and a downloadable spec.
The keystore generates and imports SSH key pairs across RSA, ECDSA and Ed25519, stores password secrets alongside certificates, and restricts destructive and administrative actions to owners and named managers.
The setup tool gains a guided wizard, an interactive administration console for browsing and editing configuration, a connection editor that routes by state, and upgrade commands that list pending conversions before applying them.
Bulk loading is unified behind a single result contract with a shared loader base, insert-or-upsert becomes the caller's choice rather than the file format's, and eight database engines get a native single-statement upsert.
A script call turns the node's logs into a Markdown report: resource metrics, error and warning signatures, a status of OK, WARNING or CRITICAL, and a coverage line stating the window.
The platform's server-side JavaScript API now ships as generated TypeScript declarations, derived from the Java source model itself, and published as installable packages for editor completion and type checking.
Text embeddings move to a dedicated ONNX microservice reached over gRPC, with the embedding model chosen per request, and the conversational assistant enables provider prompt caching with cache token usage reported.
An agent tool proposes exact edits to the open tab and the user approves a diff before anything changes. A failed statement can be explained, a buffer translates to the engine's dialect, and Redis and Qdrant get views.
A per-engine deny list removes JDBC properties that break the platform, each hit logged and a safe default restored. A lease that committed without executing is flagged, and sessions are labelled with their user.
Each login is scored on location, impossible travel, device, velocity, time, method and account age. Low scores pass, middling ones need a second factor, high ones are blocked. Failures are limited three ways.
Documentation pages render to PDF with live SQL grids laid out as on the web, Mermaid and sequence diagrams as embedded SVG, and application forms drawn as mockups from markup. A script renders a page or a book.
The document reader now extracts the machine-readable invoice XML embedded inside PDF/A-3 hybrid documents, so FACTUR-X, ZUGFeRD and Order-X invoices are read as structured data rather than scraped from a rendered page.
Database drivers are now provisioned cluster-wide from the platform's central configuration store and verified by checksum before they load. The runtime no longer reaches the public Internet to fetch a driver, closing a supply-chain path on the boot line.
The database workbench adds auto-refreshing query results, a SQL EXPLAIN action, a JavaScript debugger with a configurable port, an Explorer context menu, and a console split into separate stdout and stderr tabs.
The Studio AI agent now proposes a plan before acting, selects a model per conversation, exposes a configurable iteration ceiling, and logs each tool call as it runs for real-time review.
Schema-aware completion now reaches tables outside the metadata dictionary, offering columns and foreign keys from JDBC metadata, and resolves JavaScript modules and functions across all accessible databases at once.
A database_auth_deploy permission now controls who can push authentication and dictionary changes to a target database, and new security-audit and keeper-activity email templates notify on privileged actions.
The editor now completes SQL against the statement's own FROM and JOIN tables, offers foreign-key-derived JOIN conditions, and adds go-to-definition and CRUD completion for the server-side JavaScript database API.
Outbound WhatsApp Cloud API sends are now audit-logged, authentication templates support one-time-password buttons, and the webhook parser handles call status and template recategorization events.
A thin client for handheld scanners downloads menus, forms and events from the dictionary and renders them on a VT100 screen or in a Carbon web view from one form engine, in eight languages.
The documentation surface is now CSRF-protected at parity with the other Studio clients, and web-os-v2 gains a re-login dialog with automatic token renewal so an expired session recovers instead of failing silently.
Mermaid diagram rendering now produces PNG output alongside SVG, exposed through a new TransformMermaidToPNG gRPC call, so diagrams embed reliably in generated PDF reports.
The agents panel becomes a filterable list-to-detail view with category grouping, icons and skills, and a tool-approval preview that renders a Monaco diff for file edits from the tool's own JSON Schema.
Informix joins Postgres pgvector, Qdrant and Redis as a vector-search backend, and pgvector bulk loads can now drop and rebuild the HNSW index to remove the per-row indexing cost that dominates ingestion time.
The SQL console and script runner now accept Python: lang=python routes to the GraalPy engine, the console adds Python detection, and a shared polyglot module bridges JavaScript to both Python and Groovy.
A cluster monitoring catalog fans a single query out to every online node in parallel, prepends node identity to each row, and tracks per-node query counts and last error, skipping offline nodes.
A key/value store propagated across the orchestrator and all its sub-agents lets each agent read artifacts a sibling already produced, eliminating redundant re-fetches when the same data is needed across delegation boundaries.
Groovy is now available as a third server-side scripting engine alongside JavaScript and Python, enabled with the groovy script type and running JVM-native through JSR-223 with full standard library parity.
The chat log now segments by agent hand-offs in execution order with per-segment timing; typing @ surfaces agents and skills inline; the sidebar gains an infinite-scroll AI file library with server-side search and filters.
The retrieval pipeline now accepts a list of query texts in a single findRelevant call and aggregates results across all queries, and Vertex AI is now supported as a rerank model provider.
Tool invocations from an AI agent can now pause for explicit human approval before they execute, delivered over an SSE and REST transport so the operator approves or rejects each call in real time.
The platform now publishes an OpenID Connect Discovery document so OIDC clients configure themselves automatically, and OAuth token requests record their outcome for diagnostics.
SQL written by a model passes a strict security resolver that validates row policies on the table and its secured parents and refuses a query that skips a join. Iteration caps are set per agent.
An agent is instantiated from a dictionary record naming its prompt, tools, skills and iteration limit, and the orchestrator registers it as a sub-agent at runtime. Skills are fetched on demand.
The platform can enumerate, create and scope native database users across multiple engines through one model, with a per-verb privilege view and explicit PUBLIC grantee handling.
An agent can now delegate to registered sub-agents that run in parallel, each with a per-call timeout, cancellation propagation and a per-instance iteration cap, with agent configuration held in the database.
The data tier now reads and writes TIMESTAMP WITH TIME ZONE and TIME WITH TIME ZONE columns with the offset preserved, binds java.time values directly, and reports the standard JDBC type code for offset-aware columns.
Server-side scripts gain Microsoft Graph delegated-mailbox search, a ClamAV antivirus client, and WhatsApp template support for header media, buttons and carousel cards, all through the platform's cloud namespace.
Named graphs are registered over ordinary edge tables and traversed by routines inside the engine: neighbours, reachability, shortest path, degree and cost. The edge table stays the source of truth.
Every AWS client accepts an endpoint override through the isolated class loader, so suites run against LocalStack in containers. Microsoft, Google and IBM clients take overrides too, with 108 tests on loopback stubs.
Server-side scripts with type='python' now route automatically to GraalPy, giving platform developers full Python execution alongside JavaScript without additional engine deployment or per-project configuration.
SPL gains structured exception handling, ordered-set aggregates, INTERSECT/EXCEPT set operators, FOR UPDATE and SKIP LOCKED query modifiers, materialized-view DDL, and transaction isolation control across fifteen new grammar elements.
Excel cell styles now accept custom and built-in data format strings for number, currency, date, and time patterns, so exported spreadsheets carry precise display formatting without post-export manual adjustment.
AI chat requests now carry typed context objects covering query intent, schema, session state, and database metadata, and responses render Markdown, so agents can reference live data structures when answering questions.
The platform replaces its RxJava lifecycle primitives with JDK-native Disposable and CompositeDisposable, removing the reactive library dependency from the core module without changing call-site behaviour.
A new AI agent variant gives language models structured read, write, and directory access to the application filesystem, controlled by a role capability that is absent on all existing roles by default.
MCP tool invocations are now recorded in the audit trail with user identity and parameters; each cluster node also declares the protocol services it activates on startup, replacing all-services-by-default behaviour.
The MCP server now accepts stateless HTTP clients without persistent session state and negotiates multiple protocol versions per connection, so older and newer agents can share a single deployment without forced upgrades.
The platform implements the OAuth 2.1 authorization framework: authorization code with mandatory PKCE for browser clients, client credentials for machine-to-machine flows, and standardized error responses across all grant types.
Platform startup now enforces RSA key length minimums and validates JWT signing key strength before accepting configuration, returning a descriptive diagnostic and refusing to start when cryptographic keys do not meet required constraints.
The Graphviz component now accepts a height prop for fixed-height constrained rendering and opens a fullscreen dialog for inspecting complex graphs without the constraints of the inline viewport.
XSQL server-side scripts gain integer array variables and two iteration constructs — for list and forall — that traverse in-memory lists without a database roundtrip, working uniformly across all seven supported OLTP engines.
The MCP server advertises the data dictionary as schema:// resources, loads schema content from the AI prompt catalog at runtime, and extends dict_validate to report, virtual table, and table object kinds.
Six new MCP tools expose stored procedures, user-defined functions, and database triggers as queryable objects — three list tools and three detail tools — extending schema introspection beyond tables and views.
Dictionary filesystem sync now injects template starter files into report, virtual table, and table directories on first use, and adds color palette and query binding fields to the rich XML object format.
The JVM classloader topology is now queryable as a navigable catalog tree: a root table for the parent loader and three child detail tables covering loaded classes, classpath URLs, and per-loader resource counts — using the same browser pattern as the cache and schema catalogs.
A new role — ToolUserSettingsAIModelSelect — lets individual users override the AI model configured at department, company, or global scope for Chat, Embeddings, Reranking, and Speech independently, without requiring administrator involvement.
JWT session security is hardened with three coordinated additions: JTI-based per-token invalidation backed by a persistent audit table, a database-allowlist claim enforced at the REST API and Studio authentication layers, and zero-downtime key rotation with simultaneous multi-key signature verification.
The platform's standard library covers the Meta WhatsApp Cloud API across all interaction directions: send template messages, upload media blobs, receive and parse inbound webhook events, and deserialize template components — all from server-side JavaScript or Python.
The MCP server's InitializeHandler instructions are rewritten to stay within the 2 KB client limit: per-table write rules and the filesystem tree move from the initialization payload into individual tool descriptions, and fs_read now streams large files line-by-line.
Cursor and sub-cursor result sets now support infinite scroll: as the user approaches the end of the loaded page, the next page fetches and appends automatically, removing the manual pagination step for large result sets. Sub-cursors inside expanded parent rows use the same mechanism.
A table can be paused and resumed from the command line or the REST API so DDL runs without stopping capture. A health endpoint answers 200 or 503, and a systemd unit restarts the server.
Column headers in JDBC result sets, pixel-perfect PDF reports, and virtual tables now support per-column background colors and icon decorators configured at the query or schema level. PDF output also gains font shrink-to-fit packing so long labels in narrow cells scale rather than overflow.
QBE object queries are now logged per user in a dedicated history table. The active cursor's hint string is surfaced as a subtitle line in the object toolbar so operators can confirm which query variant is running without opening the query editor.
The export sidebar now pre-selects only the columns currently visible in the grid, seeded at mount time rather than on first interaction. Hidden columns remain available for manual inclusion; the exported file matches the operator's active view without requiring manual deselection.
Microsoft OneDrive and SharePoint are now callable from server-side JavaScript and Python via the Microsoft Graph API, using the same credential-resolution and permission-perimeter model as the AWS and WhatsApp clients. File operations, delta queries, SharePoint list access, and document library upload and download are all supported.
The cache subsystem is fully navigable as a drill-down tree: cache.caches lists every registered cache with hit/miss/eviction stats, per-entry contents are one drill-down away, 21 per-user inner caches are exposed through a declarative binding registry, and JDBCServer metadata caches appear as a named subtree.
Password changes in the user settings panel are now checked against the Have I Been Pwned breach dataset using the k-anonymity range API before the change is committed. Passwords that appear in a known breach set are rejected without transmitting the plaintext or the full hash to any external service.
The platform's Markdown renderer now parses and renders GitHub Flavored Markdown tables, including left, right, and center column alignment from the separator row. Documentation pages and AI chat responses that contain GFM tables render correctly instead of falling through to raw pipe characters.
JMX remote monitoring is built into the platform's microservice container management layer: an interactive CLI tool generates the JVM configuration, SSL support is available, port and hostname are overridable via environment variables, and Docker Hub credentials persist across Podman sessions.
An in-memory federation layer enables SQL joins across tables from multiple connected databases in a single query. Server-side scripts access federated results through a dedicated cross-database query API, with qualifier-aware alias resolution and a declarative XML test suite covering join types and error paths.
Workflows are drawn as nodes and edges in a canvas editor and compiled to server-side JavaScript the runtime executes: condition, note, model, calendar, integration, transform and custom-code nodes.
Seven additional AWS services join the standard library: SQS, SNS, CloudWatch, Athena, DynamoDB, SES, and Secrets Manager — all callable from server-side JavaScript and Python, sharing the same facade shape and credential-resolution chain as the six services shipped in the previous batch.
The embedding pipeline gains three improvements: a provider-agnostic EmbeddingTaskType enum that maps platform-level intent to each provider's vocabulary, title propagation from document metadata into the embedding context, and a configurable query-transformer history window via a new platform setting.
Studio adds multi-table Excel export and import from the application bar. Export streams progress over Server-Sent Events with per-table row counts in a live snackbar ; import reports per-table results on completion. Table names validate against live metadata before SQL composition.
Six AWS services — S3, EC2, Lambda, IAM, Pinpoint SMS and CloudFront — are now callable from server-side JavaScript and Python under the cloud namespace. Credentials resolve through the platform store, explicit key pairs or the AWS SDK default provider chain.
A dedicated child URLClassLoader loads the AWS SDK v2 in isolation from the platform classpath. A three-tier delegation model — JS wrapper, gateway interface, SDK implementation — resolves the Netty / Jackson version conflict without forking the platform's own dependencies.
The document-processing microservice now renders HTML or URLs to PDF using the W3C WebDriver Print command through a pooled Selenium fleet. Firefox is the default engine, Chromium the fallback ; the endpoint is exposed over both HTTP and gRPC.
The microservice fleet ships a Podman + systemd Quadlet management script for rootless container deployment. A persistent service.env survives upgrades, host-side JVM diagnostics (jps, jcmd) work against the running container, and no privileged daemon is required.
Cursor subscriptions compute a per-row CRC at selection time and validate it on every fetch. Forms whose sub-cursors fall out of sync trigger HTTP 409 Conflict with structured error details ; VTABLE and REPORT cursors now carry the same integrity guarantee TABLE cursors already had.
Acceptor and selector thread defaults moved from hardcoded 1/1 to CPU-aware auto-sizing via Jetty's standard heuristics. The change eliminates the HTTP/2 selector-saturation pattern that surfaced on high-concurrency installations ; system-property overrides remain for explicit tuning.
The vector tier supports OpenAI text-embedding-3-large at 3,072 dimensions, with cross-engine HNSW benchmarks comparing Informix and PostgreSQL at one, five and ten thousand rows. Both engines pass the correctness suite ; the numbers inform engine selection.
A Hierarchical Navigable Small World (HNSW) access method on Informix brings approximate-nearest-neighbour vector search to one of the seven supported OLTP engines, with pgvector-compatible function names and dual file / BLOB storage.
The MCP server's tool and resource surfaces now enforce per-caller access checks at the SPI level. listTools and canAccess gates extend the platform's role and attribute-level security model into autonomous agent interactions, with backward-compatible defaults.
IBM watsonx joins OpenAI, Anthropic Claude and Google Vertex as a first-class LLM provider. The client handles IAM token expiry transparently — fresh token fetched within five minutes of the one-hour expiry, double-checked locking under concurrent load.
Google Vertex AI embedding models are now addressable from the platform's AI configuration layer alongside OpenAI and Cohere. Endpoint-override support covers on-premises Vertex deployments ; provider choice is configuration, not a code change.
Server-side scripts can now be authored in Python via GraalVM's polyglot Python engine, sharing the platform's Ax standard library and security perimeter with JavaScript. The same business logic is expressible in two languages ; the hiring pool widens accordingly.
AI agents now enforce response schemas via OpenAI Structured Outputs in strict mode, guaranteeing reliable JSON parsing and eliminating malformed-output prompt-injection risk. Multi-tool parallel execution runs concurrent tool calls on virtual threads.
The main agent becomes an orchestrator over knowledge, coding, data presentation, debugging, external knowledge and document agents, each with its own tools. File tools are sandboxed; skills load on demand.
The cryptography layer's S/MIME decryption parses full MIME messages and extracts inner body content from decrypted payloads. Multi-part signed-and-encrypted email workflows round-trip cleanly ; credential and certificate-chain handling are unchanged.
A new microservice converts Mermaid DSL to production-grade SVG over HTTP and gRPC — flowcharts, sequence diagrams, state machines and ERDs without a third-party plugin. Server-side rendering enables platform-managed diagram caching.
The XSLT processor now operates in streaming mode, eliminating the need to buffer entire document trees in memory. XML-to-JSON conversion jobs on hundred-megabyte documents complete inside a small heap rather than scaling with document size.
The OCR microservice now supports Tesseract 5.8 LSTM and an alternate engine with automatic fallback. Accuracy becomes the property of the service rather than any single engine ; legacy OCR pipelines can be re-pointed without service interruption.
The disk tool and the script dictionaries mount as NFS shares with per-user isolated views, short-lived caches and permission bits from file attributes. FTP gains TLS, rate limits and idle timeouts.
Regular-expression match, extract and split compile per engine, with ratio-to-report, NTILE, octet length and hex conversions. Conditions gain else-if, foreign keys gain deferrability, plans are read.
The protocol stack moved from the documentation module into the runtime, so any module contributes tools, resources and prompts through a service loader, and access is checked on every endpoint.
A Java filesystem exposes dictionary tables as a dict scheme with flat and hierarchical adapters, per-user caching and permissions. Pages delete and move with real semantics; a .claude overlay serves skills.
AI agents now expose an explicit cancel() at the API level. Combined with the MCP server's role-aware tool access, architects gain fine-grained control over autonomous workflows — pause, cancel or rate-limit at any boundary.
Cohere's embedding models join through its second-generation API with retries, and its tokenizer is reachable from scripts. Vertex AI embeds text, image, audio, video and documents. Every provider model carries a price.
Each statement in the monitoring catalogue is classified by what it is for, from a cursor's main query to an export, and names the user it ran for. The catalogue lists its own tables with keys, triggers and queue limits.
A complete driver on the Simba JDBC connector: dialects, types, metadata and constraints across 37 files. The connector is downloaded as a bundle and extracted on first use; BigQuery joins the engine list.
OpenAI, Anthropic and Vertex AI web search are switched on through each provider's own mechanism. An HTTP tool gives agents bounded outbound calls, and a search tool returns titles, addresses and snippets.
The PDF rendering pipeline now respects user-defined column display order. Column widths, header names and body rows reorder visually without re-querying the database ; physical column order remains the fallback when no reordering is set.
A replica cluster attaches at server level. Every pool from that server can hand out a read-only connection routed to a replica with primary fallback, and a monitoring table shows each replica's health.
The runtime is now on Java 25 LTS, with native Argon2id password hashing meeting OWASP 2023 password-storage requirements. The platform sits on a Java foundation supported through the next decade ; credential-compromise surface is reduced.
A grid renders hierarchical rows from a parent column, with a configurable collapse depth, dragging that reports the moved rows, and per-column rendering. The tree component builds from the same hierarchy model.
The gRPC microservice mesh gains pluggable authentication with optional per-service enforcement. Organisations enforce service-level policies without redeploying the runtime, addressing federated-architecture compliance where some services lock down before others.
Database Workbench connections accept SSH tunnel parameters for cloud and network-restricted environments. Tunnel metadata is captured against the server node ; the connection lifecycle handles the tunnel transparently — no parallel terminal session required.
JDBC Pool V2 benchmarked against the platform's classic pool. Thread-local hit serves 70–90 % of acquisitions in 20–50 ns ; shared-pool acquisition runs 135–580 ns ; a single JVM sustains 1,000–3,000 concurrent per-(database × user) pools without saturating contention.
A task executes every runnable JavaScript block and every SQL tab block in the manual against real engines started in containers, PostgreSQL first and Informix with its own initialisation, storing results per engine.
An in-memory SQL engine serves the JVM's live state as schema-qualified tables: memory, threads, GC, class loaders, pools, connections and statements. A JDBC driver lets any SQL tool query it, live.
A new generation of the platform's JDBC connection pool ships, replacing the in-house design we have iterated on for years. The architecture handles thousands of independent (server × database × user) pools simultaneously — the property no generic pool can match — at sub-microsecond per-acquisition latency.
Engine behaviour moves from one 3,700-line switch into a dialect class per database, 13 in all. MERGE compiles natively or is emulated, DROP IF EXISTS works everywhere, and pagination and RETURNING follow each engine.
A temporary table is written as a braced marker and resolved to a unique name on each engine. The braces avoid clashes with MySQL variables and SQL Server parameters, and a temp table outlives the statement that made it.
Result-set pivoting is rewritten with a standard and a hierarchical form, grouped column headers as in a spreadsheet, several value columns each with its own aggregation, and a fluent options API.
The Monaco editor inside the form surface ships with type definitions for the Ax standard library — IntelliSense, inline parameter hints and refactoring across embedded JavaScript snippets. Configurable diagnostics run inside script tags without blocking the authoring flow.
Stored secrets move to an authenticated AES-GCM cipher with salt. Password verification reads the algorithm from the hash prefix, server passwords are encrypted at rest, and a script context cannot read a plain password.
A company-level setting keeps one session per user. A login publishes an event over Redis, every node invalidates that user's other sessions, and a 1,200-line overview documents the whole login system.
Studio and the microservices build images with Jib, answer liveness and readiness probes with component checks, and ship Kubernetes manifests and Terraform for an EKS cluster, on AMD64 and ARM64.
The mail service fetches attachments from Gmail and Outlook, lists Gmail labels and Outlook folders, returns signatures, includes spam and trash on request, and accepts recurrence rules on calendar events.
The vector store layer expands to three backends : Qdrant migrates from a hand-authored HTTP client to the official gRPC API, retiring 654 lines of custom serialisation ; Redis Stack joins as the third option, co-locating HNSW vector search with operational cache data on a single Redis cluster.
Streaming chat delivers LLM tokens progressively over Server-Sent Events with connection-lease management against exhaustion and mid-stream cancellation. The knowledge-aware assistant integrates document context as a first-class multi-turn interaction.
Server-side JavaScript gains native promises over Java futures, with allOf and anyOf. S3, SOAP, mail, OneDrive, Ansible and the HTTP client offer asynchronous forms beside the synchronous ones.
A platform-wide VirtualThreadExecutor lands on the runtime, replacing every newVirtualThreadPerTaskExecutor call-site with a single supervised executor that carries graceful shutdown, structured cancellation and a uniform observability surface. JEP 444 virtual threads become first-class infrastructure on every async path.
A standalone capture server reads Informix CDC and PostgreSQL logical replication and publishes cache-invalidation events over Redis. Nodes subscribe with backoff and choose a cache-sync strategy each.
Directory authentication negotiates StartTLS with host-name verification, beside plain LDAP and LDAPS. Search filters are sanitised against injection, and Dockerised OpenLDAP tests cover bind and search.
The data tier emits JDK Flight Recorder events: pool acquire, release, scavenge and exhaustion; connection open and close; statements with user, parameters and SQL state; cache clears; large result sets.
The AI agent's tool-result handling consolidates table results, chart visualisations and file attachments under one contract — replacing the fragmentation between SQL-result-set and chart-specific handlers. One canonical render pipeline serves every tool output.
Every script context comes from one factory with a sandbox policy. A generated allow list names the Java classes scripts may reach; file, network, thread, system and reflection classes are forbidden.
The microservice runtime exposes interceptor metrics and manifest metadata through JMX, surfacing operational state to Prometheus, Grafana and the customer's existing JVM monitoring stack. Server-status endpoints become Kubernetes-ready health checks.
Login attempts are rate-limited by IP and by user, with the block list readable as a result set. Administrators sign in on a separate page with a CSRF token, and custom authenticators run as JavaScript.
The microservice mesh adds first-class Outlook support — email send, thread-based retrieval, attachment handling — through Microsoft Graph with OAuth 2.0 and MSAL bearer-token flows. Outlook joins Google Gmail and Calendar as a peer in the unified connector protocol.
The runtime moves to JDK 24 and GraalVM 24.2.1, with Gradle 8.14 supporting the new toolchain. The upgrade brings stable virtual threads, structured-concurrency previews and the GraalVM JIT improvements that the platform's polyglot scripting surface depends on.
Report output follows the locale's direction: writing mode set on blocks and components, complex-script shaping for ligatures and bidirectional text, and the Dubai font embedded in three weights.
Calendar event creation through the cloud-connector mesh adds conference URIs and Hangouts Meet integration, with attendee management and pagination tokens. The event model decouples field mapping from JSON serialisation against API-version drift.
Anthropic Claude 3.7 Sonnet — including extended-thinking and reasoning-budget support — is now addressable through the platform's unified LLM interface alongside OpenAI and Google Vertex. Message-content handling is refactored to be model-agnostic.
ClickHouse joins the platform's multi-database JDBC layer as the first columnar OLAP engine. A complete SQL dialect covers ClickHouse's distinctive surface — date arithmetic, Nullable column semantics, OLAP aggregates, lateral joins and materialised views — through the same XSQL, workbench and virtual-table interfaces the OLTP engines already use.
The Vertica driver lands with array, JSON, multiset, geometry, blob, UDT and text-search types, plus database creation, metadata, users and explain. Vertica keeps one result set open, so the platform drains the first.
PDF, XSLT and HTML rendering services unify under a single gRPC architecture with shared error semantics. IP location and self-signed-certificate support join the cluster's secure inter-service path — the foundation later microservice additions build on.
Each user carries a monthly AI budget, checked against the AI log before a call runs. Default models resolve per user, then department, then company, and every provider client reports its usage the same way.
Google Vertex AI joins OpenAI and Anthropic Claude as the platform's third LLM provider. Gemini Pro and Flash models are addressable through the unified AI configuration layer ; a JavaScript model builder API exposes provider-specific options — regional endpoint override, grounding citations, thinking budget — without breaking the neutral application surface.
Chinese and Urdu translations join English, Spanish, Catalan, French, German, Italian and Portuguese in the platform UI. RTL framework support remains for Arabic and Hebrew when those packs ship — multinational Asia and South Asia deployments on a single platform.
The report engine renders PDF/UA-1 documents: tagged structure, a document language, declared metadata and alternate text on every image. Noto Sans Arabic ships in six weights for right-to-left output.
The Studio chat assistant gains tools: it charts a query in nine chart types, finds dictionary objects and answers from the manual. Its SQL runs through the XML query layer, so row security applies to the model too.
Time-based one-time passwords with QR enrolment, a delay after repeated failed logins, an option that keeps one session per user, and SAML, JWT and OAuth refinements for federated sign-in.
A credentials-manager SPI abstracts cloud credential storage across S3, Azure Blob, IBM Cloud and Google Cloud Storage. Enterprises integrate their secret-management policy of choice without rewriting application code ; rotation moves out of the application and into the platform.
A horizontal-layout analytical card joins the form-editor component palette — flexible node positioning, focus layering, configurable legends. Composable data-responsive designs replace static card layouts ; executive dashboards compose without per-screen custom styling.
A row-security rule declared once on a table is injected into every path that reads it: foreign-key lookups, vertical joins, reports, scripts and cursors, through one resolver, with ANSI joins and an explicit opt-out.
The engine-neutral SQL dialect compiles to SAP HANA: triggers, START WITH and CONNECT BY hierarchies, column-store tables. Hive connects through its JDBC bundle, and drivers without server-level connections declare it.
A notebook-style Studio tool where code and its explanation live together: folders, colour-coded tags, templates, a runner with a database connection and console, typed API completion, and notifications on sharing.
The stored-procedure language compiles triggers, common table expressions, FOR IN loops, UNION, EXECUTE IMMEDIATE and dynamic SQL with cursors to seven engines, and records where an engine refuses a construct.
The schema compiler emits storage placement: a dbspace per table, per large-object column by name pattern and per index, checked for existence first. Unique indexes may allow multiple nulls. Layouts are recorded.
Twelve spatial functions, from constructing points and polygons to area, buffer, intersection, length and centroid, compile to Informix, Oracle, PostgreSQL, SQL Server, DB2 and MySQL from one dialect.
The engine-neutral query dialect gains UNION with ordering, several common table expressions per query, synonyms, CROSS JOIN and nested joins, a rowid column, DECODE, an include resolver and full-text search.
Anthropic's Claude API joins OpenAI as the platform's second LLM provider, wired through the same provider-agnostic AI configuration layer. A RAG query transformer ships alongside it : the transformer generates multiple rephrased variants of the user's question before each retrieval pass, broadening recall against the vector index without changing the question the user sees.
Retrieval gains a reranking stage: a Cohere reranker with retries and a local Infinity service with a timeout, behind one interface. A question-answer chain wires retriever, reranker and query transformer.
Qdrant joins the platform as its first dedicated vector database, callable from server-side JavaScript through the platform's vector database namespace. A typed gRPC client replaces the earlier microservice dependency ; collection configuration, embedding store operations and payload-filtered nearest-neighbour queries are all available from scripts that hold the platform's standard role permissions.