| | Upgrade instructions Upgrade tasks | | Enhancements and bugs fixed in this version, known issues with this version |
|---|
2026/10/18 LATEST STABLE | i2incommon/grouper:7.9.0 sha256:fb54254b36
095d14ff8689aaa8be
81bfb8ac5646aca405
c8ea37944949fea0c5 | Upgrade instructions: 3 from 7.8.0 Upgrade tasks: None | OS: Rocky 9.8
Tomcat: 9.0.122
Java Corretto: 17.0.20.12.1
Grouper API: 7.9.0 | 35 Jiras Security improvements: upgrade netty; escape GSH template error output; UI actions run as POST
New Smartsheet provisioner
Duo admin role provisioner supports custom roles and role priority
WS returns all values of multivalued subject attributes
MCP: move groups, read-only GSH templates run without approval, changes audited as the logged-in user |
2026/10/11 STABLE | i2incommon/grouper:7.8.0 sha256:b3c11ec696
8cf5c3becf39043b5c
41a5bcccb3bb66f3a9
49b4c1407a8bcb0b7d | Upgrade instructions: 1 from 7.7.0 Upgrade tasks: 46 (DDL) | OS: Rocky 9.8
Tomcat: 9.0.122
Java Corretto: 17.0.20.12.1
Grouper API: 7.8.0 | 20 Jiras Security improvements: upgrade jackson, jsoup, log4j, amqp-client; escape request values in UI pages
New AI assistant in the Grouper UI
Institutions can hide the default GSH templates
Provisioning fixes: target entity id change, Duo sync-back
Accessibility: WCAG AA contrast for status messages |
2026/10/05 STABLE | i2incommon/grouper:7.7.0 sha256:509f5d9dfe
8780277ffac0b346ce
e0d9047c9c7e5787a2
f872ba4006d1444c3f | Upgrade instructions: 2 from 7.6.1 Upgrade tasks: 45 (DDL) | OS: Rocky 9.8
Tomcat: 9.0.122
Java Corretto: 17.0.20.12.1
Grouper API: 7.7.0 | 44 Jiras Security fixes: HTML escaping on the rules, audit, workflow and folder rule pages, MCP admin and SQL groups enforce sysadmin, /status endpoint can hide details, fewer stacktraces on login failures, Tomcat error pages hide stack traces and version, MCP SQL runs in a read-only transaction
New AssetSonar provisioner
GSH templates can return a file for download
Configuration review screen
MCP limited admin and SQL tiers
Provisioning: failsafe for entity deletes, ignoreIfMatchesValue is applied
Workflow: users can request to join again after a rejection |
2026/09/29 STABLE | i2incommon/grouper:7.6.1 sha256:e20941dc26
85f5678c13b292c96d
29f97e433f39ccfb3b
ee2b63e754b5f2f71a | Upgrade instructions: None Upgrade tasks: None | OS: Rocky 9.8
Tomcat: 9.0.122
Java Corretto: 17.0.20.12.1
Grouper API: 7.6.1 | 5 Jiras Config deletes propagate reliably to other JVMs
MCP: protected folders that block all MCP writes, consent screen refuses read-write scope on protected folders |
2026/09/28 STABLE | i2incommon/grouper:7.6.0 sha256:2bf168da5b
d10538540f19ada91d
28d26d70691d09bf08
0c013906f596c35d22 | Upgrade instructions: 2 from 7.5.1 Upgrade tasks: None | OS: Rocky 9.8
Tomcat: 9.0.122
Java Corretto: 17.0.20.12.1
Grouper API: 7.6.0 | 60 Jiras Security fixes: folder information leak, disabled memberships counted in authorization, HTML escaping of names, attestation settings permissions, expression language in config forms is sysadmin only
New MCP recipes
Circular group memberships are vetoed at any depth
Provisioning: Duo sync-back of login and enrollment, crudOperationOrder
UI accessibility (WCAG) improvements
Faster configuration screens |
2026/09/26 STABLE | i2incommon/grouper:7.5.1 sha256:8e37e2ed92
a27344d13bf7304a47
416d6c75ad1eaa1cce
048da51359c9d482a9 | Upgrade instructions: 2 from 7.5.0 Upgrade tasks: None | OS: Rocky 9.8
Tomcat: 9.0.122
Java Corretto: 17.0.20.12.1
Grouper API: 7.5.1 | 5 Jiras Security: fix rules UI privilege escalation, default-closed gate for rules that send email
Security: upgrade Tomcat 9.0.122
Tomcat maxHttpHeaderSize raised to 32k so large SSO cookies do not cause a 400
Quickstart applies v7 DDL |
2026/08/31 STABLE | i2incommon/grouper:7.5.0 sha256:f2d086791a
26c18f055a53e9fdca
dbb62aa6c2448828b9
16c14451c6da6fb419 | Upgrade instructions: 1 from 7.4.0 Upgrade tasks: None | OS: Rocky 9.8
Tomcat: 9.0.121
Java Corretto: 17.0.20.10.1
Grouper API: 7.5.0 | 27 Jiras Security: upgrade Bouncy Castle 1.85.2 (32 CVEs), Tomcat 9.0.121
New GitHub provisioner: organization teams and memberships
MCP: rename a group, configurable published MCP/OAuth URLs, per-configuration SQL databases, folder/group/subject consent screen
Editing provisioning on a group or folder now requires admin of that object
Accessibility: main landmark and skip link, markup out of link title attributes |
2026/08/15 STABLE | i2incommon/grouper:7.4.0 sha256:444227ae6d
7eb362afbe65bce07b
16070d20e07b556a99
06925d6b63cad52194 | Upgrade instructions: None Upgrade tasks: 44 | OS: Rocky 9.8
Tomcat: 9.0.120
Java Corretto: 17.0.20.8.1
Grouper API: 7.4.0 | 73 Jiras OAuth security fixes: open redirect on authorize, client secret verification, signing key encrypted at rest
Security improvements: upgrade PostgreSQL JDBC, jsoup, c3p0, ldaptive
New Jamf Pro provisioner
New CCure provisioner
MCP server supports spec revision 2026-07-28
Grouper wiki documentation is searchable through MCP
LDAP full sync no longer fails on an invalid paged results cookie
Provisioning retrieves members in parallel
Convert a group with members to a composite in place
Fix LDAP group loaders failing on a missing SQL attribute
Find reports from the daemon logs screen
Accessibility: tooltips, privilege screen contrast, modal close button |
2026/07/20 STABLE | i2incommon/grouper:7.3.2 sha256:bf084d0e21
f92caeecb1de4b15b7
9b8dcbaa9c2b1c5876
942abb2ac118747509 | Upgrade instructions: None Upgrade tasks: None | OS: Rocky 9.8
Tomcat: 9.0.120
Java Corretto: 17.0.19.10.1
Grouper API: 7.3.2 | 33 Jiras Fix replace-group-memberships reconciliation
Azure full sync driven from the sync-back cache
Azure provisioner recovers from an expired page token
Provisioner progress in DB logs
ABAC supports time-based queries, subject sources, timestamps
New rule action to set a membership end date
External system details show where it is used
Grouper wiki markdown is in container
Daemon log shows a performance-over-time graph
Development-only form-based login option (helps with AI browsers)
Security improvements: upgrade Tomcat, upgrade Jackson jar |
2026/07/07 EXPIRED GRP-7132 | i2incommon/grouper:7.3.1 sha256:19572cb6fb
277ce6bd6c4b92dd5f
ca19a010893b15331c
ce55327b7e6fd1a4cf | Upgrade instructions: None Upgrade tasks: None | OS: Rocky 9.8
Tomcat: 9.0.118
Java Corretto: 17.0.19.10.1
Grouper API: 7.3.1 | 1 Jira Fix provisioning replace memberships issue |
2026/07/05 NOT STABLE GRP-7119 | i2incommon/grouper:7.3.0 sha256:09fa047d51
d88a2854a920d357d8
724c75dab5424e37f2
6ee84ced8c9f3a605d | Upgrade instructions: 3 from 7.2.1 Upgrade tasks: 43 (DDL) | OS: Rocky 9.8
Tomcat: 9.0.118
Java Corretto: 17.0.19.10.1
Grouper API: 7.3.0 | 107 Jiras Capture sync-back data as Grouper writes inserts, updates, and deletes
Drive full sync from the sync-back cache to speed up large provisioners
SCIM provisioner diagnostics validate config against the target
SCIM recovers from 409 "uniqueness" instead of failing
GSH templates can compile and run as Java
New Dropbox Business provisioner
Provision faculty to Interfolio
Accessibility overhaul (WAVE fixes)
Loader control over insert/delete order and group removal
Provisioner failsafe works independently of the loader
ABAC global variables and not-in-list syntax
Visualization for scripted groups
Deep DDL check and upgrade-task UI pages
View subject screen was slow for non-admins — fixed N+1 privilege resolution
More columns on the entity data-field screens in Misc |
2026/05/24 EXPIRED | i2incommon/grouper:7.2.1 sha256:84056ec2ba
a09d0724a5a15f4d41
668c157720bc8a4a38
b0b4f68f67a2879437 | Upgrade instructions: none Upgrade tasks: none | OS: Rocky 9.7
Tomcat: 9.0.118
Java Corretto: 17.0.19.10.1
Grouper API: 7.2.1 | 4 Jiras GRP-6994: MySQL DDL issue
Upgrade Tomcat to 9.0.118 for security
Upgrade 3rd party jars for security |
2026/05/20 EXPIRED GRP-6994 | i2incommon/grouper:7.2.0 sha256:a7db745d57
a6f4074f2051c0afc8
6fdbd8925c76b6d83b
ac9daaa86b515b0f39 | Upgrade instructions: 3 from v7.1.0 Upgrade tasks: 41, 42 (DDL) | OS: Rocky 9.7
Tomcat: 9.0.115
Java Corretto: 17.0.19.10.1
Grouper API: 7.2.0 | 89 Jiras Visualization for scripted groups
Miscellaneous > Reports page to show all reports
Do not select "update alternate path" by default
Combobox should be able to be keyboard only
Make custom ui link page for all users not just admins
Tomcat access log pattern should be configurable
Add per-user UI preference to default the group Members tab to direct memberships only
Enhance the 'Advanced Filter' for Group memberships with 'Subject Source'
Generic provisioning data sync back
Incremental sql loader improvements
Add Azure (Entra) certificate-based authentication for app registrations
Update folder tree icons in UI
Raise default hibernate.jdbc.batch_size from 200 to 1000
|
2026/04/05 EXPIRED | i2incommon/grouper:7.1.0 sha256:b7008e3a17
919e1142a0c828b5f1
2abd0d49609826125f
f48a5713aa485f071d | Upgrade instructions: 3 from v7.0.3 Upgrade tasks: 39, 40 (DDL) | OS: Rocky 9.7
Tomcat: 9.0.115
Java Corretto: 17.0.18.9.1
Grouper API: 7.1.0 | 57 Jiras Export memberships from a folder
Export audit logs
TrueFoundry provisioner
Data providers and Jexl scripted daemons can run as readonly (for upgrades)
Batch data provider full sync by subject ID range to reduce memory consumption
MCP well-known endpoint should use grouper.ws.url config
Data field subject source comparison fixes and diagnostics
Data field subject source improvements
Abac data field or data row with missing privacy realm breaks the data dictionary
Once a group is not loaded anymore it should not state as such in UI
Add index to improve speed of grouper_memberships_all_v
Fix tomcat access logs
Fix entity/group in target failing (provisioning) |
2026/03/21 EXPIRED | i2incommon/grouper:7.0.3 sha256:8c4ff19344
bc1dc318ba06368d28
249f8e0606e91c5251
07ad0f67253e95a9a6 | Upgrade instructions: 1 from v7.0.2 Upgrade tasks: none | OS: Rocky 9.7
Tomcat: 9.0.115
Java Corretto: 17.0.18.9.1
Grouper API: 7.0.3 | 54 Jiras Okta provisioning improvements
Make combo for adding members wider (cuts off long groups)
Memory management and thread improvements
Add datadog provisioner
Data field subject source improvements
MCP (add lucene search engine, call GSH templates, config tool, external systems, doc search, group delete)
TeamDynamix provisioning improvements
Loader jobs can use disabled external systems
Centralized batch sizes for various things in provisioning
Google commands class needs to get tokens more often
Add scim name "nested" strategy
Jexl3 can't access public methods of class instance variables
New groups created through incremental loader should set display name and other properties
Sftp needs a jar added |
2026/03/09 EXPIRED | i2incommon/grouper:7.0.2 sha256:0aa71b411a
d31e35e8abffe66fe3
6d8c0da75c68e9dba4
2b37171ca4185d1fd7 | Upgrade instructions: none Upgrade tasks: none | OS: Rocky 9.7
Tomcat: 9.0.115
Java Corretto: 17.0.18.9.1
Grouper API: 7.0.2 | 27 Jiras Allow data fields to be used with provisioning
Okta Provisioner - Load users that are in memberships but were not fetched while retrieving users
Upgrade pac4j for security reasons
Add ldap query mcp tool
Mcp does not work for grouper in multiple WS nodes
Add mcp tool for memberships_get
Add scopes to restrict grouper mcp by folders, groups, entities
Allow the mcp sql tool to handle other external systems
Add provisioning, eligibility, types to findGroups in MCP |
2026/03/06 NOT STABLE GRP-6731 | i2incommon/grouper:7.0.1 sha256:7c8e9b6cda
40c49ad27082085196
20597d903c644bafcf
e9f7aa937012cad7ef | Upgrade instructions: 3 from v6.1.0 Upgrade tasks: 38 | OS: Rocky 9.7
Tomcat: 9.0.115
Java Corretto: 17.0.18.9.1
Grouper API: 7.0.1 | 109 Jiras MCP
"Copy to clipboard" buttons on group / folder / daemon logs pages
Security issue: Apache Tomcat upgrade to v9.115
Everything that v6.1.0 has |