Upgrade notes 2026.2.0
Version upgrade
Upgrading from 2026.1.x
Direct upgrade is supported, you will need to follow the plan :
- Apply needed modifications after reading this upgrade notes
- Upgrade ARender to 2026.3.1
- Start all applications with their prerequisites
Upgrading from 2026.0.x
Apply the 2026.1.0 upgrade notes first, then this upgrade notes, following the plan above.
Upgrading from 2025.x.x or earlier
Direct upgrade is not supported. Upgrades from 2025.x.x or earlier to 2026.2.0 must follow the following plan :
- Apply the 2026.0.0 upgrade notes first, as well as all upgrade notes between your version and 2026.0.0
- Then apply the 2026.1.0 upgrade notes and this upgrade notes, following the plan above
Architecture
Modified components
- ARender 2026.1.0 → 2026.3.1
- Plume 2026.0.0 → 2026.2.0
Deprecated components
Popup.buildSearchis deprecated and will be removed in the next major release. Migrate tobuildSearchToSelectUnique, same signature and behaviour (see Search popup).- The
criteriaoption ofSearchAttachmentPluginis deprecated. Migrate tocriteriaBuilder, a function building the criteria from the current task (see Attachment plugins).
Customisation and configuration
Configuration
Added properties
| Property | File | Default | Description |
|---|---|---|---|
gui.search.operators.restricted | gui.properties | false | Set to true to hide the does not contain, is empty and is not empty operators from every search, for a custom connector that does not support them. |
Product
Security
- Improvements to FlowerDocs security have been made by upgrading library versions and internal behaviours. This proactive approach ensures better protection against vulnerabilities.
Administration roles
In addition to ADMIN and SYSTEM_ADMIN, which keep all their rights, FlowerDocs 2026.2.0 delegates administration to six granular roles: RECOVERYBIN_MANAGER, USERS_MANAGER, SECURITY_ADMIN, DELEGATION_MANAGER, TEMPLATE_MANAGER and FUNCTIONAL_ADMIN. They are described in Administration roles.
Nothing has to change for a scope administered with ADMIN only: ADMIN keeps every right, and the new roles have no members until you add some. Act only if you used SECURITY_ADMIN to manage ACLs (see below), or if you want to delegate part of the administration to the new roles.
- Scopes created from the 2026.2.0 template declare the six profiles, empty. An existing scope does not receive them: add the profiles you want to use to your scope: in the administration console, under Principals > Teams, create a team whose identifier is the role name, then add its members (see Administration roles).
SECURITY_ADMINno longer manages ACLs. Creating and updating an ACL now requiresFUNCTIONAL_ADMIN, deleting one requiresADMIN. Add the members who must keep managing ACLs to theFUNCTIONAL_ADMINprofile.- Only
ADMINandSYSTEM_ADMINgrant administration. Adding a principal to an administration profile, team or group is refused to any other role. - Only
ADMINandSYSTEM_ADMINupdate a scope definition.USERS_MANAGERandSECURITY_ADMINmay still change the members of the profiles they manage. - Purging the caches is open to
USERS_MANAGER,SECURITY_ADMIN,FUNCTIONAL_ADMINandTEMPLATE_MANAGER, in addition toADMIN, so that each role sees its changes without waiting for the cache to expire. - New class ACLs for directory, OAuth and template documents. In the 2026.2.0 scope template, the
LDAPConfigurationandOAuthClientConfigurationclasses use the newacl-security-configuration-administrationACL, and theTemplateclass usesacl-template-administration. These ACLs letSECURITY_ADMINmanage the directory and OAuth configurations, andTEMPLATE_MANAGERmanage email bodies and signatures.- To use
SECURITY_ADMINorTEMPLATE_MANAGERon an existing scope:- Add the two ACLs to the scope and set them on the three classes. Updating the scope from the default flower-templates scope template does this for you.
- Then set the new ACL on the
LDAPConfiguration,OAuthClientConfigurationandTemplatedocuments created before the upgrade. A document keeps the ACL it was created with, so without this step the two roles cannot manage them.
- To use
Behaviour changes
Functional
- Faster searches for users who belong to many groups. ACL rules on
${user.authorities}and${user.id}now compare exact values when filtering searches, like the check on a single component already did. Preferences secured by the defaultacl-preferencesproxy, such as stamps shared with a team, are not affected: they store full identifiers (see Authorisation).
API
Behaviour changes
F00328is now returned with HTTP 403, instead of 500, and its message names the roles required:Not allowed to perform this operation, one of the following roles is required: {0}. Administration calls outside the caller's role are refused with this code.- The recovery bin is listed through its own endpoint. The generic search no longer returns the deleted components of a recovery bin: the
PURGEsearch context does not bypass the ACL filter anymore. Integrations that listed a recovery bin with the generic search must callPOST /{category}/recoverybin/searchinstead (documents,folders,tasksorvirtualFolder), open toADMIN,SYSTEM_ADMINandRECOVERYBIN_MANAGER(see Recovery bin). - Quotation marks in a Content criterion value are searched as typed. They no longer mark an exact phrase, so a value wrapped in quotation marks now matches nothing. To search an exact phrase, use the
EQUALS_TOoperator without quotation marks.
Search operators
Operators gains three values. NOT_CONTAINS (does not contain) applies to text tags and to the content criterion. EMPTY (is empty) and NOT_EMPTY (is not empty) apply to text, numeric, date and choice list tags, and to the content criterion. See Criterion types and operators.
Additions
- Error codes, all HTTP 403 (see Administration roles):
| Code | Message |
|---|---|
F00329 | Your {0} role lets you edit the data model, not delete {1}. This action is reserved for the ADMIN or SYSTEM_ADMIN profile. |
F00330 | Your {0} role lets you choose the ACL of a class when you create it, not change the ACL of {1}, which secures everything that uses the class. This action is reserved for the ADMIN or SYSTEM_ADMIN profile. |
F00333 | Not allowed to modify the privileged profile {0} |
F00335 | Your {0} role lets you change the profiles of the scope {1}, not {2}. This action is reserved for the ADMIN or SYSTEM_ADMIN profile. |
- JavaScript API:
Popup.buildSearchToSelectUniqueandPopup.buildSearchToSelectMultipleopen a search popup in which the user selects one document or several documents, respectively.TaskJsAPI.registerBeforeAnswerandTaskJsAPI.registerAfterAnswerrun a callback before or after any task answer is applied (see Tasks).ContextualMenuAPI.registerForActionDisplayResolutionis the new way to hide or show an action of the contextual menu. Do not overrideregisterToAddAnswersInTaskContextualMenuanymore: a script that overrides it replaces the product's own script, which can break the contextual menu, as happened in previous versions. Move such scripts toregisterForActionDisplayResolution(see Shortcuts).
FlowerDocs GEC
Update the GEC scope with CLM.
Modified configuration documents
From the GEC client package (gec-scope). Its gec-env-scope, GEC with eProcess, receives these changes and the eProcess ones listed in FlowerDocs eProcess.
The following configuration documents have been added :
acl-security-configuration-administration.xmlacl-template-administration.xmlgec-asyncTaskAnswer.jsgec-asyncTaskAnswer.xml
The following configuration documents have been modified :
acl-admin.xmlacl-creation.xmlacl-NA.xmlacl-notifMail.xmlacl-preferences.xmlACL_Courrier.xmlACL_DossierClient.xmlACL_GEC_Copy.xmlACL_GEC_Creation.xmlACL_GEC_Creation_GEC.xmlACL_GEC_End.xmlACL_GEC_End_GEC.xmlACL_GEC_NoCreation.xmlACL_GEC_PourInfo.xmlACL_GEC_PourInfo_Creation.xmlACL_GEC_Progress.xmlACL_GEC_Reaffectation.xmlACL_GED_Document.xmlACL_Reponse.xmlACL_Report.xmlACL_SOL_Modele.xmlB_DirectionDestinataire.xmlB_ServiceDestinataire.xmlgec-copieCourrier.jsgec-gui-configurationgui-solutionLDAP.xmlLDAPConfiguration.xmlOAuthClientConfiguration.xmlsol-common.jssol-hideAdminMenu.jsTemplate.xmltaskAvailable.jsscope.xml
FlowerDocs eProcess
Update the eProcess scope with CLM.
Attachments
- Existing documents are attached through the
SearchAttachmentPlugin. The specific search script is replaced by the FlowerDocs plugin, which can attach several documents at once to a multivalued attachment. The plugin builds its criteria withcriteriaBuilder; the staticcriteriaoption is deprecated.
Modified configuration documents
From the eProcess client package (env-scope).
The following configuration documents have been added :
acl-security-configuration-administration.xmlacl-template-administration.xmlattachmentPlugin.jsattachmentPlugin.xmlsearchAttachmentPlugin.jssearchAttachmentPlugin.xml
The following configuration documents have been modified :
acl-admin.xmlacl-annotation.xmlacl-creation.xmlacl-NA.xmlacl-notifMail.xmlacl-preferences.xmlACL_DossierClient.xmlACL_ENV_Document.xmlACL_ENV_Task_Creation.xmlACL_ENV_Task_Fin.xmlACL_ENV_Task_NoCreation.xmlACL_ENV_Task_Traitement.xmlACL_ENV_Task_Traitement_EnAttente.xmlACL_ENV_Task_Traitement_ERROR.xmlACL_GED_Document.xmlACL_Report.xmlACL_SOL_Modele.xmlenv-enveloppes-searchenv-filterWorkflow.jsenv-homeenv-searchAttachment.jsenv-shortcutsENV_MesEnveloppes.xmlENV_Statut.xmlENV_ToutesLesEnveloppes.xmlgui-solutionLDAP.xmlLDAPConfiguration.xmlOAuthClientConfiguration.xmlsol-common.jssol-hideAdminMenu.jsTemplate.xmlscope.xml