All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog, and this project adheres to Conventional Commits.
| Issue | Severity | Status | ADR Reference | Impact |
|---|---|---|---|---|
| POSITION Search Performance (UI) | 🔴 Critical | ✅ Fixed | ADR-005 | Backend UI now uses TS_RANK (100× faster) |
| Multi-Tenant Data Integrity | 🔴 Critical | ✅ Fixed | ADR-006 | UNIQUE constraint now includes ad_client_id |
| SQL Injection Vulnerabilities | 🔴 Critical | ✅ Fixed | ADR-002 | Defense-in-depth validation added |
| Transaction Isolation | 🔴 Critical | ✅ Fixed (2026-02-13) | ADR-001 | Hybrid approach: business trx for read, separate for write |
| Slovak Language Config | 🟡 Medium | ✅ Fixed | ADR-003 | sk_unaccent config support added |
| REST API POSITION Hardcoded | 🟡 Medium | ADR-004 | Requires fix in cloudempiere-rest repo | |
| Cache Invalidation | 🟡 Medium | Open | N/A | Restart required after config changes |
For comprehensive analysis and solutions, see:
- Architecture Decisions: docs/adr/README.md - Complete ADR catalog with implementation roadmap
- Root Cause Analysis: ADR-003: Slovak Text Search Configuration
- Performance Migration: ADR-005: SearchType Migration
- Cost Analysis: ADR-007: Search Technology Selection (€36,700 savings)
- Implementation Guide: Next Steps - Implementation roadmap
- CRITICAL: Fixed FK table indexing failure in uncommitted transactions (SearchIndexEventHandler)
- Event handler now uses business transaction for reading data (can see uncommitted changes)
- Fixes "NO Data found" error when parent and child records created in same transaction
- Critical for import processes that create related records atomically
- Impact: M_Product + M_Product_PO indexing now works correctly in import scenarios
- Related: ADR-001 clarified to specify hybrid transaction approach
- Commit: [pending]
Release with event handler lazy initialization optimization for improved startup reliability.
- Release configuration file for Maven/Tycho automated releases
- Optimized SearchIndexEventHandler lazy initialization with exponential backoff polling
- Replaced ScheduledExecutorService with simpler Thread-based approach for one-time startup
- Fixed chicken-and-egg problem where dynamic tables were never registered
- CLD-1677: NullPointerException during OSGi startup when DB not yet connected
- Event registration now uses fast-response polling (10ms → 500ms exponential backoff)
Major release with P2 repository structure for iDempiere plugin distribution.
- P2 repository structure for OSGi plugin deployment
- Feature bundle for grouped plugin installation
- Maven Tycho build configuration for Eclipse plugin packaging
- Reorganized project structure for Tycho/P2 build system
- Updated parent POM to support P2 repository generation
Migration scripts release for Slovak text search configuration and multi-tenant integrity fixes (CLD-1652).
postgresql/migration/202512180801_Slovak_Text_Search_And_MultiTenant_Fix.sql- Comprehensive PostgreSQL migration- Creates Slovak text search configuration (sk_unaccent) for proper diacritics handling
- Fixes multi-tenant UNIQUE constraint to include ad_client_id
- Cleans up duplicate search index data
- Includes rollback procedures
oracle/migration/202512180801_MultiTenant_Fix.sql- Oracle-specific multi-tenant fix- Applies UNIQUE constraint fix for Oracle databases
- Includes rollback procedures
MIGRATION_README.md- Migration governance documentation- Timestamped naming convention (YYYYMMDDHHmm_Description.sql)
- PostgreSQL and Oracle migration standards
- Rollback procedure requirements
- Standardized migration script naming to use timestamps for ordering
- Organized scripts into database-specific directories (postgresql/, oracle/)
- Removed deprecated migration scripts with non-standard naming
- Enhanced migration documentation with rollback procedures
- CRITICAL: Added SQL injection prevention with defense-in-depth strategy
- Created
SearchIndexSecurityValidatorwith three-layer protection:- Input validation (dangerous patterns and safe characters)
- Whitelist verification (table/column names against AD_Table/AD_Column)
- Parameterized queries where possible
- Fixed SQL injection vulnerabilities in:
PGTextSearchIndexProvider.java: WHERE clause concatenation (lines 148-151, 167-170)PGTextSearchIndexProvider.java: Table name concatenation (lines 144, 163, 361)SearchIndexConfigBuilder.java: WHERE clause concatenation (lines 320-326)
- See ADR-002 for complete analysis
- Created
- CRITICAL: Fixed multi-tenant data corruption vulnerability
- Updated UNIQUE constraint from
(ad_table_id, record_id)to(ad_client_id, ad_table_id, record_id) - Fixed
PGTextSearchIndexProvider.java:116ON CONFLICT clause - Migration scripts standardized in
postgresql/migration/202512180801_Slovak_Text_Search_And_MultiTenant_Fix.sql - Prevents cross-client record overwrites
- See ADR-006 for impact analysis
- Updated UNIQUE constraint from
- CRITICAL: Implemented separate transaction isolation for search index operations
- Refactored
SearchIndexEventHandlerto use dedicated transactions - Removed instance variables
ctxandtrxName(thread safety issue) - Added
executeIndexUpdateWithSeparateTransaction()helper method - Index failures no longer rollback business transactions
- Improved performance by reducing lock contention
- Updated helper methods to accept ctx/trxName as parameters:
getMainPOs(),getMainPOsOfTable(),applyWhereClause(),handleSearchIndexConfigChange()
- See ADR-001 for rationale
- Refactored
- CRITICAL: Changed default SearchType from POSITION to TS_RANK for 100× performance improvement
- Updated
ZkSearchIndexUI.java:189to useSearchType.TS_RANK(backend UI) - Impact: Search queries complete in <100ms instead of 5-10s for 10K records
- Breaking Change: Result ranking may differ from POSITION (uses ts_rank instead of regex position)
- Action Required: REST API still hardcoded to POSITION (cloudempiere-rest repository)
- See ADR-005 for migration guide
- Updated
- Added Slovak/Czech language diacritics support with proper text search configuration
- Updated
getTSConfig()method to detect Slovak (sk_SK) and Czech (cs_CZ) languages - Returns
sk_unaccentconfiguration for proper diacritics handling - Migration scripts in
postgresql/migration/202512180801_Slovak_Text_Search_And_MultiTenant_Fix.sql - Enables searches without diacritics to match text with diacritics
- Example: searching "ruza" matches "ruža", "růža", "rúža"
- See ADR-003 for architecture
- Updated
SearchIndexSecurityValidatorutility class for SQL injection preventionvalidateWhereClause()- Validates WHERE clause for dangerous patternsvalidateTableName()- Validates table name against AD_Table whitelistvalidateColumnName()- Validates column name against AD_Column whitelist
- ADR-003: Slovak Text Search Configuration Architecture - Formalizes Slovak language support using PostgreSQL text search configuration with multi-weight indexing to replace POSITION workaround (see docs/adr/ADR-003)
- ADR-004: REST API OData Integration Architecture - Documents REST API integration via OData
searchindex()filter function (see docs/adr/ADR-004) - ADR-007: Search Technology Selection - Captures decision to use PostgreSQL FTS over Elasticsearch/Algolia, saving €36,700 over 5 years (see docs/adr/ADR-007)
- ADR Index - Created comprehensive ADR catalog with dependency graph and implementation tracking (see docs/adr/README.md)
- Complete documentation validation and reorganization
- Extracted architectural decisions from guide documents into formal ADRs
- Established clear relationships between all ADRs (dependency graph)
- Validated all code references in documentation (all paths accurate)
- Standardized repository with CloudEmpiere governance standards
- Added CHANGELOG.md following Keep a Changelog format
- Added FEATURES.md with feature matrix and status tracking
- Created governance templates (ADR template, STRATEGIC_REVIEW.md, IMPLEMENTATION_PLAN.md)
- Enhanced CLAUDE.md with Development Standards section
- Enhanced README.md to governance-compliant format (concise, links to detailed docs)
- ADR-005: SearchType Migration - Enhanced with cross-references to ADR-003 (Slovak config root cause), ADR-004 (REST API impact), and ADR-007 (technology selection rationale)
- Documented critical performance issues with POSITION search type (see ADR-005)
- Documented Slovak language root cause analysis (see ADR-003)
- Documented REST API performance impact (see ADR-004)
- Documented cost analysis and technology comparison (see ADR-007)
- POSITION Search Type: 100× slower than TS_RANK due to regex operations bypassing GIN index
- Impact: 5 seconds for 10,000 products (unusable at scale)
- Root Cause: Workaround for Slovak diacritics without proper text search configuration (see ADR-003)
- Solution: Migrate to TS_RANK + Slovak text search config (see ADR-005)
- Files Affected:
ZkSearchIndexUI.java:189(backend UI)DefaultQueryConverter.java:689(REST API)ProductAttributeQueryConverter.java:505(REST API)
- Multi-Tenant Unique Constraint: Missing
ad_client_idin unique constraint- Impact: Records can be overwritten across clients (data corruption)
- Current Constraint:
UNIQUE (ad_table_id, record_id) - Required Constraint:
UNIQUE (ad_client_id, ad_table_id, record_id) - Solution: See ADR-006
- Cache Invalidation: Configuration cache does not invalidate automatically
- Impact: Restart required after AD_SearchIndex configuration changes
- Workaround: Restart OSGi bundle or trigger event handler re-initialization
- Slovak Language Configuration: Not yet implemented, missing €36,700 cost savings
- Impact: Using POSITION workaround instead of proper Slovak text search config
- Benefit: 100× performance improvement + €36,700 savings vs Elasticsearch
- Solution: See ADR-003
- PostgreSQL full-text search provider
- Elasticsearch provider stub
- Event-driven index updates
- Multi-weight column indexing
- Role-based access control for search results
- Reorganized plugin structure
- Improved search ranking algorithms
- Improved and documented sanitizeQuery method (CLD-1528)
- Enhanced search input sanitization (CLD-1535)
- Added record ID check in SearchIndexEventHandler (CLD-1527)
- Set result rank by iteration index for fixed order (CLD-1487)
- NPE when creating new business partner without isCustomer='Y' (CLD-1489)
- Search index rank to consider diacritics (CLD-1487)
- Ranking logic for POSITION search type (CLD-1206)
- Text search by normalizing document content
- Search index Event Handler not firing when record activated (CLD-1326)
- Unnecessary table call in SearchIndexEventHandler (CLD-1109)
- Cross-tenant integrity issues (#3562)
- Escape special characters in search term before applying regex (#3486)
- NPE for FK indexed tables blocking record saves (#2784)
- Indexing newly created records (#2784)
- Sanitized search query for PostgreSQL text search provider (#3486)
- Rank by position with weighted ranking (#3456)
- Event Handler performance (#3417)
- Rank by position (distance from beginning) (#3417)
- Support for system indexes (#2784)
- Java model corrections (#2784)
- Added SysConfig for Event Handler (#2784)
- Return rank in search results (#2784)
- Added caching for configuration (#2784)
- Event handler performance, added IsValid to Search Index (#2784)
- Implemented unaccent, order by relevance (#2784)
- Support for changes in foreign tables (#2784)
- Set default index type if none selected
- Reorganized tsearch_pg implementation
- Reorganized as plugin de.bxservice.omnisearch
- Indexing logic
- 2Pack configuration
- Dashboard registration
- Code cleanup
- Code quality and UI
- Added packout support
- Renderer for extended info in result pages
- Logic for retrieving queries
- Initial commit
- Document and index creation in database
- Join clauses for FK columns
- Log messages
- Search config language detection
- Index type reading from process parameters
- Join clauses when same table chosen multiple times
- First prototype of omnisearch plugin
Note: This CHANGELOG was generated from git history during repository standardization on 2025-12-13. Historical entries before 2025 may lack detail. Please update with additional context as needed.