v9.3.9

frappe/ganttv9.3.9Jun 17, 2026by jlongWang

AI Summary

This release prioritizes security hardening by addressing a specific CVE and improving static file handling. It also upgrades the Threat Intelligence Sharing program and fixes several bugs related to logging, certificate management, and configuration reloading.

Key Highlights

Security hardening: Upgraded Nginx components to mitigate CVE-2026-49975.
Fixed a static file path handling edge case related to Auth.
Upgraded Threat Intelligence Sharing program.
Fixed issues with application access logs and certificate synchronization.
Optimized Nginx/MGT reload logic to reduce unnecessary reboots.

New Features

CVE-2026-49975 mitigation
Static file path security fix
Threat Intelligence Sharing upgrade
IP geo location database update
Application access log refresh fix
Certificate synchronization optimization

Full Release Notes

## Release Notes

This release focuses on security hardening, an upgrade to the Threat Intelligence Sharing program, and several stability and user experience fixes. Community Edition users are advised to update promptly.

  ### Security Hardening

  - Upgraded Nginx-related components to mitigate the potential security risk of CVE-2026-49975 and improve the runtime security of the protection service.
  - Fixed an edge case in static file path handling related to Auth,improving security when abnormal paths are accessed.

  ### Improvements

  - Upgraded Threat Intelligence Sharing.
  - Updated the IP geo location database.

  ### Bug Fixes

  - Fixed an issue where the application access log could automatically switch back to the real time log after refresh or polling while viewing the History log.
  - Fixed an issue where a failed Free Cert application or renewal could trigger an abnormal full rebuild of application configuration.
  - Optimized certificate synchronization and configuration reload logic to reduce unnecessary Nginx/MGT reloads when certificate content has not changed.