Skip to main content

Mango 5.6.x Release Notes

Release notes for all Mango 5.6.x patch releases. The latest release in this series is 5.6.12 (September 1, 2026).

Mango 5.6.12 — September 1, 2026​

core​

  • Fixed OAuth 2.0 / OpenID Connect logins resetting a user's roles to only user when oauth2.client.registration.{registrationId}.userMapping.roles.sync is false — roles assigned by an administrator in Mango are now preserved across logins.
Mango 5.6.11 — August 25, 2026

bacnet-ds

Security Fix

Upgraded BACnet4J to 6.1.1, fixing an infinite loop that a malformed or malicious BACnet message could trigger.

Breaking Change

The BACnet REST serialization of CharacterString values now represents the character encoding as an object rather than a byte.

core

Security Fix

Fixed a privilege escalation where any user with a script engine permission could evaluate scripts with arbitrary roles, including superadmin.

Security Fix

File store operations now reject paths that traverse a symbolic link pointing outside the file store, closing a path traversal that a symlink created inside a file store could open.

Breaking Change

Evaluating a script while requesting roles the caller does not hold now fails with a permission error instead of being silently allowed; callers must stop passing roles they do not have.

  • Third-party dependencies updated to their latest patch releases, resolving known security vulnerabilities: Spring Framework 6.2.19, Spring Security 6.5.11, Jetty 12.1.12, Netty 4.2.17, PostgreSQL JDBC 42.7.13, jOOQ 3.19.37, log4j 2.25.5, and many other runtime and protocol-client libraries.
  • Jackson upgraded from 2.19.2 to 2.21.6, resolving several published JSON parsing and data-binding vulnerabilities. Jackson 2.19 receives no further fixes upstream, so this is a two-minor-version upgrade of the library behind all REST API serialization on this line; custom modules and scripts that use Jackson directly should be re-verified after upgrading.
  • BouncyCastle upgraded to 1.84, Apache HttpComponents to httpclient5 5.6.4 and httpcore5 5.4.3, and lz4-java to 1.11.1, resolving known vulnerabilities including denial-of-service issues in HTTP response parsing.
  • Spring LDAP upgraded to 3.3.8, which rejects LDAP binds pairing a username with an empty password (CVE-2026-41720); Mango's LDAP login already rejected empty passwords before binding, so no behavior change is expected.
  • All supported Mango release lines are now scanned nightly for known vulnerabilities in their third-party dependencies, direct and transitive, against the OSV vulnerability database; findings are triaged into dependency updates, such as those shipped in this release, or documented accepted risks.
  • Each Mango release now includes a CycloneDX software bill of materials: a signed <artifactId>-<version>-cyclonedx.json file is published alongside the core bundle and each module, listing exactly the third-party Java components that artifact ships.
  • The npm packages bundled into the web UI are not yet covered by the SBOM.
  • Mango is now built with dependencies resolved only from Maven Central and Radix IoT's own package registry. Previously a third-party library could introduce its own download locations into the build, which resulted in internal Mango artifact names being requested from unrelated external hosts.
  • Every third-party library Mango is built against is now fixed to an exact version. Some previously specified a range of acceptable versions, which allowed the version selected to depend on what external repositories reported at build time.
  • Dependency downloads whose checksum does not match are now rejected rather than accepted with a warning.

modbus-ds

Security Fix

The Modbus serial locator, serial write and scan tools now require the data source permission, matching their IP equivalents; previously any authenticated user could write to serial Modbus devices or trigger scans.

ui

  • Security updates for frontend packages.
Mango 5.6.10 — August 4, 2026

ui

  • Chart data no longer stops updating when 3 or more points are selected without combine-values.
Mango 5.6.9 — July 22, 2026

ascii-file-ds

  • Fixed a bug where the ASCII File data source never registered with the module system on startup, so the data source type did not appear as an option. ASCII File data sources are now available again.

bacnet-ds

  • Fixed a bug where writing a set point value to a BACnet Real point truncated any fractional part, and writing to a Double point collapsed the value to 0 or 1 instead of passing it through unchanged. Writing to an Enumerated point also silently failed to apply. All three now write the correct value.

bacnet-ds, modbus-ds

  • Fixed a bug where a BACnet or Modbus publisher writing a value back into Mango (or relinquishing a point) applied the value correctly, but any event raised as part of that write — such as a data-type-mismatch, not-settable, or recursion-failure event — failed to fire because no security context was available on the callback thread. These events now fire correctly.

bacnet-ds, persistent-pub-ds

  • Fixed a bug where a BACnet publisher's write-back to Mango could hang for up to 30 seconds and log a PermissionException: No authentication set in security context error, because constructing the write-back task on the BACnet4J listener thread required a security context that wasn't yet established when the task object was created. Also fixed a related bug where a gRPC publisher's write-back could silently fail to apply the value (logged only as an internal error) for the same reason. Both publishers now establish a system security context before running their write-back path.

core

  • Fixed a bug where data arriving on a virtual serial port backed by a client-mode TCP socket bridge never fired an RX event to the listening data source, unlike a real serial port or the server-socket bridge variant. Also fixed an import-order bug where virtual serial ports could be imported after the data sources that depend on them.

core, persistent-pub-ds

  • Fixed a flood of "Error syncing point … Status{code=UNKNOWN}" messages that could fill the log when saving or restarting a data source whose points are published to a gRPC data source. Concurrent point synchronizations could update a data point's attributes without proper thread-safety, causing intermittent failures, and every per-point sync needlessly reprocessed all of the publisher's points — work that grew with the square of the point count and could peg the CPU on large publishers. Point attribute updates are now thread-safe and each sync only processes the affected point, eliminating the errors and greatly reducing CPU usage when saving or restarting publishers with many points.
  • Fixed gRPC publisher and data source metrics that would freeze after the publisher or data source was disabled, restarted, or reconfigured. Previously their Prometheus metrics — the egress/ingress counters, the error count, and the queue size and file-size gauges — would stop updating and stay stuck at their last value until Mango itself was restarted, which made rate and throughput panels in Grafana read zero. These metrics are now correctly removed when the publisher or data source stops and re-registered when it restarts, so they resume updating immediately.

data-file-ds

  • Fixed a bug where the Data File data source never registered with the module system on startup, so the data source type did not appear as an option and any configured Data File data sources failed to start. Data File data sources are now available again.

line-protocol-ds

  • Fixed a bug where a Line Protocol point locator's measurement and fieldKey were silently dropped when exporting a data point to JSON, causing them to be lost on re-import.
  • Fixed a bug where writing values to a Line Protocol data source over its HTTP write endpoint could fail due to incorrect handling of Spring's asynchronous request processing under Jetty 12.

mqtt-sparkplug-ds

  • Fixed the exported MQTT Sparkplug point locator incorrectly writing the group ID into the edge node ID field, which caused the point to lose its real edge node ID and re-subscribe to the wrong topic on re-import.

serial-ds

  • Fixed a bug where writing a non-alphanumeric value (numeric, multistate, or binary) to a serial data source produced a broken outbound message instead of the intended value.
  • Fixed a bug where processing an incoming value on a serial data source connected via a virtual serial server-socket bridge could fail with a PermissionException: No authentication set in security context instead of recording the value.

tcpip-ds

  • Fixed a bug where the TCP/IP data source never registered with the module system on startup, so the data source type did not appear as an option and any configured TCP/IP data sources failed to start. TCP/IP data sources are now available again.

watchlist

  • Fixed a bug where importing a Watchlist from JSON silently dropped its custom data — including chart configuration — because Jackson could not serialize seroJson's JsonValue subclasses embedded in that data. Watchlist JSON imports now preserve chart configuration and other custom data correctly.
Mango 5.6.8 — June 23, 2026

cloud-connect, core

  • Fixed a bug where syncing a Mango user from a server to a client over Cloud Connect failed when "Sync Mango User from server to client" was enabled. The synced user's roles were wiped during the transfer, which caused user creation to fail and left the client's web interface returning an ERR_TOO_MANY_REDIRECTS error. Synced users now retain their roles and the web interface loads correctly.
  • Fixed a bug where importing users via JSON configuration import did not save the user's assigned roles. Imported users now keep their assigned roles.

core

Breaking Change

MySQL row-by-row result streaming has been removed. Setting db.fetchSize=Integer.MIN_VALUE in mango.properties no longer triggers row-by-row streaming on MySQL — that property value is now invalid. MySQL deployments now use cursor-based fetching (useCursorFetch=true) with whatever positive db.fetchSize is configured (default 100). Audit your mango.properties for db.fetchSize=Integer.MIN_VALUE or any negative value before upgrading. (This change first shipped in Mango 5.7 and is now backported to the 5.6 line.)

  • MySQL row-by-row result streaming removed — the legacy MySQL streaming mode (returning Integer.MIN_VALUE as the fetch size to trigger row-by-row streaming) has been dropped. MySQL now always uses cursor-based fetching (useCursorFetch=true) when a positive db.fetchSize is configured.

ems

  • Fixed the "Go to alarm details" link to route to the EMS Active Alarms page with contextual filters instead of the generic Events page.
  • Fixed the EMS Active Alarms page becoming unresponsive when viewing large alarm sets.
  • Fixed a bug in the EMS device details page where tabs and data from a different device would intermittently appear when switching between devices, device types, or sites.
  • Fixed an EMS issue where the General Overview map could take a long time to load, or fail to load entirely, on sites with many alarms.
  • The EMS General Overview map height is now configurable, including its unit (px, vh, vw, or %).
Mango 5.6.7 — June 16, 2026

modbus-ds

  • Fixed a startup issue that could prevent Modbus serial (ASCII/RTU) data sources from initializing correctly when Mango starts up.
Mango 5.6.6 — May 13, 2026

radix-tsl

  • Upgraded the ClickHouse JDBC driver to the official upstream com.clickhouse:clickhouse-jdbc:0.9.8 (from the internal ru.yandex.clickhouse:0.3.1-radix fork) and tuned default ClickHouse table settings, improving ingest, compression, and aggregation performance on ClickHouse-backed installations. The new DDL defaults are:
    • index_granularity = 1024 (was 8192) — smaller granules, faster chart and rollup queries, at the cost of a larger primary-key index held in RAM.
    • parts_to_throw_insert = 3000 (was 1000) — tolerates higher-cardinality ingest before ClickHouse rejects writes.
    • deduplicate_merge_projection_mode removed (no longer needed with the new deduplication path).
  • These settings only take effect on newly-created tables. Existing installations are not migrated automatically — to pick up the new defaults you must create a new data / aggregates table with the updated DDL, copy data across, and rename. Plan for the RAM impact of the smaller index_granularity before migrating (the primary-key index is always resident in memory and is ~8× larger at granularity 1024 than at 8192).
  • Duplicate point values written into ClickHouse are now deduplicated cleanly without the previous full-table merge cost. If you previously added a custom projection on the data table to work around aggregation slowness, it can be removed.
  • Aggregation now runs in chunks so it shares the server cleanly with ingest, queries, and background merges instead of stalling them. Chunk width is tunable via the new db.tsl.clickhouse.aggregation.chunkSize property (default 100000 series IDs per chunk).
  • New db.tsl.clickhouse.aggregation.schedule and db.tsl.timescale.aggregation.schedule properties let you run the aggregation task less often than the aggregation period (e.g. once per hour with a 15-minute period) to reduce steady-state CPU and IO load.
  • Each sweep batches all unprocessed windows since the last run, so a longer schedule only delays the appearance of new aggregate values — no data is lost.
  • Defaults to the existing behavior (one sweep per aggregation.period), so existing installations need no change.
Mango 5.6.5 — March 23, 2026

radix-tsl

  • FINAL is removed from queries that do not require deduplication to improve performance.
  • ClickHouse FINAL behavior made optional with ConflictMode=FINAL, enabling deduplicated results in queries at query time, with an associated performance cost.

persistent-pub-ds

  • Fix an issue where inactive events were not published by the gRPC publisher when they were re-raised after a crash.
Mango 5.6.4 — March 10, 2026

radix-tsl

  • radix-tsl upgraded to version 0.5.2.
  • Fixed startup issue in Mango when the NoSQL database is disabled.
  • Added support for querying multiple series at once.
  • Latest point values queries improved using argmax instead of order by when the limit is 1.
  • Default table settings improved to optimize partitions on background.
  • Queries now use FINAL with do_not_merge_across_partitions_select_final to ensure accurate deduplication at the query level.

ems

  • Fix two null check bugs.
  • Corrected the behavior of the filters, avoiding the first on changes change and then checking the previous value as an extra fall back.
Mango 5.6.3 — February 19, 2026

mango-nosql-database

  • Improve the performance of the "reload links" functionality of the NoSQL (ias-tsdb) database.
  • Upgrade ias-tsdb to version 1.9.0.
  • Expose more NoSQL database settings in default mango.properties.

ui

  • When point data exceeds the limits, a data is displayed until the limited is reached and a flat line is displayed for the rest of the time range.
  • Only show point values fetch error on errors that are not of type request aborted.
  • Fixed when clicking view Logs within a Scripting data source, open the Logging Console and apply a filter to the log specific to that Scripting data source.
  • Added multi select to modbus tools UI within the modbus DS.

ems

  • Added filter to dropdown in map with filters component used in platform manager general overview.
  • Added custom settings to site table with filters component allowing for ems customer to enable or disable table pagination per component use location.
  • Added a restriction on queries in mentioned components so if no pointNames are configured the queries would not be made.
  • Added condition where if point is type "value" and not a statistical configuration no statistics queries will be made.
  • Added props to statistics components where you can pass in a map of points, site, device and deviceType.
  • Fixed issues where random site was selected when switching to alarm details or loading the system for the first time.
  • Fixed issues where if site was changed, deviceType and devices would not update to the first available item in the new deviceTypes or devices list.
Mango 5.6.2 — December 15, 2025

core

  • Jetty upgraded to version 12.1.5. Resolves an issue in Jetty 12.1.x that caused FileMappingHttpContentFactory to serve stale file content even after the files were modified on disk.

ems

  • Fixed error where the warning icon was not showing according to the value of the point in the device details.
  • Removed cases where date format was hardcoded and not linked to the UI settings configuration.
  • Added restrictions to pages so no page can query items until all of the dropdowns have been populated.
Mango 5.6.1 — December 5, 2025

ui

  • Users page now has a fixed height in order to avoid the infinite table from loading all items and producing infinite queries.

access-control, cloud-connect, maintenance-events

  • Resolved an issue where if an active event exists in the database upon Mango startup it was possible for a circular dependency exception to be thrown while loading event type definitions in modules.
Mango 5.6.0 — December 1, 2025

core

  • Mango is now built and tested using Java 25. Java 25 is fully supported (except if you are using the Chronicle Point Value Cache, in which case Java 21 is the maximum supported version).
  • Java 17 is still the minimum supported version of Java required for Mango to run.
  • The Docker image has been upgraded to use Java 21.
  • Core libraries updated:
    • Spring Framework: 6.2.12
    • Spring Security: 6.5.5
    • Jetty: 12.1.2
    • jOOQ: 3.19.27
    • gRPC: 1.76.0
    • HikariCP: 7.0.2
  • Stability and startup performance improvements: moved the initialization of core services into the Spring context initialization, notably the runtime manager (data sources, data points, and publishers) initialization now happens earlier.
  • Implemented batch writing of event detector state data when terminating data sources or shutting down Mango; this should drastically improve the termination time when using eventPersistence.serviceName=DATABASE.
  • Ensured that data point events are cancelled when disabled data points are deleted.
  • Added JsonData gRPC API for querying, saving, and deleting JSON Store items.
  • Added oauth2.client.registration.{registrationId}.issuerLocation property which allows automatically loading an OAuth2/OIDC configuration from a "well known" URL, simplifying the OAuth2/OIDC authorization code flow login setup. Mango will now exit on startup if the web application context fails to start; use web.exitOnError to configure this behavior.
Breaking Change

Mango no longer maps the built-in "superadmin" role to ROLE_ADMIN. It now uses ROLE_SUPERADMIN instead. Any code or configuration that checks for ROLE_ADMIN granted authority on superadmin users must be updated.

  • Allow purge periods of less than a day — hours and minutes are now selectable.
  • UI cleanup of the "Purge settings" page in "System settings".
  • Event types can now be removed from an event handler when importing via JSON configuration import. Importing with an empty "eventTypes" array will remove all event types from the event handler.
  • Added card style and help information when filtering on event handlers.
  • Fixed an issue causing inconsistencies between the first escalation email and subsequent escalation emails.
  • Enhanced email event handlers to support multiple escalation levels.
  • Added a new Until Inactive escalation mode and configurable limit options to the Email Event Handler.

core, mango-api

  • Added support for exposing Mango metrics in Prometheus format, useful for monitoring Mango from external tools such as Prometheus.
  • Metrics are available at /rest/latest/system-metrics/prometheus for authenticated superadmin users; access is configurable via a system permission.
  • A separate HTTP server can be enabled on another port to allow anonymous access to metrics at GET /metrics. Set metrics.server.enabled=true to enable; see mango.properties for details.

mango-api

  • Added new REST API endpoint at /rest/latest/event-types/query-data-point-event-types for finding data point event types by filtering on data point properties.

core, persistent-pub-ds

  • Fixed a deadlock scenario when terminating publishers, in particular the PTCP publisher.

persistent-pub-ds

  • The gRPC publisher's republish data feature will now abort republishing if it detects that the persistent queue size has exceeded the "Queue warning size" threshold. Ensure queue sizes are configured appropriately large (at least tens of millions).
  • The gRPC publisher now captures all point values and events even when the publisher is not enabled. Point values and events are continuously recorded into the publisher's persistent queue.
  • A checkbox labeled "Enable offline queuing" in the gRPC publisher editor controls this feature; by default queuing is disabled.
  • Fixed a bug that prevented setting point values back to the publisher/edge from PTCP data source points.
  • Added an option to completely clear the gRPC publisher queue from the UI.

maintenance-events, mango-nosql-database

  • Implemented fast update of point values in the NoSQL/IasTsdb time series database when retroactively updating point values for past maintenance event periods.

bacnet-ds

  • BBMD registration is now performed exclusively by the BACnet local device. The data source no longer performs its own BBMD registration on initialization.

mqtt-sparkplug-ds

  • Tahu library and protobuf definitions upgraded to version 1.0.14.
  • Fixed a bug that occurred when saving birth metrics if the alias value was null.

ui

  • Fixed an issue where chart annotation shapes were not visible.
  • Removed duplicate import/export button in admin home page/utilities.
  • Added multiple ways to restrict queries from being auto-generated from date bar auto-update events.
  • New UI for managing event types on the event handlers page: a three-pane view with filtering, select-all, and view-selected-only capabilities.
  • Angular services for data point values, events, and statistics are now prevented from running parallel stale requests to the same endpoint.

ems

  • Added dashboard designer dependency as a restriction to using the EMS module.
  • Fixed issue where migrating from platform manager 5.4.x to a higher version caused new migrated version to show points as disabled.
  • Introduced an EMS setting to allow displaying more than 5 KPIs in Site Overview.
  • Introduced a setting to allow displaying data point values for each device in the device list component in Site Overview.
  • Fixed requests made by the datebar in statistics components.
  • Fixed an issue where from and to from the datebar were not applied to some components in Site Overview.
  • Fixed a bug on Device Type → Metering where the order of the points was not saved correctly.

Documentation updated for 5.6.11​

Pages with 5.6.11 behavior changes​

Security & authentication

Data sources

  • Modbus Data Source — the serial locator, serial write and scan tools now require the data source permission.
  • Modbus Troubleshooting — a failed node scan may now be a permission error.
  • BACnet Data Source — CharacterString REST serialization now represents the character encoding as an object (5.6 line only); BACnet4J 6.1.1.

Release artifacts

  • Release Notes — new CycloneDX SBOM published alongside the core bundle and each module, plus nightly OSV dependency scanning.

Module development

  • Custom Module Overview — Jackson 2.19.4 → 2.21.6 on the 5.6 line; recompile and re-verify modules and scripts that use Jackson directly.

Documentation updated for 5.6.8​

  • Mango Properties Reference — db.fetchSize MySQL behavior change (legacy Integer.MIN_VALUE row-by-row streaming trigger removed; cursor-based fetch via useCursorFetch=true) now also applies to the 5.6 line as of 5.6.8, not just 5.7.
  • Configuring Platform Manager Views — the General Overview Map card height is now configurable, with a selectable unit (px, vh, vw, or %).

Documentation updated for 5.6.6​

  • TSL Module Configuration — new db.tsl.clickhouse.aggregation.chunkSize, db.tsl.clickhouse.aggregation.schedule, and db.tsl.timescale.aggregation.schedule properties; ClickHouse DDL defaults retuned (index_granularity=1024, parts_to_throw_insert=3000) with manual-migration caveat; upstream com.clickhouse:clickhouse-jdbc:0.9.8 driver swap.
  • Mango Properties Reference — new TSL Aggregation subsection listing the new db.tsl.*.aggregation.schedule and db.tsl.clickhouse.aggregation.chunkSize properties.
  • Rollups and Statistics — new "TSL-Backed Storage and Rollups" section explaining which rollups read from the TSL pre-aggregate store vs. require raw values.