Release Notes

Devices and iiziRun

Store-built iiziRun apps

iiziServer 5.0 and the development server of iiziGo 5.0 answer protocol version 5, and every iiziRun checks that number for equality. An iiziRun installed from a store before 5.0 – iiziRun Developer and every iiziRun Custom or Customized app – reports “not compatible” and opens nothing; the message names both versions.

• Update the devices to the 5.0 store builds of iiziRun Developer and iiziRun Custom.
• Rebuild a Customized iiziRun of your own with iiziGo 5 and publish it to the stores. The rebuild also brings the appearance plug-in, the usage statistics question and the other launcher changes of 5.0.
• Keep a server that serves store apps on 4.8 until its users' devices have the 5.0 builds. Browser and installed web app users can move to 5.0 at any time.

A Browser with a 4.x page in its cache

A Browser that still holds a 4.x page in its cache shows “Network error.” once; a reload gets the 5.0 page.

Application addresses

Every application is served at /app/<appID>/. The address /iiziApp.html?0:0&app=<appID> of earlier versions answers with a redirect there. ServerAdmin's address is /app/com.iizix.serveradmin/.

No IIZI cookie

The Browser client keeps its parameters, the device's ID and the analytics consent in the Browser's local storage, per application address; the cookies of earlier versions are moved there once and removed.

Sensitive device parameters

Values an application stored on a device as sensitive device parameters are sealed to the application from 5.0. A value stored under 4.x reads as not found once and is removed from the device. An application must treat that answer as a missing value – ask the user for it again and store it anew – or the value is lost.

Installing the server

A new installation, step by step: Installing iiziServer.

A Windows service installed by 4.x

Install it again with 5.0's iiziServer\bin\ntservice\is.bat, so that it runs through 5.0's service host and wrapper:

is.bat UNINSTALL serviceName
is.bat INSTALL serviceName SERVER javaDir memory

An update keeps bin\ntservice\, so after a later update the service keeps running the previous service wrapper until it is installed again the same way (stop, uninstall, install with the same parameters, start).

Linux

bin/install-iiziServer.sh installs iiziServer from the signed distribution package as a systemd service under its own service account, after checking the package's signature. bin/iiziServer.sh starts ServerAdmin only: define further applications in the configuration file, or add them on its command line, for example bin/iiziServer.sh -app com.example.app -appjar apps/example.jar.

Which Java the launchers use

Every launcher – iiziServer, iizi-secrets and iiziServer-update, as .sh and .bat – runs the Java named by the environment variable IIZI_JAVA when it is set, else the installation's own JDK, else java from the PATH.

Applications in config.iiziServer

A configuration file of 4.x with its application entries directly in an environment still loads: the server moves them into the environment's applications at load, with one WARNING naming the file, and the file takes the new layout at its next save.

• An application ID or alias used twice, in any two environments, stops the server at start: give each a unique one.
• A port configuration's name is unique, has no comma and at most 64 characters (by default the configuration's own name).

Going back to the previous version

Stop the server and run bin/iiziServer-update.sh <previous package> -allowDowngrade (bin\iiziServer-update.bat on Windows). The database is never rolled back, and the rollback copy is replaced by every update: it is no backup.

Server settings to review

• Behind a reverse proxy, set $geo.trustedProxies: until it is set, every client counts as one source for the sign-in throttle and for geolocation, and the server says so at start.
• Behind a proxy that terminates TLS, mark the port “Secured port” in its port configuration and bind it to the address the proxy connects to (“Bind address”). A front-end secured port bound to every interface is reachable without the proxy, and the server warns about it at start. A bind address that does not resolve stops the server at start (exit code 9).
• TLS. A client setting that never stored “verify the server certificate” now verifies it: a server with a self-signed certificate and no pinned certificate is refused without a prompt. Pin the certificate, or use one from a trusted certificate authority.
• Cross-origin callers. A web page on another origin that reads an IIZI server's responses needs its origin in $allowedOrigins (exact scheme://host[:port] values, comma or space separated, no wildcards).
• Uploads are off by default: turn on “Allow upload” and restart the server.
• Geolocation. IPStack has no built-in access key: configure one, or use the IP2Location provider.
• Web engine data. The weekly web engine refresh contacts Google's VersionHistory service ($webEngine.refresh, on by default).

Accounts, groups and administrators

The group “Default All Apps (disabled!)”

A new 5.0 database creates its third group disabled and names it “ServerAdmin” (it allows all applications; builds before 2026-10-30 named it “Default All Apps (disabled!)”). An existing database is not changed: the group keeps its old name and stays enabled, so its members (the two administrators and the two “iiziRun Developer” accounts, whose password is public) reach every application. Disable it after the upgrade: ServerAdmin, Groups, “Default All Apps (disabled!)”, check “Disabled”, save – or, on the server's database:

UPDATE IZS.GROUPS SET disabled=TRUE WHERE gid=3;

and restart the server. Before doing so, check which users reach an application only through this group. Renaming the group to “ServerAdmin” is optional (ServerAdmin, Groups, Edit).

Application access by group is enforced

Until 5.0 every enabled user signed in to every application, whatever the application's group list said. Check each application's groups in ServerAdmin before the upgrade: an application whose list names no group admits only the groups that allow all applications, and a name that is no group admits nobody.

Applications whose users signed in at the connection

Such an application is public on 5.0 unless it gates itself. In 4.x the connection signed the user in, so every session of the application had a user; in 5.0 every session starts with nobody signed in, and the group list is applied only when a user signs in with the SignIn module. A session that never signs in is shown every page the application opens. Before the upgrade, decide for each application whether it is public; if it is not, it must check for a signed-in user itself.

Administrators

• ServerAdmin admits members of an enabled Administrators group only and, on an installed server, asks every administrator for a second step by default.
• On an installed server, iiziAdmin still on the password of the database script gets a generated password at the next start, also on an existing database. It is shown once on the server's console and written to initial-admin-password.txt in the server's working directory, readable by the server's account only, and deleted once the password is changed, which the first sign-in requires.
• The former backup administrator iiziAdmin BACKUP, still on its public password, is disabled (not deleted), and a new database no longer creates it. Any other administrator still on a public password must change it at the next sign-in.
• An administrator with no e-mail address, or still on the installation's placeholder address, enters a real one at sign-in before ServerAdmin opens.
• To regain a lost administrator password, start the server once with -Diizi.admin.reset=<account>.

The seeded users of the database script

On an installed server, the accounts user, iiziRun Developer and iiziRun Developer 2 that still have the passwords of the database script, which are public, are disabled at the next start (not deleted, the password untouched). The server log names each one with a WARNING at that start and at every later start while it stays disabled. To use such an account, give it another password in ServerAdmin and enable it again. An account whose password was changed is not touched, and iiziGo's development server keeps the three as they are.

Licensing

The license system is installed and does not enforce in 5.0, in iiziGo and in iiziServer alike: nothing is refused.

• A release build of iiziGo or iiziServer connects to the license server mls.mindus.co on port 443, unless the system property iizi.license.servers or the environment variable IIZI_LICENSE_SERVERS names other servers; the value none keeps it from connecting. Open the port in your firewall if the server should report its license state.
• An iiziServer that has neither a license document nor an activation token does not connect: it says so in one INFO line at start, naming the token file settings, and reads a token placed later at its next restart.
• While a server has no valid license, ServerAdmin's Dashboard says from which date new sign-ins would be refused, followed by “(observed only: nothing is refused in this release)”.

Push Notification secrets

An application's VAPID private key and Firebase service account are read only from the machine's secrets store. A value written in the application's .iiziPush, or a key file it names, is dropped when the application loads, with one WARNING naming the member (never the value). Before moving an application with Push Notifications to a 5.0 server:

1. In iiziGo 5, open its Push page and generate the key pair or import the service account; this stores them in the machine's store.
2. Export them on the iiziGo machine: iizi-secrets export <file> app.<appID>.
3. Import them on the server: iizi-secrets import <file>.

A new VAPID key pair ends the Browser subscriptions made under the old one.

Logs from 4.x

A server.log written before 5.0, on a server where a password reset link was opened, holds that link's token. Such a token is dead 30 minutes after it was issued or once used, but a reader of the log inside that window could have used it: treat old logs as confidential, or delete them. From 5.0 no log line holds the token.

Application developers

• Own sign-in screens. An application that signs its users in with its own screen – checking the password with UserAuthentication.validateUser, or putting a user into the session with changeExternallyAuthenticatedUser or signInAuthenticatedUser – bypasses the server's checks: no throttle per client source, no second step, and with validateUser alone the server records nobody. Move it to the SignIn module.
• Sign-in with providers. An application that signed its users in through the 4.x OAuth layer has no provider sign-in in 5.0; keep it on 4.8 until 5.1 if it depends on one. A module that still carries the provider keys (Provider.clientID, .clientSecret, .scopes, .tenant) gets one WARNING at load naming the keys; remove them.
• NotFoundException extends RuntimeException instead of Error: a catch (Exception) around a lookup (event.getField, getPanelUIComponent, VirtualSpace.getTable, GroupInfo.getGroup, ...) now catches a miss; a catch (Error) no longer does. Nothing needs recompiling.
• KStrings with SCRIPT, IFRAME, STYLE, FOREIGNOBJECT or script URLs must be made trusted (KString.newTrustedHTMLKString, or trusted="true" in the saved value), or they are refused.
• @OnUIFocus methods are now also called when their component gains the focus: a method that should act on a focus lost checks isFocusGained().
• Device selectors. 24 terms that never matched (11 dev-*, 12 cap-* and size-micro) are retired; they still load, match nothing, and iiziGo shows each as a WARNING naming its replacement. Tablets are now classified as tablets, so a panel chosen by dev-isMobile is also chosen on a tablet: choose phone panels with dev-isPhone and tablet panels with dev-isTablet.
• Percent sizes resolve against the parent's content box, as in CSS. A percent child of a padded or bordered parent comes out smaller than in 4.x by the padding and border: check such panels, and drop work-arounds such as “100% - 20px”.
• Colors and CSS. Colors an application paints itself (a literal text or background color) do not follow dark mode: use palette colors or theme roles for text that must read in both modes. An application's own CSS for buttons meets the theme's gradient, border and shadow: give it the specificity it needs, or set background-image and box-shadow to none.
• Themes. Applications designed with hololight, winlight or claro show the default theme. A panel that allows both desktop themes now keeps the session's theme instead of switching to dbootstrap, so its look can change.
• Push Notifications. The Push wire is version 2; a client of version 1 is refused and must be rebuilt.
• Libraries. Applications that used firebase-admin, netty, pushy, commons-net, the TOTP library or image4j from IIZI's class path ship their own copy.
• UIGauge's value property is $value, as the slider's; panels saved with the old name value still load.
• iiziRun text tables. An application with its own iiziRun text table adds the launcher's new texts DEEPLINK_NOT_HERE, STAT_TITLE, STAT_ASK, STAT_YES and STAT_NO; iiziGo reports a missing one, and a build falls back to the launcher's own text.
• PWA and Push pages. The PWA page's application name, description and Firebase group (the App's own are used) and the Push page's private key and service account fields are gone; files that still carry them load, and the values are not used.
• “Initial login”. A .iiziRun file that still names a default user and password loads, and the two values are ignored.

3270 terminal captures

In iiziGo before 5.0, a field of a 3270 capture that was set numeric was saved as numeric and non-display, so it showed hidden; 5.0 saves it numeric only, but does not repair captures saved earlier. A saved field carrying both attributes is the sign: set it numeric again and save. (A capture written by NetPhantom's editor may hold a genuine numeric non-display field, such as a PIN.)

iiziGo

Installing iiziGo 5 on each platform, or into an existing Eclipse: Installing iiziGo.

• Keep a copy of your 4.8 workspace. “Check for Updates” in iiziGo 4.8 offers 5.0: iiziGo is a complete product, so that one update brings IIZI 5.0 together with Eclipse 2026-09 and the Java 25 JustJ runtime. Its updates come from the update site https://support.iizi.co/downloads/builds/latest/p2/.
• iiziGo 5 keeps the translator keys obfuscated in the workspace settings and moves a key that iiziGo 4.x stored there; iiziGo 4.x on the same workspace then shows its translators as not configured.
• New Module projects of the quick-start wizard are created for Java 25; existing projects are not changed.
• iiziGo's iOS build of iiziRun no longer needs CocoaPods or Ruby of its own when no plug-in declares a pod, and an iOS-only build needs no Android keystore.

Back to the IIZI 5.0 release notes