JumpServer v4.10.20-lts Release Notes

JumpServer v4.10.20-lts is now available. This release adds direct editing of saved search conditions, Oracle password changes with the REPLACE clause, a SYSDBA connection option, and bulk editing of password change eligibility. It also tightens validation across login callbacks, asset addresses, and permission checks, and delivers more than 30 improvements and fixes in total.

Improvements

• Search conditions can be edited in place, including text, single-select, and multi-select fields.
• Automated Oracle password changes support the REPLACE clause with the old password (JumpServer EE).
• Oracle connections through the Web Terminal, Web SQL, and DBeaver support a SYSDBA option (JumpServer EE).
• Authorized assets can be sorted by custom name and searched by custom name or comment.
• Unread site messages now support pagination, with better loading states, retry handling, and mobile display.
• Saved SQL snippets support pagination and filtering by database type, and Dameng SQL snippets can now be saved.
• The argument length limit for jobs and quick commands has been raised from 8,192 to 65,536 characters.
• Authorization caching and logical session reuse have been optimized for concurrent database proxy connections while following Core’s token reuse policy.
• Filesystem cache usage for long-running SSH session recordings has been optimized to reduce memory pressure.
• Russian translations have been improved, and task log labels now follow the current interface language.
• The ticket audit list has an optional Approvers column, and session details can be opened from session tickets (JumpServer EE).
• OAuth2 user attribute mappings support dot-separated paths for nested fields (JumpServer EE).
• The account password change eligibility setting supports bulk editing (JumpServer EE).
• LDAP user group mapping supports the OU path in distinguishedName.

Bug Fixes

• Fixed OTP binding failures caused by a secret change after a page refresh or a failed verification, which invalidated codes generated from the previously scanned QR code.
• Fixed LDAP connection timeout settings that did not take full effect, user list sorting errors, and the unavailable periodic synchronization toggle in the Community Edition.
• Fixed managed passwords not being updated after a successful Windows AD password change when connection verification was inconclusive (JumpServer EE).
• Fixed ineffective job cancellation and timeout handling under Docker and bwrap isolation, and cleaned up executor containers left behind after abnormal exits.
• Fixed SSH multi-factor authentication issues, port forwarding and command execution errors when connection reuse is disabled, and improved resource cleanup after connection failures.
• Fixed a busy loop after SSH connections are closed.
• Fixed fragmented Oracle Thin authentication responses, negotiation data continuation handling, and incomplete reads of data descriptor frames (JumpServer EE).
• Fixed invisible remote desktop scrollbars on macOS and inaccessible left-side content in zoomed VNC sessions.
• Fixed log write failures during consecutive recording conversion tasks.
• Fixed repeated cloud database synchronization overwriting manually configured default database names (JumpServer EE).
• Fixed phone number changes not appearing in user profiles and failed reconnections from recent sessions in the workbench.
• Fixed duplicate accounts when filtering by asset node, already-authorized assets remaining selectable, and the inability to clear the switch-from account.
• Fixed dropdowns extending beyond the viewport, encrypted email uniqueness validation, and Bearer authentication fallback compatibility.
• Fixed password submissions not correctly using SM2/SM4 encryption in environments configured for Chinese cryptographic algorithms.

Security Enhancements

• Strengthened login and account binding callback validation for WeCom and DingTalk, prevented implicit binding to local accounts with matching usernames, and enforced one-time validation of callback state (JumpServer EE).
• Strengthened asset address validation to reject template syntax, control characters, and invalid host addresses.
• Restricted Celery task, result, and log message serialization to JSON.
• Corrected permission checks for system tools, quick commands, and remote desktop clipboard operations so that both asset operation permissions and ACL policies are enforced.

Installation and Upgrade

• Bundled OpenBao now enables TLS, supports CA certificate upload and verification, and provides separate connection settings for SSH CA (JumpServer EE).
• JDMC installation and upgrades have been improved with custom data directory support, compatibility with symbolic links in older packages, and better component-specific start, stop, and status operations.
• Docker and Compose binary downloads support custom mirror URLs, and bundled database ports are bound to the loopback interface.

Upgrade

Upgrade to v4.10.20-lts through the standard update procedure. For details, refer to the official documentation.

Full release notes: https://github.com/jumpserver/jumpserver/releases/tag/v4.10.20