Commands App Release Notes
The initial installation of ITRS Analytics includes all required app, such as the Web Console, bundled by default. No separate installation steps are required for individual apps. For installation guidance, refer to the Install ITRS Analytics apps documentation.
To stay informed about the most recent updates and packaging versions, you can refer to the ITRS Analytics Packaging Changelog. This resource provides direct links to release notes for each bundled version of the ITRS Analytics Platform and its apps, bill of materials listing all included components, and references to the published Docker images.
Commands 1.10.0 Copied
Released: 14 August 2026
This app is packaged with ITRS Analytics 2.18.11+p2.18.7.
Important
Starting with version 1.10.0, the Commands app uses RocksDB instead of Chronicle Map for on-disk storage of persisted command data.
When you upgrade to this version, previously saved command runs, command history, and in-progress commands are not migrated, even when command persistence is enabled. The new storage format is not compatible with data from earlier versions. After the upgrade, the Commands page starts empty until new commands are run.
Highlights Copied
These are the highlights of this release:
- The Commands REST API v2 is now available, expanding the API with command permission management and enhanced command registration capabilities.
- It includes all registration, query, execution, and lifecycle endpoints from v1, together with new command permission APIs and enhancements to the
/commands/registerendpoint, includingsupportsPermissionsandvalidationMode. - API v1 remains supported, but permission management requires v2.
- It includes all registration, query, execution, and lifecycle endpoints from v1, together with new command permission APIs and enhancements to the
New features and enhancements Copied
These are the new features and enhancements of this release:
| Issue key | Release description |
|---|---|
| OCM-170 | The following endpoints to manage command permissions are now available in the Commands REST API v2:
|
| OCM-185 | The /commands/register endpoint now supports an optional lenient validation mode that registers valid commands in a batch and returns invalid commands in the response instead of failing the entire request. |
| OCM-186 | The Commands app now uses RocksDB instead of Chronicle Map for on-disk storage. Upgrading to version 1.10.0 does not preserve previously saved command runs, command history, or in-progress commands, even when command persistence is enabled by default. The new storage format is not compatible with data written by the previous format, so the Commands page starts empty until new commands are run. |
| OCM-272 | Batched /commands/register requests now reject duplicate command names submitted in later requests of the same registration session. |
| OCM-285 | The Commands REST API v2 is now available. It includes all registration, query, execution, and lifecycle endpoints from v1, together with new command permission APIs and enhancements to the /commands/register endpoint, including supportsPermissions and validationMode. |
Security updates Copied
The following security vulnerabilities have been addressed in this release:
| Issue key | Release description |
|---|---|
| OCM-172 | Addressed CVE-2026-5928 by updating glibc dependencies in the Commands images. |
| OCM-175 | Addressed CVE-2026-5450 by updating glibc dependencies in the Commands images. |
| OCM-183 | Addressed CVE-2026-5773 by updating curl dependencies in the Commands images. |
| OCM-184 | Addressed CVE-2026-6276 by updating curl dependencies in the Commands images. |
| OCM-187 | Addressed CVE-2026-32316 by updating jq dependencies in the Commands images. |
| OCM-191 | Addressed CVE-2026-44249 by updating netty-handler dependencies in the Commands UI image. |
| OCM-192 | Addressed CVE-2026-45416 by updating netty-handler dependencies in the Commands UI image. |
| OCM-193 | Addressed CVE-2026-45674 by updating netty-resolver-dns dependencies in the Commands UI image. |
| OCM-194 | Addressed CVE-2026-47691 by updating netty-resolver-dns dependencies in the Commands UI image. |
| OCM-204 | Addressed CVE-2023-39810 by updating busybox dependencies in the Commands image. |
| OCM-205 | Addressed CVE-2026-34180 by updating libcrypto3 and libssl3 dependencies in the Commands images. |
| OCM-206 | Addressed CVE-2026-34181 by updating libcrypto3 and libssl3 dependencies in the Commands images. |
| OCM-207 | Addressed CVE-2026-34182 by updating libcrypto3 and libssl3 dependencies in the Commands images. |
| OCM-208 | Addressed CVE-2026-34183 by updating libcrypto3 and libssl3 dependencies in the Commands images. |
| OCM-209 | Addressed CVE-2026-42764 by updating libcrypto3 and libssl3 dependencies in the Commands images. |
| OCM-210 | Addressed CVE-2026-42765 by updating libcrypto3 and libssl3 dependencies in the Commands images. |
| OCM-211 | Addressed CVE-2026-45445 by updating libcrypto3 and libssl3 dependencies in the Commands images. |
| OCM-212 | Addressed CVE-2026-45447 by updating libcrypto3 and libssl3 dependencies in the Commands images. |
| OCM-213 | Addressed CVE-2026-7383 by updating libcrypto3 and libssl3 dependencies in the Commands images. |
| OCM-214 | Addressed CVE-2026-9076 by updating libcrypto3 and libssl3 dependencies in the Commands images. |
| OCM-215 | Addressed BDSA-2026-14000 by updating Spring Security dependencies in the Commands image. |
| OCM-216 | Addressed CVE-2026-26157 by updating busybox dependencies in the Commands images. |
| OCM-217 | Addressed CVE-2026-26158 by updating busybox dependencies in the Commands images. |
| OCM-218 | Addressed CVE-2023-39810 by updating busybox dependencies in the Commands images. |
| OCM-219 | Addressed CVE-2026-26157 by updating busybox dependencies in the Commands images. |
| OCM-220 | Addressed CVE-2026-26158 by updating busybox dependencies in the Commands images. |
| OCM-221 | Addressed CVE-2026-32316 by updating jq dependencies in the Commands images. |
| OCM-222 | Addressed CVE-2026-34180 by updating libcrypto3 and libssl3 dependencies in the Commands images. |
| OCM-223 | Addressed CVE-2026-34181 by updating libcrypto3 and libssl3 dependencies in the Commands images. |
| OCM-224 | Addressed CVE-2026-34182 by updating libcrypto3 and libssl3 dependencies in the Commands images. |
| OCM-225 | Addressed CVE-2026-34183 by updating libcrypto3 and libssl3 dependencies in the Commands images. |
| OCM-226 | Addressed CVE-2026-42764 by updating libcrypto3 and libssl3 dependencies in the Commands images. |
| OCM-227 | Addressed CVE-2026-42765 by updating libcrypto3 and libssl3 dependencies in the Commands images. |
| OCM-228 | Addressed CVE-2026-45445 by updating libcrypto3 and libssl3 dependencies in the Commands images. |
| OCM-229 | Addressed CVE-2026-45447 by updating libcrypto3 and libssl3 dependencies in the Commands images. |
| OCM-230 | Addressed CVE-2026-5450 by updating glibc dependencies in the Commands images. |
| OCM-231 | Addressed CVE-2026-5773 by updating curl dependencies in the Commands images. |
| OCM-232 | Addressed CVE-2026-5928 by updating glibc dependencies in the Commands images. |
| OCM-233 | Addressed CVE-2026-6276 by updating curl dependencies in the Commands images. |
| OCM-234 | Addressed CVE-2026-7383 by updating libcrypto3 and libssl3 dependencies in the Commands images. |
| OCM-235 | Addressed CVE-2026-9076 by updating libcrypto3 and libssl3 dependencies in the Commands images. |
| OCM-236 | Addressed BDSA-2026-16693 by updating Keycloak dependencies in the Commands image. |
| OCM-237 | Addressed BDSA-2026-16698 by updating Keycloak dependencies in the Commands image. |
| OCM-238 | Addressed BDSA-2026-17031 by updating antlr dependencies in the Commands image. |
| OCM-240 | Addressed CVE-2026-10536 by updating curl dependencies in the Commands image. |
| OCM-241 | Addressed CVE-2026-11352 by updating curl dependencies in the Commands image. |
| OCM-242 | Addressed CVE-2026-11564 by updating curl dependencies in the Commands image. |
| OCM-243 | Addressed CVE-2026-11586 by updating curl dependencies in the Commands image. |
| OCM-244 | Addressed CVE-2026-11856 by updating curl dependencies in the Commands image. |
| OCM-245 | Addressed CVE-2026-12064 by updating curl dependencies in the Commands image. |
| OCM-246 | Addressed CVE-2026-56131 by updating libexpat1 dependencies in the Commands image. |
| OCM-247 | Addressed CVE-2026-56407 by updating libexpat1 dependencies in the Commands image. |
| OCM-248 | Addressed CVE-2026-56408 by updating libexpat1 dependencies in the Commands image. |
| OCM-249 | Addressed CVE-2026-8286 by updating curl dependencies in the Commands image. |
| OCM-250 | Addressed CVE-2026-8924 by updating curl dependencies in the Commands image. |
| OCM-251 | Addressed CVE-2026-8925 by updating curl dependencies in the Commands image. |
| OCM-252 | Addressed CVE-2026-8926 by updating curl dependencies in the Commands image. |
| OCM-253 | Addressed CVE-2026-8927 by updating curl dependencies in the Commands image. |
| OCM-254 | Addressed CVE-2026-8932 by updating curl dependencies in the Commands image. |
| OCM-255 | Addressed CVE-2026-9079 by updating curl dependencies in the Commands image. |
| OCM-256 | Addressed CVE-2026-9080 by updating curl dependencies in the Commands image. |
| OCM-257 | Addressed CVE-2026-9545 by updating curl dependencies in the Commands image. |
| OCM-258 | Addressed CVE-2026-9546 by updating curl dependencies in the Commands image. |
| OCM-259 | Addressed CVE-2026-9547 by updating curl dependencies in the Commands image. |
| OCM-262 | Addressed CVE-2026-15075 by updating Vert.x dependencies in the Commands image. |
| OCM-263 | Addressed CVE-2026-15076 by updating Vert.x dependencies in the Commands image. |
| OCM-265 | Addressed GHSA-r7wm-3cxj-wff9 by updating jackson-core dependencies in the Commands UI image. |
| OCM-268 | Addressed CVE-2026-55831 by updating netty-codec-http dependencies in the Commands UI image. |
| OCM-269 | Addressed CVE-2026-55833 by updating netty-codec-http dependencies in the Commands UI image. |
| OCM-270 | Addressed CVE-2026-56745 by updating netty-codec-http dependencies in the Commands UI image. |
| OCM-271 | Addressed CVE-2026-59901 by updating netty-codec dependencies in the Commands UI image. |
| OCM-275 | Addressed CVE-2026-56816 by updating Netty dependencies in the Commands image. |
Known issues Copied
These are the known issues affecting this release:
| Issue key | Known issue description |
|---|---|
| OCM-273, OCM-274 | Apache Tomcat version 10.1.55 is affected by high-severity security vulnerabilities (BDSA-2026-17153 and BDSA-2026-17158). This issue currently lacks a vendor-provided fix and is being tracked as a known vulnerability within the Commands app. |
Commands 1.9.0 Copied
Released: 23 June 2026
This app is packaged with ITRS Analytics 2.18.3+p2.18.5.
New features and enhancements Copied
These are the new features and enhancements of this release:
| Issue key | Release description |
|---|---|
| OCM-174 | Addressed CVE-2026-5435 by updating glibc dependencies in the Commands images. |
| OCM-176 | Addressed CVE-2026-42579 by updating netty-codec-dns dependencies in the Commands UI image. |
| OCM-177 | Addressed CVE-2026-42583 by updating netty-codec dependencies in the Commands UI image. |
| OCM-178 | Addressed CVE-2026-42584 by updating netty-codec-http dependencies in the Commands UI image. |
| OCM-179 | Addressed BDSA-2026-9430 by updating Netty dependencies in the Commands image. |
| OCM-180 | Addressed BDSA-2026-9433 by updating Netty dependencies in the Commands image. |
| OCM-181 | Addressed CVE-2026-42587 by updating netty-codec-http and netty-codec-http2 dependencies in the Commands UI image. |
| OCM-189 | Added support for OpenShift restricted security context constraints. |
Commands 1.8.0 Copied
Released: 6 May 2026
This app is packaged with ITRS Analytics 2.18.0+p2.18.3.
Note
The Commands app version 1.8.0 requires ITRS Analytics Platform version 2.18.0 or later.
New features and enhancements Copied
These are the new features and enhancements of this release:
| Issue key | Release description |
|---|---|
| OCM-77 | The Commands app now supports ephemeral storage for PVCs when useEphemeralStorage is set to true. In embedded clusters, this allows the app to be rescheduled to another node in the event of a node failure. |
| OCM-116 | Upgraded the Commands app to support ITRS Analytics Platform 2.18.0. |
| OCM-117 | Updated the Commands app to use the Logs API for retrieving audit logs. |
Commands 1.7.1 Copied
Released: 25 February 2026
This app is packaged with ITRS Analytics 2.17.7.
New features and enhancements Copied
These are the new features and enhancements of this release:
| Issue key | Release description |
|---|---|
| OCM-169 | All app Helm charts now include configurable resource requests and limits. |
Commands 1.7.0 Copied
Released: 2 December 2025
This app is packaged with ITRS Analytics 2.17.0.
Issues fixed Copied
These are the issues we have fixed in this release:
| Issue key | Release description |
|---|---|
| OCM-154 | Added support for installing the app in secured Kubernetes clusters. |
Commands 1.6.0 Copied
Released: 14 November 2025
Issues fixed Copied
These are the issues we have fixed in this release:
| Issue key | Release description |
|---|---|
| OCM-131 | Fixed an issue where Gateway commands were missing from the Entity Viewer. |
Commands 1.5.0 Copied
Released: 12 November 2025
Issues fixed Copied
These are the issues we have fixed in this release:
| Issue key | Release description |
|---|---|
| OCM-130 | Fixed the duplicated version in the Commands app REST API URL that prevented Gateway commands from working correctly. |
Commands 1.4.0 Copied
Released: 30 October 2025
Issues fixed Copied
These are the issues we have fixed in this release:
| Issue key | Release description |
|---|---|
| OCM-79 | Updated Spring Framework to version 3.5.6 to address a high-severity security vulnerability CVE-2025-41249. |
Commands 1.3.0 Copied
Released: 27 February 2025
Minimum required ITRS Analytics Platform version: 2.5.0
Issues fixed Copied
These are the issues we have fixed in this release:
| Issue key | Release description |
|---|---|
| OCM-64 | Resolved the following critical security vulnerabilities:
|
Commands 1.2.0 Copied
Released: 7 November 2024
Minimum required ITRS Analytics Platform version: 2.5.0
Issues fixed Copied
These are the issues we have fixed in this release:
| Issue key | Release description |
|---|---|
| OCM-51 | Multiple subscriptions for the same service are now correctly handled and no longer cause the liveness check to fail. |
Legacy releases Copied
Commands 1.1.0 Copied
Released: 4 October 2024
Minimum required ITRS Analytics Platform version: 2.5.0
Issues fixed Copied
These are the issues we have fixed in this release:
| Issue key | Release description |
|---|---|
| OCM-39 | Improved the input validation message of duration fields. |
Commands 1.0.0 Copied
Released: 26 August 2024
Minimum required ITRS Analytics Platform version: 2.5.0
Highlights Copied
These are the highlights of this release:
The Commands app enables additional command functions in the Entity Viewer app. Through the Commands app, commands set up in the Geneos Gateway Setup Editor can be accessed right in the Entity Viewer app.
Disclaimer
The information contained in this document is for general information and guidance on our products, services, and other matters. It is only for information purposes and is not intended as advice which should be relied upon. We try to ensure that the content of this document is accurate and up-to-date, but this cannot be guaranteed. Changes may be made to our products, services, and other matters which are not noted or recorded herein. All liability for loss and damage arising from reliance on this document is excluded (except where death or personal injury arises from our negligence or loss or damage arises from any fraud on our part).