Skip to content
Rhize Product documentation
Releases
4.4.0

4.4.0

Release notes for version 4.4.0 of the Rhize application.

Release date: 11 August 2026

Changes by service

The following sections document the changes this release brings to each service.

Admin

Add

  • Add opt-in support for authentication against a generic OIDC provider instead of Keycloak
  • Add environment variable APP_AUTH_OIDC_ADDITIONAL_SCOPES to request extra scopes on top of standard scopes
  • Add JWT node template

Change

  • Change Physical Assets page to use generic versioned entity components
  • Change OIDC to request openid, profile, email, and offline_access as standard scopes on every sign-in
  • Change description on Google BigQuery node template for clarity

Fix

  • Fix issue where inline editing on Equipment Class Properties would result in a GraphQL error
  • Fix issue where saving a versioned entity with many entities present would cause the version dropdown to disappear
  • Fix Equipment sidebar search not searching unloaded Equipment
  • Fix missing success notification for enabling and disabling Equipment
  • Fix missing scopes on OIDC sign-in
  • Fix extra brackets being displayed around version on Physical Asset page
  • Fix Approved and Deprecated Physical Asset versions allowing properties to be disabled
  • Fix Physical Asset page showing success message along with error message when trying to create duplicate property
  • Fix versioning in Physical Asset properties to include version number in entity version prefix to prevent duplicate ID error
  • Fix issue with connections not rendering in Work Master editor
  • Fix issue with dragging nodes not updating selection in Work Master editor
  • Fix positioning of Work Master nodes created by API

Known Issues

  • Known issue where navigating to another tab after adding an Equipment Asset Mapping may cause the newly created mapping to disappear
  • Known issue preventing editing of inherited properties on Equipment, Person, Operations Event Definition, and Physical Asset pages
  • Known issue where creating a new version on the Person page causes other versions to disappear from the dropdown
  • Known issue where two Active versions may display for an Operational Location
  • Known issue where editing an Operational Location property may cause other properties on the table to disappear
  • Known issue where prior values for an Operations Event Definition version may display after creating a new version

Agent

Add

  • Add option to bypass OIDC
  • Add support for authentication against a generic OIDC provider instead of Keycloak
  • Add support for Azure EventHub datasource

Change

  • Change JWT library to golang-jwt/jwt/v5 from dgrijalva/jwt-go/v4
  • Change OIDC to use client_credentials grant
  • Change oidc.realm in config to be optional
  • Change golang to v1.25.12 from v1.25.11
  • Change library golang.org/x/net to v0.57.0 from v0.55.0
  • Change library golang.org/x/text to v0.39.0 from v0.37.0
  • Change library google.golang.org/grpc to v1.82.1 from v1.80.0

Remove

  • Remove support for OIDC username and password
  • Remove durable queue from MessageHandler

BaaS

Add

  • Add EventDefinitions and SchemaDiagrams to the /admin GraphQL API
  • Add functionality to allow GraphQL queries to be called with a timestamp
  • Add full CDC sink-and-source pipeline for publishing CDC events to Solace
  • Add an immutable audit trail for capturing CDC events from a Solace queue and writing append-only rows to an Apache Iceberg table, allowing audit records to be queried through the queryAudit resolver on the /admin GraphQL API
  • Add Schema Explorer page to the BAAS Console, allowing visualization of the GraphQL schema as a node graph
  • Add support for authentication against a generic OIDC provider instead of Keycloak with enable-generic-oidc

Change

  • Change library golang.org/x/text to v0.39.0 from v0.37.0
  • Change library google.golang.org/grpc to v1.82.1 from v1.81.1
  • Change library github.com/go-chi/chi/v5 to v5.3.0 from v5.2.4
  • Change library github.com/klauspost/compress to v1.18.7 from v1.18.4

Fix

  • Fix worker: resolve CDC-pinned orphaned transactions
  • Fix worker/cdc: reset stranded pending events when WAL is trimmed past seenIndex
  • Fix GraphQL subscriptions failing with authentication
  • Fix rebuild index ignoring schema requirements

Known Issues

  • Known issue where BAAS Console S3/Minio Backup page may show a success message despite giving an invalid destination
  • Known issue where BAAS Console Local Export backup page may show a success message despite giving a potentially invalid export destination
  • Known issue where BAAS Console schema upload page will not show an error for a potentially invalid schema

ISA-95

Add

  • Add tests for timeseries queries
  • Add AzureEventHub to DataSourceProtocol
  • Add historyQuery custom field to Equipment type to enable SQL queries of timeseries data within Equipment context
  • Add EventSource* types for defining event specific data sources
  • Add ackMethod field to EventSourceTopic

Change

  • Change schema to reflect default limits on SQL runtime queries
  • Change golang to v1.25.12 from v1.25.11
  • Change library golang.org/x/text to v0.39.0 from v0.37.0

Fix

  • Fix DispatchStatus values to align with ISA-95 specification
  • Fix missing deprecation on DispatchStatus for CANCELED causing errors

Typescript host service

Releasing in step with other components.

Workflow

Add

  • Add JSON schema node for fetching schema from a schema registry
  • Add support for authentication against a generic OIDC provider instead of Keycloak
  • Add terminal error messages to BPMN variable context
  • Add AMQP Event Source driver
  • Add support for different acknowledgement methods for Event Sources based on topic configuration

Change

  • Fix missing check for debug mode on Workflow Instances
  • Change OIDC to use client_credentials grant
  • Change calls to Restate from BPMN nodes to allow calls to any endpoint
  • Change zeebe:input mapping with an empty target to spread resolved JSON object fields directly into taskVars
  • Change zeebe:input source evaluation to read inputs starting without “=” as raw JSON when the input’s target is empty
  • Change golang to 1.25.12 from 1.25.9
  • Change library golang.org/x/tools to v0.47.0 from v0.45.0
  • Change library google.golang.org/grpc to v1.82.1 from v1.80.0

Fix

  • Fix authentication not being checked on BPMN load and execution
  • Fix trailing / being appended to discovery URL in OIDC adapter

Remove

  • Remove support for OIDC username and password

Compatibility

Rhize v4.4.0 has been tested to work with the following third-party applications:
  • Grafana: 11.6.0
  • Keycloak: 26.4
  • Prometheus: 3.7.3
  • Restate: 1.5.3
  • Redpanda: 25.2.10
  • Redpanda Console: 3.2.2

Checksums

When you install, check the container images against these checksums:

Admin:
registry.gitlab.com/libremfg/frontend/libre-admin-ui:v4.4.0
sha256:9289508a3c274b50373622c69b262f1ed078d6e3eebe8faa10aaf0e7982e054a

Agent:
registry.gitlab.com/libremfg/libre-agent:v4.4.0
sha256:3d686c67343b4964623ad10c1a3f3ad469ba963955d65ee90190945160a3fd0a

BaaS:
registry.gitlab.com/libremfg/baas:v4.4.0
sha256:698656b367a7a839f7aab995b5a04e1d4b8b8c847b69d00da2097d52c89ed7e9

ISA-95:
registry.gitlab.com/libremfg/isa95:v4.4.0
sha256:459d3e1e14037005586bc53a3073ca0a1f1f9fc1e8f0cd804c8bba6737320694

Keycloak theme:
registry.gitlab.com/libremfg/frontend/libre-keycloak-theme:v4.4.0
sha256:ca10b5804720680df0937685cfb44c284c845c2547c11ab1bad247efee478912

Typescript host:
registry.gitlab.com/libremfg/typescript-host-service:v4.4.0
sha256:d9ba14fedc30c13e4018375c3d604794e94552357949fc8e0eb53e083c961123

Workflow:
registry.gitlab.com/libremfg/workflow:v4.4.0
sha256:9436f1a108fe75ac698c43b780b1c28572c939a609f34b9c0701062365265eec

Download v4.4.0-checksums.txt

Upgrade

To upgrade to v4.4.0, first ensure that you have made corrections for the following breaking changes.

After you’ve made the necessary mitigations, follow the Upgrade instructions.

Breaking Changes

Changes to OIDC Configuration

Agent and Workflow now authenticate with client credentials instead of password grants. The OAuth client must now be confidential with service accounts enabled, and its service account user must be granted any necessary roles. For Keycloak the following changes will need to be made:

Workflow Required Roles

Workflow now requires the bpmn:mutation role to execute BPMNs that are not started by a user.

  1. In the left hand menu, select Clients > libreBaas and then select the Roles tab.
  2. Select Create role.
  3. Name the role bpmn:mutation.
  4. Save.
  5. In the left-hand menu, select Groups.
  6. Select your admin group, and then select the Role mapping tab.
  7. Select Assign role > Client roles.
  8. Select bpmn:mutation from libreeBaas.
  9. Assign.

Configure Clients

Clients now need to be configured to use service account roles and have their service account user be added to the admin group.

  1. In the left-hand menu, select Clients > libreWorkflow.
  2. Under Capability config, enable Service account roles.
  3. Save.
  4. Select the Service account roles tab.
  5. In the notice “To manage details…” select the service-account-libreworkflow link.
  6. Select the Groups tab.
  7. Select Join Group.
  8. Select your admin group, commonly named libreAdminGroup.
  9. Join.
  10. Repeat the process for libreAgent.
4.3.0