9.24.44

LTS

August 19, 2026

Mendix Studio Pro is our low-code IDE for professional developers. It's a powerful visual model-driven development environment to build apps on the Mendix Platform. With Studio Pro you can easily create, change, integrate, test and deploy your applications, all in one place. Moreover, you can manage branch lines and security as well as extend your app with custom code using the built-in editors. Click 'Download Studio Pro' to get the installer for free (Windows OS required*). Learn more about the installation and the Studio Pro capabilities in our documentation. Not a professional developer? Learn How Mendix supports different developer profiles .Before installing, please read the Release Notes to learn about improvements, bug fixes, backwards compatibility, breaking changes and known issues. *If you are using a Mac, check out these instructions first.

Release Notes - **Release date: August 19, 2026** ### Improvements * We improved the security of the module import process by validating the file paths declared in an MPK package before extraction. Packages containing paths that traverse outside the app directory or target protected directories (such as `.git`, `deployment`, or `releases`) are now rejected with an error. * We fixed a bypass in the extraction-time path filter where non-canonical ZIP entry names (for example, paths containing `..` segments) evaded the protected-subtree check. Entry names are now canonicalized before filtering. * We added support for the following database versions: * MariaDB 12.3 * MySQL 9.7 * We updated the .NET Runtime to version 10.0.7. * We added a confirmation dialog when enabling anonymous user access in App Security, warning that unrestricted anonymous roles may expose data unintentionally. * We now delete the log files generated by Studio Pro that are older than seven days. ### Fixes * We upgraded Jetty dependencies to fix CVE-2026-2332. (Tickets 277670, 281968) * We upgraded Netty dependencies to fix CVE-2026-42578, CVE-2026-42583, CVE-2026-42587, CVE-2026-42585, CVE-2026-42584, CVE-2026-42581, CVE-2026-42580, CVE-2026-41417, CVE-2026-42577, CVE-2026-42579. (Tickets 278202, 278290, 277691, 278290) * We fixed an issue where files with `%` in the filename could not be downloaded, which caused incorrect *File could not be found* errors. (Ticket 281292) * On SQL Server, when a unique constraint or foreign key constraint is dropped, we now use `IF EXISTS`. This avoids an automatic rollback of the synchronization transaction in case the constraint does not exist. (Ticket 279545) * We fixed an issue in the **Call web service** activity and in consumed OData services that consume services using OData version 3. The XML parser now rejects DTD declarations and external entities because a compromised server might exploit those features. * We fixed an issue where publishing a microflow in a new a REST service allowed adding that service to read-only modules such as the System module. * We fixed an issue where local file storage does not use optimal directory structure. ### Deprecations * We dropped support for the following database versions that are no longer supported by the vendors: * PostgreSQL 13 * MariaDB 10.6