Release notes

Riversoft® STCP Gemini API has its own version numbering. The running version is returned by GET /info/version.

3.10.0 — September 2026

New features

• License validation at startup, with the appl_serialnumber and appl_license parameters in config.json. With an invalid license, the API does not start; when the license expires, the API shuts down.
• GET /info/license returns the days until expiration (daysRemaining) and the expiration date (expiresAt).
• Token validity configurable in the session_duration parameter in config.json, in minutes: default 60, maximum 720.

Improvements

• Constant-time password comparison.
• The reason for authentication failures is now logged.
• The authentication bypass used by automated tests no longer exists in the production executable.

Fixes

• Locking an operator after too many sign-in failures overwrote the operator configuration and hid the original authentication error.
• Cache and database errors were ignored when locking the operator and counting sign-in failures.
• The Authorization header with extra spaces after Bearer was accepted.
• Error when closing a supervision connection that was never established.
• Filter with more than one user (user) in the reports with an Oracle database.
• An invalid password hash configuration could stop the API.

3.9.6 — September 2026

Improvements

• Identity providers (ssoProviders) now use the configuration structure shared by the Riversoft STCP products.

3.9.5 — September 2026

Fixes

• Operator identification in SSO sign-in with OpenID Connect, which now uses the preferred_username claim.

3.9.4 — August 2026

Fixes

• The transfer report did not reach the limit of 15000 records per page.
• The next field was always empty in the transfer history with Microsoft SQL Server and Oracle.

3.9.2 — July 2026

Improvements

• Limit of records per report page raised to 15000.
• Distribution for Enterprise Linux 8, 9 and 10.
• Version information in the Windows executable properties.

Fixes

• Wrong permission required to reset an operator password.
• The operator appeared as enabled after being locked by sign-in failures.

3.9.1 — June 2026

Fixes

• Formatting of the data read from the database in the log reports.

3.9.0 — June 2026

New features

• Validation of the Webhook connector data in users and network services.
• Encryption of the Webhook sensitive data, including the proxy password.
• TLS connection to the MySQL or MariaDB log database.

Improvements

• Installation scripts updated for all supported databases.

3.8.0 — April 2026

New features

• Operator 2FA enabled in the API registration (enable2FA).
• Reset of an operator 2FA: POST /stcpadminsvc/v2/supervision/stcpauth/reset/operator/2fa.
• GET /info/sso/providers also returns the active LDAP providers.

Improvements

• Tracing on all routes, with the entity, instance and user names in the log.

Fixes

• The API did not start when an SSO provider configuration was wrong.
• The operator was not recorded in the tracing of global file type deletion.

3.7.2 — January 2026

New features

• Encryption and masking of the FTPS sensitive data.

Fixes

• Pagination of the transfer and statistics reports, which did not apply the limit correctly.

Breaking changes

• Full access now belongs to the stcpadmin operator, and no longer to the operators of the group with ID 1. Operators that relied on that group for full access must be given the permissions in their groups.