> This page is for Applications Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.humansecurity.com/llms.txt.

# Java changelog

## June 29, 2026

## Version 6.17.1

* Fix ClassCastException when adding headers to non-RequestWrapper request

## May 24, 2026

## Version 6.17.0

* Added Jakarta EE support via new `perimeterx-sdk-jakarta` artifact (Spring Boot 3.x, Tomcat 10+). The existing `perimeterx-sdk` artifact continues to support Java EE / `javax.servlet` environments (Spring Boot 2.x, Tomcat 9 and earlier).
* Fixed first party captcha reverse proxy to use `startsWith` instead of `contains` when matching the captcha prefix
* Fixed first party captcha reverse proxy to correctly return `true` (handled) after rendering the default response when first party is disabled
* Send original vid from cookie on all activities under `orig_cookie_vid`

## November 12, 2025

## Version 6.16.0

* Added support for data enrichment header feature (`px_data_enrichment_header_name` configuration)
* Added support for AD user identifiers feature
* Added `px_secured_pxhd_enabled` configuration option to enable secure flag on `pxhd` cookie
* Added `is_sensitive_route` to risk api and async activities
* Added `additional_token_info` to risk api and async activities
* Updated telemetry activity to new format (`static_config` and `active_config`; `remote_config` is not supported)
* Updated telemetry activity to include `request_id`
* Updated captcha page template to newest version
* Updated dependencies minor and patch versions (major versions unchanged)
* Changed custom parameters to be of type `Object` instead of `String` to allow more flexibility
* Changed first party block script in captcha template to end with expected `/captcha.js`
* Changed `RequestWrapper` to include custom headers in methods that retrieve request headers
* Fixed possible connection leak issue due to unclosed responses in first party and telemetry requests
* Fixed first party fuzzing errors by returning 400 on first party requests with URL length > 1000 characters

## September 8, 2025

## Version 6.15.1

* Added additional `updateReason` `RISK` to Telemetry flow

## September 3, 2025

## Version 6.15.0

* Added Telemetry by Risk support

## June 15, 2025

## Version 6.14.2

* Added Cross Tab Session cookie support on `risk_api` and async activities

## November 12, 2024

## Version 6.14.1

* Fix Telemetry bug when sending page requested activities when telemetry fails
* Fix `risk_rtt` is not sent when risk call gets `s2s_timeout`

## September 15, 2024

## Version 6.14.0

* Added cookie secret rotation support

## April 27, 2024

## Version 6.13.0

* Added vid validation for `_pxvid` extraction

## February 25, 2024

## Version 6.12.0

* Fixed: sensitive headers are now case-insensitive.

## February 18, 2024

## Version 6.11.0

* Added base64-encoded request http method to captcha script query parameters on block - pages

## December 28, 2023

## Version 6.10.0

* Added feature **request-header-based-logger**.
* Align risk api and async activities fields.
* Added `enforcer start timestamp` and `risk start timestamp` to activities schema
* Removed the `blockedUrl` window variable from the block page to prevent XSS vulnerability.
* Added blocked URL to the captcha query params.

## November 23, 2023

## Version 6.9.5

* Updated the first-party request handler with connection timeout limit.
* Updated the captcha template for a better user experience.

## November 21, 2023

## Version 6.9.4

* Fixed first party connection timeout issue.
* Updated the captcha template to efficiently manage delays in captcha retrieval.

## November 16, 2023

## Version 6.9.3

* Fixed risk request schema.
* Fixed cookie validation.

## November 15, 2023

## Version 6.9.2

* Fixed potential XHR first party issue.

## November 13, 2023

## Version 6.9.1

* Updated ABR and captcha template.

## November 8, 2023

## Version 6.9.0

* Added request filtering with a new RequestFilter for better management and introduced CustomFilterByFunction for more powerful filtering.
* Added hard block support.
* Fixed issues with cookies containing special characters, ensuring proper handling.
* Fixed the Captcha page template.
* Fixed resource management issues across various code locations.
* Updated the Context URI to Servlet Path to better enforce feature routes.
* Updated the Risk Request Schema to better support detection.
* Updated Page Request and Block Activity schema to better support detection.

## October 22, 2023

## Version 6.8.1

* Fixed handling of cookies with illegal arguments.

## October 18, 2023

## Version 6.8.0

* Fixed Resolved an issue with unhandled Telemetry errors.
* Added Enhanced customization with configurable IPXHttpClient and HUMANClient settings.
* Fixed HUMANHD didn't set cookies after using the risk\_api.
* Fixed Enhanced security with the addition of an HTTP method check for static content extensions.

_Showing the 20 most recent of 72 entries. Append `/llms.txt` to the changelog URL for the complete index._