Releases: iTwin/itwinjs-core
v5.10.3
Release notes
Changes
- Security: remediate GHSA-gv7w-rqvm-qjhr (esbuild <0.28.1) (backport #9398) [release/5.10.x] (#9402)
- @bentley/imodeljs-native 5.10.35
- resolve CVE-2026-12143; CVE-2026-53571; CVE-2026-48779 (backport #9411) [release/5.10.x] (#9413)
- WorkspaceDb offline fixes (backport #9400) [release/5.10.x] (#9410)
Full changelog: 5.10.2...5.10.3
v5.10.2
v5.10.1
Release notes
Changes
- @bentley/imodeljs-native 5.10.34
- Fix quantity formatter unit system lookups (backport #9374) [release/5.10.x] (#9375)
Full changelog: 5.10.0...5.10.1
v5.10.0
5.10.0 Change Notes
@itwin/core-backend
ECSQL CROSS JOIN now supports optional ON clause
CROSS JOIN in ECSQL now accepts an optional ON condition, matching standard SQL and SQLite behavior. Previously, CROSS JOIN only produced an unfiltered Cartesian product between two classes.
The key benefit of using CROSS JOIN with an ON clause — rather than INNER JOIN — is optimizer control: SQLite's special CROSS JOIN handling prevents the query planner from reordering the joined tables, giving applications explicit control over the join order and query execution plan.
Example — filter the Cartesian product while locking join order:
-- Returns only matching Person/Identifier pairs, but forces Person to be the outer table
SELECT * FROM ts.Person p CROSS JOIN ts.Identifier i ON p.PersonalID = i.PersonIdThis is equivalent in result to an INNER JOIN, but the optimizer is not permitted to swap the table order, which can be important for performance-sensitive queries.
Schema changesets can be reversed
This makes it possible to walk a changeset timeline backwards through interleaved schema and data changesets. After reversing a schema changeset, the EC metadata (class definitions, property mappings, schema version) reflects the state prior to that changeset.
As a result, CheckpointManager.downloadCheckpoint now succeeds when the target changeset is older than the checkpoint and the range spans one or more schema changesets. Previously this would fail because schema changesets could not be reversed.
ChangesetReader: `enableStrictMode` and `disableStrictMode`
ChangesetReader gains ChangesetReader.enableStrictMode and ChangesetReader.disableStrictMode to toggle strict column-count checking. In strict mode a mismatch between a change record and the live table column count throws immediately; in lenient mode (the default) the minimum column count is used instead. See Strict mode for details.
ChangesetReader: `spillThresholdInBytes` controls disk spill for bounded memory use
ChangesetReader.openGroup, ChangesetReader.openTxn, ChangesetReader.openLocalChanges, and ChangesetReader.openInMemoryChanges now accept spillThresholdInBytes to bound peak memory by spilling change data to a temporary file on disk when the threshold is exceeded (default 50 MiB). See spillThresholdInBytes for details.
ChangesetReader: `close` and `Symbol.dispose` can now throw
ChangesetReader.close (and [Symbol.dispose]()) can now propagate errors from the native layer; previously they were silently swallowed. Code using manual [Symbol.dispose]() calls in a finally block may need updating — see Disposal for the safe patterns. Code using using is unaffected.
@itwin/core-quantity
Generated unit identifiers and sync built-in conversion helpers
@itwin/core-quantity now exposes beta Units, Phenomena, UnitSystems, and UnitConversions helpers for the built-in canonical unit set shipped with the package. This gives callers discoverable package-owned identifiers instead of magic strings, grouped unit browsing by phenomenon, and a synchronous built-in conversion path for canonical bundled units.
Units includes bundled BIS InvertedUnit identifiers inside their natural phenomenon buckets, removing magic-string cases for ratio-style units such as Units.HORIZONTAL_PER_VERTICAL.
The package also now exposes beta getDefaultPersistenceUnit for the package's default built-in persistence unit of a supported bundled phenomenon. Phenomena.LENGTH_RATIO is intentionally excluded from that helper because the bundled built-in unit set does not currently provide an agreed default for that phenomenon.
Additionally, Quantity.convertTo now throws QuantityError with QuantityStatus.InvalidUnitConversion when given UnitConversionProps marked with error: true, matching the newer UnitConversions throwing helpers. Callers that previously relied on convertTo(...) silently applying identity math for invalid conversions should update to handle this error explicitly.
Electron 42 support
In addition to already supported Electron versions, iTwin.js now supports Electron 42.
v5.9.5
Release notes
Changes
- @bentley/imodeljs-native 5.9.21
- Resolve CVEs coming from
vm2dependency (backport #9344) [release/5.9.x] (#9347) - Security: ignore dev-only vitest UI advisory CVE-2026-47429 (GHSA-5xrq-8626-4rwp) (backport #9351) [release/5.9.x] (#9354)
Full changelog: 5.9.4...5.9.5
v5.9.4
Release notes
Changes
- Restore deprecation version sync in the version bump pipeline (backport #9288) [release/5.9.x] (#9310)
- Correct stale deprecation versions in API comments (backport #9290) [release/5.9.x] (#9311)
- @bentley/imodeljs-native 5.9.20
- Security: bump multiparty to 4.3.0 (backport #9316) [release/5.9.x] (#9317)
Full changelog: 5.9.3...5.9.4
v5.9.3
Release notes
Changes
- Bulk element deletion API fixes (backport #9285) [release/5.9.x] (#9293)
- fix background map geometry crash on iModels without ecefLocation (backport #9297) [release/5.9.x] (#9299)
- 5.8.5 Changelogs
- Security: fix critical CVE GHSA-248r-7h7q-cr24 (vm2 sandbox breakout) (backport #9304) [release/5.9.x] (#9305)
- Track the implicit lock on a newly-added element without adding to the locks database (backport #9296) [release/5.9.x] (#9308)
Full changelog: 5.9.2...5.9.3
v5.8.5
Release notes
Changes
- fix(@itwin/build-tools): remediate CVE vulnerabilities in transitive deps (backport #9237) [release/5.8.x] (#9238)
- Security: fix 4 high axios CVEs (GHSA-pmwg-cvhr-8vh7) (backport #9259) [release/5.8.x] (#9261)
- fix background map geometry crash on iModels without ecefLocation (backport #9297) [release/5.8.x] (#9298)
Full changelog: 5.8.4...5.8.5
v5.9.2
Release notes
Changes
- Make FormatSpecHandle read current specs on access (backport #9264) [release/5.9.x] (#9265)
- docs: remove duplicate QuantityFormatter migration sample (backport #9270) [release/5.9.x] (#9272)
- [semantic Rebase] Remove unnecessary fields from "$meta" in instance patches and added batching while writing instance patches to temp file (backport #9266) [release/5.9.x] (#9273)
- fix: stop deep-importing core-backend internals in linear-referencing (backport #9271) [release/5.9.x] (#9274)
Full changelog: 5.9.1...5.9.2
v5.9.1
Release notes
Changes
- Security: fix 4 high axios CVEs (GHSA-pmwg-cvhr-8vh7) (backport #9259) [release/5.9.x] (#9260)
- Fixing semantic rebase issues (backport #9215) [release/5.9.x] (#9256)
Full changelog: 5.9.0...5.9.1