API Server 8.x to 9.x

While there are several major changes with the 9.0.0 release, one of the primary goals for this release is to maintain an easy upgrade path from 8.x versions. There are several important points that have been implemented with the 9.0.0 release to ensure that the migration from 8.0.0 is a quick and easy transition.

• No database upgrade scripts or schema changes With the 9.0.0 release, there are no schema changes or upgrade scripts that will be performed on deployments during an upgrade from 8.x to 9.0.0

• No major Developer Portal, Formio.js Renderer, or Form Builder changes We encourage the upgrade to 9.0.0 to take advantage of the security enhancements and CVE resolutions as soon as possible. To enable an easy upgrade path, the first 9.0.0 version contains only the necessary upgrades to dependencies and libraries and is without any major changes to the Developer Portal Application, Formio.js Renderer, or Form Builder since 8.x.

9.x Changes

Most of the changes for 9.0.0 pertain to security updates, performance improvements, major library dependency and runtime upgrades. The following is a detailed list of all major changes that have been made for the 9.0.0 release:

• VM2 replaced with Isolated-VM One of the instigating motivations for releasing a new major version was the recent deprecation of the heavily depended on library VM2. https://github.com/patriksimek/vm2 Before 9.0.0, this library was heavily used to ensure proper sandbox execution of any server-side JavaScript evaluations that would occur within a number of Form features. The following server-side evaluations were previously executed within the VM2 runtime:

  • Form Component: Calculated Values w/ “Calculate on Server” enabled

  • Form Component: Custom Default Values

  • Form Component: Advanced Logic w/ Custom triggers or actions

  • Form Component: Custom Conditionals

  • Form Component: Custom Validations

  • Form Component: Select Available Items Validation

  • Form Actions: Email Action template rendering

  • Form Actions: Save Submission Transform

  • Form Actions: Custom Action Conditions

  • Form Actions: Webhook Action Transforms

  • Project Settings: Token Parse

  Each of these systems relies on a secure JavaScript evaluation context to securely execute JavaScript within a sandboxed environment. Due to VM2 being deprecated, Isolated VM was selected to replace this library: https://github.com/laverdet/isolated-vm.

  This library replacement also required a refactor of the Form.io Server Side data processing system. Previously, the Javascript renderer, Formio.js, was leveraged as the mechanism to perform this validation within VM2, but this was no longer viable considering the level of protection surrounding evaluation contexts within Isolated VM.

  Therefore a new Submission Data Processing system was developed, which was released under the @formio/core library. The code behind this new system is Open Source and can be found @ https://github.com/formio/core/tree/master/src/process.

The following methods are listed below as either available or "no-op" in 9.x. This applies only to the server side evaluation context.

component instance methods available:

• get root

• get component

• get currentForm

• get data

• get parent

• get dataValue (getter)

• set dataValue (setter)

• getValue()

• setValue()

• isEmpty()

component instance no-op methods:

• get schema

• get options

• on()

• off()

• render()

• redraw()

• ready()

• init()

• destroy()

• teardown()

• attach()

• detach()

• build()

• t(text)

• sanitize(dirty)

• renderString(template)

instance.root methods available:

• getComponent(path)

• get submission

instance.root no-ops:

• set submission

• set form

• get root

instance.root fields available:

• data (submission data)

Other updates in 9.0.0

• New Server Validation Runtime Along with the new data processing system is a new validation runtime for every submission that is processed on the server. This system has been refactored to no longer use the full “formiojs” renderer on the server, but instead use a more dedicated data processing system provided by our core validation engine found @ https://github.com/formio/core/tree/master/src/process/validation. This change will improve performance as well as memory allocation when new submissions are sent to the server.

• Upgrade to Node v20 As part of the upgrade for dependencies and data processing, we are also moving to use the Node v20 runtime within the Docker containers that run our Enterprise deployments. Node v20 includes several performance and security improvements, which can be found in their release notes found @ https://nodejs.org/en/blog/announcements/v20-release-announce.

While it is absolutely our intention that reverse compatibility is upheld during this transition, it will be critical to test submitting forms to ensure the validation processing works as expected before deploying 9.0.0 into a production environment.

9.x Breaking Changes

There are a few breaking changes with the 9.x upgrade you should be aware of.

• Buttons are now included within the submission object

  "data":{
      "textField": "Test",
      "submit": true
  },