VisualSVN Server 5.4

• Updated to OpenSSL 3.0.22 with fixes for the following vulnerabilities: CVE-2026-63072, CVE-2026-63076, CVE-2026-54874, CVE-2026-63074, CVE-2026-75803.
• Updated to APR Util 1.6.5 with cumulative fixes for the following vulnerabilities: CVE-2026-34502, CVE-2026-34501, CVE-2026-34191, CVE-2026-32327, CVE-2025-49506.
• Updated Expat XML parser to version 2.8.4 with cumulative fixes for the following vulnerabilities: CVE-2026-50219, CVE-2026-56131, CVE-2026-56132, CVE-2026-56403, CVE-2026-56404, CVE-2026-56405, CVE-2026-56406, CVE-2026-56407, CVE-2026-56408, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411, CVE-2026-56412, CVE-2026-72522, CVE-2026-66046, CVE-2026-76641, CVE-2026-76957, CVE-2026-76956.

• Updated to Apache HTTP Server 2.4.68 with cumulative fixes for the following vulnerabilities: CVE-2026-49975, CVE-2026-48913, CVE-2026-44631, CVE-2026-44186, CVE-2026-44185, CVE-2026-44119, CVE-2026-43951, CVE-2026-42536, CVE-2026-42535, CVE-2026-34356, CVE-2026-34355, CVE-2026-29170, CVE-2026-29167, CVE-2026-34059, CVE-2026-34032, CVE-2026-33857, CVE-2026-33523, CVE-2026-33007, CVE-2026-33006, CVE-2026-29169, CVE-2026-29168, CVE-2026-28780, CVE-2026-24072, CVE-2026-23918.
• Updated to OpenSSL 3.0.21 with fixes for the following vulnerabilities: CVE-2026-45447, CVE-2026-34182, CVE-2026-45445, CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-42766, CVE-2026-42770, CVE-2026-45446.
• Updated Expat XML parser to version 2.8.1 with cumulative fixes for the following vulnerabilities: CVE-2026-45186, CVE-2026-41080.

• Updated to OpenSSL 3.0.20 with fixes for the following vulnerabilities: CVE-2026-31790, CVE-2026-28387, CVE-2026-28388, CVE-2026-28389, CVE-2026-28390, CVE-2026-31789.
• Updated Expat XML parser to version 2.7.5 with cumulative fixes for the following vulnerabilities: CVE-2026-24515, CVE-2026-25210, CVE-2026-32776, CVE-2026-32777, CVE-2026-32778.
• Fixed: VisualSVN HTTP Service may crash under certain circumstances when Access Logging is enabled.

• Updated to Apache HTTP Server 2.4.66 with fixes for the following vulnerabilities: CVE-2025-66200, CVE-2025-65082, CVE-2025-59775, CVE-2025-58098, CVE-2025-55753.
• Updated to OpenSSL 3.0.19 with fixes for the following vulnerabilities: CVE-2025-15467, CVE-2025-68160, CVE-2025-69418, CVE-2025-69419, CVE-2025-69420, CVE-2025-69421, CVE-2026-22795, CVE-2026-22796.
• Fixed: VisualSVNServerHooks.exe commit-notification hook may crash when processing substitution variables, such as $(author).

• Updated to Apache HTTP Server 2.4.65 with cumulative fixes for the following vulnerabilities: CVE-2025-54090, CVE-2024-42516, CVE-2024-43204, CVE-2024-43394, CVE-2024-47252, CVE-2025-23048, CVE-2025-49630, CVE-2025-49812, CVE-2025-53020.
• Updated to OpenSSL 3.0.18 with fixes for the following vulnerabilities: CVE-2025-9230, CVE-2025-9232.
• Updated Expat XML parser to version 2.7.3 with cumulative fixes for the following vulnerabilities: CVE-2024-8176, CVE-2025-59375.
• Fixed: VisualSVNServerHooks.exe commit-notification hook crashes when the repository has a webviewer:revision property in a relative format.
• Fixed: Set-SvnServerLicense PowerShell cmdlet makes unnecessary queries to the VisualSVN Server Background Job Service (vsvnjobsvc).
• Fixed: Set-SvnServerLicense PowerShell cmdlet may work incorrectly if the server has suspended Subversion users.

• Updated to OpenSSL 3.0.16 with fixes for the following vulnerabilities: CVE-2024-13176, CVE-2024-9143.
• Fixed: firewall configuration error when installing VisualSVN Server in a Windows container.

• Updated to Apache Subversion 1.14.5 with a fix for the following vulnerability: CVE-2024-46901.
• Updated Expat XML parser to version 2.6.4 with cumulative fixes for the following vulnerabilities: CVE-2024-45490, CVE-2024-45491, CVE-2024-45492, CVE-2024-50602.

• Fixed: VisualSVN HTTP Service fails to start when repositories are stored on a network share.
• Fixed: commits that delete a large number of locked files may fail with the "Unexpected HTTP status 431 'Request Header Fields Too Large'" error message.

• Updated to Apache Subversion 1.14.4 with a fix for the following vulnerability: CVE-2024-45720.
• Updated to Apache HTTP Server 2.4.62 with cumulative fixes for the following vulnerabilities: CVE-2024-40725, CVE-2024-40898, CVE-2024-39884, CVE-2024-36387, CVE-2024-38472, CVE-2024-38473, CVE-2024-38474, CVE-2024-38475, CVE-2024-38476, CVE-2024-38477, CVE-2024-39573.
• Updated to OpenSSL 3.0.15 with cumulative fixes for the following vulnerabilities: CVE-2024-6119, CVE-2024-5535, CVE-2024-4741, CVE-2024-2511.
• Updated Expat XML parser to version 2.6.2 with cumulative fixes for the following vulnerabilities: CVE-2024-28757, CVE-2023-52426, CVE-2023-52425.
• Fixed: viewing job history may cause the VisualSVN Background Job Service to crash.
• Fixed: VisualSVNServerHooks.exe check-pathnames --case-conflicts hook may unexpectedly reject valid commits.

Web interface enhancements

• Markdown rendering is now compliant with the CommonMark specification.
• Use the markdown-it library for Markdown rendering.
• Add support for anchor links in Markdown documents.
• Add support for HTML tags in Markdown documents.
• Add support for syntax highlighting of code blocks in Markdown documents.
• Add support for GFM task lists in Markdown documents.
• Add support for GFM alerts in Markdown documents.
• Add support for mailto: links in Markdown documents.

Backup enhancements

• New advanced backup creation policies for conditional full and incremental backup.
• Fixed: removal of expired backups might not occur if a backup job skips creating a new backup.
• Fixed: removal of expired backups might be unexpectedly postponed until the next job run.

PowerShell enhancements

• New Test-SvnRepositoryBackup cmdlet for verifying repository backups.
• New Get-SvnRepositoryBackup cmdlet for getting information about repository backups.
• Set-SvnServerConfiguration now accepts a new -ServerCertificatePfx option for importing a PFX certificate with a private key.

Compatibility changes

• Drop backward compatibility with VisualSVN Server 5.1.x and older versions for Remote Server Administration.

Other changes

• New option to allow Windows Basic authentication only for specific IP addresses.
• Add a 'Show history' button to the Properties of a background job.
• Grant VisualSVN HTTP Service explicit read access to the VisualSVN Server's installation directory.
• Configure a Windows Defender exclusion for svnsync.exe.
• Return HTTP status 431 'Request Header Fields Too Large' if a request header exceeds the server's limit.
• Allow only the PLAIN and LOGIN authentication methods by default when sending email notifications.
• Minor adjustment of tab size rendering in email commit notifications.
• Fixed: Search Index service may perform unnecessary I/O work under certain circumstances.
• Fixed: potential race condition when calculating the size of a repository.
• Do not install the mod_wsgi Apache module by default.
• Do not install the command-line openssl.exe utility by default.
• Various UI refinements.
• Updated to highlight.js 11.8.0.
• Updated to curl 8.1.2.