Skip to content

Canvus Server 26.x release notes

Back to release notes index

Canvus Server 26.09.2

Released on September 2026

Bug Fixes

  • The server now reports which version it is. The admin dashboard showed "Server version: N/A" on every release, because the server answered the request for its own version with an empty value, so there was no way to confirm from the interface which build a server was running. The dashboard now shows the version, matching what the server writes to its log at startup. An offline activation request also carries that version instead of the product name, so it is clear which build a request came from.

Canvus Server 26.09.1

Released on September 2026

Bug Fixes

  • Fixed the server failing to start after a Windows upgrade was installed over an existing version. Setup reported that the MT Canvus Server service failed to start, every later start attempt failed with error 1053, and the server wrote nothing to its log. Program files were only replaced when the new copy carried a higher version number, so supporting libraries whose version number had not changed between releases were left at the older build and the new server could not load against them. Every program file is now written on upgrade, so the installed folder always matches the version you installed. Configuration, databases and assets were never affected. A server already in this state can be recovered by repairing the installed version, which rewrites all of its files.

  • Fixed an upgrade stopping when a database upgrade step tried to add a column that was already present. The log showed "column ... already exists" followed by "Rolled back migration ... database left at version N", and the server would not start. This could happen to a database that already carried part of a later upgrade while still recording the earlier version. Upgrade steps that add a column now skip it when it is already there, so the upgrade completes and records the correct version whatever state the database was in. No data was at risk in the failed state: the step was rolled back and the database left unchanged.

Canvus Server 26.09.0

Released on September 2026

Bug Fixes

  • Database upgrades are now applied atomically. Previously, if an upgrade step failed part-way through, the changes it had already made were kept while the recorded version was left behind. The next start retried the same step, failed because part of it was already present, and the server could not start at all --- a state that had to be repaired by hand before the server would run again. Each upgrade step and the version it records are now saved together, so a failed upgrade leaves the database exactly as it was and the server starts normally once the cause is corrected.

  • Upgrade steps are also read more carefully. A comment written inside one is no longer mistaken for the end of an instruction. Previously such a comment could either split an instruction and stop the server starting, or cause an instruction to be skipped entirely while the upgrade was still recorded as complete --- leaving a database that reported itself as up to date while part of its structure was missing.

Canvus Server 26.08.8

Released on September 2026

Security

  • Container deployments now ship PostgreSQL 17.11, which clears CERT-FR advisory CERTFR-2026-AVI-1024 (including CVE-2026-14669 and CVE-2026-14668). The advisory was addressed for the Windows and Linux installers in 26.08.4, but the container images were not covered at that time and could still contain PostgreSQL 17.10, which predates the fix. Updating to this release and pulling the new images applies the fix in place; because it is a minor PostgreSQL update, no database migration is required.

  • Note that the deployment methods are currently on different PostgreSQL major versions: the Windows and Linux installers bundle PostgreSQL 18.6, while the container images use PostgreSQL 17.11. Both are clear of the advisory above --- it is fixed in 17.11 and in 18.6 --- so neither is exposed, but the versions are not the same. Moving the container images to PostgreSQL 18 is a major-version upgrade, which requires converting an existing database directory rather than simply replacing the software, so it is being handled as its own change instead of being folded into a security update. Until that lands, treat container and installer deployments as running different PostgreSQL majors when transferring database dumps between them, or when relying on behavior or extensions specific to a version.

Canvus Server 26.08.7

Released on September 2026

Bug Fixes

  • Fixed the server failing to start after upgrading to 26.08.6. A database upgrade step could not be applied, so the server stopped with "Could not connect to database" and never came up. New installations were unaffected --- only upgrades from an earlier version. Upgrading directly from 26.08.5 or earlier to this release applies the step correctly, and no data was at risk in the failed state.

Canvus Server 26.08.6

Released on September 2026

New Features and Improvements

  • Canvas backgrounds can now be videos. The server stores the background video together with the timing reference that keeps every connected client at the same point in the loop, so a canvas opened on several devices shows the same frame. This applies both to newly created databases and, on upgrade, to existing ones.

Bug Fixes

  • Share links now open the canvas in the browser for visitors who are not signed in, whatever level of access the link grants. Previously only a canvas shared as Can edit opened anonymously: a Can view link, or a canvas whose sharing list granted the Guest user Owner or Edit, showed the sign-in page instead, with no way for the visitor to proceed. Visitors following a view-only link now get a read-only canvas rather than editing controls that the server would reject.

Canvus Server 26.08.5

Released on September 2026

Security

  • Closed a weakness in the browser gateway. The connection used for live video streaming bypassed the gateway's normal authentication path, so it accepted connections that had neither a signed-in session nor a share-link session. An unauthenticated client could therefore open streaming sessions against the media service and consume its capacity, and could address a streaming session belonging to another browser. That connection is now authenticated with the same session check as the rest of the gateway, each connection is given a server-generated identity instead of one supplied by the client, and streaming messages are refused for any canvas the connection has not been authorized to join. Servers with video streaming disabled were not affected.

Bug Fixes

  • Fixed connections building up and requests hanging when the server is reached through its built-in reverse proxy. Requests forwarded to the server had no response timeout and could wait indefinitely, and a client that disconnected was not reported onwards, so connections were left behind and never reclaimed --- on a busy server these accumulated until it stopped responding. Waits are now bounded and client disconnects are passed on, so abandoned requests are released promptly.

Canvus Server 26.08.4

Released on August 2026

Security

  • The PostgreSQL instance bundled with the server has been updated to PostgreSQL 18.6-1, on both Windows and Linux. This clears the vulnerabilities addressed in PostgreSQL's 18.6 point release, listed in CERT-FR advisory CERTFR-2026-AVI-1024 (13 August 2026), which flags PostgreSQL versions before 18.6 as affected. Existing databases are unaffected and no migration is required --- this is a minor PostgreSQL update within the same major version, so upgrades proceed in place as normal.

Canvus Server 26.08.3

Released on August 2026

New Features and Improvements

  • Offline activation now follows the same flow as the Canvus and Showcase apps and works with the MultiTaction license portal. Both mt-canvus-server --create-license-request <key> and the web admin (Admin area > Settings > License) produce a self-contained MT-Canvus-Server-offline-request.html. Upload it at https://ls2026.multitaction.com/keys/<key> to receive an .html license file, then install that file from the same admin page or by placing it in the server's license directory and restarting. Legacy .cslicense files are still accepted. Previously the server wrote a JSON request in a format the portal rejected, so offline activation depended on manual handling by MultiTaction support.

Canvus Server 26.08.2

Released on August 2026

Bug Fixes

  • The server now sends the complete TLS certificate chain. Previously only the first certificate in certificate-file and the first in certificate-chain-file were read, so a full-chain PEM was served as a bare leaf, and pointing both settings at the same bundle sent the leaf twice with no issuer at all; clients then failed with "the issuer certificate could not be found". Both files are now read in full, duplicates are skipped and the order is preserved, so existing configurations work without changes.

Canvus Server 26.08.1

Released on August 2026

New Features and Improvements

  • Startup now logs the [certificates] settings exactly as configured, before any fallback is applied. When SSL is enabled but the certificate and key paths are empty, the server states that it is generating a self-signed certificate, names the empty settings and the configuration file, and says plainly that any certificate installed on the machine is not in use. Previously that fallback produced a single routine-looking log line, and a server could run for days on a self-signed certificate while the operator believed their CA-issued certificate was active.

Canvus Server 26.08.0

Released on August 2026

New Features and Improvements

  • When SSL is enabled, Canvus Server now records which TLS certificate it is serving. Startup logs the certificate, key and chain file paths together with the certificate's subject, subject alternative names and expiry date; a chain file that has not been configured is stated explicitly rather than left out. A warning appears when the certificate expires within 30 days, and an error once it has already expired. Previously the log confirmed only that SSL was enabled, so there was no way to tell whether a renewed certificate had actually been picked up, or whether an intermediate chain file had been configured at all --- a common cause of a site that works in desktop browsers but fails on mobile.

Bug Fixes

  • When a Windows installation fails, Setup now tells you where to find the reason. Previously it ended with only a generic "Setup Wizard ended prematurely" message, giving no indication that a detailed explanation had already been written to disk; the final dialog now names that log file directly, and the log survives the rollback. Where an existing PostgreSQL is occupying port 5432 and blocking the install, the reported error also identifies the specific program and Windows service holding the port. Installing onto a machine that still carries the database service from a previous Canvus install now stops that service before replacing program files, rather than only doing so during a recognized upgrade.

  • Fixed the Windows installer failing with error 1332 on localized versions of Windows. Permissions were applied using English-language account names, which do not exist on systems installed in another language; they are now applied using the underlying Windows account identifiers, which are the same everywhere.

  • The Linux .deb published to the downloads page and the APT repository now always matches the released version. Previously the .deb was copied across by hand after each release, and the step was occasionally missed, leaving the downloads page offering a package older than the corresponding Windows installer.

Canvus Server 26.07.9

Released on August 2026

Security

  • The PostgreSQL instance bundled with the Windows installer now ships OpenSSL 3.5.7, resolving CVE-2026-7383, which was reported against the OpenSSL libraries in the previously bundled PostgreSQL build. Existing databases are unaffected and no migration is required --- this is a minor PostgreSQL update within the same major version, so upgrades proceed in place as normal.

  • 26.07.8 carried the same fix but was superseded by 26.07.9 within a day. If you already installed 26.07.8 you have the fix; no action is needed.

Canvus Server 26.07.7

Released on July 2026

Bug Fixes

  • Windows upgrades of Canvus Server now reinstall to the same drive and directory chosen during the original installation, instead of resetting to C:\Program Files. A related fix ensures the web client path is also updated correctly after an upgrade, preventing broken browser access to the interface when the install directory changes.

Canvus Server 26.07.6

Released on July 2026

Bug Fixes

  • Fixed a bug where 3D models imported with separate material files (multi-file OBJ models, with a companion .mtl and texture images) could silently lose their materials after a canvas was closed and reopened. The server previously had nowhere to store the companion material bundle alongside the model file, so re-loading a canvas would drop it.
  • Fixed the admin dashboard and server status API always showing a blank version number ("N/A"). The server now reports its real build version through the built-in web gateway; native desktop and mobile clients were unaffected.

Canvus Server 26.07.5

Released on July 2026

New Features and Improvements

3D model pose synchronization

  • Model roll is now included in pose synchronization, completing full yaw/pitch/roll orientation sync for 3D models across all connected clients.

Canvus Server 26.07.4

Released on July 2026

New Features and Improvements

3D model view synchronization

  • Camera field-of-view (zoom level) for 3D models now synchronizes across all connected clients, alongside the orientation sync introduced in 26.07.3.

Canvus Server 26.07.3

Released on July 2026

New Features and Improvements

3D model pose synchronization

  • Model yaw, pitch, and backdrop color for 3D models are now persisted server-side and replicated in real time, so every participant sees the same orientation and background for a 3D model. (Camera zoom and roll follow in 26.07.4 and 26.07.5.)

Canvus Server 26.07.2

Released on July 2026

Bug Fixes

  • Fixed a Windows installer bug (present in the short-lived 26.07.0 preview) where installing over an existing standalone install could keep an older core library, leaving the service unable to start ("Entry Point Not Found", error 1053). All server binaries now carry version metadata so upgrades replace them correctly.
  • Public canvases are no longer blocked by a stale authentication state — a cached or expired session no longer prevents access to canvases shared for public (unauthenticated) viewing.

Canvus Server 26.07.1

Released on July 2026

New Features and Improvements

Node-free in-process architecture

  • The web client and authentication gateway now run in-process inside Canvus Server via a built-in reverse proxy, removing the separate Node.js web-proxy service. This is consistent across every deployment format — container, Linux .deb, and Windows MSI.

Standalone installers

  • In addition to the container deployment, Canvus Server is now available as native standalone installers: a Linux .deb (Ubuntu 24.04) and a Windows MSI. Each bundles an isolated PostgreSQL 18 cluster and installs Canvus as system services (systemd on Linux, Windows Services on Windows) — no containers and no Node.js required.

Real-time video

  • The media relay can now re-encode video to VP8 for broader client compatibility.

Canvus Server 26.06

Released on June 2026

New Features and Improvements

Container image release channels

  • Canvus Server container images now publish to named release channels. The recommended compose file pins to the :stable tag, which always points to the newest generally-available release — pull the images and restart the stack to move to the latest stable build, with no compose edits required. A :latest alias of :stable is kept for tooling that pulls without an explicit tag.
  • For reproducible deployments that never change underneath you, pin to an immutable version tag such as :26.6.0, or download the version-specific compose file published alongside each release. Pre-release builds are available on the :dev channel for testing and should not be used in production. All public images remain cryptographically signed and can be verified with notation verify against the published trust policy.

Built-in WebRTC video relay

  • The server-side WebRTC video relay is now part of the standard server product, so a special build is no longer required to relay live video streams between participants. It remains opt-in: enable it by setting webrtc/enabled and webrtc/media-service-url in the server configuration and running the companion media (SFU) service. With those unset, the server behaves exactly as before.

Licensing

  • Bundle and suite license keys (such as a Canvus Connect suite key) can now be activated directly on the server. Online activation previously rejected these multi-product keys with a "product type required" error; the server now identifies itself as a Canvus server during activation so the licensing service resolves the correct seat pool.
  • The license activation form in the web admin no longer truncates long keys, so activation keys with a CS- prefix can be entered in full. When activation fails, the page now shows the licensing server's actual error message instead of a generic HTTP status, making it clearer why a key was rejected.

Canvas color palettes

  • Administrators can now set the default color palettes used when a new canvas is created. Configure the default pen colors and note background colors from the web admin (Settings) or the [canvas] section of mt-canvus-server.ini; new canvases pick these up after a server restart, and an empty or invalid list falls back to the built-in defaults.
  • An individual canvas's color palettes can be reset back to the server defaults through a new REST action (action=reset-color-presets) or the matching server operator. The reset only happens on explicit request, so reopening a canvas never overwrites palettes a user has edited. Connector colors now always mirror the pen palette and can no longer drift apart.

Video metadata

  • Video widgets now persist their muted state and duration on the server. The muted state can be set and is remembered across clients viewing the same canvas, and the duration reported by the client decoder is exposed through the REST API.

REST API

  • On server builds compiled without mipmap support, requesting an asset mipmap level over the REST API now returns a clear 404 Not Found with the message "Mipmaps are disabled in this build", instead of failing unexpectedly.

Bug Fixes

  • Fixed a bug where the server's background storage cleanup could permanently delete images, videos, and PDFs that a canvas was still using. It affected canvases that were loaded but had nobody connected — most visibly demo and other "cold" canvases — and showed up later as broken or missing content even though the canvas still listed the file. The server now keeps in-use assets protected through save operations and while canvases are idle, and re-requests any genuinely missing file through the normal asset-sync path so a connected client that still holds it can restore the file. The fix prevents future loss; it cannot recreate files that were already deleted, which must be recovered from a backup or a client device that still has a copy.
  • Fixed a multi-site synchronization problem where an interrupted asset transfer between sites could get permanently stuck, never completing and repeatedly logging errors. When a peer restarts a transfer from the beginning, the receiving server now recovers automatically and finishes the transfer instead of failing indefinitely.

Canvus Server 26.05

Released on May 2026

New Features and Improvements

Annotations in the web client

  • The web client now supports drawing and erasing annotations on canvas content. Switching to Annotate mode lets users draw freehand strokes on any widget (notes, images, browsers, videos, PDFs, anchors, tables) and on the canvas plane itself. Erase removes individual strokes with a tap. Strokes persist across reloads and replicate to other clients in real time, the same way widget edits do.
  • The pen and eraser tools show a live cursor and a size indicator while drawing, with tool-size settings applied as you draw.
  • Annotations can also be created and retrieved programmatically through the Canvus REST API.

Folder view: per-canvas and per-folder action menu

  • Every tile in the web folder view now carries a three-dot action button that opens Share, Rename, Move, Duplicate, Details, Show QR code, and Delete — plus Open in local Canvus and Copy link for canvases. The trash folder collapses to a single Empty-trash action.
  • Tapping a canvas tile no longer opens it immediately: the first tap highlights the tile and shows an Open button, the second tap confirms. Folders remain single-tap.

Bug Fixes

  • Public canvas links no longer briefly flash the login form before showing the canvas. Unauthenticated visitors opening a canvas shared as "anyone with the link can edit" now see it immediately, even on slower connections.
  • "Open in local Canvus" from the folder menu now hands off to the desktop app correctly; it previously built a malformed link that could cause connection timeouts.
  • Folder management fixes: the Move dialog now hides destination folders the user only has view access to; Duplicate copies correctly; the Details dialog shows the parent folder's name instead of a numeric id; subfolder navigation under "My Canvases" keeps the correct sidebar entry highlighted; and browser-back from a canvas reliably returns to the folder view.
  • Email-confirmation links sent during user registration and email-change flows now work end-to-end in the web client; previously some links resolved to a placeholder page and verification did not complete.
  • Shift+drag lasso selection now shows a visual rubber-band rectangle as you drag, and nested widgets inside scaled or translated parents are now selectable via lasso.
  • The server health check now detects both crashed and wedged server processes, with faster failure detection (about 90 seconds instead of 150). Health-check requests now include timeouts so they cannot hang on a wedged server.

Canvus Server 26.4.0

Released on April 2026

  • Switched to calendar versioning: version numbers now follow YY.M.PATCH format (26.4.0 = April 2026)
  • mt-canvus-server is now a separate product with its own source repository, release notes context, and manual. The Canvus Server Manual is the authoritative reference for server operators; the Canvus Client Manual now covers the desktop client only
  • Backwards compatible with 3.4.x in both directions: 26.4.0 clients work against 3.4.x servers (26.4-only features stay dormant until the server is upgraded), and 3.4.x clients work against 26.4.0 servers (retaining existing functionality without 26.4-only features). Some perpetual licenses are tied to a specific major version and may need to be re-issued — contact sales@multitaction.com if validation fails after upgrade.

Upgrading from 3.4.x

See Upgrading the Canvus server from 3.x to 26.x for upgrade requirements and fleet coordination guidance.

New Features and Improvements

Containerised deployment is now the supported model

  • Canvus Server 26.4.0 ships as a set of Linux container images; containerised deployment is the recommended model for new installations
  • The default deployment is composed of two containers:
    • canvus-combined — the Canvus server binary, REST API, web client, and administration dashboard
    • canvus-postgres — PostgreSQL 17 with the Canvus schema
  • A third container, canvus-media (mediasoup-based Selective Forwarding Unit for WebRTC media routing and HLS transcoding), ships commented out of the default compose file --- it supports the coming-soon WebRTC video streaming feature described below
  • Supported on Linux (native Podman) with Podman Desktop on Windows and macOS for evaluation and single-server setups
  • Images are published to docker.multitaction.com; a read-only deploy token is available for end-user pulls
  • DRM / license enforcement is active in the 26.4.0 container images — deployments must supply a valid Canvus license

Browser-based canvas access (web client)

  • New browser-based canvas viewer lets collaborators open a canvas from a share link or QR code directly in a browser, without installing the desktop client
  • Delivered through an in-process gateway inside canvus-combined that also bridges sign-in and sign-out between the dashboard and the new web client
  • Share-link guest sessions are now treated as authenticated for the canvas they were shared into
  • See Browser-based canvas access

WebRTC video streaming (coming soon)

  • Video — screen share, IP camera streams, embedded browser capture, and RDP capture — will be routed end-to-end over WebRTC via the canvus-media SFU, with H.264 codec and hardware-accelerated encode/decode where available
  • New [webrtc] INI section and CANVUS_WEBRTC_ENABLED / CANVUS_WEBRTC_MEDIA_URL environment variables control server-side signaling relay
  • WebRTC video streaming is not yet feature-complete and is disabled by default in 26.4.0; the canvus-media service ships commented out of the default compose file
  • Once enabled, the UDP port range 40000-40100 must be reachable by clients that participate in media streaming

Multi-site

  • Cross-server permission checks are now namespace-aware, ensuring that owners from a federated site are validated against the correct namespace rather than the local user directory
  • Once the coming-soon WebRTC feature above is enabled, signaling relay between federated sites will route video through each site's canvus-media instance

Backup and restore

  • The backup/restore engine has been extracted into a dedicated canvus-backup library, shared between the server binary and future migration tooling
  • Archive format and mt-canvus-server --backup / --restore CLI flags are unchanged; 26.4.0 can restore archives produced by 3.4.x

Migration from 3.4.x bare-metal

  • A command-line tool, mtcs-migrate, is in development to assist with bare-metal → container migration. It is not yet functional in 26.4.0 --- migrate manually in the meantime
  • See Migration for the current, manual procedure

SAML authentication

  • SAML SSO login now works end-to-end in the 26.4.0 web client. Administrators who have configured SAML (including Microsoft Entra) can sign in via the "Login with SSO" button and land directly in the application after IdP authentication completes
  • Added [saml] idp-cert-file= INI key: operators can now supply the IdP's signing certificate as a PEM file. This supports Identity Providers that sign SAML responses but omit <KeyInfo> from the signature — a spec-permitted behavior that the previous fingerprint-based path could not handle. When set, idp-cert-fingerprint is ignored. See SAML IdP Certificate File
  • The SAML Assertion Consumer Service (ACS) URL is now honored from the [saml] acs-url= key in mt-canvus-server.ini. Deployments behind a load balancer or reverse proxy that need to advertise an ACS URL distinct from external-url can set this key; the IdP-facing metadata, /v1/server-config response, and the bundled web-proxy will all use it. When the key is empty (the default), the ACS URL is derived from external-url + /users/login/saml/callback

QR code sign-in

  • QR code sign-in now has a copy-URL button (chain-link icon in the bottom-right corner of the QR). Click it to copy the sign-in URL to the clipboard and complete the handshake in a new browser tab without a second device
  • Switching between Password, SAML, and QR Code on the sign-in dialog now clears any error message left over from the previous method

Web client

  • The web client hamburger menu (≡ button in the title bar) now includes Upload entries for images, videos, and PDFs. Editors can upload files directly to the active canvas from the title bar on desktop and tablet, providing a discoverable upload path alongside drag-and-drop

Administration and dashboard

  • Dashboard now rejects empty canvas and folder names in the create dialogs rather than producing unnamed resources

Bug Fixes

  • Fixed QR code sign-in: a 90-second TTL on the desktop-side QR token and a missing session-cookie save on the mint endpoint combined to make "QR code expired" the most likely outcome of every attempt. The TTL is back at ten minutes (matching the 3.4 dashboard) and the mint response now reliably issues the desktop session cookie
  • Fixed a container-entrypoint race that could restart the web-proxy and dashboard twice and crash-loop the combined container
  • Fixed a regression where crash diagnostics from background processes were swallowed instead of surfaced in container logs