Skip to main content

ProfileUnity with FlexApp — Third-Party & Open Source Software Inventory

Glen Porter
  • Created:
  • Updated:
ProfileUnity FlexApp — Open Source & Third-Party Component List

This article provides the official inventory of open source and third-party software components shipped with each release of ProfileUnity with FlexApp. Each release entry links to a downloadable ZIP archive hosted on the Liquidware CDN containing:

  • A CSV component list — columns: Group, Component, Version, License, License URL, Usage
  • A CycloneDX 1.6 JSON SBOM — machine-readable Software Bill of Materials including SPDX license IDs and package URLs (purl) for all components

For the hot fixes and installers that make up each release listed below, see the ProfileUnity Hot Fix List.

The component list is updated whenever a GA or hotfix release adds, removes, or updates a third-party dependency. The current supported release is 6.9.5 HF2. Superseded releases remain available below so a given deployment can be matched to the inventory it actually shipped with.

6.9.5 — ProfileUnity with FlexApp Current Release

6.9.5 HF2 ⭐ LatestAugust 14, 2026 | MongoDB, MailKit, SharpCompress, 7-Zip and JavaScript updates
Download ProfileUnity_FlexApp_6.9.5-hf2_Open_Source_3rd_party.zip
Contains:
6.9.5-hf2_Open_Source_3rd_party.csv
6.9.5-hf2_Open_Source_3rd_party.json (CycloneDX 1.6)
Contents
  • 481 components across the following product groups: ProfileUnity Server, ProfileUnity Client, ProfileUnity License Server, FlexApp, FlexApp One, FlexApp Packaging Console, FlexApp Packaging Automation
  • Includes embedded open source software (MongoDB 7.0.39, Microsoft .NET Framework) and all third-party libraries
  • CycloneDX 1.6 SBOM includes SPDX license IDs and package URLs (purl) for all components
Changes from prior release Compared with 6.9.5 HF1 — six components updated, none added or removed, component count unchanged at 481:
  • MongoDB 7.0.37 → 7.0.39 (ProfileUnity Server)
  • MailKit 4.15.0 → 4.17.0 (ProfileUnity Server)
  • SharpCompress 0.30.1 → 0.48.1 (ProfileUnity License Server)
  • Chart.js 2.5.0 → 2.9.4 (ProfileUnity Server)
  • Moment.js 2.18.1 → 2.30.1 (ProfileUnity Server)
  • 7-Zip 26.01 → 26.02 (ProfileUnity Server, ProfileUnity Client, FlexApp Packaging Automation)
CVEs addressed
25 CVEs resolved since 6.9.5 HF1
MongoDB 7.0.37 → 7.0.39 — 16
CVE-2026-9737, CVE-2026-13055, CVE-2026-13059, CVE-2026-13060, CVE-2026-13061, CVE-2026-13062, CVE-2026-13065, CVE-2026-13066, CVE-2026-13068, CVE-2026-13069, CVE-2026-13070, CVE-2026-13071, CVE-2026-13072, CVE-2026-13074, CVE-2026-13077, CVE-2026-13078
7-Zip 26.01 → 26.02 — 1
CVE-2026-14266
MailKit 4.15.0 → 4.17.0 — 2
CVE-2026-30227, CVE-2026-41319
SharpCompress 0.30.1 → 0.48.1 — 1
CVE-2026-44788
Microsoft.OpenApi 2.4.1 → 2.7.5 — 1
CVE-2026-49451
Chart.js 2.5.0 → 2.9.4 — 1
CVE-2020-7746
Moment.js 2.18.1 → 2.30.1 — 3
CVE-2017-18214, CVE-2022-24785, CVE-2022-31129

Superseded releases

6.9.5 HF1 SUPERSEDED BY HF2
July 2, 2026
6.9.5 HF1July 2, 2026 | MongoDB and 7-Zip version updates; duplicate rows removed
Download ProfileUnity_FlexApp_6.9.5-hf1_Open_Source_3rd_party.zip
Contains:
6.9.5-hf1_Open_Source_3rd_party.csv
6.9.5-hf1_Open_Source_3rd_party.json (CycloneDX 1.6)
Contents
  • 481 components across the following product groups: ProfileUnity Server, ProfileUnity Client, ProfileUnity License Server, FlexApp, FlexApp One, FlexApp Packaging Console, FlexApp Packaging Automation
  • Includes embedded open source software (MongoDB 7.0.37, Microsoft .NET Framework) and all third-party libraries
  • CycloneDX 1.6 SBOM includes SPDX license IDs and package URLs (purl) for all components
Changes from prior release Compared with 6.9.5 GA7 — no components added or removed; component count 483 → 481:
  • MongoDB 7.0.34 → 7.0.37 (ProfileUnity Server)
  • 7-Zip 26.00 → 26.01 (ProfileUnity Server)
  • Two redundant 7-Zip 26.00 rows were removed from ProfileUnity Client and FlexApp Packaging Automation. Both groups already listed 7-Zip at 26.01 in GA7, so the shipped software is unchanged — this accounts for the drop of two in the component count.
CVEs addressed
19 CVEs resolved since 6.9.5 GA7
MongoDB 7.0.34 → 7.0.37 — 11
CVE-2026-9740, CVE-2026-9741, CVE-2026-9746, CVE-2026-9747, CVE-2026-9748, CVE-2026-9749, CVE-2026-9750, CVE-2026-9751, CVE-2026-9752, CVE-2026-9753, CVE-2026-11933
7-Zip 26.00 → 26.01 — 8
CVE-2026-48092, CVE-2026-48095, CVE-2026-48101, CVE-2026-48102, CVE-2026-48103, CVE-2026-48104, CVE-2026-48111, CVE-2026-48112
6.9.5 GA7 SUPERSEDED BY HF1
June 8, 2026
6.9.5 GA7June 8, 2026 | Initial open source component release
Download ProfileUnity_FlexApp_6.9.5ga7_Open_Source_3rd_party.zip
Contains:
6.9.5_Open_Source_3rd_party.csv
6.9.5_Open_Source_3rd_party.json (CycloneDX 1.6)
Contents
  • 483 components across the following product groups: ProfileUnity Server, ProfileUnity Client, ProfileUnity License Server, FlexApp, FlexApp One, FlexApp Packaging Console, FlexApp Packaging Automation
  • Includes embedded open source software (MongoDB 7.0.34, Microsoft .NET Framework) and all third-party libraries
  • CycloneDX 1.6 SBOM includes SPDX license IDs and package URLs (purl) for all components
Changes from prior release Initial component list — no prior 6.9.x release to compare against.
CVEs addressed None — initial component list, no prior 6.9.x release to compare against.

 

Product Liquidware ProfileUnity with FlexApp
Applies To ProfileUnity 6.9.5 and later
Updated August 31, 2026

↑ Back to Contents

Related articles