Which open source and third-party components ship in each ProfileUnity with FlexApp release, and where do I download the inventory?
This article provides the official inventory of open source and third-party software components shipped with each release of ProfileUnity with FlexApp. Each release entry links to a downloadable ZIP archive hosted on the Liquidware CDN containing:
- A CSV component list — columns: Group, Component, Version, License, License URL, Usage
- A CycloneDX 1.6 JSON SBOM — machine-readable Software Bill of Materials including SPDX license IDs and package URLs (purl) for all components
Related article
For the hot fixes and installers that make up each release listed below, see the ProfileUnity Hot Fix List.
For the hot fixes and installers that make up each release listed below, see the ProfileUnity Hot Fix List.
The component list is updated whenever a GA or hotfix release adds, removes, or updates a third-party dependency. The current supported release is 6.9.5 HF4. Superseded releases remain available below so a given deployment can be matched to the inventory it actually shipped with.
Each release's CVEs addressed row lists vulnerabilities resolved in the third-party and open source components of that release's inventory. Microsoft .NET runtimes bundled with FlexApp, FlexApp One and FlexApp Packaging Automation are serviced through Microsoft's own security updates and are not counted there; Microsoft's .NET release notes list the fixes in each runtime version.
📄 Contents
6.9.5 — ProfileUnity with FlexApp Current Release
| 6.9.5 HF4 ⭐ LatestOctober 19, 2026 | MongoDB, 7-Zip and CBFS Filter updates | |
|---|---|
| Download |
ProfileUnity_FlexApp_6.9.5-hf4_Open_Source_3rd_party.zip
Contains:
6.9.5-hf4_Open_Source_3rd_party.csv6.9.5-hf4_Open_Source_3rd_party.json (CycloneDX 1.6) |
| Contents |
|
| Changes from prior release |
Compared with 6.9.5 HF3 — three components updated, none added or
removed, component count unchanged at 482:
|
| CVEs addressed |
5 CVEs resolved since 6.9.5 HF3MongoDB 7.0.41 → 7.0.45 — 3
CVE-2026-89099, CVE-2026-96297, CVE-2026-103965
7-Zip 26.02 → 26.04 — 2
CVE-2026-58052, CVE-2026-104086
|
Superseded releases
6.9.5 HF3 SUPERSEDED BY HF4
September 15, 2026
| 6.9.5 HF3September 15, 2026 | MongoDB updated to 7.0.41; no other component changes | |
|---|---|
| Download |
ProfileUnity_FlexApp_6.9.5-hf3_Open_Source_3rd_party.zip
Contains:
6.9.5-hf3_Open_Source_3rd_party.csv6.9.5-hf3_Open_Source_3rd_party.json (CycloneDX 1.6) |
| Contents |
|
| Changes from prior release |
Compared with 6.9.5 HF2 — one component updated, none added or
removed, component count unchanged at 482:
|
| CVEs addressed |
34 CVEs resolved since 6.9.5 HF2MongoDB 7.0.39 → 7.0.41 — 34
CVE-2026-18688, CVE-2026-18690, CVE-2026-18691, CVE-2026-18693, CVE-2026-18694, CVE-2026-18695, CVE-2026-18696, CVE-2026-18697, CVE-2026-18698, CVE-2026-18699, CVE-2026-18700, CVE-2026-18701, CVE-2026-18702, CVE-2026-18705, CVE-2026-18708, CVE-2026-18709, CVE-2026-18712, CVE-2026-82052, CVE-2026-82053, CVE-2026-82054, CVE-2026-82056, CVE-2026-82058, CVE-2026-82059, CVE-2026-82060, CVE-2026-82063, CVE-2026-82064, CVE-2026-82065, CVE-2026-82066, CVE-2026-82067, CVE-2026-82068, CVE-2026-82070, CVE-2026-82074, CVE-2026-82075, CVE-2026-82076
|
6.9.5 HF2 SUPERSEDED BY HF3
August 14, 2026
| 6.9.5 HF2August 14, 2026 | MongoDB, MailKit, SharpCompress, 7-Zip, CBFS Filter and JavaScript updates | |
|---|---|
| Download |
ProfileUnity_FlexApp_6.9.5-hf2_Open_Source_3rd_party.zip
Contains:
6.9.5-hf2_Open_Source_3rd_party.csv6.9.5-hf2_Open_Source_3rd_party.json (CycloneDX 1.6) |
| Contents |
|
| Changes from prior release |
Compared with 6.9.5 HF1 — seven components updated, none added or
removed; component count 481 → 482 because FlexApp One lists two
CBFS Filter builds:
|
| CVEs addressed |
25 CVEs resolved since 6.9.5 HF1MongoDB 7.0.37 → 7.0.39 — 16
CVE-2026-9737, CVE-2026-13055, CVE-2026-13059, CVE-2026-13060, CVE-2026-13061, CVE-2026-13062, CVE-2026-13065, CVE-2026-13066, CVE-2026-13068, CVE-2026-13069, CVE-2026-13070, CVE-2026-13071, CVE-2026-13072, CVE-2026-13074, CVE-2026-13077, CVE-2026-13078
7-Zip 26.01 → 26.02 — 1
CVE-2026-14266
MailKit 4.15.0 → 4.17.0 — 2
CVE-2026-30227, CVE-2026-41319
SharpCompress 0.30.1 → 0.48.1 — 1
CVE-2026-44788
Microsoft.OpenApi 2.4.1 → 2.7.5 — 1
CVE-2026-49451
Chart.js 2.5.0 → 2.9.4 — 1
CVE-2020-7746
Moment.js 2.18.1 → 2.30.1 — 3
CVE-2017-18214, CVE-2022-24785, CVE-2022-31129
|
6.9.5 HF1 SUPERSEDED BY HF2
July 2, 2026
| 6.9.5 HF1July 2, 2026 | MongoDB and 7-Zip version updates; duplicate rows removed | |
|---|---|
| Download |
ProfileUnity_FlexApp_6.9.5-hf1_Open_Source_3rd_party.zip
Contains:
6.9.5-hf1_Open_Source_3rd_party.csv6.9.5-hf1_Open_Source_3rd_party.json (CycloneDX 1.6) |
| Contents |
|
| Changes from prior release |
Compared with 6.9.5 GA7 — no components added or removed;
component count 483 → 481:
|
| CVEs addressed |
19 CVEs resolved since 6.9.5 GA7MongoDB 7.0.34 → 7.0.37 — 11
CVE-2026-9740, CVE-2026-9741, CVE-2026-9746, CVE-2026-9747, CVE-2026-9748, CVE-2026-9749, CVE-2026-9750, CVE-2026-9751, CVE-2026-9752, CVE-2026-9753, CVE-2026-11933
7-Zip 26.00 → 26.01 — 8
CVE-2026-48092, CVE-2026-48095, CVE-2026-48101, CVE-2026-48102, CVE-2026-48103, CVE-2026-48104, CVE-2026-48111, CVE-2026-48112
|
6.9.5 GA7 SUPERSEDED BY HF1
June 8, 2026
| 6.9.5 GA7June 8, 2026 | Initial open source component release | |
|---|---|
| Download |
ProfileUnity_FlexApp_6.9.5ga7_Open_Source_3rd_party.zip
Contains:
6.9.5_Open_Source_3rd_party.csv6.9.5_Open_Source_3rd_party.json (CycloneDX 1.6) |
| Contents |
|
| Changes from prior release | Initial component list — no prior 6.9.x release to compare against. |
| CVEs addressed | None — initial component list, no prior 6.9.x release to compare against. |
| Product | Liquidware ProfileUnity with FlexApp |
| Applies To | ProfileUnity 6.9.5 and later |
| Updated | October 15, 2026 |