Kiwi TCMS 16.2

multiple security improvements, database migrations and API changes

Posted by Kiwi TCMS Team on Thu 23 July 2026 under releases

Dear testers, we're happy to announce Kiwi TCMS version 16.2!

IMPORTANT:

This is a minor version release which includes multiple security related updates, several improvements, database migrations, API changes and bug fixes.

You can explore everything at https://public.tenant.kiwitcms.org!

---

Public container image (x86_64):

pub.kiwitcms.eu/kiwitcms/kiwitcms   latest  1296a8044fcb    863MB

IMPORTANT: version tagged and multi-arch container images are available only to subscribers!

Changes since Kiwi TCMS 16.1

Security

  • Update Django from 6.0.6 to 6.0.7
  • Update node_modules/fast-uri from 3.1.3 to 3.1.4
  • Make admin pages, views and API methods tenant aware so that they only show users which are authorized for the current tenant. Fixes Issue #4410
  • Restrict field arguments for API method calls. Fixes CVE-2026-77437
  • Remove handling for ?next= parameter in Confirm view. Fixes CVE-2026-77433
  • Improve how file upload validator interprets chunks for large files. Fixes CVE-2026-77434
  • Improve parsing for tracker_from_url() helper. Fixes CVE-2026-77435

Improvements

  • Update django-modern-rpc from 1.1.0 to 2.1.0
  • Update tzdata from 2026.2 to 2026.3
  • Update node_modules/webpack from 5.107.2 to 5.108.4
  • Update node_modules/webpack-cli from 7.0.3 to 7.2.1
  • On TestRun Admin page when clicking the "+ Add test run" button redirect to the New Test Run page

API

  • Method Component.create() no longer accepts the initial_qa_contact field
  • Method Component.filter() no longer returns the initial_qa_contact field

Database

  • Remove initial_qa_contact field from Component model - not used anywhere
  • Introduce new migration management.0013_remove_initial_qa_contact

Bug fixes

Refactoring and testing

  • Update actions/setup-node from 6 to 7
  • Update locust from 2.44.4 to 2.46.1
  • Update pylint-django from 2.7.0 to 2.8.0
  • Add JSON-RPC tests for User.filter API method
  • Add test case for Environment Admin page
  • Adjust calls to format_html() to always pass arguments
  • Replace mark_safe() with format_html()
  • Refactor API methods for compatibility with django-modern-rpc v2
  • Refactor HTML escape logic with class-based KiwiTCMSHandlerMixin base for the existing custom API handlers
  • Remove unused User = get_user_model() assignments

Changes since Kiwi TCMS Enterprise v16.1-mt

  • Based on Kiwi TCMS v16.2
  • Update certbot from 5.6.0 to 5.7.0
  • Update kiwitcms-tenants from 4.5.0 to 4.7.0
  • Update sentry-sdk from 2.63.0 to 2.66.0
  • Update social-auth-app-django from 5.9.0 to 6.0.0 - login views now only accept POST requests!
  • Refactor social-auth login buttons to forms

Private container images

hub.kiwitcms.eu/kiwitcms/version          16.2 (aarch64)          67362bc2085e    22 Jul 2026     716MB
hub.kiwitcms.eu/kiwitcms/version          16.2 (x86_64)           133f2a8a46e5    22 Jul 2026     697MB
hub.kiwitcms.eu/kiwitcms/enterprise       16.2-mt (aarch64)       31dce251b9a8    22 Jul 2026     915MB
hub.kiwitcms.eu/kiwitcms/enterprise       16.2-mt (x86_64)        6f1d64253383    22 Jul 2026     893MB

IMPORTANT: version tagged, multi-arch and Enterprise container images are available only to subscribers!

How to upgrade

Follow the Upgrading instructions from our documentation.

Happy testing!

---

If you like what we're doing and how Kiwi TCMS supports various communities please help us grow!