Today we released Orbeon Forms 4.0 M10 (Milestone 10). Like 4.0 M9 and the previous milestones this is not a final release.

We have addressed the following issues in this build:

• Form Runner
• Don't allow "dot" in app/form name in page flow
• PDF template: support output of file metadata for file attachments
• XForms engine
• "Prefix for xxforms:separator is not declared" (#418)
• Security improvements (see blog post)
• More robust encryption
• Use item position instead of encryption
• Hash function configurable via properties
• More fixes for "Namespace interference with xs:*" (#331)
• Allow xxforms:get-request-path() to be used after XForms initialization
• "Save request parameters and headers to the dynamic state" (#422)
• "XHTML output: `Accept` header lost upon submission" (#424)
• Other
• Initial implementation of "Protect pages and services by default" (#75)
• Email sending: global properties for username, password, encryption, and smtp-port
• Orbeon Forms now builds on Oracle JDK 7
• Upgrade Commons Lang library
• Refactoring of HTTP connection code

More information is available in the in-progress release notes for 4.0.

You can download the builds using these links:

• PE version: orbeon-4.0.0.m10.201208212303-PE.zip
• CE version: orbeon-4.0.0.m10.201208220022-CE.zip

Don't forget to grab a trial license for the PE version.

Please send feedback preferably to the ops-users list or via twitter (if short!), or feel free to comment on this blog entry if appropriate.