https://releaseradar.jp/en/Official release notes and API changes from freee, kintone, SmartHR, LINE, and other Japanese SaaS products for AI builders.enhttps://releaseradar.jp/en/updates/sakura/64eeb7010911/https://releaseradar.jp/en/updates/sakura/64eeb7010911/Sun, 01 Nov 2026 15:00:00 GMTSecurityUsers running Linux servers are advised to check security notices and apply kernel updates for vulnerability CVE-2026-98432. ・Specially crafted IPv4 TCP packets from outside may lead to service disruption or arbitrary code execution. ・Packet filter and network restriction features can be used to limit connections to trusted sources as a mitigation. ・Restarting after an OS update can be completed solely using the "Reboot" operation rather than "Stop -> Start". ・Mitigations are being sequentially applied to managed services including Enhanced Load Balancers, VPN Routers, and AppRun. ・No impact on Sakura Cloud infrastructure systems or provided services has been confirmed at this time. https://cloud.sakura.ad.jp/news/2026/11/02/cve-2026-98432/https://releaseradar.jp/en/updates/moneyforward/8d69ab5d6b50/https://releaseradar.jp/en/updates/moneyforward/8d69ab5d6b50/Wed, 28 Oct 2026 15:00:00 GMTSecurityMoney Forward Cloud Accounting has temporarily suspended standard PDF export due to a security response and provided alternative methods. ・PDF export has been unreachable since around 21:00 on October 29, 2026. ・Financial statements can be exported as PDF from the bulk print page under the Financial Statements screen, with a different layout. ・Journals, cash books, general ledgers, and subsidiary ledgers can be exported as PDF from their print pages, with a different layout. ・Other reports cannot be exported as PDF at present and must be exported in CSV format. https://biz.moneyforward.com/support/account/news/important/20261029-2.htmlhttps://releaseradar.jp/en/updates/smaregi/fd3b9424d6bc/https://releaseradar.jp/en/updates/smaregi/fd3b9424d6bc/Mon, 26 Oct 2026 15:00:00 GMTSecurityA permanent fix for PHP vulnerabilities has been applied to the Waiter admin screen in ver. 2.46.2. ・Applies to all plans. ・No user action is required because this update is on the management screen side. https://smaregi.jp/news/product/202610271782.phphttps://releaseradar.jp/en/updates/smaregi/fb924f36b4f3/https://releaseradar.jp/en/updates/smaregi/fb924f36b4f3/Sun, 25 Oct 2026 15:00:00 GMTSecurityPHP vulnerabilities have been resolved in Admin Console and Self-Service version 1.14.3. https://smaregi.jp/news/product/202610261780.phphttps://releaseradar.jp/en/updates/lolipop/3f06254afad1/https://releaseradar.jp/en/updates/lolipop/3f06254afad1/Wed, 21 Oct 2026 15:00:00 GMTSecurityMaintenance for critical PHP vulnerabilities was completed, restoring site display and administrative tools. ・The session.upload_progress feature stops working across all PHP versions ・PHP 8.2 through 8.5 now run patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 ・Patches also apply to unsupported PHP versions 5.3 through 8.1 ・No unauthorized access or data leakage targeting the vulnerabilities has been confirmed https://lolipop.jp/info/news/8239/https://releaseradar.jp/en/updates/mackerel/4fa57cbc7cea/https://releaseradar.jp/en/updates/mackerel/4fa57cbc7cea/Wed, 21 Oct 2026 15:00:00 GMTSecurityThe Mackerel service infrastructure and official mackerel-agent do not use PHP and are unaffected by the disclosed PHP vulnerabilities. https://mackerel.io/ja/blog/entry/announcement/20261022https://releaseradar.jp/en/updates/line/60160a927799/https://releaseradar.jp/en/updates/line/60160a927799/Mon, 19 Oct 2026 15:00:00 GMTSecurityDue to an XSS vulnerability in older LIFF SDK versions, LINE plans to restrict the use of affected versions in external browsers. ・A cross-site scripting vulnerability (CVE-2026-112148) was confirmed in LIFF v2.20.0 through v2.31.0. ・Opening an endpoint URL from a malicious URL in an external or LINE in-app browser may allow arbitrary JavaScript execution. ・Usage restrictions on LIFF v2.20.0 through v2.31.0 are scheduled around November 24, 2026, and may be moved up without notice. ・After the restriction, LINE Login and other LIFF features may stop working when opening affected apps in external browsers. ・Apps using the CDN edge path (https://static.line-scdn.net/liff/edge/2/sdk.js) are automatically updated to v2.31.2 and need no action. https://developers.line.biz/ja/news/2026/10/20/liff-sdk-issue/https://releaseradar.jp/en/updates/lolipop/f72da75fe120/https://releaseradar.jp/en/updates/lolipop/f72da75fe120/Tue, 13 Oct 2026 15:00:00 GMTSecurityYou must update Movable Type or apply file workarounds due to vulnerabilities that allow remote code execution and data leaks. ・You can update Movable Type (9.0.9 and earlier, 8.8.5 and earlier, 8.0.12 and earlier) and Premium editions to fixed versions ・Fixed versions are not provided for unsupported versions such as Movable Type 4.x–7.x, 8.4.x, and Premium 1.x ・If you cannot update immediately, you can delete files like mt-upgrade.cgi or change their permissions to 000 ・Deleting or changing the permissions of mt-search.cgi makes site search unavailable https://lolipop.jp/info/news/8227/https://releaseradar.jp/en/updates/mackerel/7d4b1ad98c09/https://releaseradar.jp/en/updates/mackerel/7d4b1ad98c09/Tue, 06 Oct 2026 15:00:00 GMTSecurityAs a preventive measure, existing API key access and IDCF account login have been suspended for IDCF Free and IDCF Free+ plans. ・Metric posting and data retrieval using existing API keys stop for IDCF Free and IDCF Free+ plans ・Logging in to Mackerel using an IDCF Cloud account stops working ・You can continue monitoring by generating a new API key and replacing it in mackerel-agent and other tools ・Logging in with a password or via password reset remains available https://mackerel.io/ja/blog/entry/announcement/20261007-idcfhttps://releaseradar.jp/en/updates/moneyforward/d917ea29de6b/https://releaseradar.jp/en/updates/moneyforward/d917ea29de6b/Mon, 05 Oct 2026 15:00:00 GMTSecurityAll organizations can now create roles to separate report viewing permissions from operational task permissions. ・The Permission Management menu is now available to all organizations without contacting support. ・You can now create roles and assign them to each staff member in member management. ・You can now configure view permissions for individual reports such as pay slips and deduction statements. ・Existing permission pattern settings were migrated to the new roles. https://biz.moneyforward.com/support/payroll/news/new-feature/20261006.htmlhttps://releaseradar.jp/en/updates/line/5a9be1694217/https://releaseradar.jp/en/updates/line/5a9be1694217/Tue, 29 Sep 2026 15:00:00 GMTSecurityLIFF v2.31.1 fixes a potential security bug in the LIFF SDK, and versions v2.20.0 through v2.31.0 have been deprecated. ・Fixed an internal LIFF SDK issue that occurs when opening a LIFF app in an external browser from a URL with crafted query parameters ・Deprecated LIFF versions v2.20.0 through v2.31.0 due to potential security impact without changing LIFF app functionality ・Users of the CDN edge path are automatically updated to v2.31.1 and require no additional action https://developers.line.biz/ja/news/2026/09/30/release-liff-2-31-1/https://releaseradar.jp/en/updates/komoju/bb54a84db040/https://releaseradar.jp/en/updates/komoju/bb54a84db040/Sun, 30 Aug 2026 15:00:00 GMTSecurityYou can now use 3D Secure authentication and card brand filtering in Google Pay. https://docs.komoju.com/ja/changelog#:~:text=Google%20Pay%E3%81%AE3D%E3%82%BB%E3%82%AD%E3%83%A5%E3%82%A2%E8%AA%8D%E8%A8%BC%E3%81%A8%E3%82%AB%E3%83%BC%E3%83%89%E3%83%96%E3%83%A9%E3%83%B3%E3%83%89%E3%81%AE%E7%B5%9E%E3%82%8A%E8%BE%BC%E3%81%BFhttps://releaseradar.jp/en/updates/line/3be13065df87/https://releaseradar.jp/en/updates/line/3be13065df87/Sun, 30 Aug 2026 15:00:00 GMTSecurityAfter LIFF v2.31.0 was released with internal behavior changes, it was deprecated due to a security bug and faces planned usage limits. ・LIFF v2.31.0 changed the internal behavior of the LIFF SDK without changing features. ・LIFF v2.31.0 was deprecated after a bug with potential security impact was confirmed. ・Usage restrictions for LIFF SDK versions v2.20.0 to v2.31.0 are planned around November 24, 2026. https://developers.line.biz/ja/news/2026/08/31/release-liff-2-31-0/https://releaseradar.jp/en/updates/moneyforward/89579a070e12/https://releaseradar.jp/en/updates/moneyforward/89579a070e12/Mon, 24 Aug 2026 15:00:00 GMTSecurityIn Cloud Payroll, HR service names changed to HR Master, and users with the Payroll Admin role can now sync employee information. ・The service name displayed in Cloud Payroll changed from Money Forward Cloud HR Management to Money Forward Cloud HR Master and HR Master. ・Users with the Payroll Admin role in Cloud Payroll can now sync employee information without having the Full Administrator role in Cloud HR Management. https://biz.moneyforward.com/support/payroll/news/new-feature/20260825.htmlhttps://releaseradar.jp/en/updates/cloudsign/524fd459e2fd/https://releaseradar.jp/en/updates/cloudsign/524fd459e2fd/Sun, 16 Aug 2026 15:00:00 GMTSecurityAdministrators can restrict Web API users and manage client ID issuance, deletion, and audit logging. ・You can now access the "Web API 設定" menu. ・You can now view and delete client ID holders. ・You can now select the client ID issuance method. ・Administrator operations are now recorded in the audit log. ・You can now send batch reminder emails to all recipients in an And-signature group. https://www.cloudsign.jp/releasenotes/202607_releasenote/https://releaseradar.jp/en/updates/line/ecdea045fc23/https://releaseradar.jp/en/updates/line/ecdea045fc23/Sun, 16 Aug 2026 15:00:00 GMTSecurityLIFF v2.30.0 added arguments to three friendship and permission methods, but was later deprecated due to a security issue with usage restrictions planned. ・LIFF v2.30.0 added argument support to liff.permission.requestAll(), liff.getFriendship(), and liff.requestFriendship() when multiple accounts are enabled on a LINE MINI App channel. ・LIFF v2.30.0 was later deprecated due to a bug with potential security impact. ・Usage restrictions on older LIFF SDK versions from v2.20.0 to v2.31.0 are planned around November 24, 2026. ・Apps using the CDN edge path are updated automatically, while npm or yarn users update the @line/liff package. https://developers.line.biz/ja/news/2026/08/17/release-liff-2-30-0/https://releaseradar.jp/en/updates/komoju/34537a9a2b3d/https://releaseradar.jp/en/updates/komoju/34537a9a2b3d/Fri, 31 Jul 2026 15:00:00 GMTSecurity3D Secure authentication has migrated to Netcetera. https://docs.komoju.com/ja/changelog#:~:text=3D%E3%82%BB%E3%82%AD%E3%83%A5%E3%82%A2%E8%AA%8D%E8%A8%BC%E3%81%AENetcetera%E3%81%B8%E3%81%AE%E7%A7%BB%E8%A1%8Chttps://releaseradar.jp/en/updates/line/475f4c4b1a55/https://releaseradar.jp/en/updates/line/475f4c4b1a55/Thu, 30 Jul 2026 15:00:00 GMTSecurityLIFF v2.29.2 was released with internal SDK behavior changes, then deprecated due to a security issue with usage restrictions planned. ・LIFF v2.29.2 changed internal LIFF SDK behavior without functional changes. ・LIFF v2.29.2 was deprecated after a bug with potential security impact was confirmed. ・Usage restrictions for LIFF SDK versions v2.20.0 through v2.31.0 are planned around November 24, 2026. https://developers.line.biz/ja/news/2026/07/31/release-liff-2-29-2/https://releaseradar.jp/en/updates/microcms/b5f840c74f21/https://releaseradar.jp/en/updates/microcms/b5f840c74f21/Thu, 02 Jul 2026 15:00:00 GMTSecurityYou can now restrict the environments members can access by managing read permissions for each environment in role settings. https://blog.microcms.io/environments-read-permissions/https://releaseradar.jp/en/updates/line/f5dbb9b36ca0/https://releaseradar.jp/en/updates/line/f5dbb9b36ca0/Sun, 28 Jun 2026 15:00:00 GMTSecurityLIFF v2.29.1 was released with internal behavior changes, then deprecated due to a security issue with usage restrictions planned. ・LIFF v2.29.1 changed internal LIFF SDK behavior without changing features. ・LIFF v2.29.1 was deprecated after a bug with potential security impact was confirmed. ・Usage restrictions for LIFF SDK versions v2.20.0 to v2.31.0 are planned around November 24, 2026. ・CDN edge path users were updated to v2.29.1 automatically, while npm package users updated by installing @line/liff@2.29.1. https://developers.line.biz/ja/news/2026/06/29/release-liff-2-29-1/https://releaseradar.jp/en/updates/line/c2997f65ee76/https://releaseradar.jp/en/updates/line/c2997f65ee76/Tue, 12 May 2026 15:00:00 GMTSecurityOlder LIFF SDK versions face planned usage restrictions due to vulnerabilities, requiring an update to v2.31.1 or later. ・Usage restrictions for LIFF SDK v2.20.0 to v2.31.0 are scheduled around November 24, 2026. ・LIFF v2.29.0 is deprecated due to a defect that may have security implications. ・LIFF v2.29.0 changed internal behavior without altering functionality. https://developers.line.biz/ja/news/2026/05/13/release-liff-2-29-0/https://releaseradar.jp/en/updates/komoju/af79f5163a7e/https://releaseradar.jp/en/updates/komoju/af79f5163a7e/Wed, 15 Apr 2026 15:00:00 GMTSecurityHigh-risk card payments now prompt for 3D Secure authentication instead of being automatically rejected, allowing payment completion. https://docs.komoju.com/ja/changelog#:~:text=%E9%AB%98%E3%83%AA%E3%82%B9%E3%82%AF%E5%88%A4%E5%AE%9A%E3%82%AB%E3%83%BC%E3%83%89%E6%B1%BA%E6%B8%88%E3%81%AB%E3%81%8A%E3%81%91%E3%82%8B3D%E3%82%BB%E3%82%AD%E3%83%A5%E3%82%A2%E8%AA%8D%E8%A8%BC%E3%81%B8%E3%81%AE%E3%83%95%E3%82%A9%E3%83%BC%E3%83%AB%E3%83%90%E3%83%83%E3%82%AFhttps://releaseradar.jp/en/updates/kintone/9e1e3fb6bebe/https://releaseradar.jp/en/updates/kintone/9e1e3fb6bebe/Tue, 31 Mar 2026 15:00:00 GMTSecurityFollowing a compromise in the axios dependency of kintone npm packages, kintone issued an advisory and released version-pinned patches. ・Environments resolving 7 kintone npm packages between 9:21 and 12:15 JST on March 31, 2026 may have installed compromised axios@1.14.1 or axios@0.30.4. ・Running @kintone/cli with plugin init --template typescript or @kintone/create-plugin with --template modern is also affected because it downloads @kintone/rest-api-client internally. ・Starting an MCP server configured with npx @kintone/mcp-server may also be affected because it downloads the package at startup. ・Patch versions pinning the axios dependency, including @kintone/rest-api-client 6.1.4 and @kintone/cli v1.19.2, were released as a preventive measure. https://cybozu.dev/ja/kintone/news/api-updates/2026-03-axios-patch/https://releaseradar.jp/en/updates/line/9d63492296f8/https://releaseradar.jp/en/updates/line/9d63492296f8/Mon, 23 Mar 2026 15:00:00 GMTSecurityWhile you can now prompt users to add friends in LIFF v2.28.0, older SDK versions will be restricted due to a security vulnerability. ・Usage restrictions for older LIFF SDK versions (v2.20.0 to v2.31.0) are scheduled for around November 24, 2026. ・LIFF v2.28.0 has been deprecated due to a bug with potential security impacts. ・You can now use liff.requestFriendship() to display a subwindow prompting users to add the LINE Official Account as a friend or unblock it. https://developers.line.biz/ja/news/2026/03/24/release-liff-2-28-0/https://releaseradar.jp/en/updates/gmosign/13b1730099b4/https://releaseradar.jp/en/updates/gmosign/13b1730099b4/Tue, 25 Nov 2025 15:00:00 GMTSecurityDue to encryption specification changes, communication with GMO Sign may fail on devices running older operating systems or browsers. ・The specification change is scheduled for December 10, 2025, from 12:00 to 13:00. ・Communication may fail on devices running versions prior to IE/Win8.1, Safari 8/OS X 10.10, Android 4.3.1, or iOS 8. https://www.gmosign.com/news/detail?no=89517https://releaseradar.jp/en/updates/gmosign/91be19d571fa/https://releaseradar.jp/en/updates/gmosign/91be19d571fa/Thu, 30 Oct 2025 15:00:00 GMTSecurityGMO Sign is updating its communication encryption specifications, and older environments may lose access. ・Encryption specifications for the Web browser version will be updated on November 19, 2025. ・Encryption specifications for API integrations will be updated on November 10, 2025, for Sandbox and January 19, 2026, for Production. ・Access may become unavailable in some environments using older operating systems, browsers, or API clients. https://www.gmosign.com/news/detail?no=89098https://releaseradar.jp/en/updates/microcms/ee9aa131cc20/https://releaseradar.jp/en/updates/microcms/ee9aa131cc20/Wed, 08 Oct 2025 15:00:00 GMTSecurityThe specifications for roles change alongside an update to the review feature. https://blog.microcms.io/review-role-spec-change/https://releaseradar.jp/en/updates/gmosign/4b04efdd48d6/https://releaseradar.jp/en/updates/gmosign/4b04efdd48d6/Tue, 26 Aug 2025 15:00:00 GMTSecurityEmails sent from GMO Sign now display the official logo via BIMI and VMC, helping reduce spoofing and spam misdetection risks. ・Applies to sender addresses such as noreply@gmosign.com and @cs.gmosign.com. ・As of August 2025, the official logo is displayed when received in Gmail and Fastmail. ・Reduces the risk of signature request emails being falsely blocked by recipient security filters. https://www.gmosign.com/news/detail?no=88383https://releaseradar.jp/en/updates/microcms/fe9dabb8a281/https://releaseradar.jp/en/updates/microcms/fe9dabb8a281/Sun, 30 Jun 2024 15:00:00 GMTSecurityYou can now set detailed permissions for content. https://blog.microcms.io/role-permission-detailed/