XPressEntry 3.7.7699

This release focuses on muster and occupancy accuracy, single sign-on, and keeping every open

client in step with the server. It also adds two new access control integrations and replaces the

facial recognition engine.

Highlights

Muster and occupancy counts are accurate again

Several separate causes were making headcounts wrong. Re-badged users were dropped from occupancy by

a lookup filter, soft-deleted rows were still being counted, OnGuard occupancy was compared against

the wrong timestamp, and deleting a user through a data manager left their occupancy row behind.

Live muster and occupancy updates now also carry the badge number and reader name.

OAuth and OIDC authentication

XPressEntry can authenticate against an OAuth or OIDC provider, with scope, audience, issuer and

refresh token settings. LDAP and OAuth secrets are encrypted at rest, and provider changes take

effect without a restart.

Push-to-Talk

Readers can join named audio channels and talk to one another, with one speaker at a time per

channel. Channels and their reader assignments are managed from a new setup screen that shows which

readers are online and who is currently speaking.

A new facial recognition engine

Facial recognition now runs on telaeris_vision with a lighter, more accurate model and aligned

embeddings, and ships in the installer. The separate FaceRecognition application has been removed.

Two new integrations

Avigilon Alta and DOORS.NET.

Security

• Fixed a SQL injection vulnerability in handheld badge enrollment.
• Fixed a SQL injection vulnerability in the equipment occupants endpoint.
• Credential hash comparison is constant-time.
• Fixed a path traversal vulnerability in upload handling.
• Reader credentials are generated with a cryptographically secure random number generator.
• LDAP and OAuth secrets are encrypted at rest.

Server

• Re-badged users are no longer dropped from occupancy, so muster counts include them.
• Soft-deleted occupancy rows are excluded from muster counts.
• Deleting a user through a data manager now clears their occupancy record.
• Live muster and occupancy updates include the badge number and reader name.
• Scans denied at a muster reader are flagged, so a user who was refused entry is not silently

counted.

• A new Past Muster form lets you review previous muster events.
• Muster and occupancy changes now push to open clients as they happen.
• The External Muster Activity Sync setting has been renamed and now defaults to Always.
• Reader profile data loads at startup, so the Muster node appears without opening settings first.
• Muster map default queries have been updated.
• Badges can no longer be saved with an expiration date before their activation date.
• Adding a new user no longer deletes the previous user's custom field values.
• Badge printing gained a print preview, and the badge printer list is populated correctly.
• Enrollment forms use the configured thumbnail size and quality.
• Visitor and host checkboxes now behave as mutually exclusive toggles.
• Clicking Add New clears the selection in the left-hand list.
• Reader profiles gained an unauthorized user mode.
• The default Wiegand format is chosen from a list instead of typed free-hand.
• Reader names that collide are numbered from the name you provided.
• Reader validation and the occupancy Edit User screen were corrected, and the Random Badge

Challenge percentage is now described accurately.

• Deleting a timezone cascades to the records it owns instead of leaving orphans behind.
• Deleting and restoring records with dependents works correctly.
• Fixed errors on the Events page attendee list, including a crash when filtering.
• Map view summaries support a separate background colour, which is included when the map syncs.
• Map view objects can be excluded from the map, and the editor preview honours that setting.
• Zooming a map view no longer shows a stale image.
• Map views load correctly against older database schemas rather than failing outright.
• User and badge changes refresh in open clients immediately, including in a record that is already

open for editing.

• Settings and authentication provider changes apply in memory without a restart.
• Deleting a picture now propagates to handhelds.
• The "Settings Changed Externally" prompt no longer appears twice.
• Sync summaries can be purged automatically, keeping the table from growing without bound.
• Exporting sync summaries is paged, so large exports no longer time out at 30 seconds.
• A finished sync appears at the top of the grid as it completes, without losing your selection.
• Login errors are shown on the login screen instead of being discarded.
• Fixed an intermittent login failure at startup when the service port was not yet listening.
• Fixed login for non-joined domains.
• Legacy HTTP authentication settings are supported for existing deployments.
• Settings import and export now cover custom fields, OAuth and LDAP configuration.
• All settings are editable from the Config Tool.
• Sync buttons are disabled when their corresponding sync option is unchecked.
• The Data Manager node reappears after clearing a settings filter.
• The custom display logo picker accepts PNG files and rejects oversized images.
• Custom field values populate correctly after a data manager sync writes new records.
• Fixed three faults in the reader connection pipeline: the listener could stop accepting new

reader connections, reader status updates could be dropped without warning, and the reader status

screen could freeze.

• The server no longer halts on debug break statements left in production code paths.
• Data manager log output no longer degrades the interface during heavy sync activity.
• Large database imports no longer time out.
• Disconnected clients are evicted correctly instead of blocking notifications to everyone else.
• Errors now raise general alarms.
• Updated XPressReports to resolve an authentication incompatibility that prevented reports from

loading.

Config Tool / Database

• The Config Tool is now authoritative over the web console's environment file, rather than

depending on the installer to write it.

• More web console settings are editable, including mail settings, TLS options, public scheme and

port.

• Email settings configured in XPressEntry are synced to the web console.
• Status messages appear in an inline banner instead of interrupting with pop-up dialogs.
• The collation check no longer blocks on a minor collation difference, warning instead.
• Fixed web console configuration generation when the install path contains spaces.
• Fixed schema mismatches on SQL Server installations using a non-default schema.
• SQL Server connections can require encryption, with a Trust Server Certificate option.
• Added a unique index on time card activities.
• Database schema kept in step with the web console for employee type, default work codes and time

card notes.

• Fixed a database migration that could fail when run twice.

Reporting

• Added a Logins pivot table.
• Fixed percentage calculations, timezone handling and password masking in the diagnostic report.

Other Fixes

• The Messages feature has been removed.
• Manual Enter/Exit Users menu items and forms have been removed.
• The deprecated legacy HTTP server has been removed. Deployments using it should move to the

current API.

• The standalone FaceRecognition application has been removed, replaced by the telaeris_vision

engine described above.

Integrations

OnGuard

• Fixed a timeout that went unhandled during session token checks.
• Occupancy sync is limited to the activity look-back window.
• Occupancy timestamp handling corrected, fixing headcount discrepancies.
• Software events no longer write badge activities when activity sync is turned off.
• Access levels can be filtered by panel selection, and the panel filter can be searched by name.
• Durable OpenAccess subscriptions are removed on permanent teardown.
• Activity and occupancy options were consolidated in the setup screen, removing duplicate

checkboxes.

• Fixed subscription filtering and casing errors in hot-event recovery.
• A full sync no longer aborts when a badge download returns partial results.

Brivo

• Cardholders can be filtered by site access, and unknown users can be pulled on scan.
• Added site partitioning and user custom field mapping.
• Activity and occupancy timestamps display in local time rather than UTC.
• Fixed a crash during activity sync when mapping activity data.
• Token refresh recovers on its own after an invalid grant.

CCURE 9000

• Clearance doors load correctly.
• Fixed a crash during setup when a custom field had an empty external ID.
• The embedded CCURE Connector Service has been removed; the REST connection now defaults to port

9501.

• Installer fixes for shipped components.

Avigilon Unity (ACM)

• Optionally pulse the door relay on a handheld scan, with a muster pulse toggle and per-door relay

filter.

• Fixed activity polling missing scans that occurred on the watermark second.

Avigilon Alta

• New data manager, with MQTT support and activity sync.

Galaxy

• Fixed expiration dates not being sent.
• Fixed activity sync never completing.
• Fixed crashes caused by activity timestamps and empty muster reader IDs.

Honeywell Pro-Watch

• Support for Pro-Watch API 7.0, including live events and data change notifications.
• Improved reliability under load and safer handling of sync data.
• Added credential protection on login for both DTU and REST.
• Handheld button behaviour is configurable from the reader profile.
• With No Groups Data enabled, full and partial syncs no longer create group memberships.

Autec

• Fixed a sync delay and an authentication retry failure.
• Profiles sync from all CMM panels rather than masters only.
• Improved error reporting and login refresh.

AEOS

• Fixed user and badge event parsing.
• Fixed settings being corrupted during migration.

BioStar

• User start and end dates and badge expiry dates map correctly.
• Fixed date parsing on systems with a non-English regional format.

Genetec

• Fixed a failure on systems with a conflicting Newtonsoft.Json version installed.
• Fixed RIO login sending credentials with the wrong content type.

Amadeus

• Card codes are assigned to the badge number exactly as provided.
• Fixed event payload handling and cardholder card retrieval.

Frontier

• Muster scans are sent as egress on single-sided doors.

RS2

• Auto-exit hours are checked before occupancy is updated.

Spica

• Fixed access denials being recorded as granted.
• Fixed crashes during activity mapping and occupancy updates.
• Removed a SQL injection risk in event processing and duplicate-activity checks.
• A failed sync now reports failure instead of always reporting success.
• Fixed a potential deadlock during status checks and a database connection leak while retrieving

activities.

Verkada

• Optional verbose API request and response logging for troubleshooting.

ZKTeco

• Kiosk settings for door unlock and Wiegand output.

DOORS.NET

• New integration.

What's Changed

New Features

• Add common biometric timeout
• Add constant-scanning option to biometric settings
• IDScan iOS License
• Rename MDM/Managed labels to SDM/Secure
• Facial Recognition Unknown User Message/Activity
• Add auto select mode for entry/exit and door font configuration
• Add deferred entry/exit setting
• Optimize agent markdowns
• OnGuard Device Translator REST API with Panic Alarms and Muster Activities
• Add name-based lookup option to reader profiles
• Sign deployed PS1 scripts and add SIGN_DLLS flag for conditional DLL signing
• Add ComboBox search/filter popup to CRUD forms (#2837)
• Add iOS-specific IDScan MRZ license support
• Add Gallagher Competency check
• Reader profile settings for handheld error logging

Server/Client Updates

• Stop double-escaping search filter ΓÇö breaks names with apostrophes

Onguard Integration Updates

• Data Manager Settings Normalization and All Settings Import/Export via JSON
• Fix for Indonesia date formatting and number formatting
• Add diagnostic report generation to Config Tool and Server
• Hotfix onguard process updated user images
• Fixes re-mapping issues for PicturesUpdatedHandler
• Panic Alarms and Muster Activities via Device Translator Pipeline
• OAuth and JWT Authentication
• Short Circuit Logic Checks of OrElse / AndAlso / Null Checks
• Fix NuGet package version mismatches across 20 projects
• Fix DM disable step escaping and target database
• Fix infinite activity loop possibility when OnGuard Device Translator is enabled
• Filter pending activities by panel ID for OnGuard translator
• OnGuard: Add panel filter for reader sync + bulk insert temp tables
• Support Generic OAuth Providers
• Update all Telaeris NuGet packages to signed versions
• Add DataManager settings to XPressEntryConfigTool
• OnGuard Deleted Records Fixes

CCURE 9000 Integration Updates

• CCURERest Group Readers mapping throwing exception fix
• Fixed IIF Short Circuit Logic throughout code and Stop on unexpected conditions in CCURE9000 and PacomGMS and cExternalDataManager
• HOTFIX: Fix Decimal/Double culture-sensitive save and NumericUpDown bounds

AMAG Integration Updates

• Use NullToInteger for comparison in GetTimeCodes

Amadeus Integration Updates

• Amadeus integration

AEOS Integration Updates

• Fix incorrect null checks on reference types causing false matches

Apollo Integration Updates

• Prowatch badge data parsing fix and Updates in apollo event base 64 data processing
• Apollo Cardholder Badge and Access Level Live Event Update Fix

Brivo Integration Updates

• Fix Binding Redirects and DLL references

DSX Integration Updates

• DSX Integration Fix ΓÇô Door/Reader Mapping and Muster Push Error

Frontier Integration Updates

• Frontier Data Manager: Setup guide, bug fixes, and SSL checkbox
• HOTFIX: Fix Frontier DM timestamp parsing issue

Gallahger Integration Updates

• Fix for ever growing dmsyncsserver_logs table

Prowatch Integration Updates

• Prowatch api response parsing updates for version 6.5
• Prowatch update post event date format
• Update Prowatch reader event payload & logging
• Fix Prowatch POST activity datetime error and card disabled status is not updated
• Prowatch 6.5.2 Fixes
• Pro-Watch REST API - Treat 405 MethodNotAllowed as connection error
• ProWatch Occupancy map and SingalR updates
• Prowatch user last zone mapping fix
• Fix badge type parsing error in ProWatch mapping
• Prowatch SignalR closing and UDF fix
• Prowatch Rest Code Improvements and UDF Mapping Bug Fix
• Prowatch Rest Custom Badge Fields Data Mapping Fix
• Option to ignore Prowatch Badge api Filter

Kantech Integration Updates

• Kantech support multi-digit card info fields fix
• Add Support for all Kantech field types as custom field mappings
• Kantech Add omitted sender to get sites

Maxxess Integration Updates

• Fixed sender parameter bug in maxxess
• Added maxxess groups users sync to bPartial using reports
• allow partial to update groups users maxxess

S2 Integration Updates

• Optimize S2 large picture URL handling by extracting string operation outside retry loop
• S2 Large picture pull URL fix

Sipass Integration Updates

• SiPass DM HR API Multiple Login Fix

Velocity Integration Updates

• Velocity DM: custom ICredential -> BadgeData field mappings

RS2 Integration Updates

• RS2 REST - Added groups readers timezones to partial sync

Other Changes

• Spica Activity Sync DateTime Conversion Fix
• Fix for Negative Devices Count on Handheld Setup Wizard
• AEOS - Pagination in readers update and Custom sync support
• Rename XPressEntryDatabaseTool to XPressEntryConfigTool
• Fixed raised call for zones delete records in Saba
• Hotfix Spica DM Activity Sync
• Feature DM IDCube
• Genetec Installer Fix
• Use UTF-8 Base64 for reader profile JSON
• Skip null data manager settings on migration of data manager settings
• Update GitHub Actions workflow for PR notifications
• Add permissions for pull requests in workflow
• Genetec Installer properly copies SDK install files
• Refine unsupported SDM device handling
• Update all Telaeris.* NuGet packages to latest versions
• Web Console Roadrunner support
• Sync summaries filtering improvements
• Quick Fix for REST api table
• Fixes in Config Tool for RoadRunner
• Fix User Cache Issue with Handheld Sync
• Support manual credentials for LDAP connection
• Fix for validation color not saving
• Genetec Custom Fields to User standard field mapping fix
• Quote username and password
• Digitronica sync and software event fixes and re-sending activities
• Location Update Settings
• Guard Tour V2
• SCSMA Integration - Remove unnecessary error log on groups user mapping
• Elements integration
• Multiple Documentation Updates
• Fix SQL injection vulnerability in record cleanup and user import
• Fix SQL connection and reader leaks in PremiSys plugin
• Fix Google.Protobuf version mismatch in FaceRecognitionWorker
• Guard Tour Mode Enable in profile
• Fix crash in activity parser on malformed form fields
• Harden auto-exit processing: reentrancy, transaction safety, error handling, and related settings fixes
• Harden Jenkins pipeline: distinguish infra failures from test failures
• Fix WebSocket listener port leak and activity queue test failures
• Remove dead ADD_CREDENTIALS activity handler
• Add repo name to Teams notification
• Protect against disposed and duplicate QR form
• Fix frmMain refresh and top icon visibility after General Settings chΓǪ
• Avigilon Alta Data Manager
• Fix wrong sender parameter and missing sync cancellation in base data manager
• Fix user search returning no results with 20K+ users
• Update AI agent instructions and add line-ending normalization proposal
• Add OAuth Models
• Remove Telaeris.Authentication from Telaeris.Models packages
• Fix Jenkinsfile for multi-server builds
• Jenkinsfile updates for multi-server builds
• Diagnostic Zip UseZip64WhenSaving fix
• Update Telaeris.Controls and XPressReports packages
• Fix MSMQ processing stall when downstream callback throws
• Fix null reference when deleted timezone displayed in Groups form
• Fix XPE Client and Auth issues
• Sign WiX custom action DLLs to fix Defender ASR install blocks
• Add GlobalAssemblyInfo.cs to CustomActionStopXPE
• Made DM Sync Text box read only
• Sign tests/scripts/*.ps1 + per-build LocalDB share name (test-pipeline infra)
• Fix Sync summaries log growth
• Fix: Reader last-synced time displaying UTC instead of local time
• SCSMA - Add handheld name and GUID to activity send
• Add hidden CheckCertificateRevocation knob (fixes #2902)
• MorphoManager Integration
• Auto Exit: Include Badge ID and Badge No in Activity Record
• Refactoring for frmMain
• fix: DRY up ParseDigits ΓÇö consolidate duplicate declarations
• Jenkinsfile: workspace cleanup + reference-repo hang fix
• Refine .claude/ ignore so team-shared settings can be committed
• Fix user search timeout in frmAddEditInfo at 30K+ users
• fix: preserve Legacy reader created_at on update
• CI: dedicated XPETEST SQL Server test pipeline (split from PR-2739)
• Break apart HandleHandheldActivityRecord into focused sub-functions
• ci: collapse Require Checklist re-runs on PR body edits
• MFlex test data manager + Extract ExternalDataManager DLL
• fix: resolve WCF cert identity mismatch in Config Tool DM sync

Full Changelog: https://github.com/Telaeris/XPressEntry-Desktop/compare/3.7.7240...3.7.7454

What's Changed

New Features

• Added Sync Summaries for all Data Managers
• Improved Sync Processing Time for all Data Managers
• Added SDM Profiles
• Added max occupancy support to zones
• Migration Number is at 376

Onguard Integration Updates

• Fix for Software Events Processing out of Order

Genetec Integration Updates

• Prefix fixes for Supporting Multiple Data Managers

Kaba Exos Integration Updates

• Prefix fixes for Supporting Multiple Data Managers

OnGuard Integration Updates

• Fix for User UDFs not Mapping Properly

RS2 Integration Updates

• RS2 fix for badge activities with facility code -1

Spica Integration Updates

• Push Activities to Time API and Activity Sync Refactoring

Suprema Biostar Integration Updates

• Added user group name to external data for mapping groups to users better

Verkada Integration Updates

• Added user group name to external data

Other Changes

• Fix to avoid starting any Data Manager twice upon initial setup
• Added Multibranch Test Coverage

What's Changed

Final 3.6 Release

New Features

• Hindi and Polish Language Handheld Support
• Offline Handheld Alarms and Notifications
• Added DB Migration Logging
• Added muster site Client Setting
• Send Partition Data to Handhelds
• Facial Recognition
• Updated permissions for Data Editing based on Login
• MSMQ Processing Support for loop limit
• Activity History and Logs filtering fixes and max record limit
• Updated Max Min of Wipe Handheld Activities Older than X Minutes
• Remove user Occupancy update for invalid badge scan out of zone
• Credential Fix for Backwards Compatibility with old handhelds
• Fixed the missing logging for ReaderStream Connected/Disconnected
• Updates for Logins/Client Settings for Muster Dashboard
• Expiration Date Issues addressed in enrollment mode
• XPressEntry Installer stops programs automatically
• Badge Type form fixes for load and save records
• Fix for XPressEntryService not Stopping
• Expand Web Console certificate setup to work with any certificate
• Web Console support for LDAP and Maps
• Monitor Handheld Device Battery Level + Alarms
• LDAP/Active Directory Integration for User Logins
• MDM Mode

Onguard Integration Updates

• Onguard SRS Updated requirements for checking unfit status (?)
• Allow OnGuard Access Denied Events
• OnGuard Fingerprint and Badge Overrides
• Updated OnGuard badge override logic to always override
• Added filter for OnGuard Fingerprints and querying the BiometricBodyPart field from MMOBJS
• Truncating onguard invalid status override
• Updated Device Translator downloads available downloads.telaeris.com

Onguard Custom Features

• Onguard custom access levels assignments
• Onguard Hotfix vehicle and driver ids parsing
• Added Software Event Processing for Groups Vehicles Mapping

Genetec Integration Updates

• Genetec support multiple Cloudlink devices
• Added Genetec Custom Credential Field Mappings
• Genetec add visitors back to cardholder query
• Genetec multiple Cloudlink UI fixes and send muster scans
• Genetec send raw badge in place of non wiegand badge from search
• Genetec Remove expiration date from active badge
• Genetec Fix Setup RIO password overwrite bug
• Genetec Fix UDF load on setup form

CCURE 9000 Integration Updates

• CCUREREST single event processing and badge restoration bug fix
• CCUREREST Allow HTTPS for SignalR
• CCUREREST Software Event Reconnection Improvements
• CCUREREST Add Support for HTTPS
• Add full picture support for CCUREREST
• CCUREConnectorService Now using Signed Executable
• CCUREREST Fix image pull when missing full pictures setting

Prowatch Integration Updates

• ProwatchREST Add Custom Sync and Fix Pictures Sync

AEOS Integration Updates

• Fixed DateTime UTC conversation for group users
• Group User Mapping And Deletion
• Added Option to Only Single Process MSMQ Events
• Fix for Groups Users not being removed in a software event
• Fix for Muster Activity Push

Apollo Integration Updates

• events parsing fix with MSMQ and Activity Pull Updates
• Added Live data updates
• Fix for Apollo Post Activity Marked as Processed when APACS service is Off

Avigilon Integration Updates

• Fixed activity sync with loggeddateutc
• Avigilon time formatting fixed to use UTC

Galaxy Integration Updates

• Galaxy REST Data Manager Data Change Polling
• Changed local time conversion to use server timezone specified from DM Settings
• Prevent User Deletion on Users Pull API Error
• Galaxy - Support activity datetime conversion using reader timezone

Gallahger Integration Updates

• Gallagher Partner Token Implementation
• Added legacy gallagher license option

Kantech Integration Updates

• Kantech Global Support for reader mappings
• Kantech updates for Global Edition and door / zones synchronization
• Kantech activity sync and door sync updates

Velocity Integration Updates

• Added Occupancy override to enable checkbox
• Added Support for Software Events and Occupancy Push

RS2 Integration Updates

• RS2Rest Partial Sync Filter Fix
• Optimize RS2Rest Transaction Synchronization
• Fix for RS2 REST activity mapping
• Updated RS2 REST post to use Long instead of Integer to support PIV card

Feenics Integration Updates

• Feenics Integration Refresh

XMP Babylon/Siport Integration Updates

• AUTEC setup form missing credentials fix
• AUTEC Correct datetime format for picture sync
• Reader Profile Settings updates for Live validation mode
• AUTEC Server updates for CMM sync

ZKTeco Integration Updates

• Added optional Get Photos to the ZKTeco API List call. Defaults to True
• Filter ZKTeco Person List by authAreaId
• ZKTeco Processing Pictures outside of the main loop

Spica Integration Updates

• Changed parameter for activity push to Spica DM
• Fix for Activity Sync
• Added Employee ID Mapping
• implement udf mapping
• Spica Occupancy Update Fixes

Verkada Integration Updates

• Added "Add Activity" Code

DSX Integration Updates

• DSX Post Data and Door Mapping Fixes

Maxxess Integration Updates

• Maxxess Data Sync optimization

Sipass Integration Updates

• Sipass Add Activity To Audit log

Suprema Biostar Integration Updates

• Biostar User Group and Activity Mappin fixes

Other Changes

• Fix issues in user picture template generation - Thumbnail generation 10x faster
• Fixes issue where you can delete the last admin/login
• Added Token Refresh for TimeAPI
• Add Export SQL Script and Cleanup old Web Occupancy
• Bumped XPressReports for bugfix
• Activity History DateTime Filter Fix
• Migrations for Web Release 1.3.4