ISL Conference Proxy 5.0.2533.91 for Windows and Linux (2026-02-24)

libxslt was upgraded to version 1.1.45.

Go was upgraded to 1.24.13.

OpenSSL was updated to 3.0.19.

Legacy U2F authentication and registration were disabled.

User's password storage (hash of password in DB) is now automatically updated on successful login when scheme, number of islhash1 rounds or salt size is larger than current. Storage strength is only increased and never lowered because maximum of current value (salt size or rounds) and current setting is used when upgrading.

Support for signing with authenticode on remote ISL Conference Proxy was added. Remote authenticode is enabled when an encrypted base64 blob with remote metainfo is present in license field "Microsoft Authenticode" or "Microsoft Authenticode v2", or in a setting "Use authenticode packed parameters (BASE64)".

When ICP is performing remote code signing (acting as RCS server) it now adds client ICPs integrator key and current runtime id to codesigned executable. This info can be used to determine on whose behalf this executable was signed, this can be checked in final executable and also in programs unpacked folder in "rcs.ini" file. When executable was signed locally these keys are not set, file is empty.

Packet cache in folder "packetstemp" now uses two types of entries. Short term entries are treated same as before and are deleted on ICP restart while long term cache (prefixed with "lt_") remains even after restart. In case of unclean restart also long term cache is cleared. New setting was added to "/conf -> Configuration -> Advanced -> Performance" to control packet cache size: "Packet generator file cache size limit in MB".
Existing setting "Packet generator minimum cache time in seconds" was removed and this is no longer used, there is no minimum retention time for cache items.

New file storage was added: "Translations (archive)". This is only shown when ICP has "Allow remote authenticode clients" enabled. This storage contains archive (all available) translation files that are used when performing remote code sign (RCS) operations. Client ICP will only send translation file name, actual translation used is from the archive on RCS server. Translations are cached on RCS server, cache size is controlled by the setting (default 100), only latest used translations are kept when cache is overflown.
Translations archive is filled when selecting "Install all" in Online update. This will install all available translation files for module/base to archive (only when "Allow remote authenticode clients" is enabled).

Additional limitations and sanitizing were added to zip2minitar. Number of extracted files is now limited to 255 and maximum total unpacked size is limited to 64 MB.

New permission 'Allow "Log in with browser" in native applications' was added to /conf -> Security. When enabled, users can use the "Log in with browser" 2FA login method to log in to application through their browser. This option is available when the user has Passkey(s) configured, but the application or operating system does not support them.

In previous version when program executable generation fails, error 500 was shown. This was redesigned and more informative error page with a retry button was added.

New integrator endpoint "integrator/remote_authenticode/add/1" was added, which creates an integrator with RCS capabilities and generates the corresponding license blob. The created integrator has the "remote_authenticode_client" right granted and expects the JWT requests to be signed by the provided private key.

Support for general (platform, cross-platform(USB, BT, NFC)) passkey support for usage in 2FA was added to ICP login. New passkeys management dashboard was added, available at: "Security -> 2-Step Verification -> Passkey".
The dashboard has the following features:

• List Passkeys: New webapi2 method "security/login/tfa/passkey/list/1" is used to list user's registered passkeys.
• Edit Passkey: Passkeys description can be updated using existing webapi2 "security/login/tfa/u2f/description/update/1" method.
• Remove Passkey: Passkeys can be deleted using existing webapi2 "security/login/tfa/u2f/remove/1". As before, removing the last passkey is rejected in case the user does not have an alternative 2FA login method set-up. In this case user is prompted to turn off 2FA to remove the last passkey.
• Set as default 2FA method: As before Passkeys can be set as default 2FA login method using existing webapi2 "security/login/tfa/method/default/set/1" method.
• Create New Passkey: The registration of new passkey flow has been redesigned to a modal flow, where user selects type of Passkey to create and its description. Passkeys can now be registered using platform authenticators (e.g. Windows Hello, password manager browser extension, ...) or cross platform authenticators (e.g. Security Keys or mobile devices).

Text "Leave" was removed from Leave button in the top bar of ISL Meeting, together with updated SVG icon.

New option "Install all without module" was added to Online update actions, when ISL Conference Proxy is running in RCS mode. This option will install everything but module itself:

• all programs
• all translations for the archive (but not module translation)
• all plugins
• all actions

New setting "Allowed program download entry points" was added to /conf -> Security, that can be used to control which program download entry points are allowed:

• "Allow all": default, all entry points are allowed
• "Allow only remote authenticode": only "/users/programs/asset/<name>.program/remote_authenticode.bin" entry point is allowed (used for RCS)

Default islhash1 number of rounds was raised from 10k to 210k.

New setting "Remote authenticode program download entry point base URL" was added to "/conf -> Security -> Authenticode" that can be used to control the remote authenticode endpoint base URL, returned by webapi "integrator/remote_authenticode/token/make/1" to RCS clients. If setting is empty (which is default), ICP's public address is used, same as before.

Support for passkeys as 2fa method was added to v2400 web template.

In previous versions using U2F authentication standard as 2FA (Two-factor authentication) method would fail on some browsers, as browsers have deprecated U2F support. This was redesigned, legacy U2F authentication standard was replaced with WebAuthn and issue should not happen anymore.

The defect was fixed.

Deprecated duo-labs/webauthn lib was replaced with go-webauthn/webauthn.

In previous version WebView window in ISL Light application stayed open when user logged out. This was redesigned and `handleClosing` has been refactored to include an option to force closing of the window, which allows ISL Light to close Webview window on log out.

The defect was fixed.

In previous versions syntax error could be shown in error reporting in ISL AlwaysOn module. This was redesigned and issue should not happen anymore.

The defect was fixed.

In previous version it was not possible to move the miniplayer window using touch input (or the movement was very jittery). Computation of coordinates was redesigned and issue should not happen anymore.

The defect was fixed.

In previous version missing import was preventing correct error to be shown. This was redesigned, missing imports were added and issue should not happen anymore.

The defect was fixed.

In previous version customized icons for macOS applications were not displayed correctly in settings, because image tool only generated macOS icons in PNG format. This was redesigned, smaller icons are now in RGB + mask format and issue should not happen anymore.

The defect was fixed.

In previous version user sometimes did not hear audio streams that were active before he joined. This was redesigned and issue should not happen anymore.

The defect was fixed.

In previous versions if attempt of code sign operation already managed to create final file but failed later, caused all subsequent retries to fail, as file already existed. This was redesigned, temporary target is removed and issue should not happen anymore.

The defect was fixed.

In previous version spotlight camera stream sometimes did not resize correctly and camera stream was off screen. This was redesigned and camera stream should now be correctly resized.

The defect was fixed.