InterformNG2 4.4.0 was released on 31-08-2026. It carries 215 changes, and most of them are about control - who can reach what, from where, and with which credentials.
If your IT department sends you a security questionnaire once a year, this is the release that answers most of it. There are also two features customers have been asking for directly, and seven things to check before you upgrade. The full release log is on the Help Center; this is the short version.
Security comes first in this release
Secrets held in settings and workflows are now encrypted with AES-256. Values encrypted with AES-128 stay readable, so nothing stops working when you upgrade. A secret tied to a URL is bound to that URL and cannot be decrypted with a different one.
Three new controls sit with the System Admin:
- Native command execution. Off by default. It gates the “Execute native O/S command” component.
- Outbound connections. Switches off all, or some, of the components that make outbound network connections - HTTP and REST, FTP and SMB transfer, message queues, the connectors, e-mail in and out, socket and LPD printing. A blocked component shows as “blocked by security” in the workflow designer.
- Filesystem allow-list. When direct file access is allowed, this lists the paths a workflow may reach. Anything outside the list is blocked.
User passwords must now be at least 12 characters, and commonly used passwords are rejected. On a new installation the default “admin” and “default” users start with a temporary password and are forced to change it at first sign-on.
One point worth being plain about: these controls are system-wide and administrator-only, and they change nothing until someone configures them. Upgrading gives you the controls. Deciding how tightly to set them is a conversation with your administrator, and the Guide for Secure Configuration in the Help Center walks through it.
Two fixes in this release will matter to specific customers straight away. Sign-in through Entra ID or OIDC now falls back to the “upn” claim when “preferred_username” is absent, instead of failing. And importing printer definitions with an encrypted password now drops that password when it was encrypted with a key from a different tenant or installation, rather than leaving the printer list in a bad state.
Two more security changes to note: password export decryption has been removed, and the audit log now records connection tests made from tenant settings. HTTPS certificate expiry raises a notification and an e-mail warning, and for a certificate on a load balancer you can enter the expiry date in system settings to get the same warning.
If you are filling in a security questionnaire, ask us for the Software Bill of Materials and the Security Remediation Attestation. That is a faster route than working through individual fixes.
One installation, several IBM i systems
A single InterformNG2 installation can now connect to more than one IBM i system. Each connection is named, the connections live in their own system settings group, and a workflow component or a printer picks the connection it uses.
Two customers asked for this independently. Both were facing a second installation to licence, patch and monitor purely because they had a second IBM i system. If that describes your setup, you now have a reason to consolidate.
Two things to know. The connections are defined at system level rather than per tenant, and no maximum number is documented.
Alongside it, “IBM i Call Program” now supports up to 20 input parameters and 20 return parameters, both raised from 10. Workflows using 10 or fewer are unaffected. A program that needs more than 10 has to be changed and recompiled on the IBM i, and the original program object stays in place so existing installations keep running.
Modern authentication for incoming e-mail
E-mail server input can now receive mail through the MS Graph API, and IMAP input can authenticate with OAuth2. Outgoing mail is unchanged. The “To email server” component also accepts an EML payload now.
If your e-mail-driven workflows still sign in with a user name and password, this is the supported way off it. Your identity team will need to create an app registration with the right permissions - talk to us or to your partner about what that involves in your environment.
InterformNG2 as a remote output client
An InterformNG2 installation can now act as the remote output client for another InterformNG2 installation. An Entra ID app registration can be used for remote output notifications.
That opens a central-plus-satellite print setup for organisations with sites that need local printing and central control. It is an additional option: the standalone remote output client is not withdrawn.
The designers are now interactive
This is the part your template team touches every day.
The transformation designer has an interactive result view - click an element in the result and see it in context - a three-panel split of sample input, transformation and result, and validation of the transformation against Schematron, XSL or XSD. The Excel designer also gained an interactive result view, along with working cut, copy and paste shortcuts. In the template designer, the result view supports multi-selection by dragging a rectangle, table rows copy with their borders and colours, and the last edited field is reselected when you reopen a template.
One table change deserves its own line. Repeated header rows are now only added to a page if at least one regular row fits with them. A manufacturer had been hand-adjusting every outgoing quotation because header rows were landing at the foot of one page with the detail rows pushed to the next. That manual step is gone.
Answering “why is this template slow”
The template designer can now produce a performance report giving the count and timings of every XPath expression it runs. A slow template stops being a support ticket and becomes something you can diagnose yourself. The XML usage report can also be exported to a file now.
Document generation from templates using automatic page overflow was also improved. The case behind that work was documents of 1,000 pages and more using page overflow without a page break. We have not published a before-and-after figure, so treat it as an improvement rather than a number.
Also in the release
New “AES encrypt/decrypt” and “RSA-OAEP key wrap” workflow components, added to support Poland’s Krajowy System e-Faktur (KSeF), and a BASE64 option on “Calculate checksum”. These are cryptographic building blocks: KSeF authentication and submission are not part of 4.4.0. If e-invoicing is on your roadmap, the e-invoicing page covers the formats InterformNG2 handles today.
Also: an AES-256 option on the PDF protect and restrict component. JavaScript files can be edited in the library text editor. Selected resources can be exported directly from the library, and the transform library accepts uploaded XML files. System log files can be exported from the admin log viewer. A new logging option, “Log workflow input on error”, stores the workflow input payload in the job log when a workflow fails. Tenant selection at sign-on has a search function. PCL6 works for an unregistered printer using direct socket print. The global system settings “system” group is split into four - General and Administration, Workflow Capabilities, Maintenance, and IBM i Connection.
Before you upgrade
Seven items change behaviour on an existing installation. This is the list to check first, and the release log carries the detail.
- IBM i command line input. The user must now have the Webservice role. It was previously only suggested. Check the role on that user before upgrading.
- Native command execution is disabled by default. Enable it, or the “Execute native O/S command” component stops working.
- REST webservice Basic now requires a password of at least 8 characters. Before installing, add a user name and password to every workflow using this component and check the calling system works with them. A workflow left without credentials, or with a shorter password, stops working after the upgrade.
- Allow database selects now defaults to disabled. It was enabled before. Enable it if any workflow or template uses ng:databaseLookup, “From database with custom SQL” or “Database SQL Select”.
- Secrets are encrypted with a method earlier releases cannot read. On a rollback to an earlier version, re-enter every secret that was changed under 4.4.0.
- Linux installations need a change to the ExecStart property in the service file. Follow the Linux installation guide before starting the service.
- Multi-server setups using built-in authentication get a new keystore on first start. The keystore, the interformng2.privateKey environment variable and the ng2.keystore.password property must be identical on every server in the environment. Copy them from one server to the others.
Getting 4.4.0
The full release notes are in the Release log on the Help Center. Sign in there to download the release, or talk to your Interform partner. If you want to walk through the seven items above against your own configuration, ask us - that is a short conversation and it saves a long one later.