V44 Release Notes

44.0.2 (28 Oct 2026)

Security fix

Critical security fix
This release version addresses CVE-2026-111497. Upgrade affected on-premise deployments as soon as possible.

Brotli decompression (CVE-2026-111497) — The system now uses version 1.2.1 of the Brotli decompression library, which rejects malformed compressed data. This update also applies to the Brotli library that the system uses to process PDF files. Previously, specially crafted Brotli data could stop a process, expose data in memory, or, in some cases, run unauthorized code. The cause is a security vulnerability in the open-source Brotli library (CVE-2026-111497, also called HTTP2Shell) that affects many software products.

The vulnerability affects instances that do any of the following:

Process PDF files, including PDF files received through the Email Listener.
Use Supervision task notifications. Only API users can set the notification URL.
Retrieve files through the flow run data API (/api/v5/flow_runs/<id>/data). This API requires authentication.
Receive responses from other HTTP endpoints that an administrator configures, such as identity providers or another instance connected to the Artifacts Repository. Members of the Artifacts managers group can also select that instance.

Deployment guidance
SaaS deployments: No action is required. Hyperscience deploys this update to supported SaaS versions.
Kubernetes and Docker/Podman deployments: Upgrade to this version as soon as possible. Until you complete the upgrade, apply the temporary mitigations below.

Temporarily disable automated external ingestion channels, such as Email Listeners, where PDF files originate. If continuous document intake is required, route incoming files through an upstream security gateway or sandbox to scan and validate the documents.
Send Supervision task notifications only to trusted endpoints, or turn off these notifications.
Give API access only to trusted users.
Keep administrator-configured endpoints, including Artifacts Repository connections, on trusted servers over HTTPS, and limit the Artifacts managers group to trusted users.

Learn more in our Security Advisory article.

Upgrades

Fixed

Copying user-installed Python packages to a newer Python version — When an upgrade adds a newer Python version, Hyperscience no longer copies user-installed packages that are built for a different Python version. Previously, these packages were copied and shown as installed on the Python Packages page, but flows that used them failed with an ImportError or ModuleNotFoundError. The upgrade now lists the packages it did not copy in a warning. After upgrading, upload a build of each listed package for the newer Python version (Flows > Python Packages). For more information, see Developing Flows and contact your Hyperscience representative

Layouts

Fixed

Additional safeguards preserve existing field notes in Structured layouts — After upgrading to 43.2.4, field notes, including VLM prompts, remain available when a layout is viewed, edited, copied, or added to a release. In earlier affected versions, these actions could make field notes appear blank or remove them. Table notes were not affected. The upgrade does not automatically restore notes removed before v43.2.4. Notes still available in a working layout version may be recoverable. For more information, file a Support ticket.

44.0.1 (07 Oct 2026)

Highlights

Hyperscience v44.0.1 gives you a clearer view of your flows and more flexibility in how they connect to external systems. It also makes models easier to manage and updates the Flows SDK. Read on for a closer look at what’s new.

Flows

New

Address Validation subflow — Hyperscience v44.0.1 introduces a reusable Address Validation subflow. It checks whether an address is a real, recognized location by comparing the address against an authoritative data source.

Addresses are core data in many document processes:

Invoices contain bill-to, ship-to, supplier, and remit-to addresses.
Transportation and logistics processes depend on correct addresses across all of the documents in a shipment.
If an extracted address is incorrect, the error moves downstream and can send shipments to the wrong location.

The subflow sends each address field in a submission to the Google Address Validation API. Then, it adds an is_deliverable value to each field that it validates:

true — Google accepts the address as it is written on the document.
false — Google rejects the address, recommends human review, or accepts the address only after it replaces or spell-corrects a part of it.
null — The subflow could not get a response from Google for the field. The submission continues to process.

Using the Address Validation Subflow gives you the following benefits:

Validate the document as written — A true value confirms the address on the document, not a version Google corrected. For example, if Google replaces the ZIP code, the value is false.
Validation after Supervision — The subflow runs after Flexible Extraction, so it also validates addresses that keyers identify or correct.
Results in the output — The is_deliverable value stays on each address field in the completed submission. You can use it in downstream logic and integrations.
Reuse in other flows — The subflow takes a submission as input and returns a submission as output, so you can add it to other flows.

To configure the subflow, use two settings in the flow:

Address Fields to Validate and Google Address Validation API key.
You must supply a Google Maps Platform API key with the Address Validation API enabled.
- Set the key before you process submissions.
- Your instance must be able to connect to Google.

To learn more, contact your Hyperscience representative.

View For Each blocks in Flow Studio and Flow Runs — Flow Studio now has a dedicated For Each block that shows the block or subflow that gets executed for each item in a collection.

In Flow Runs, the For Each block displays item counts by status. You can then use the Items tab to filter the list, view an item’s processing time, or open the related subflow run.

To learn more, see Flow Runs Page.

Updated

Python 3.14 support for flows — v44.0.1 adds Python 3.14 support for flows, including Custom Code Blocks. Beginning in v44, Hyperscience no longer supports Python 3.12 in flows, including Code Blocks and external Python packages. This change ensures that v44 uses maintained Python versions throughout its support period.

Before upgrading to v44, update affected flows and packages to a supported Python version and test the updated flows. During the upgrade, Hyperscience undeploys flows that still reference Python 3.12 blocks, stops in-progress tasks that use those blocks, and removes customer-installed Python 3.12 packages.

Flow Blocks

New

New Salesforce Notifier Output Block — Customize how processed submission data is transformed, mapped, and written to Salesforce instead of relying on the fixed field mappings supported by the deprecated Salesforce Notifier block.

After adding the new block to a flow, select it to open its configuration settings. At the top of the settings, use the Integration Flow field to select a custom Hyperscience flow containing your Salesforce write-back logic. The block runs this integration flow for each submission payload and provides the submission and payload identifiers, along with the Salesforce credentials, so the integration flow can retrieve the data and write it to Salesforce.

This approach provides greater flexibility to support different Salesforce objects, mapping requirements, and update behaviors without limiting the integration to the deprecated block’s Lookup Field Mapping and Document Field Mappings settings.

To learn more, see Salesforce Notifier.

Updated

Salesforce Notifier deprecation — The previous Salesforce Notifier block is now labeled Salesforce Notifier (Deprecated) Output Block and will be removed in v46. To migrate, create an integration flow and select it in the new Salesforce Notifier Output Block. For the migration steps, see Salesforce Notifier.

OAuth authentication in the HTTP Downloader Block — In v44.0, you can choose how the block sends client credentials when requesting an OAuth token.

Basic Auth Header (client_secret_basic) sends them in the Authorization header
Request Body (client_secret_post) sends them in the token request body. Existing configurations continue using Request Body unless you change the setting.

Flows SDK

Updated

Data type in Machine and Manual Classification blocks — Machine and Manual classification blocks add only basic data type information to each document they process. This keeps flow data smaller and reduces memory use.

The data type information still includes uuid, name, ml_model, entry_type, and meta_type.
It no longer includes pattern, normalization_strip_charset, normalization_map, accepted_values, or raw_results. If you need this information, file a Support ticket.

Existing flows do not change when you upgrade. The new behavior starts when you update either classification block in a flow. Before updating, check any custom flow logic that uses the omitted properties.

Updated v44.0.1 flow examples — The Flows SDK examples will be updated for the v44 Core IDP and ORCA flows.

Machine Transcription

Fixed

Target accuracy for table-cell transcription — Machine Transcription now uses the configured Table Target Accuracy when calculating transcription confidence for table cells in Semi-structured documents. Previously, it used Semi-structured Text Target Accuracy. This fix helps table-cell processing achieve the intended balance between transcription accuracy and automation.

Training Data Management

New

Rename models in TDM — You can now rename Semi-structured Classification (NLC), Field Identification, and Table Identification models in their Model History tables. Renaming changes the model’s displayed name without creating a new version. Legacy model names are also preserved when you export and import them. To learn more, see TDM for Classification Models and TDM for Identification Models.

Model History - version rename

Updated

Bulk actions respect your training data selection in TDM for Classification — When you filter the Training Data table, editing or deleting selected documents affects only those documents. You can also select all documents matching the filters to apply the action to the full filtered set. To learn more, see TDM for Classification Models.

Reporting

Updated

Flow names in the Usage Bundle — The entry_automation.csv file now includes a Flow Name column alongside the flow ID, making it easier to identify which flow each set of automation metrics belongs to.

Automatic Usage Bundle transmissions — Daily automatic transmissions now include usage data from the previous 17 calendar days. The longer window helps capture updates to metrics that may be finalized days after the underlying activity. Manually initiated transmissions and selected date ranges are unchanged.

Fixed

Document output accuracy for fields marked as not present — Reports now recognize a missing output and a blank Transcription QA value as equivalent. Previously, the report treated these values as different when a field was marked as not present during Identification QA. Affected semi-structured submissions could therefore show 0% document output accuracy even when the QA result matched the output.

Audit Log

Updated

Model archive and delete actions in the Audit log — Archiving a model or permanently deleting an archived model now creates an audit log entry.

Upgrade notes

These updates may impact your upgrade process or affect initial processing times after upgrading. For more information or assistance, contact your Hyperscience representative.

Python versions

Removal of Python 3.12 support — Beginning in v44, Hyperscience no longer supports Python 3.12 in flows, including Code Blocks and external Python packages. This change ensures that v44 uses maintained Python versions throughout its support period.

Deprecated

Memory Management (VM Affinity) removed — The previously deprecated Memory Management setting, also known as VM Affinity, has been removed in v44.0.1. If your deployment uses this setting, contact your Hyperscience representative before upgrading.