Skip to main content
Version: v3.5.x LTS

Version 3.6.0 (September 2026)

Last updated
:  |
... min read
|
Edit this page
Print
Open doc issue

Version 3.6.0 (September 2026)

Welcome to the Zowe Version 3.6.0 release!

See New features and enhancements for a full list of changes to the functionality. See Bug fixes for a list of issues addressed in this release.

Download v3.6.0 build: Want to try new features as soon as possible? You can download the v3.6.0 build from Zowe.org.

New features and enhancements​

Zowe Version 3.6.0 contains the enhancements that are described in the following topics.

Zowe CLI​

Zowe CLI (Core)​

breaking change
  • zowe zos-uss (ssh) commands now verify the z/OS SSH server's host key before sending credentials. On first connect you confirm the fingerprint and the key is saved to your ssh profile; a changed key is rejected. Use --insecure to skip verification or --host-key to pin a key. (#2813)
  • Added the ability to resolve data set aliases to their true target names using the zowe zos-files list alias command or the List.resolveAlias SDK method. (#2728)
  • Standardized the help text to use <The User Home Directory>/.zowe instead of ~/.zowe. (#2541)
  • Added a new --legacy option to the zowe tso issue command command, allowing the user to force the use of the previous TSO command functionality (where Zowe CLI creates and tears down the TSO address space via multiple API calls). This is useful for working around an error reading "Did not receive output from the z/OSMF TSO API" that might occur with the newer TSO API. (#2738)

Zowe CLI Imperative Framework​

  • Added an --allow-scripts option to the zowe plugins install and zowe plugins update commands. (#2839)
  • Added a ConfigRedact API, accessible via the Config.api.redact class instance, with methods for programmatically retrieving Zowe configuration layers with sensitive values redacted. (#2827)
  • Added a IO.hasOwnerOnlyAccess utility function to check whether a file or directory's access is restricted to the current user only, cross-platform (POSIX mode bits/owner; Windows icacls ACL). (#2823)
  • Added the zowe config export-redacted command to export Zowe configuration layers with sensitive values redacted for troubleshooting and sharing purposes. (#2732)
  • Added containsPathSep, containsBacktrack, and evaluatesToDir helper functions to the IO class. (#2747)

CICS Plug-in for Zowe CLI​

  • Added open and close local file operations. (#241)

DB2 Plug-in for Zowe CLI​

  • Added a post-install check that fails the plug-in installation with instructions for completing the installation of the bundled ibm_db package when npm does not run its install script. (#242)

MQ Plug-in for Zowe CLI​

breaking change
  • Changed the default value of the reject-unauthorized option to true so that TLS certificates presented by the IBM MQ REST API are validated by default, preventing credentials from being sent over an unverified connection. Profiles or commands relying on the previous insecure default must now explicitly pass --reject-unauthorized false. (#127)

z/OS FTP Plug-in for Zow CLI​

  • Added a max depth of 100 for the UssUtils.deleteDirectory function. Relative directories are now filtered from the list of items to delete. (#196)

Zowe Explorer​

Zowe Explorer (Core)​

  • See the Zowe Explorer changelog for updates included in this release.

Zowe Explorer API​

Zowe Explorer for IBM z/OS FTP​

Zowe Explorer ESLint Plug-in​

Zowe Remote SSH (ZRS)​

Introducing Zowe Remote SSH, an open-source, full-stack solution designed to make interacting with your mainframe streamlined and efficient.

ZRS provides intuitive tools to get started quickly by providing a straightforward configuration and deployment process that significantly accelerates access to mainframe capabilities directly within VS Code. For more information, see Configuring and deploying Zowe Remote SSH.

Bug fixes​

Zowe Version 3.6.0 contains the bug fixes that are described in the following topics.

Zowe CLI​

Zowe CLI (Core)​

breaking change
  • Updated the zowe zos-files (ds/uss) edit command to prompt the user to trust custom editors. (#2740)
  • Hardened temporary file handling for the zowe zos-files edit command: the etag-refresh step no longer uses a shared, fixed path; edit temp directories are now scoped per user (so co-tenants on a shared temp location no longer conflict) and owner-only access is enforced on all platforms; and the downloaded working file is restricted to the owner. (#2823)
  • Updated various dependencies for technical currency. (#2817)
  • Censored sensitive connection properties from the diagnostic details serialized into workflow and job submission command errors. (#2784)
  • Prevented the daemon client from connecting to a Windows named pipe that belongs to a different user. (#2790)
  • Hardened daemon client authentication so that another local user cannot drive a daemon they do not own. The daemon now generates a random secret token at startup, stores it in the owner-only daemon_pid.json file, and requires every client request to echo it back (compared in constant time). Because only the owner can read that file, this closes a gap on Windows, where the named pipe can be opened by local users other than the owner and the previously self-asserted user name check was insufficient. (#2743)
  • Fixed "Access is denied" error when running CLI commands on Windows if daemon mode is active. (#2808)
  • Reduced the encoding of URIs to the minimum that still allows Zowe SDK operations to work successfully in the current z/OS environment. (#2758)
  • Updated the tar dependency for technical currency. (#2752)
  • Improved the error message if z/OSMF fails to return any output when executing a TSO command. (#2738)
  • Added extra filesystem checks when downloading config files with the zowe config import command. (#2747)
  • Added extra filesystem checks when downloading data sets and USS files. (#2747)
  • Added extra filesystem checks when downloading job spool. (#2747)
  • Restricted access to daemon-related files and directories to the current user only on all platforms. The daemon directory, ~/.zowe/bin directory, the extracted native executable, the daemon PID file, and the Unix domain socket are now given owner-only permissions (0o700/0o600 on POSIX, owner-only ACL on Windows) to prevent other local users from accessing them. The daemon directory, the ~/.zowe/bin directory, and the native executable inside it are also re-restricted when they already exist, so that artifacts created before this fix with looser permissions are corrected on the next zowe daemon enable or zowe daemon restart. (#2743)
  • Updated the error handling for plug-in installation to report the first failure that occurs. (#2722)
  • Updated the display of failures from third party programs to include more diagnostic information while avoiding repeated text. (#2722)
  • Updated zowe daemon enable help text to warn users that the Zowe bin directory must be on your PATH after enabling daemon mode. (#2717)

Zowe CLI Imperative Framework​

  • Addressed an issue that caused the npm pack command to fail, since npm v12 changed the command's JSON output from an array to an object. (#2840)
  • Added a default request completion timeout to the AbstractRestClient class. (#2842)
  • Removed top level import of an ESM dependency (sanitize-html) for better compatibility with dev tools like Jest. (#2841)
  • Fixed an issue where TextUtils.getTable rendered an empty cell instead of the value when a cell contained 0 or false, causing commands that display numeric tables to appear to be missing data. (#2698)
  • The Config.set function, ConfigProfiles.set function, and the ConfigSecure property walkers now reject dotted paths whose segments are empty or use reserved property names. (#2807)
  • Escaped regular-expression metacharacters in secure values before masking them in the Censor.censorRawData function. (#2799)
  • Redacted sensitive environment variables and command-line arguments from the diagnostic information written to the log when a command handler fails to load or throws an error. This prevents credentials supplied via environment variables (for example, ZOWE_OPT_PASSWORD) from being persisted to disk in plain text. (#2788)
  • Fixed an issue where passing an object with null values to the Censor.mCensorObject function caused a runtime error. Now, only non-null values are recursively handled in this function. (#2784)
  • Added an optional token property to the IDaemonResponse interface. The daemon client sends this secret token (read from the owner-only daemon PID file) so the daemon can authenticate the client as its owner. (#2743)
  • Masked sensitive command-line options that are supplied in the equals-separated form (for example, --user=example or -u=example) before the command line is written to the log, and also mask secure values that contain embedded whitespace. (#2778)
  • Updated Logger.ts to wrap the formatted message with Censor.censorRawData. (#2772)
  • Redacted cert, key fields, and token value from logs in AbstractRestClient. (#2781)
  • Encoded diff content before embedding it in the inline script of the web diff page to prevent stored cross-site scripting. (#2771)
  • Removed environment variables from the log messages produced when an exception is caught during Imperative.init. (#2764)
  • Placed imperative_debug.log into the Zowe Home directory's logs subdirectory, (or as a fallback into the user's home directory) instead of the current directory. (#2764)
  • Reduced the encoding of URIs to the minimum that still allows Zowe SDK operations to work successfully in the current z/OS environment. (#2758)
  • Updated the WebDiffManager class's openDiffs function to better process input data. (#2769)
  • Added path sanitization checks to prevent writing the configuration schema to an invalid file path. (#2763)
  • Updated js-yaml and markdown-it dependencies for technical currency. (#2752)
  • Added extra filesystem checks when downloading config files with the zowe config import command. (#2747)
  • Updated the NpmFunctions.installPackages function to throw an error when a launched NPM program fails. (#2722)
  • Updated the ExecUtils.handleSpawnResult function to display more detailed failure information from third party programs. (#2722)
  • Added the ImperativeError.newImpErrorFromExistingError function and used it to display failures from third party programs with more diagnostic information while avoiding repeated text. (#2722)

DB2 Plug-in for Zowe CLI​

  • Updated and bundled the ibm_db package for technical currency. (#242)
  • Added proper escaping of single quotes in string values returned by the export table command. (#207)
  • Updated the form-data dependency for technical currency. (#205)
  • Updated the axios dependency for technical currency. (#203)
  • Updated the axios dependency for techncial currency. (#202)

MQ Plug-in for Zowe CLI​

  • Updated minimum supported version of Node from 18 to 20. Added Node 24 support. (#91)

z/OS FTP Plug-in for Zow CLI​

  • Added path validation for the resolved output file path when downloading a spool file. (#197)

Zowe Explorer​

Zowe Explorer (Core)​

  • See the Zowe Explorer changelog for updates included in this release.

Zowe Explorer API​

Zowe Explorer for IBM z/OS FTP​

Zowe Explorer ESLint Plug-in​

Vulnerabilities fixed​

Zowe discloses fixed vulnerabilities in a timely manner giving you sufficient time to plan your upgrades. Zowe does not disclose the vulnerabilities fixed in the latest release as we respect the need for at least 45 days to decide when and how you upgrade Zowe. When a new release is published, Zowe publishes the vulnerabilities fixed in the previous release. For more information about the Zowe security policy, see the Security page on the Zowe website.

The following security issues were fixed by the Zowe security group in version 3.5:

  • CVE-2025-66412
  • CVE-2026-22610
  • BDSA-2025-40344
  • BDSA-2026-0384 (CVE-2026-22610)
  • CVE-2025-48976 (BDSA-2025-5248)
  • CVE-2025-58754 (BDSA-2025-11547)
  • BDSA-2025-5572
  • BDSA-2025-27523
  • CVE-2025-67735 (BDSA-2025-62789)
  • CVE-2025-12816 (BDSA-2025-34467)
  • CVE-2025-66030 (BDSA-2025-35153)
  • CVE-2025-66031 (BDSA-2025-35154)
  • CVE-2025-15284 (BDSA-2025-87749)
  • CVE-2026-22036 (BDSA-2026-0521)
  • CVE-2025-12758 (BDSA-2025-35151)

On this page