Skip to main content
Determination Anywhere
Search
Search Indirect Tax Help and Support.

This article applies to:

  • Product: ONESOURCE Determination

Determination Anywhere 2026.06 release notes

Please review this release note in conjunction with the Determination – Enterprise Cloud 2026.06 release notes, which outline key updates to the core application. These include enhancements to the tax engine logic, regulatory compliance improvements, UI feature upgrades, and may also highlight defect resolutions and known issues – all of which directly impact the tax engine's functionality within Determination Anywhere (DA).
The following DA components and versions are included in this release. Not all artifacts apply to every customer. For example, “lite” components are applicable to DA Store, while “hub” components are applicable to DA Hub. Please review the list below based on the DA components currently used in your environment.
  1. deta-app-c-installer –
    2026.06.00-93
  2. dete-app-calc –
    2026.06.02-1949
  3. deta-app-c-data-sync-streaming –
    2026.06.03-355
  4. deta-app-c-telemetry –
    2026.06.02-279
  5. deta-app-c-transaction-sync –
    2026.06.03-242
  6. deta-app-c-helm-charts:
    1. Database: chart-version-determination-anywhere-delta-db.txt –
      2026.06.00-1223
    2. App: chart-version-determination-anywhere-installer.txt –
      2026.06.00-1205
    3. App: chart-version-determination-anywhere.txt –
      2026.06.00-1833
  7. deta-app-c-lite-sync –
    2026.06.01-111
  8. deta-app-c-lite-helm-charts:
    1. chart-version-deta-c-lite-sync.txt –
      2026.06.00-936
    2. chart-version-deta-c-tax-calc-lite.txt –
      2026.06.00-939
  9. deta-app-c-hub-cloud-sync –
    2026.06.01-183
  10. deta-app-c-hub-cloud-sync-helm-charts –
    2026.06.00-278
  11. DA Hub UI: dete-app-ui-deta –
    2026.06.01-15
Thomson Reuters recognizes that security vulnerabilities in software deployed within our own environments, or within our customer environments can pose significant risk. We conduct daily vulnerability scans of ONESOURCE Determination application code and dependencies. ONESOURCE Determination Anywhere container images are scanned daily to identify and remediate security vulnerabilities. While we strive to address zero-day vulnerabilities as rapidly as possible, remediation timelines follow the Thomson Reuters Information Security & Risk Management (ISRM) guidelines based on severity classifications identified by our scanning tool, Snyk – Critical (30 days), High (60 days), Medium & Low (best-effort basis in a future release). If vulnerabilities are found after software is released, Critical issues are fixed through urgent Production releases or in the next scheduled release cycle. We aim to uphold our commitment to providing secure solutions.

Release highlights

Determination Anywhere (DA) 2026.06 introduces support for Content Throttling, aligning DA with the feature now enabled in Enterprise Cloud.

New features

The following topics outline the new features introduced in this release.
Content Throttling (5181384)
DA now supports the Content Throttling capability available through Enterprise Cloud. Content Throttling provides customers with greater control over tax content updates by allowing specific content versions to be selected and pinned rather than automatically receiving each content update. This provides greater predictability and control over when tax content changes are applied to tax engine environments.
Content Throttling is not enabled by default and must be enabled by the customer through Enterprise Cloud UI.
Apart from the ability to control which content versions are applied, there are no changes to the existing DA synchronization process or how content is reflected in the tax engine. The DA Dashboard also includes additional fields to display information related to throttled content.
Content configuration defined in Enterprise Cloud is synchronized to DA Cloud and DA Store instances. Customers who choose to enable Content Throttling require client-side infrastructure and configuration changes. Please work with your ETS representative to complete the required changes.
Important:
 Content Throttling is not supported with the SDI data synchronization process in DA. It is supported only with the Bulk Import and associated streaming synchronization processes.
For additional information about using Content Throttling feature in Enterprise Cloud, refer to the Help documentation.
DA Client Backward Compatibility Support (5803914, 5804097)
Customers operating on a supported DA version that is one release behind the upcoming 2026.06 release will be able to take advantage of selected upcoming tax content enhancements without requiring manual configuration, synchronization changes, or database updates.
This update introduces backward compatibility between the DA client and Determination tax content, helping ensure seamless adoption of future content updates. DA environments will be prepared to support upcoming content capabilities, including enhancements related to Global Rules and Leasing transactions.
By maintaining compatibility between the DA client and Determination tax content, customers can continue to receive supported tax content updates seamlessly while ensuring accurate and consistent tax calculation results.
DA Dashboard Updates (5813872)
With this release, the DA Dashboard has been enhanced to provide greater visibility into prefetch data generation and synchronization status.
The DA Instance Details view now includes Latest Prefetch Generation Status and Latest Sync Status, along with corresponding timestamps and failure details when available. These enhancements help administrators and support teams identify synchronization issues more quickly, reduce troubleshooting time, and minimize the risk of DA instances using outdated tax content.
The Native User Last Update field has also been removed from the dashboard, as this field was applicable only to the SDI synchronization process.

Fixes

The following topics outline issues identified that have been resolved in this release.
Security Vulnerability Remediation (5417726)
This release includes remediation of several critical and high-severity security vulnerabilities within the DA platform, further strengthening application security and reducing exposure to known third-party component risks.
Key security updates include:
  • CVE-2026-71290 (httpclient5) - Improper Certificate Validation
  • CVE-2026-12185 (bcprov-jdk18on) - Improper Certificate Validation
  • CVE-2026-62243 (netty-handler) - Improper Check for Unusual or Exceptional Conditions
  • CVE-2026-18036, CVE-2026-71891 (BouncyCastle) - Timing Attack; Improper Verification of Cryptographic Signature
  • CVE-2026-12802, CVE-2026-12803, CVE-2026-12816, CVE-2026-12860, CVE-2026-13506, CVE-2026-14682 (BouncyCastle) - Various cryptographic vulnerabilities
  • CVE-2026-59639, CVE-2026-59642, CVE-2026-59645 (BouncyCastle) - Improper Validation of Integrity Check Value; Uncontrolled Recursion
  • CVE-2026-59295, CVE-2026-59296 (micrometer-core) - Missing Release of Memory after Effective Lifetime; CRLF Injection
  • CVE-2026-47857, CVE-2026-47863 (reactor-core) - Allocation of Resources Without Limits or Throttling; Race Condition
  • CVE-2026-47874 (reactor-netty-http) - Allocation of Resources Without Limits or Throttling
  • CVE-2026-75595 (netty-handler) - Improper Validation of Certificate with Host Mismatch
  • CVE-2026-59903, CVE-2026-93491 (netty-codec-http) - Allocation of Resources Without Limits; Use of Cache Containing Sensitive Information
  • CVE-2026-89425 (jackson-core) - Allocation of Resources Without Limits or Throttling
  • CVE-2026-68497, CVE-2026-91777 (jackson-databind) - Allocation of Resources Without Limits or Throttling
  • CVE-2026-55856, CVE-2026-55857, CVE-2026-55858 (mariadb-java-client) - Inappropriate Encoding for Output Context; Insufficiently Protected Credentials
  • CVE-2026-64958, CVE-2026-57819, CVE-2026-65432 (Apache CXF) - Allocation of Resources Without Limits; XML External Entity (XXE) Injection
  • CVE-2026-66142, CVE-2026-66143, CVE-2026-66144, CVE-2026-91863, CVE-2026-91864, CVE-2026-91865, CVE-2026-91866, CVE-2026-91867 (neethi) - Uncontrolled Recursion; Allocation of Resources Without Limits
  • CVE-2026-19203 (jetty-http) - HTTP Request Smuggling
  • CVE-2026-87795, CVE-2026-87823, CVE-2026-87824, CVE-2026-87825, CVE-2026-87877, CVE-2026-90560 (zstd-jni) - Integer Overflow; Out-of-bounds Read; Use After Free
  • CVE-2026-78254 (ant) - Relative Path Traversal
As previously communicated, vulnerability scan results are available through the Security Vulnerabilities Report in the Enterprise Cloud user interface under the Determination Anywhere menu. The report provides greater visibility into the security posture of deployed DA environments and supports customers’ internal security and compliance review processes.
DA Store – Updated Helm Charts to Support Independent Component Versioning (5439937)
The DA Store Helm charts have been updated to remove the dependency on the shared
appVersion
 field for containers within the lite-sync pod.
Previously, the transaction-sync-invoices, transaction-sync-calc-history, telemetry, and lite-sync containers were required to use the same image tag based on
appVersion
. This required individual applications to carry the lite-sync version in addition to their own version, making it more difficult to identify the actual application version and manage deployments independently.
With this update, each container can reference its own image tag independently (for example,
images/deta-c-hub-cloud-sync
,
images/deta-c-hub-cloud-sync-ui
), allowing individual applications to maintain their respective versions. This simplifies deployment and version tracking and reduces the potential for version-related confusion or deployment errors.

Known issues

The following topics outline issues identified that have been resolved in this release.
Snyk Vulnerabilities
This release includes remediation of several critical and high-severity security vulnerabilities within the DA platform, further strengthening application security and reducing exposure to known third-party component risks.
Key security updates include:
The following known vulnerabilities have been reviewed and are planned to be addressed in future releases. Based on the current DA implementation and deployment architecture, these vulnerabilities have been assessed as not exploitable in DA.
  • reactor-netty-http
    (CVE-2026-47874): The required upgrade could not be applied to some DA applications because it requires Netty 4.2, which is incompatible with the Netty 4.1 version currently used by those applications. The update is planned as part of the future migration to Netty 4.2.
  • bcpkix-jdk15on
    : This legacy library may continue to be identified by some vulnerability scans. During the build process, the dependency is redirected to
    bcpkix-jdk18on version 1.86
    , which contains the applicable security fixes.
  • Spring Framework vulnerabilities
    (CVE-2026-59282, CVE-2026-59276, CVE-2026-47889, CVE-2026-47886, CVE-2026-47842): Upgrades to patched Spring Framework versions are planned for a future release.
DA Dashboard
For DA Store instances:
  • The throttled content version will be displayed on the POD Details page beginning with the next release.
  • The Latest Sync Status displays N/A until support is introduced in the next release.
  • Several fields currently display N/A. Some corresponding values are available only in the POD Details view, while others are not applicable to DA Store. These fields and their displayed values will be clarified in a future release.

Related Content