URI validation, introduced in Zabbix 3.4.2, now can be turned off/on in the new VALIDATE_URI_SCHEMES frontend constant.
Relative URLs are no longer validated against the URI scheme whitelist i.e. are always considered valid.
In URLs where macros are supported, delayed validation is used. If the URL after resolving the macros is not valid, then the link will not work.
URLs with invalid port numbers, like ftp://[email protected]:port are considered as invalid
In system.cpu.util agent items user and nice time no longer include guest time and guest_nice time (on Linux kernels 2.6.24 and above)
vmware.eventlogitems will now browse up to 1000 events (instead of 10) in search of events that have not yet been processed. Consequently, when catching up after some downtime Zabbix may cache up to 1000 events, which will increase the VMware cache usage right after startup. The new algorithm is also less tolerant to multiple vmware.eventlog items configured with the same VMware URL.
From now on, Zabbix internal item zabbix[java,,ping] will not become not supported if java gateway is misconfigured or java gateway is unreachable
If you have some actions configured for internal events to monitor zabbix[java,,ping], please change it to nodata trigger to continue monitoring the availability of java gateway.
From now on HttpOnly flag is set for all session cookies.
An event will now only be deleted by the housekeeper if it is not associated with a problem in any way. This means that if an event is either a problem or recovery event, it will not be deleted until the related problem record is removed. Additionally, the housekeeper now will delete problems first and events after, to avoid potential problems with stale events or problem records.