Release 26.05.22-01

Release: v26.05.19-01 → v26.05.22-01

Features & Enhancements

• Analytics: New DotAnalyticsCountPipe standardizes compact/full count formatting across the analytics dashboard, with improved tooltips and ARIA labels on pageview bar charts. (#35744)
• Push Publishing: AllPushPublishEndpointsFailureEvent and SinglePushPublishEndpointFailureEvent now carry an optional List<EndpointFailureDetail> payload with HTTP status, FailureCategory (auth/authz/client/server/network/bundle), and a retryable hint — legacy 1-arg constructors preserved for backward compatibility. (#35765)
• Content Search: Date and date_time fields in the Content Search portlet now render FROM/TO date pickers that build a Lucene range value, replacing the free-text Lucene input. (#35745)
• UVE: Lock/unlock state is now validated across different pageViews behind the FEATURE_FLAG_UVE_TOGGLE_LOCK flag. (#35747)
• Workflow API: New GET /api/v1/workflow/contenttypes/schemes endpoint accepts a comma-separated contentTypeIds query parameter and returns workflow schemes grouped by content type. (#35729)
• Telemetry: Per-window and lifetime request-cost (token) counters are now published to an external REST collector on the existing 60s monitor tick — gated by REQUEST_COST_PUSH_URL + REQUEST_COST_PUSH_TOKEN, off by default. (#35749)
• Security: New EncryptPlainPasswordsJob (Quartz, every 5 minutes) scans user_ for rows with passwordEncrypted = false, hashes the cleartext password via PasswordFactoryProxy, and flips the flag — gated by ENABLE_ENCRYPT_PLAIN_PASSWORDS_JOB (default true). (#35767)
• Toolbar: The "Report an Issue" toolbar menu item is now gated behind FEATURE_FLAG_REPORT_ISSUE_ENABLED (default false). (#35759)
• VTL Grid Block: Grid block renderer now collapses columns to full-width stacking below 768px via a scoped style block injected once per page. (#35783)

Fixes and Known Issues

• OpenSearch: ConfigurableOpenSearchProvider now actually applies the configured SSLContext to the async connection manager, loads trust flags regardless of how TLS was enabled, and skips certificate verification by default via the new OS_TLS_CERT_REQUIRED property (set to true for strict validation). (#35735)
• UVE Palette: Content retrieval now passes sorting parameters so palette results display in the expected order. (#35774)
• Feature Flags: ConfigurationResource now case-insensitively normalizes boolean feature-flag property values ("True", "FALSE", "1", etc.) to canonical "true"/"false" strings — the frontend === 'true' comparison no longer silently fails for non-lowercase values. (#35769)
• Edit Content (Locale Translation): Binary fields are now cleared on both populate and manual translate; HOST_FOLDER and RELATIONSHIP values are preserved during manual translation; relationship items resolve to the target language with the correct DotLanguage object so the language column renders; tags are no longer cleared by the legacy editor's populate flow. (#35738)
• dotAI: Example image-model config updated to gpt-image-1; Image Playground response JSON now pretty-prints and wraps without overflowing; EmbeddingContentListener, BulkEmbeddingsRunner, and SearchResource now resolve the host before calling getEmbeddingsAPI() so site-scoped configurations work; search form validates required fields; model dropdown reads from providerConfig.chat.model; missing index now returns 404 with known indexes listed. (#35716)
• Velocity: VelocimacroFactory now fails loud when a configured velocimacro.library file cannot be loaded — engine init throws and readiness probes go red until macros are healthy. Opt out with velocimacro.library.fail-on-missing=false. (#35768)
• Tomcat: RemoteIpValve internalProxies regex in setenv.sh now includes CGNAT 100.64.0.0/10 (RFC 6598) used by cloud load balancers, Kubernetes overlay networks, and Tailscale; also fixes a pre-existing brace bug in server.xml that broke Tomcat property resolution. (#35805)

Infrastructure & Security

• CI Filters: .github/filters.yaml exclusion patterns refined so language property files under WEB-INF/messages and other path matches are correctly routed to area_backend. (#35779)
• Release Tooling: Slack release announcement now includes a QA-coverage section listing PRs whose linked issues lack a recognized QA label (failed, missing, unlinked, external). (#35762)
• Test Stability: Template_Resource Postman collection and SiteAPIIT integration test now retry the default-language lookup on cold start to avoid intermittent language_id = -1 FK violations. (#35787)
• Test Stability: Workflow_Resource_Tests and GraphQLTests Postman collections now resolve and pass an explicit defaultLanguageId in request bodies that previously fell through to the -1L server default. (#35795)

dotcms-cli - 26.05.22-01

Changelog

• 0a14f77 🏁 Publishing dotCLI release version [26.05.22-01]

Contributors

We'd like to thank the following people for their contributions:

• dotCMS-Machine-User

Release 26.05.19-01

Release: v26.05.18-01 → v26.05.19-01

Features & Enhancements

• Maintenance: New REST endpoints for session management — list active sessions, invalidate a single session, or invalidate all but the caller — replacing the legacy UserSessionAjax DWR class. (#35733)
• Maintenance: Added GET /api/v1/maintenance/_threads and /api/v1/maintenance/_threads/info returning structured JSON, replacing the legacy ThreadMonitorTool HTML output. (#35463)
• Maintenance: Added GET /api/v1/maintenance/_logFiles returning a sorted, regex-filtered list of log file names for use with the existing tail and download endpoints. (#35741)
• Search: Introduced a vendor-neutral SearchAPI with a phase-aware router that delegates reads to Elasticsearch or OpenSearch; ContentletAPI.esSearch / esSearchRaw are now @Deprecated(forRemoval = true) in favor of search() / searchRaw(). (#35609)
• Report Issue: Added a /api/v1/report-issue endpoint and toolbar user-menu dialog for submitting issue reports, with multipart upload, client metadata capture, and a new REPORT_ISSUE_INCLUDE_USER_PII config to control whether user details are included. (#35717)

Fixes and Known Issues

• Edit Content: Lock warning banner on Pages now correctly displays the locker's name and no longer appears when the current user holds the lock, by normalizing the dual string/object shape of lockedBy on the frontend. (#35726)

dotcms-cli - 26.05.19-01

Changelog

• 9179020 🏁 Publishing dotCLI release version [26.05.19-01]

Contributors

We'd like to thank the following people for their contributions:

• dotCMS-Machine-User

Release 26.05.18-01

Release: v26.05.14-01 → v26.05.18-01

Features & Enhancements

• dotAI: Azure OpenAI is now a supported LangChain4J provider for chat, streaming, embeddings, and image — enterprise customers can configure Azure-hosted deployments via providerConfig JSON with no code changes. (#35243)
• ES Search portlet: Applied product/design polish — parameters panel switched to the standard form pattern with checkboxes, "Wrap code" moved into the Query panel header, Help button relocated next to the Query title, top toolbar removed, Share/Export buttons moved into the right side of the results stats bar, and the Status column is now sortable. (#35702)
• Analytics dashboard: Engagement report now shows device and browser breakdowns as pie charts (via new transformBrowsersToPieChartEntries / transformDevicesToPieChartEntries aggregation utilities capped at 10 entries), with the engagement rate metric spanning the full width. (#35695)
• UVE Style Editor: Accordion content styling and radio field visibility improvements for better UI consistency. (#35724)

Fixes and Known Issues

• UVE: The pencil icon in the hover toolbar now opens the Angular-based new edit content dialog when CONTENT_EDITOR2_ENABLED is on for the content type, for both single- and multi-page contentlets. (#35674)
• Edit Content (History tab): Polished the Versions and Push Publish accordions in the new side panel — context-menu options now filter by status (Draft/Published/Other), the current version has a distinct active highlight, status chips align with Content Drive, the kebab is hover/active only, Compare view supports reversed columns with a "Return to current version" button, and Push Publish entries are sorted newest-first with a readable "Bundle ID" label. (#35687)
• Edit Content (side panel): Added tooltips to sidebar tab icons, copy button now shows the "Copied" tooltip and checkmark immediately on click, replaced the local status tag with the shared dot-contentlet-status-chip (including a "New" state), and replaced the untranslated locale component with the shared DotBinaryOptionSelectorComponent with locale-aware copy options. (#35671)
• Maintenance: Fixed broken double-checked locking in MaintenanceResource.jobHelper() where two threads could race and both initialize the CDI bean — now uses the full volatile + synchronized + double null-check pattern. (#35713)

Infrastructure & Security

• CI/CD: The dotcms-dev image build now derives its base from the release's Java major version via a new JAVA_BASE_IMAGE build-arg, so the java-25 variant is actually built on jdk:25-ubuntu instead of being hardcoded to Java 21. (#35718)
• URL Map: Added an integration regression test that locks down the cross-site URL map fix — processURLMap must return empty when the requesting site has no matching content, preventing the foreign-host content bleed previously introduced by an unrestricted ES fallback. (#35723)

Release 26.05.14-01

Release: v26.05.11-01 → v26.05.14-01

Caution

Rollback Warning: This release contains an irrevertable change that is non-trivial to rollback from.

• Push Publish: Bundles now carry dotStyleProperties and Style Editor schemas; receivers persist data that older senders/receivers did not write. (#35659)

Features & Enhancements

• Content Analytics: Split the docker-compose-examples/analytics stack into a dedicated experiments/ directory and redirected CA infrastructure setup to the new dot-ca-event-manager repo. (#35624, #35678)
• Content Analytics: Renamed DOT_ANALYTICS_CUSTOMER_ID → DOT_ANALYTICS_TENANT and DOT_ANALYTICS_ENVIRONMENT → DOT_ANALYTICS_PROJECT (and the upstream ?environment= query param to ?project=) to align with Platform Team naming conventions. (#35662)
• Queue: Added a cloud-agnostic DotQueuePublisher abstraction with DOT_QUEUE_PROVIDER config-driven selection, shipping SqsQueuePublisher and a default NoOpQueuePublisher. (#35628)
• Folder Resource: Added offset and limit query parameters to POST /api/v1/folder/byPath, replacing the silent 20-row truncation with paginated subfolder results (default 40, -1 for unlimited up to a 10000 safety cap). (#35618)
• Maintenance Portlet: Added DELETE /api/v1/maintenance/_contentlets REST endpoint for bulk contentlet destruction, replacing the legacy DWR path. (#35233)
• Analytics Dashboard: Added getContentAttribution and getConversionsOverview service methods plus refactored conversions state for the new dashboard charts. (#35657)
• API Documentation: Expanded OpenAPI descriptions for NavResource, ContentTypeResource, TempFileResource, and WorkflowResource to better serve AI agents and API consumers. (#35382)

Fixes and Known Issues

• Edit Content: Dismissing the unsaved-changes dialog via the X icon or ESC key now keeps the user on the editor instead of discarding their work. (#35646)
• Edit Content: Switching content items of the same type and translating manually between locales now properly clear stale field state (binary/image, date picker, relationship, and custom fields). (#35596)
• Edit Content: Required Custom Fields left empty now show the standard "This field is mandatory" inline message and a red border, exposed via new getValidationState() and onValidationChange() methods on DotCustomFieldApi. (#35653)
• SDK Client: client.page.get({ mode: 'EDIT' | 'PREVIEW' }) now correctly translates UVE_MODE keys to backend PageMode values, so preview/edit modes no longer silently fall back to LIVE. (#35656)
• OpenSearch Migration: Startup connectivity failures are now hard errors that trigger an emergency haltMigration() reset to phase 0; hasEmptyIndices() is phase-aware; thread-unsafe SimpleDateFormat replaced with DateTimeFormatter in ESIndexResource. (#35632)
• CSV Import: Tag processing now uses a diff-based approach under a SELECT ... FOR UPDATE row lock and propagates exceptions, eliminating a race condition that produced tag unions and silently swallowed failures. (#35648)
• Categories API: Single quotes in category names are now escaped in the recursive path SQL literal, fixing "Unterminated identifier" errors on /api/v1/categories/children and closing a SQL injection vector. (#35676)
• Page Cache: Vanity URL 200-forward responses now include the original request URI in the cache key, preventing different vanity-forwarded URLs that resolve to the same detail page from serving each other's cached content. (#35704)
• Permissions: PermissionBitFactoryImpl.loadPermissions() no longer caches empty walk-up results, preventing intermittent 401s on public pages after Push Publishing. (#35684)
• Template Builder: Templates portlet wrapper no longer echoes layout changes synchronously back to the designer, fixing column reordering and row duplication after row deletion. (#35698)
• Legacy Edit Content UI: Tag chips in the legacy Dojo edit screen now grow to fit their full text instead of being clipped at 112px. (#35667)
• dotAI: Default embeddings search threshold lowered from 0.5 to 0.25 across backend constants and frontend defaults. (#35660)
• UVE: Fixed auto-expand of tabs on style editor changes. (#35689)
• Block Editor 2.0: Follow-up improvements and bug fixes. (#35691)

Infrastructure & Security

• CI/CD: Docker :latest push and "Next Release" issue relabeling in the -6 Release Process workflow are now gated to main-branch dispatches only. (#35652)
• TipTap: Pinned @tiptap/core via resolutions and promoted @tiptap/extension-code-block to a direct dependency to unblock yarn nx serve dotcms-ui after the Block Editor 2.0 merge. (#35685)
• SDK: Bumped SDK VERSION from 1.5.2 to 1.5.3 to keep trunk @next builds ahead of @latest. (#35562)
• Tooling: gh-issue-troubleshoot slash command now auto-registers new integration tests in the correct JUnit 4/5 suite file. (#35644)

dotcms-cli - 26.05.14-01

Changelog

• bd50cbd 🏁 Publishing dotCLI release version [26.05.14-01]

Contributors

We'd like to thank the following people for their contributions:

• dotCMS-Machine-User

Release 25.07.10_lts_v9

v25.07.10_lts_v9

🏁 Publishing release version [25.07.10_lts_v9]

Release 25.07.10_lts_v10

v25.07.10_lts_v10

🏁 Publishing release version [25.07.10_lts_v10]

Release 24.12.27_lts_v20

v24.12.27_lts_v20

🏁 Publishing release version [24.12.27_lts_v20]