Release 25.07.10_lts_v16

v25.07.10_lts_v16

🏁 Publishing release version [25.07.10_lts_v16]

Release 26.08.03-01

dotCMS 26.08.03-01 moves the Analytics Dashboard onto the new domain-driven query API, adds embeddings support to the OpenRouter AI provider, and broadens user search on the /api/v1/users/filter endpoint.

Caution

Rollback Warning: This release contains an irrevertable change that is non-trivial to rollback from.

• Analytics Dashboard: The dashboard now queries the new domain-driven analytics endpoints and the retired Conversions Overview widget has been removed, so rolling back requires restoring the previous per-metric endpoints and their upstream service support. [#36843]

Features

• The OpenRouter AI provider now supports embeddings via OpenRouter's OpenAI-compatible embeddings endpoint, so it is no longer limited to chat models. [#36808]

Enhancements & Adjustments

• /api/v1/users/filter now matches on user ID, first name, last name, email, and full name, and accepts an optional role filter to restrict results to users holding given roles. [#36794]
• The Analytics Dashboard now reads from the domain-driven analytics query API, defaults to the Engagement tab, and shows a loading overlay while a tab's data loads; the Conversions Overview table has been removed and the analytics health check no longer re-runs on every tab switch. [#36843]

Fixes

• OpenSearch index-bootstrap failures during the dual-write migration phases now degrade to Elasticsearch-only with an actionable log instead of aborting startup or failing reindex requests with HTTP 400. [#36222]

Infrastructure & Security

• CleanUpFieldReferencesJobTest can now be run on its own, aligning it with the CDI-managed test pattern used across the integration module. [#36753]

dotcms-cli - 26.08.03-01

Changelog

• 60c3baa 🏁 Publishing dotCLI release version [26.08.03-01]

Contributors

We'd like to thank the following people for their contributions:

• dotCMS-Machine-User

Release 26.07.31-01

dotCMS 26.07.31-01 adds lossless Markdown round-tripping for Story Block rich nodes and fixes multilingual CSV imports, Site Search on OpenSearch, and a Universal Visual Editor dead-end when declining a translation.

Caution

Rollback Warning: This release contains an irrevertable change that is non-trivial to rollback from.

• Block Editor: Story Block content written through the Markdown/HTML endpoints now persists rich nodes encoded as dotcms-* fenced code blocks; content saved after upgrading may not read back correctly on an older version. [#36658]

Features

• Story Block rich nodes (dotContent, dotImage, dotVideo, youtube, aiContent, gridBlock, and custom blocks) now survive a Markdown round-trip via dotcms-* fenced code blocks, with opt-in emission through the new roundtrip flavor on $markdownTool.blockToMarkdown() and $contentlet.storyBlock.toMarkdown(); Markdown/HTML writes to a Story Block holding rich blocks now apply instead of being silently discarded, and the previous keep-existing behavior can be restored with STORY_BLOCK_MARKDOWN_RICH_OVERWRITE_PROTECT=true. [#36658]

Fixes

• Multilingual CSV imports without an identifier column now match existing content by key field, so additional language rows become versions of the existing contentlet instead of creating new ones. [#35790]
• Site Search now resolves index aliases and renders index stats correctly when reads are served by OpenSearch, restoring alias-based searches, the portlet's Alias column, deactivate-by-alias, and the Count/Shards/Replicas/Size/Health columns. [#36360]
• Declining the translation prompt in the Universal Visual Editor now returns the user to their previous location, or the Pages portlet, instead of leaving them stuck on an untranslated page. [#36782]

Infrastructure & Security

• Removed wall-clock timing assertions from several unit tests that failed intermittently on loaded CI runners, with no change to behavioral coverage. [#35174]

dotcms-cli - 26.07.31-01

Changelog

• 229d47b 🏁 Publishing dotCLI release version [26.07.31-01]

Contributors

We'd like to thank the following people for their contributions:

• dotCMS-Machine-User

Release 26.07.30-01

dotCMS 26.07.30-01 refreshes the icon style across the modernized admin portlets and extends the release pipeline with automated SDK version checks.

Enhancements & Adjustments

• The eight modernized portlets now render Material Symbols Rounded icons throughout, with the shared empty-container and copy-button components gaining an opt-in icon style so existing callers are unaffected. [#36693]

Infrastructure & Security

• The release pipeline now automates minimum SDK version bumps with AI-assisted detection of SDK breaking changes. [#36810]

dotcms-cli - 26.07.30-01

Changelog

• 46dff96 🏁 Publishing dotCLI release version [26.07.30-01]

Contributors

We'd like to thank the following people for their contributions:

• dotCMS-Machine-User

Release 26.07.28-01

dotCMS 26.07.28-01 brings new Content Drive capabilities — dynamic "Show In List" table columns and folder-level upload behavior preferences — alongside stored-XSS hardening in the admin Users panel, OpenSearch read-path permission and parity fixes, and a fix that preserves Key/Value field ordering in API responses.

Caution

Rollback Warning: This release contains an irrevertable change that is non-trivial to rollback from.

• Key/Value fields: Key/Value field values are now serialized through a dedicated ordered map type so insertion order survives the REST response; content saved and read under the new behavior cannot be assumed to round-trip identically on an older build. [#31904]

Features

• Content Drive's results table now shows additional columns derived from the selected content type's "Show In List" fields, with type-aware rendering for dates, booleans, and image thumbnails, plus sorting on indexed fields. [#36736]
• Folders can record an upload-mode preference so Content Drive uploads default to Assets or Files instead of asking every time, exposed through a new nullable field on the /v1/assets/folders API and folder schema. [#35577]
• A new Upload Behavior tab in Folder Settings lets you pin a folder's upload mode, and the Content Drive Upload button and drag-and-drop flow honor it — skipping the Asset/File prompt entirely when a preference is set. [#35578]

Enhancements & Adjustments

• Restricted Block Editor fields now keep declared remote custom blocks selectable and round-trip unknown nodes as a placeholder instead of silently deleting the content. [#36668]
• The host/folder field popover gains left-aligned overlay positioning, clear buttons and loading spinners on the site and folder search inputs, focus restoration after clearing, and more legible hostname tooltips. [#36612]
• Line divider fields in the content editor render through a dedicated, lazily loaded component, removing a third-party divider dependency. [#36614]

Fixes

• Key/Value field entries are returned in their saved order rather than re-sorted alphabetically by the REST layer. [#31904]
• Content Drive date, date-and-time, and time filters now send the wall-clock value you picked and the table renders the same server-time value, so the editor, index, table, and filter all agree; the Time filter inputs are typeable, range-validation copy is clearer, and the New Folder dialog previews the folder you actually have open. [#36383]
• User names are escaped in the admin Users panel, closing a stored-XSS vector where a low-privilege user's stored name executed in an administrator's browser session. [#36357]
• User first and last names are now validated against the configurable name pattern on every save path, including PUT /api/v1/users/current. [#651]
• OpenSearch-backed searches now apply the secondary category-permission filter, closing a gap where category-restricted content was returned to users without the category role. [#36677]
• Deleting a content type no longer leaves orphaned unique-field rows when index removal hits a document version conflict, and an index-cleanup error can no longer abort relocation, database deletion, or the content-type-deleted event. [#36680]
• Field-sorted searches report a null relevance score on OpenSearch, matching Elasticsearch behavior instead of returning 0.0. [#36681]
• GET /api/v1/contenttype with multiple type filters now sorts the whole result set before paginating, so pages are disjoint and a content type no longer reappears across pages. [#36072]
• Removed the repackaged dot.commons-io jar, a shaded copy of Apache Commons IO 2.0.1 flagged for CVE-2024-47554; the modern commons-io already on the classpath covers all usage. [#36739]

Infrastructure & Security

• Integration suites can now run under a chosen Elasticsearch-to-OpenSearch migration phase — locally, per PR via label, on demand, or on a weekly sweep across all three phases. [#36320]
• Elasticsearch mapping, index, and app ITs resolve the active index in a phase-aware way and gate Elasticsearch-only assertions, stabilizing the OpenSearch-only test phase. [#36320]
• Release pipeline reliability fixes: a transient Docker cache-export error no longer fails release deployments, the changelog site-publish job was restored after being dropped in a merge conflict, the changelog publisher sends the required end-of-life date, and SDK publishing runs as intended. [#36744]
• Concurrent AI review workflows no longer overwrite each other's pull-request comment, so a code review is not replaced by an unrelated job's progress message. [#36761]
• Added an operator runbook covering evergreen-track taint, track hold, and single-environment hold procedures, including dry-run steps, verification, and undo. [#36769]

dotcms-cli - 26.07.28-01

Changelog

• 5cbc50a 🏁 Publishing dotCLI release version [26.07.28-01]

Contributors

We'd like to thank the following people for their contributions:

• dotCMS-Machine-User

Release 26.07.27-01

v26.07.27-01

🏁 Publishing release version [26.07.27-01]