Release notes for Magnolia CMS 6.2.16

LTS release • Delivered on January 28, 2022 • Changelog: 20647

Magnolia CMS 6.2.16 is a bug-fixing and security release that delivers critical vulnerability fixes.

magnolia-dx-core-webapp-6.2.16.war
magnolia-dx-core-demo-webapp-6.2.16.war
magnolia-community-demo-webapp-6.2.16.war
mtk_2.0.1.zip (as a light module)

Improvements

Merged tabs in Tasks and Notifications apps

In the Tasks and Notifications apps, all tabs have been merged into the Status and Type columns respectively. This enables you to filter tasks by status and notifications by type without the need to switch between tabs.

MGNLUI-6953

No need to specify `class` for Delivery API endpoint

When configuring a Delivery API endpoint, the class property is now set to info.magnolia.rest.delivery.jcr.v2.ConfiguredJcrDeliveryEndpointDefinition by default.

restEndpoints/delivery/my-endpoint.yaml

workspace: website
limit: 25
depth: 2
includeSystemProperties: true
nodeTypes:
  - mgnl:page
childNodeTypes:
  - mgnl:area
  - mgnl:component
#references

MGNLREST-341

`$type` aliases for Delivery API reference resolvers

When configuring Delivery API reference resolvers, you can now use the $type alias instead of the class property. Possible values are:

assetReferenceResolver for resolving asset references
jcrReferenceResolver for resolving JCR node references
richTextLinkReferenceResolver for resolving asset links in rich text fields

restEndpoint/tours.yaml

references:
  - name: tourTypeReference
    propertyName: tourTypes
    referenceResolver:
      $type: jcrReferenceResolver
      targetWorkspace: category

MGNLREST-279

Notable bug fixes

Magnolia no longer throws an exception when a node name starts or ends with a whitespace (MAGNOLIA-8273).
In rich text fields, special characters are now escaped in the alt text of an <img> element (MAGNOLIA-8278).
In rich text fields, the <sup> and <sub> tags are no longer automatically removed from the source code. The superscript and subscript options have also been added to the toolbar (MGNLUI-6975).
The HTMLEscapingHttpServletRequest.getCookies() method no longer throws an exception when there are no cookies (MAGNOLIA-8275).
The declarative layout does not fall back to a single-tab layout anymore (MGNLUI-6014).
Component autogeneration now supports multi-value properties (MAGNOLIA-6985).
When a field is not required, empty values are accepted as valid and any field validator is ignored (MGNLUI-6245).
When a DAM upload field is not required, you do not have to upload an asset. It is now also possible to delete an asset from a DAM upload field (MGNLUI-6990, MGNLUI-6991).
Switching languages in a dialog or the detail subapp no longer breaks the DAM upload field layout (MGNLUI-6637).
Uploading assets works at any level when JcrDatasourceDefinition#rootPath is defined (MGNLUI-7013).
In the Assets app, folders now have their own icon in the thumbnail view (MGNLUI-6545).
In content-type based apps, Publish deletion works for items in an unpublished folder (MGNLUI-7000).
In the Tasks app, the last task is now always fully visible when you scroll down the task list (MGNLUI-6919).
In the Pages app:
- When you add a Text and image component, the title, format and size of any uploaded asset are displayed in the Image tab (MGNLDAM-1004).
- Changing the filename of a YAML template no longer breaks the Change template button (PAGES-419).
- All page templates can now be selected in the column filter (PAGES-530).
In the REST module:
- AssetReferenceResolver no longer throws an exception when the asset key cannot be resolved (MGNLREST-256).
- The title and version number have been added to the OpenAPI v3 schema so that it conforms with the OpenAPI Specification. Without this information, importing the specification in third-party tools like Postman would fail (MGNLREST-339).

Third-party library updates

This release comes with the following third-party library updates to fix some security and compatibility issues:

HttpCore updated to 4.4.15 (BUILD-615).
HttpMime updated to 4.5.13 (BUILD-622).
JDOM updated to 2.0.6.1 (BUILD-485).
jsoup updated to 1.14.3 (BUILD-626).
Log4j updated to 2.17.1 (BUILD-620, MGNLDAM-1006).
Lombok updated to 1.18.22 (BUILD-574).
MockRunner Servlet updated to 1.0.10 (BUILD-646).
Protocol Buffers updated to 3.19.2 (BUILD-650).
Swagger Core updated to 2.1.12 (BUILD-651).
Swagger Parser updated to 2.0.29 (BUILD-662).

We keep the details of security fixes private in line with our security policy. Contact our Support team if you need more information.

Others

RSS integration functionality extracted into a new submodule

In the Categorization module, the RSS integration functionality has been extracted from magnolia-categorization into a separate sub-module (magnolia-categorization-rss-integration).

The new submodule depends on the magnolia-categorization and magnolia-module-rssaggregator modules.

MGNLCAT-177

Known issues

If you are upgrading from an earlier version, read the Upgrading to Magnolia page first and check the Known issues page.

Documentation screenshot updates

Some of the screenshots in the documentation still show the legacy Magnolia 5 UI. Please bear with us as we work to update them.

Updated modules

Categorization 2.9
Community Edition 6.2.16
Content Translation Support 2.5.5
DAM 3.0.13
DX Core 6.2.16
Form 2.7.4
Icons 27
Language Bundles 1.1.10
Magnolia 6.2.16
Mail 5.5.10
Pages 6.2.15
Personalization 2.0.15
Publishing Transactional 1.2.1
Repository Tools 1.9.3
REST Framework 2.2.11
Scheduler 2.3.6
Task Management 1.2.9
Third-party library BOM 6.2.16
UI 6.2.16
Workflow 6.0.6

Acknowledgements

The Magnolia team would also like to thank everyone who reported issues, contributed patches or simply commented on issues for this release. Your continued interest helps us make Magnolia better. Special thanks go to Jordie Diepeveen, Philipp Güttler, Diana Racho, Ewa Snopczynska-Sienczylo and Tobias Szczepanski.

Feedback

DX Core