Release notes for Magnolia CMS 6.3.10

LTS release • Delivered on June 26, 2025 • Changelog: 17965

Magnolia 6.3.10 enhances functionality with a new CKEditor 5 General HTML Support plugin, YAML environment variable substitution, and a separate IP security filter. Workflow dialogs now support i18n site-awareness.

This release also fixes security issues, Content-Type header for binaries, REST filter OR operator, UI responsiveness, item order preservation, and SpaRenderer error logs.

Improvements

MAGNOLIA-7918 Extract ipSecurity functionality out of uriSecurity filter to a separate filter

For more, see IP security.

MAGNOLIA-9659 Support environment variable substitution in YAML decoration files

For more, see Interpolate environment variables in light modules.

Any secrets that are substituted in YAML files may be exposed in the Definitions App. Substitutions are turned off by default, and you must be careful when setting the magnolia.yaml.envsubst feature flag to true, especially when you substitute sensitive data.

MGNLCKE-40 Add GeneralHtmlSupport plugin

For more details about the plugin and how to configure it, see CKEditor 5 customization: General HTML Support plugin.
MGNLWORKFLOW-556 Show changes a dialog needs to be site-aware for i18n

Security improvements

MAGNOLIA-9550, MGNLPN-830, MGNLPN-837, MGNLUI-9211

We keep the details of security fixes private in line with our security policy. Stay informed on the latest security updates by subscribing to our Security Announcements list. Contact our Support team if you need more information.

Bug fixes

MAGNOLIA-6923 Content-Type header not set when serving binaries from website
MGNLREST-869 OR operator not working correctly on filters
MGNLUI-6879 UI not responsive after saving jcrMultiField on a node with a lot of child nodes
MGNLUI-9200 Order of items not preserved when several items are moved after a selected item
PAGES-1720 SpaRenderer always logs an error

Miscellaneous

MGNLTOMCAT-55 Update org.apache.tomcat:tomcat to 9.0.106

Third-party library updates

This release comes with third-party library updates, see the Magnolia Third-party library BOM 6.3.10.

Notable updates

BUILD-1025 Upgrade to SnakeYAML 2

There are several changes between SnakeYAML 1.x and 2.x which are explicitly noted as backwards-incompatible or have the potential to break existing code due to altered behavior.

These include API changes, changes in default behavior, and security-driven restrictions. The breaking changes primarily affect:
- Low-level API users (for example, custom parsers or tag handling).
- Applications serializing JavaBeans with read-only properties.
- Code deserializing untrusted YAML without explicit constructor configurations.
If you are using SnakeYAML in your project, consider the changes if you need to update. For more details, see snakeyaml / Changes on Bitbucket.
BUILD-1405 Update info.magnolia.beanutils2:commons-beanutils2 to 2.0.1-magnolia
BUILD-1412 Update commons-fileupload to 1.6.0

Updated modules

Bundled modules included with this release.

Barebones Tomcat Bundle 1.2.37
CKEditor 5 Build 1.0.6
Cache 6.0.4
Community Edition 6.3.10
DAM 4.0.8
DX Core 6.3.10
Demo Projects 6.3.10
Imaging 4.0.4
License 2.0.1
Magnolia 6.3.10
Pages 6.3.6
Personalization 3.0.5
REST Framework 3.1.1
Resources 4.0.4
Third-party library BOM for Extensions 6.3.10
Third-party library BOM 6.3.10
UI 6.3.10
Webhooks 2.0.2
Workflow 7.0.4

Unbundled modules

Unbundled modules released since Magnolia 6.3.9.

Content Translation Extended 4.1.3
Veeva DAM Connector module 2.0.0

Release for Magnolia 6.3 compatibility.

Acknowledgements

The Magnolia team would also like to thank everyone who reported issues, contributed patches or simply commented on issues for this release. Your continued interest helps us make Magnolia better.

Thanks a mill!

Special thanks go out to Kacper Paluch and Łukasz Sobański.

Feedback

DX Core