Release notes for Magnolia CMS 6.3.16

LTS release • Delivered on October 8, 2025 • Changelog: 20374

Magnolia 6.3.16 is a maintenance release focused on enhancing stability and compatibility for content management workflows. This release addresses critical issues in content restoration and translation, ensuring smoother operations for developers and system administrators working with complex content structures and multilingual setups.

Notable improvements include automatic license key retrieval at startup and enhanced compatibility of the content translation module with IETF-compliant internationalization support.

Improvements

Automatic license retrieval and monitoring

Two additions make working with DX Core licenses simpler and safer:

Automatic license key retrieval at startup.

From this release onwards, Magnolia automatically retrieves a license key at startup by checking multiple sources. For more details, see Updating a license key. You should use magnolia.license.location for more security if required in your environment.
Live monitoring of license files.

Both the magnolia.license.location target and the default ${magnolia.home}/license.key are monitored for changes. Automatic file monitoring refreshes the license without you having to use the UI or restart the application, making it suitable for secret rotation and automated deployments.

For more details, see License.

MGNLLIC-121, MGNLLIC-126

Security improvements

BUILD-1471, MAGNOLIA-9725, MGNLDAM-1828

We keep the details of security fixes private in line with our security policy. Stay informed on the latest security updates by subscribing to our Security Announcements list. Contact our Support team if you need more information.

JNDI disabled by default (CVE-2025-58782)

To use JNDI, set the system property jackrabbit.jndi.enabled to true.

Example

export JAVA_OPTS="$JAVA_OPTS -Djackrabbit.jndi.enabled=true"

If enabled, ensure repository registration and lookup through JNDI is done through configuration values. Using user supplied values is a potential security risk and should be avoided.

Interpolated variables

Interpolation of environment variables remains unaltered, but values are now hidden in the Definitions and About apps. If you know the name of an environment variable, you can display its value in the About app; otherwise, you need to find the injected environment variable names in the Resources app first.

Bug fixes

MAGNOLIA-9749 Subitems can’t be restored after being marked for deletion
MGNLCTS-200 Content translation is not compatible with IetfI18nContentSupport

Updated modules

Bundled modules included with this release.

About 6.3.1
Cache 6.0.5
Community Edition 6.3.16
Content Translation Support 3.0.2
DAM 4.0.11
DX Core 6.3.16
Definitions App 3.0.5
Demo Projects 6.3.16
Form 3.0.2
License 2.0.2
Magnolia 6.3.16
Personalization 3.0.8
Third-party library BOM for Extensions 6.3.16
Third-party library BOM 6.3.16
UI 6.3.16
Usage Metrics 2.1.0
Webhooks 2.0.3

Unbundled modules

Unbundled modules released since Magnolia 6.3.15.

Acknowledgements

The Magnolia team would also like to thank everyone who reported issues, contributed patches or simply commented on issues for this release. Your continued interest helps us make Magnolia better.

Feedback

DX Core