Release notes for Magnolia CMS 6.3.7

LTS release • Delivered on April 8, 2025 • Changelog: 16909

Magnolia 6.3.7 is primarily a bug-fixing and security release that delivers critical security fixes and also a breaking change in the SPA template annotations endpoint. We keep the details of the security fixes private in line with our security policy. Contact our Support team if you need more information.

Breaking changes

Removal of the `bypassWorkspaceAcls` property

For security reasons, we’ve removed the bypassWorkspaceAcls property from the template annotations endpoint.

To maintain the ability to edit your SPA project, you can implement several solutions. The recommended one is the following:

First, create a user in Magnolia specifically for the purpose of making requests from your frontend.
Then, assign it a role with write access to the website repository.
Finally, update the frontend project to include the username and password via basic authentication when it makes requests to the Magnolia endpoints.

For the other solutions, see the bypassWorkspaceAcls property.

We also suggest enhancing the security of the author instance through additional measures, such as restricting access to specific IP addresses (through /server/IPConfig) or placing it behind a firewall.

PAGES-1698

Improvements

MGNLIMG-408 Provide a mechanism to limit the number of concurrent requests and the amount of memory used during image processing. For more information, see Image throttling.
MGNLIMG-414 Subsample images before loading them into memory for later processing. For more information, see Image subsampling.

Bug fixes

MAGNOLIA-9527 Copy/Paste action doesn’t fill the lastModified and lastModifiedBy properties
MAGNOLIA-9552 Magnolia not dealing properly with Japanese characters at various places
MAGNOLIA-9636 JcrDataStoreHealthCheck#getDataStoreStatus should unwrap the test node from MgnlVersioningNodeWrapper
MGNLRESTCL-231 Decoration of a REST client configuration no longer possible
MGNLUI-9073 Find Bar search can throw errors on the results when searching through many content pages
MGNLUI-9178 LazyThumbnail fails to set image URL when updated from a push operation

Third-party library updates

This release comes with third-party library updates, see the Magnolia Third-party library BOM 6.3.7.

Notable updates

BUILD-1340 Update webp-imageio to 0.9.0

Updated modules

Bundled modules included with this release.

Community Edition 6.3.7
DX Core 6.3.7
Demo Projects 6.3.7
Imaging 4.0.3
Magnolia 6.3.7
Multisite 3.0.1
Pages 6.3.5
REST Client 3.0.3
REST Framework 3.0.2
Third-party library BOM for Extensions 6.3.7
Third-party library BOM 6.3.7
UI 6.3.7

Unbundled modules

Unbundled modules released since Magnolia 6.3.6.

Acknowledgements

The Magnolia team would also like to thank everyone who reported issues, contributed patches or simply commented on issues for this release. Your continued interest helps us make Magnolia better.

Feedback

DX Core