Release notes for Magnolia CMS 6.3.8

LTS release • Delivered on April 28, 2025 • Changelog: 17305

Magnolia 6.3.8 is a bug-fixing and security-focused release, introducing key enhancements for performance and efficiency. Notable updates include support for Elliptic Curve Cryptography (ECC) to sign publication requests and the new canSkipProperty and excludeProperty indexing rules, which significantly optimize indexing.

We keep the details of security fixes private in line with our security policy. Contact our Support team if you need more information.

Breaking changes

Restricted access to component variants on public instances

Two default voters prevent direct rendering of mgnl:variant nodes via the URL. See restricting node type rendering.

MGNLPN-831

Improvements

New signature mechanism for publication tasks

You can now configure Elliptic Curve Cryptography (ECC) to sign publication requests. Due to ECC’s shorter key length, it is more performant than RSA signing. With the addition of this signature mechanism, it’s also possible to use cipher algorithms other than RSA for data encryption.

ECC signature is not yet supported on Magnolia PaaS.

For more, see How to change the signature algorithm for publication tasks.

New `canSkipProperty` and `excludeProperty` indexing rules

The canSkipProperty and excludeProperty indexing rules allow fine-grained control over which properties are excluded from indexing, improving performance and storage efficiency.

This is an experimental feature. It’s disabled by default and must be enabled in the magnolia.properties configuration file of the Magnolia instance where you want to apply indexing optimization.

magnolia.repositories.jackrabbit.indexing.optimization=true

You can also set it at the JVM level using the -D flag:

-Dmagnolia.repositories.jackrabbit.indexing.optimization=true

For more, see Skipping properties.

MAGNOLIA-9632 Implement a rule to exclude properties from indexing

Other improvements

MGNLWORKFLOW-524 Performance improvements of workflow creation and the Approve & publish action
MGNLWORKFLOW-542 Performance issue for workflow creation and the Approve & publish action

Bug fixes

ADMINCTR-490 Screen is blocked after rejecting a publication request
ADMINCTR-578 Performance issue in the Notifications app with many long messages
MAGNOLIA-9569 Add sign/verify functionality to SecurityUtil with support for the ECC algorithm
MAGNOLIA-9579 MgnlVersioningNodeWrapper#remove triggers JCR session save
MAGNOLIA-9592 MgnlPropertySettingSessionWrapper may trigger re-indexing twice
MGNLCKE-44 Pasted Google Docs content applies bold formatting
MGNLUI-9061 JcrMultiLinkField doesn’t open multiChooser correctly

Miscellaneous

MGNLTOMCAT-53 Update org.apache.tomcat:tomcat to 9.0.104
Magnolia CLI version 4 reached end-of-life (EOL) on April 16, 2025 and will receive no further updates, including security fixes.

Use CLI v5, which was released on October 16, 2024 and is fully supported. Version 5 is a plugin-based CLI designed for developers seeking modularity and the ability to extend functionalities through custom CLI commands.

Third-party library updates

This release comes with third-party library updates, see the Magnolia Third-party library BOM 6.3.8.

Notable updates

BUILD-1347 Update Apache POI to 5.4.1

Updated modules

Bundled modules included with this release.

Admincentral 6.3.5
Barebones Tomcat Bundle 1.2.35
CKEditor 5 Build 1.0.4
Community Edition 6.3.8
DX Core 6.3.8
Demo Projects 6.3.8
Magnolia 6.3.8
Personalization 3.0.4
Publishing Transactional 2.0.2
Publishing 2.0.4
Security 7.0.2
Third-party library BOM for Extensions 6.3.8
Third-party library BOM 6.3.8
UI 6.3.8
Workflow 7.0.3

Unbundled modules

Unbundled modules released since Magnolia 6.3.7.

Acknowledgements

The Magnolia team would also like to thank everyone who reported issues, contributed patches or simply commented on issues for this release. Your continued interest helps us make Magnolia better.

Feedback

DX Core