Release notes for Magnolia CMS 6.3.20

LTS release • Delivered on January 28, 2026 • Changelog: 23104

Magnolia 6.3.20 is centered on AdminCentral stability and configuration clarity, highlighted by a new configurable limit for Vaadin’s DataCommunicator. This improvement prevents potential errors when handling large datasets in selection fields, ensuring a smoother experience when working with components like twinColSelectField.

For developers, this release streamlines REST endpoint caching by deprecating the timeToLive property. Caching behavior for endpoints is now managed exclusively via the central Cache module, eliminating the risk of duplicated headers. We have also addressed multiple link management issues, ensuring correct link rewiring in live copies and offering a configurable approach for handling trailing slashes.

Finally, with this update, CKEditor 4 is officially marked as deprecated and has entered maintenance mode.

Improvements

  • MGNLSITE-233 Facilitate CSP header configuration for projects

    For more details, see Content-Security-Policy (CSP) filter.

  • MGNLUI-9038 Add a property to configure Vaadin’s DataCommunicator maximumAllowedRows

    You can now set the global property magnolia.selectField.maximumAllowedRows (default is 500) to increase the limit of items fetched by selection fields.

    This prevents IllegalStateException errors when displaying large datasets in AdminCentral components like twinColSelectField.

Security improvements

MAGNOLIA-9881

We keep the details of security fixes private in line with our security policy. Contact our Support team if you need more information.

Bug fixes

  • ADMINCTR-636 Incorrect filter order in publishing configuration causes failures

  • MAGNOLIA-9846 Configurable way to end links with slash

  • MAGNOLIA-9859 Link management – Transformer fails to create bean for node

  • MGNLUI-9349 Links inside the compositeFields aren’t correctly rewired on Livecopy creation

Deprecations

CKEditor 4

With this upgrade, the CKEditor 4 is deprecated and in maintenance mode only.

timeToLive property in REST

This release deprecates the timeToLive configuration property for REST delivery endpoints. Previously, using this property could result in duplicated Cache-Control headers.

Caching behavior for endpoints should now be managed centrally via the Cache modules. To enable caching for REST endpoints, which often use URLs without file extensions, adjust the emptyExtensionVote property in your cache configuration.

To cache REST endpoints, set the emptyExtensionVote property to false at the following configuration path:

/modules/cache/config/contentCaching/defaultPageCache/browserCachePolicy/policies/dontCachePages/voters/contentType

For more details, see Cache control directives.

  • MGNLREST-896 Deprecate the timeToLive config for delivery endpoints

Updated modules

Bundled modules included with this release.

  • Admincentral 6.3.10

  • Community Edition 6.3.20

  • DX Core 6.3.20

  • Demo Projects 6.3.20

  • Magnolia 6.3.20

  • Publishing Transactional 2.0.3

  • Publishing 2.0.6

  • REST Framework 3.1.7

  • Site 2.0.3

  • Templating Essentials 3.0.3

  • Third-party library BOM for Extensions 6.3.20

  • Third-party library BOM 6.3.20

  • UI 6.3.20

  • Usage Metrics 2.1.1

Unbundled modules

Unbundled modules released since Magnolia 6.3.19.

Acknowledgements

The Magnolia team would also like to thank everyone who reported issues.

Feedback

DX Core

×

Location

This widget lets you know where you are on the docs site.

You are currently perusing through the DX Core docs.

Main doc sections

DX Core Headless PaaS Legacy Cloud Incubator modules