Release 26.07.28-01

dotCMS 26.07.28-01 brings new Content Drive capabilities — dynamic "Show In List" table columns and folder-level upload behavior preferences — alongside stored-XSS hardening in the admin Users panel, OpenSearch read-path permission and parity fixes, and a fix that preserves Key/Value field ordering in API responses.

Caution

Rollback Warning: This release contains an irrevertable change that is non-trivial to rollback from.

• Key/Value fields: Key/Value field values are now serialized through a dedicated ordered map type so insertion order survives the REST response; content saved and read under the new behavior cannot be assumed to round-trip identically on an older build. [#31904]

Features

• Content Drive's results table now shows additional columns derived from the selected content type's "Show In List" fields, with type-aware rendering for dates, booleans, and image thumbnails, plus sorting on indexed fields. [#36736]
• Folders can record an upload-mode preference so Content Drive uploads default to Assets or Files instead of asking every time, exposed through a new nullable field on the /v1/assets/folders API and folder schema. [#35577]
• A new Upload Behavior tab in Folder Settings lets you pin a folder's upload mode, and the Content Drive Upload button and drag-and-drop flow honor it — skipping the Asset/File prompt entirely when a preference is set. [#35578]

Enhancements & Adjustments

• Restricted Block Editor fields now keep declared remote custom blocks selectable and round-trip unknown nodes as a placeholder instead of silently deleting the content. [#36668]
• The host/folder field popover gains left-aligned overlay positioning, clear buttons and loading spinners on the site and folder search inputs, focus restoration after clearing, and more legible hostname tooltips. [#36612]
• Line divider fields in the content editor render through a dedicated, lazily loaded component, removing a third-party divider dependency. [#36614]

Fixes

• Key/Value field entries are returned in their saved order rather than re-sorted alphabetically by the REST layer. [#31904]
• Content Drive date, date-and-time, and time filters now send the wall-clock value you picked and the table renders the same server-time value, so the editor, index, table, and filter all agree; the Time filter inputs are typeable, range-validation copy is clearer, and the New Folder dialog previews the folder you actually have open. [#36383]
• User names are escaped in the admin Users panel, closing a stored-XSS vector where a low-privilege user's stored name executed in an administrator's browser session. [#36357]
• User first and last names are now validated against the configurable name pattern on every save path, including PUT /api/v1/users/current. [#651]
• OpenSearch-backed searches now apply the secondary category-permission filter, closing a gap where category-restricted content was returned to users without the category role. [#36677]
• Deleting a content type no longer leaves orphaned unique-field rows when index removal hits a document version conflict, and an index-cleanup error can no longer abort relocation, database deletion, or the content-type-deleted event. [#36680]
• Field-sorted searches report a null relevance score on OpenSearch, matching Elasticsearch behavior instead of returning 0.0. [#36681]
• GET /api/v1/contenttype with multiple type filters now sorts the whole result set before paginating, so pages are disjoint and a content type no longer reappears across pages. [#36072]
• Removed the repackaged dot.commons-io jar, a shaded copy of Apache Commons IO 2.0.1 flagged for CVE-2024-47554; the modern commons-io already on the classpath covers all usage. [#36739]

Infrastructure & Security

• Integration suites can now run under a chosen Elasticsearch-to-OpenSearch migration phase — locally, per PR via label, on demand, or on a weekly sweep across all three phases. [#36320]
• Elasticsearch mapping, index, and app ITs resolve the active index in a phase-aware way and gate Elasticsearch-only assertions, stabilizing the OpenSearch-only test phase. [#36320]
• Release pipeline reliability fixes: a transient Docker cache-export error no longer fails release deployments, the changelog site-publish job was restored after being dropped in a merge conflict, the changelog publisher sends the required end-of-life date, and SDK publishing runs as intended. [#36744]
• Concurrent AI review workflows no longer overwrite each other's pull-request comment, so a code review is not replaced by an unrelated job's progress message. [#36761]
• Added an operator runbook covering evergreen-track taint, track hold, and single-environment hold procedures, including dry-run steps, verification, and undo. [#36769]