Release 26.08.12-01

dotCMS 26.08.12-01 adds Lock and Unlock quick actions to Content Drive and an opt-in HTML minifier for rendered pages, alongside fixes to category deletion, push publishing, OpenSearch random-sorted queries, and cluster cache-transport visibility.

Features

• Content Drive's Action Center gains Lock and Unlock quick actions, with every quick action now routed through the preview screen so the selection can be edited before firing and a run survives the dialog closing. [#36844]
• Rendered HTML can now be minified — stripping insignificant whitespace and comments from delivered pages — behind the opt-in FEATURE_FLAG_MINIFY_HTML flag, off by default. [#36851]

Enhancements & Adjustments

• The content editing side panel now closes on a click outside through the unsaved-changes guard, defaults to 80% width, and picks up sidebar and section-order polish. [#36965]
• SDK README files now include a "Which SDK Version Should I Use?" section covering version compatibility with your dotCMS instance, upgrade guidance, and LTS handling. [#36955]
• Frontend documentation and coding-standards guidance were refreshed for the Angular 22 / TypeScript 6 upgrade, including the new change-detection default, teardown patterns, and pnpm nx commands. [#37009]

Fixes

• Deleting a category now removes every descendant at all depths instead of leaving deeper levels orphaned as top-level categories, and the REST endpoint reports per-item failures rather than always returning success. [#36906]
• Random-sorted searches on OpenSearch no longer discard the query and return arbitrary content — affecting $dotcontent.pull(query, limit, "random") and the identifier date job. [#36973]
• The identifier date job now walks its content with a scroll query instead of broken offset arithmetic that skipped roughly half the content of a type and could loop forever above ~15,000 contentlets, and skips index hits the database cannot resolve instead of failing the whole job. [#36973]
• Push publishing a site no longer bundles related non-Host contentlets as .host.xml, which caused the receiver to fail with a missing content type or a null host. [#34522]
• Cluster cache invalidations dropped by a failing pub/sub transport are now counted and logged instead of discarded silently, transport re-initialization is idempotent, a failed cluster rewire is retried on the next heartbeat, and a new cache-transport health check plus Micrometer gauges expose the state. [#36803]
• Startup no longer runs full-table count(*) probes against inode — existence checks are used instead, removing a significant cost from repeated startup-task passes. [#36974]
• Clicking a link to a file asset in the Universal Visual Editor now opens it in a new tab instead of failing to load it as a page, in Edit as well as Preview mode. [#36925]
• The native Block Editor renderer in @dotcms/angular no longer pads text runs with leading and trailing spaces, so links and adjacent marked runs render flush against surrounding punctuation. [#37001]
• Content Drive's Unlock warning no longer fires for administrators who can release any lock, the action preview marks which rows hold locks owned by other users, and a partial run now reports skipped and failed counts together with their causes. [#36975]

Deprecations, End of Life & Reminders

• The FEATURE_FLAG_LOCALE_SELECTOR_V2 flag and the legacy locale selector component it gated have been removed; the current locale selector is now always used. [#36980]

Infrastructure & Security

• UtilMethods.getURL — reachable from Velocity templates — is now restricted to http/https, rejects loopback, link-local, and private hosts, and no longer follows redirects, closing a local-file-read and SSRF path for users with design-layer access. [#36969]
• Request cost metering was extended to previously unpriced work — bulk content loading, GraphQL execution, Velocity rendering, navigation building, content indexing, and background jobs — with the price table re-based and background cost reported separately in the snapshot. [#36977]
• Navigation cost is now charged only on a cache miss, so a live-mode navigation served from cache costs nothing. [#37000]
• The pg-base backup image ships the PostgreSQL 18 client so pg_dump covers the current and upcoming server fleet. [#36812]