Release 26.08.19-04

dotCMS 26.08.19-04 introduces the AI agent platform with its first agent, the Accessibility Studio, adds an Experiments portlet and new role-management REST endpoints, and fixes several high-impact defects in reindexing, App secrets storage, and the page editor.

Features

• New Accessibility Studio portlet under the agents route runs axe-core scans on a page, streams agent-applied fixes live, and lets authors review the working-vs-live diff before publishing, built on a reusable agent platform (@dotcms/ai SDK, MCP server, shared agent UI). [#36641]
• New Experiments portlet with a site-wide list screen — searchable, filterable, sortable, and paginated, with URL-synced state. [#36989]
• New Asset Picker for File and Image fields in Edit Content, with shared folder-tree browsing utilities lifted into @dotcms/data-access. [#36831]
• Content Drive quick actions now include Push Publish, gated on push publish environments reachable by the user's role. [#37080]
• New PUT /api/v1/roles/{roleId} updates a role's name, key, description, grant flags, and parent, including a guard against reparenting cycles. [#36936]
• New role-membership endpoints — POST /api/v1/roles/{roleid}/users/{userId} to grant a user a role and DELETE /api/v1/roles/{roleid}/users for bulk removal with per-user partial-success reporting. [#36937]

Enhancements & Adjustments

• API errors are now actionable for integrators and agents: an unknown field in a JSON write request returns a 400 listing the valid fields, /api/vtl/dynamic returns structured Velocity parse/eval errors plus non-fatal warnings in a response header, bad fillTemplate input returns 400 instead of 500, and previously undocumented request parameters and bodies are described in the OpenAPI spec. [#36641]
• Content Drive quick actions no longer duplicate Publish, Unpublish, Archive, Unarchive, and Delete — those are offered by the Workflow Actions section, where they resolve through the content type's own scheme mapping. [#37080]
• Removed the non-functional GET /api/v1/agents/a11y/active-run proxy endpoint, which could only ever relay an upstream 404. [#37099]
• Corrected a misleading comment on the server heartbeat interval, which defaults to 60 seconds rather than 5. [#37015]

Fixes

• Reindexing no longer stops permanently after repeated mapping timeouts: the concurrency guard now releases its permits correctly, a saturated pool never charges a retry against the journal entry, the guard self-heals without a restart, and a new reindex-mapping health check reports abandoned mappings. Instances that ran 26.07.13-01 or later still need the one-time requeue described in the linked issue. [#37038]
• The App secrets store is no longer deleted and recreated empty when it cannot be read — reads degrade gracefully, writes are refused rather than allowed to overwrite an intact store, and the store is published atomically. [#36724]
• The UVE editor script is now injected at the correct position on pages containing characters whose lowercase form is longer than the original, such as İ, which previously broke the page editor silently or returned a 500. [#37072]
• GraphQL page queries now resolve Block Editor fields containing commas, URLs, or punctuation instead of returning null with an internal error. [#37087]
• The Vanity URL Forward To picker no longer duplicates the file name when selecting a non-page asset. [#37050]
• Linked images authored in the Block Editor now render as clickable anchors in the Angular, React, Vue, and Velocity renderers, with rel="noopener noreferrer" added for target="_blank". [#36998]
• Embedded contentlet cards in the new Block Editor can be selected, deleted, reordered, and edited when text precedes them. [#36985]

Infrastructure & Security

• The dev image build no longer pulls pgvector's recommended packages, which were failing the arm64 build and blocking releases. [#36807]
• Added a developer quick start for the repository's Spec-Kit spec-driven workflow, including a recorded walkthrough. [#37110]
• Removed three unreferenced AI issue-triage sub-agent definitions from the repository's Claude configuration. [#37096]