Skip to content

Release 26.08.24-01

Choose a tag to compare

View all tags
@dotCMS-Machine-User dotCMS-Machine-User released this 24 Aug 18:31
v26.08.24-01
9db7f74

dotCMS 26.08.24-01 brings OAuth/OIDC and SAML authentication into core as the new dotAuth portlet, ships a redesigned dotAI provider configuration page with live connection testing, and fixes a set of Content Drive filtering and Block Editor rendering defects. It also raises BouncyCastle to 1.85 across the distribution.

Caution

Rollback Warning: This release contains an irrevertable change that is non-trivial to rollback from.

  • Users REST API: PUT /api/v1/users now applies an explicit empty roles array by removing all user-assignable roles; role memberships removed under the new behavior are not restored by rolling back. [#37109]

Features

  • OAuth 2.0 / OIDC and SAML authentication are now first-class in core under a unified dotAuth portlet in Settings, with per-host configuration, OIDC discovery auto-fill, config bundle import/export, configurable role sync, and a headless token-exchange flow for SPAs. [#35555]
  • Redesigned dotAI provider configuration page with per-capability cards for Chat, Embeddings and Image, fields rendered dynamically from provider metadata, and a Test Connection action that issues a real call against the configured provider. [#37048]

Enhancements & Adjustments

  • OpenSearch 3.x test environments and migration examples now target 3.8.0, including the single-node-os-migration reference stack and the integration-test compose defaults. [#37059]

Fixes

  • Content Drive field rendering and filtering now behave correctly: True/False Radio and Select filters match both values, single-option Checkbox filters return results in either direction, the Locale filter defaults to the environment default language, the Content Type filter no longer keeps a stale search, system content types are excluded from the Add New picker, and ?editContent= deep links reopen the intended language version. [#37074]
  • Content Drive columns for boolean Radio and Select fields with Show in List enabled are now sized from their own header text, so headers no longer overflow into the neighbouring column. [#37164]
  • The Block Editor no longer renders blank for content carrying highlight marks or for values passed as a bare array of nodes, both of which previously discarded the stored document. [#37145]
  • PUT /api/v1/users now honors an explicit empty roles array by removing the user's assignable roles instead of silently returning 200, and role updates reconcile memberships rather than wiping and re-adding them. [#37109]

Infrastructure & Security

  • BouncyCastle upgraded from 1.84 to 1.85 across the dependency BOM and the Tika OSGi bundle, addressing CVE-2026-59638. [#37111]
  • The bundled dotSAML plugin moves to release 26.08.21, replacing the embedded BouncyCastle 1.54 jar with 1.85. [#37159]
  • Release and PR pipelines no longer hang indefinitely on an unbounded package-manager step: the release path drops the dependency entirely and the test phase bounds its install with a timeout. [#37119]
  • Release notes tooling now walks back to the last documented release when auto-detecting the previous tag, so a same-day retry no longer truncates the changelog. [#37140]
  • Added label-gated dotbot code review and dotbot act workflows to the CI pipeline. [#37163]
  • Fixed a time-dependent failure in the QA stuck-check smoke tests by freezing the Date constructor rather than only Date.now(). [#37169]
Assets 3
Loading