Releases: intersoftdatalabs-in/percussioncms-java8
Release list
v8.1.7
Canonical Java 8 / 8.1.x download home: this repository (
percussioncms-java8).Binaries for the 8.1.x line are published here. The main percussioncms repo tracks Java 21 / 8.2 development.
Percussion CMS v8.1.7 Release Notes
Release Date: June 25, 2026
Build: 1
Percussion CMS v8.1.7 delivers platform modernization, security hardening, and accessibility compliance - so your team can operate with confidence. This release adds Google GA4 support, includes significant WCAG 2.1 AA accessibility improvements, critical security patches, and dozens of quality-of-life fixes across the CMS editor, publishing system, and REST APIs.
Upgrading is strongly recommended - this release addresses critical security vulnerabilities.
Quick Summary
Key Changes:
- Accessibility: WCAG 2.1 AA navigation improvements, ARIA attribute fixes, and tooltip refinements across the UI
- Automatic Directory Index Touch configuration on workflow approvals
- REST API validation now returns proper
400status codes - Folder creation displays correct success/error status
- Deleted pages properly removed from bookmarks and search results
- GA4 support for Google Analytics integrations, Google Setup, Traffic, and What's Working gadgets
- Deprecations: Registration Widget, Secure Login Widget, Redirect Management Gadget, EMS Event List Widget
Accessibility Improvements
Built for compliance: Percussion CMS v8.1.7 includes significant accessibility enhancements to meet WCAG 2.1 AA standards - ideal for government, education, healthcare, and public sector deployments.
This release addresses:
- Navigation Widgets: Added proper ARIA landmarks and labels to Nav and Breadcrumb widgets for improved screen reader navigation
- Form Widget: Email form fields now have configurable autocomplete attributes for better form completion support
- HTML Cleaner: Added missing roles and HTML attributes to improve semantic structure
- Dashboard Tables: Added missing
scope="col"andscope="row"attributes to table headers in Dashboard screens - Tab Navigation: Fixed sequential Tab key navigation on the Home screen
- Home Dashboard Tooltips: Removed global jQuery UI tooltip configuration that caused tooltips to persist incorrectly
New Features & Enhancements
Google Analytics 4 (GA4) Migration
- Updated for GA4: The Traffic Gadget, Google Setup, and What's Working gadgets are now updated to GA4
Need help configuring GA4? Intersoft Data Labs offers configuration assistance as part of standard support: percussionsupport@intsof.com
Important: If you previously configured Google Analytics and saw no data, please verify your GA4 credentials in the Google Setup Gadget after upgrading.
Workflow Automation
- Automatic Directory Index Refresh: Pages with Directory Widgets are now automatically touched when Person or Department assets are updated. Pages containing Directory Widgets will automatically be added to the Incremental publishing queue.
REST API Improvements
- Page by Path REST Resource: Added support for leading
Sites/prefix in the Page by Path REST resource, improving consistency with other API endpoints. - Improved Validation Error Responses: Validation errors now return proper
400 BAD_REQUESTstatus codes instead of500 INTERNAL_SERVER_ERROR, making API error handling more consistent and easier to handle in custom integrations. - DELETE Page by Path API: Fixed an issue where the API would fail to delete existing pages and return HTTP 500 PageNotFoundException.
Bug Fixes
CMS Editor & UI
- Footer Alignment: Default Percussion theme: Fixed footer text/value not properly aligned on the Page editor. The editor now maintains proper layout positioning regardless of theme CSS rules by using
!importantheight rules in the decoration CSS. - Admin Console Page: Fixed JavaScript error ("Cannot read properties of null (reading 'scrollHeight')") on the Admin Console page by ensuring DOM elements exist before referencing them.
- Site Import: Added safeguards to prevent JavaScript errors during site import operations when page data is incomplete.
Folder & Path Management
- Folder Creation Fixed: Content authors no longer see misleading "Path not found" errors when folders are successfully created - eliminating confusion and unnecessary retry attempts.
- Path Validation Improved: System now handles complex site structures more reliably.
Search & Directory
- Search Reliability: Path-based searches now work correctly without server errors - users get results instead of HTTP 500 failures.
- Directory Widget Filters: Fixed filter behavior so content authors can narrow and expand directory searches without losing their current selections.
- Deleted Content Handling: Search results gracefully handle deleted pages instead of showing confusing error messages.
Gadgets & Dashboards
- My Bookmarks: Deleted pages are automatically removed from user bookmarks - no more broken links or error messages.
- Traffic Gadget: Google Analytics data displays correctly again.
- Style Tab: Theme selection now loads properly without JavaScript errors.
- Theme Thumbnails: Layout stays clean and consistent regardless of image sizes.
Publishing
- New Site Publishing Fixed: Publishing now works correctly for newly created sites without requiring manual DTS Server configuration.
- High-Traffic Publishing: System handles concurrent publish operations reliably - no more failures or timeouts during busy periods.
- Publishing Console Fixed: Admin, Publishing, and Design tabs now load correctly without errors.
Workflow
- Workflow Name Validation: Fixed regex pattern issues with workflow and step names containing hyphens, resolving checkValidity errors.
- Page Saves: Optimized page save operations to avoid Derby lock timeouts during high-concurrency scenarios.
Content Security
- Duplicate Metadata Tags: Fixed duplicate Facebook Open Graph tags and Twitter/X metadata being rendered on pages.
Security Updates
This release includes critical security patches to keep your CMS infrastructure robust:
- Apache Shiro 2.1.0 Upgrade: Major security upgrade for Dashboard dependency - addresses CVE-2023-46749 (authentication bypass) and CVE-2023-46750 (open redirect)
- Tomcat 9.0.115: Latest security patches from Apache Tomcat including CVE-2026-32990, CVE-2026-29146, CVE-2026-24880, and others
- Content Security Policy: Updated CSP settings to support modern image URIs and improved DTS security configuration
Enterprise Support Customers: Critical security patches are available as part of your support contract. Contact us for priority upgrade assistance.
Dependency Updates
This release includes numerous dependency updates for improved security, compatibility, and stability.
Security-Critical Updates
| Component | Old Version | New Version | CVE Links |
|---|---|---|---|
| Apache Shiro | 1.13.0 | 2.1.0 | CVE-2023-46749, CVE-2023-46750 |
| Apache Tomcat | 9.0.113 | 9.0.115 | CVE-2026-32990, CVE-2026-29146, CVE-2026-24880 |
Server & Build Updates
| Component | Old Version | New Version | Notes |
|---|---|---|---|
| Jetty Maven Plugin | 9.4.11-SNAPSHOT | 9.4.58.v20250814 | Build improvements |
| Apache XBean Spring | 4.29 | 4.30 | Compatibility |
| Maven Resolver API | 2.0.14 | 2.0.16 | Build improvements |
| Maven Compiler Plugin | - | Updated | Build improvements |
| Maven Dependency Plugin | - | Updated | Build improvements |
| Maven JDeps Plugin | 3.1.2 | 3.2.0 | Build improvements |
| KeyTool Maven Plugin | 1.7 -> 2.0.2 | (progressive) | Build improvements |
| Versions Maven Plugin | 2.20.1 | 2.21.0 | Build improvements |
| Properties Maven Plugin | 1.2.1 | 1.3.0 | Build improvements |
Library Updates
| Component | Old Version | New Version | Notes |
|---|---|---|---|
| PDFBox | 2.0.30 -> 3.0.6 | 2.0.36 | 3.x reverted for Java 8 compatibility |
| Google HTTP Client | 2.0.3 | 2.1.0 | REST client improvements |
| Google API Client | 2.8.1 | 2.9.0 | API compatibility |
| Swagger UI | 5.31.0 | 5.31.2 | API documentation |
| Swagger | 2.2.41 -> 2.2.43 | (progressive) | API documentation |
| Netty | 4.2.9.Final | 4.2.10.Final | Network performance |
| Commons JEXL3 | 3.6.1 | 3.6.2 | Expression language |
| JUEL | 2.2.2 | 2.2.7 | Expression language |
| TwelveMonkeys | 3.13.0 | 3.13.1 | Image processing |
| ClassMate | 1.7.1 -> 1.7.3 | (progressive) | JSON processing |
| JUnit Jupiter | 5.14.1 | 5.14.3 | Testing |
| AWS SDK | 1.12.796 | 1.12.797 | AWS integration |
Platform Modernization
Keeping Percussion CMS current with modern standards. The following components have been deprecated or are pending removal. We encourage users to plan migrations accordingly.
Need help with deprecation migrations? Intersoft Data Labs offers migration assistance for all deprecated components as part of standard support and professional services. Contact Us
| Widget/Gadget | Status | Notes |
|--------------...
v8.1.6
Canonical Java 8 / 8.1.x download home: this repository (
percussioncms-java8).Binaries for the 8.1.x line are published here. The main percussioncms repo tracks Java 21 / 8.2 development.
PercussionCMS v8.1.6 Release Notes
Overview
This release provides security updates and bug fixes for PercussionCMS while maintaining compatibility with Java 8 (JDK 1.8.0).
Important Note
Several dependency updates were rolled back to maintain Java 8 compatibility. The versions listed below reflect what is actually deployed in this release.
Dependency Updates
Security & Core Libraries
- OWASP CSRF Guard: Updated to 4.5.0
- Jackson: Updated to 2.20.1
- Apache Tika: Updated to 2.9.4
- JSON: Updated to 20251224
- Eclipse Jetty: Updated to 9.4.58.v20250814
- Apache CXF: Updated to 3.5.11
- Apache PDFBox: Updated to 2.0.30
- Apache FOP: Updated to 2.11
- Rome: Updated to 2.1.0
- ICU4J: Updated to 77.1
- Apache Tomcat Updated to 9.0.113
Java 8 Compatibility Maintenance
The following dependencies remain at Java 8-compatible versions:
- Apache MyFaces: 2.3.11 (3.x requires Java 11+)
- Apache Shindig: 1.1-BETA5-incubating (3.x requires Java 11+)
Rolled Back Updates
The following dependency updates were attempted but rolled back for compatibility:
- Apache Commons Digester - Reverted to maintain stability
- Spotless Maven Plugin - Reverted to maintain compatibility
- Phloc Commons - Reverted to maintain compatibility
- javax.jcr - Reverted to maintain compatibility
Requirements
- Java Version: JDK 1.8.0 (Java 8)
- All dependencies in this release are compatible with Java 8
Build Information
- Branch: development-8.1.x
- Commit: 0a58214
For detailed information about specific PRs and version changes, see the detailed correction document.