Release notes:OpenCms 21

• Page editor: Allow copying write-protected elements.
• Workplace: Added users’ full names to the principal selection dialog.
• Workplace: Improved the “Edit new module” dialog.
• Workplace: Improved folder size formatting in the resource info dialog.
• Workplace: Confirm file selection filter with Enter key.
• Gradle build: Updated configuration for Gradle 8.10.
• Gradle build: Improved handling of module JARs.
• Solr: added update option for searchcontent in XSD searchsettings.
• Solr: Improved module import performance for external servers.
• Solr: Improved indexing performance for resources with relations.
• Solr: Updated Solr to version 10.
• Added test case for improved handling of missing XSDs.
  Cleaned up redundant legacy javax.* and jakarta.* API JARs in WEB-INF/lib.
• Pull request #825 file sorting by name in explorer table and tree (partial merge) (github pull request #825).
  Pull request #827 removes mavenLocal for more stable Gradle dependency resolution (github pull request #827).
• Pull request #831 modernizes Gradle plugin usage and build directory handling (github pull request #831).
• Pull request #832 updates Gradle to use lazy task registration (github pull request #832).
• Pull request #833 standardizes test execution for Gradle and IDE integration (github pull request #833).
• Pull request #837 Added .csv and .ai file type mappings to VFS resource types (github pull request #837).

Issues fixed in OpenCms 21

• Security: Fixed RCE vulnerability related to UGC.
• Security: Fixed CVEs by upgrading Apache Tika.
• Security: Fixed XXE issue for old import versions.
• Fixed flex cache issue with wrong entry after direct page open following publish.
• Fixed wrong accordion heading in the container page “Info” dialog.
• Fixed inactive save buttons in the i18n bundle editor.
• Fixed Solr highlighter configuration to use hl.method.
• Fixed dummy elements displayed on default detail pages.
• Fixed missing input validation in the resource type app.
• Fixed edge case issue when moving a user between OUs.
• Fixed upgrade wizard including demo template JARs.
• Fixed exception for unreadable content folders in resource type config.
• Fixed websites app error when server URL has no protocol.
• Fixed websites app removing a site on empty or invalid input.
• Fixed issue with reloaded element HTML sanitation breaking inline editing.
• Fixed issue #836 edit button shown for non-editable resources in the publish dialog (github issue #836).
• Fixed issue #838 undelete for Element Authors without the Editor role (github issue #838).

OpenCms 21 is backwards compatible with all OpenCms versions from 10 to 20. Templates and other OpenCms developed code from these versions should mostly work “out of the box” with version 21.

Note for Alkacon OCEE users: Alkacon OCEE users will need a new OCEE version for OpenCms 21. The update is free for Alkacon customers with a current OCEE subscription. Please contact Alkacon to obtain the new version.

Compatibility with Java versions, servlet containers and databases

OpenCms 21 is compatible with Java 25 and 21.

OpenCms 21 requires a Java Servlet 4.0 compliant web container. We have tested this release with Jetty and Tomcat. It works “out of the box” with Jetty 12 or Tomcat 9. Others have reported successful deployments of OpenCms on other web servlet containers like WildFly, GlassFish, WebLogic, WebSphere and Resin.

On the database side, we provide support for MySQL, MariaDB, Oracle, PostgreSQL, MS SQL Server, DB2 and HSQLDB.

Git branches and build tags for this release

The main OpenCms Git repository is available on Github at github.com/alkacon/opencms-core.

This release is tagged build_21_0_0. In case you want to get the most recent OpenCms sources from Github, please check out the branch master. 

OpenCms is a leading Open Source Content Management System. The software has been in continuous development since 2000 and has an active community of open source developers.

OpenCms is a Java and XML based enterprise website content management solution built entirely from open source components. The user interface is completely browser based. OpenCms offers powerful and easy-to-use features that are particularly suitable for Internet or Intranet applications of large companies and organizations. OpenCms is open source software released under the LGPL license.

Alkacon Software GmbH & Co. KG from Cologne, Germany is the company responsible for the development of OpenCms. Alkacon Software provides training, support and add-on products for OpenCms. This provides our customers with additional security and convenience when using OpenCms in mission critical installations. For more information, please see the Alkacon product overview.

• The page editor allows WYSIWYG inline editing of web pages and arrangement of content by drag & drop.
• The form based editor allows editing of structured content in a well defined form mask.
• The sitemap editor allows creating new pages and rearranging the navigation tree by drag & drop.
• Responsive "Mercury" default template based on Bootstrap 5 with many features.
• Headless API for accessing content as JSON from external applications.
• Content creation for mobile devices with preview and device specific content control.
• Structured content can be defined using a simple XML schema.
• Easy to use "Online / Offline" workflow, changes must be approved before they become visible.
• Link management for all internal resources with broken link detection.
• Integrated image scaling and cropping.
• SEO features with automatic sitemap.xml generation and page alias support.
• Full featured user management that supports the concept of "Organizational Units" (OUs).
• Allows management of multiple websites within a single installation.
• Content can be served dynamically or exported to static HTML files.
• File access to the OpenCms content repository over WebDAV and CMIS.
• Integrates Apache SOLR for powerful content searching and noSQL like queries.
• Full text search for web pages as well as in office documents such as PDF, MS Office and Open Office.
• Extensions can be added through a flexible module system.
• The "time warp" feature allows to view resources which are expired or not yet released.
• JSP integration for dynamic functionality in templates, dynamic forms etc.
• ... and much more

If you find a security vulnerability, please report it to us by using our security vulnerability report form.

Please report other issues found in OpenCms using our GitHub issue tracker.

Contributions to the OpenCms core development are most welcome. Please submit your pull requests directly on GitHub.