Deprecation of Workflow Client Methods

Multiple constants and methods in Workflow Client have been deprecated.

The legacy Workflow Client properties file configuration setup has been deprecated. It will be replaced by a Spring approach in a future release. In preparation for this, multiple methods and constants in com.coremedia.workflow.WfClient have been deprecated.

Other deprecations without a replacement:

(CMS-28272)

Updated postgresql driver

Updated `org.postgresql:postgresql` to `42.7.7`

(CMS-28048)

Third-Party Update: OpenCSV

OpenCSV has been updated to version 5.11.1. This includes an update of transitive dependency commons-beanutils to version 1.11.0 and avoids potential security issue CVE-2025-48734.

(CMS-27955)

Deprecation: Workflow JAR Upload

The feature to upload a JAR file of classes with a workflow process definition has been deprecated and should not be used anymore. This avoids potential problems with storing executable code in the database. With different versions of custom code in the database, it can become hard to track which code is actually used in production, and to detect and fix security issues in all variants of uploaded custom code. Furthermore, in case attackers have gained write access to the database, they could use this feature to execute code in the Workflow Server. If unused, it is therefore recommended to disable the usage of uploaded classes by setting the newly introduced configuration property workflow.server.use-uploaded-jar to false. Required classes should be added to the Workflow Server classpath instead.

The Workflow Server does not automatically remove previously uploaded JAR files from the database, if workflow.server.use-uploaded-jar is set to false. In case of unexpected problems with workflows that still need previously uploaded JAR files, it is possible to enable JAR file usage again by setting the property back to true.

As part of this change, the corresponding options j and -jar of the cm upload tool have been deprecated.

The following Java API methods have been deprecated as well, and should not be used anymore:

(CMS-27951)

Deprecation of XML Importer

The XML Importer has been deprecated for removal. As a replacement, a custom Unified API client, the Ingest Service for CoreMedia Content Cloud Service or the serverimport tool should be used.

The XML Importer will be removed in the next major release.

(CMS-27870)

Fix Content Feeder Background Issue Feeding

Fixed a bug in the Content Feeder that content issues were not indexed in the background.

(CMS-27868)

Deprecated Blueprint CAE Feeder Classes ValidFromPropertyConverter and ValidToPropertyConverter

Blueprint CAE Feeder classes ValidFromPropertyConverter and ValidToPropertyConverter of package com.coremedia.blueprint.caefeeder have been deprecated and will be removed in a future release. Their usage in apps/cae-feeder/modules/extensions/am/am-caefeeder-component/src/main/resources/META-INF/coremedia/am-caefeeder.xml has been replaced with the functionally equivalent configuration of a default value.

(CMS-27627)

Deprecation: Public API for Custom Proactive Engine Application

Custom Proactive Engine / Persistent Cache applications will not be supported anymore in the next major version CMCC 13 (2512.0.0). Proactive Engine and Persistent Cache are internal technical components of the CAE Feeder. They should not be used in custom applications anymore and may not work as before in future release CMCC 13. Consequently, parts of the public Java API have been deprecated.

The following classes and interfaces have been deprecated now for removal in CMCC 13. There is no known use case to keep that API for customization in the CAE Feeder.

The following interface of package com.coremedia.cap.persistentcache.proactive.content has been deprecated with replacement:

The following methods of package com.coremedia.cap.persistentcache.proactive.content have been deprecated with replacement:

The methods startEvaluators and stopEvaluators of class com.coremedia.cap.persistentcache.proactive.ProactiveEngineManagement have been deprecated. JMX operations of MBean ProactiveEngine with the same name should not be used anymore. They don't have any effect for the CAE Feeder.

(CMS-27400)

Content Server and Workflow Server DB Transaction Retry on Amazon Aurora "Zero-Downtime Patching"

The Content Server can now be configured to perform retries on database transactions in case of connection loss due to “Zero-Downtime Patching” on Amazon Aurora (MySQL only).

To configure the Content Servers for retries, use these properties:

To configure the Workflow Server for retries, use these properties:

Retries on a single Workflow Server database transaction are limited to 15 times.

Set the delay values and retries (see above) large enough to cover prolonged database unavailability during failover.

Make sure to set DNS caching on your system to a very short time (probably shorter than *.retry-delay) to allow for refreshed hostname resolution before the next attempt on a previously failing database is started. This can be necessary to successfully contact the current primary database instance in a database failover setup.

(CMS-27224)

Options for Command Line Tools

With the update to org.apache.commons.cli.DefaultParser, the handling of command line options has become stricter.

To allow backwards compatible configuration, several long options have been added explicitly. In these cases, only the long options are documented, but the short options will still work, e.g., --bloburl can be passed as -bloburl. This fallback behavior is part of commons-cli and may change in the future.

Generally, the usage of a long option should be preferred over the use of a short option, i.e. prefer --url over -url, while the latter one will still work for now.

The following changes are introduced:

(CMS-27223)

Updated Maven dependencies and plugins

Updated several dependency and plugin versions.

The following plugins and dependencies have been updated:

(CMS-27021)

Update of MongoDB Java driver to 5.3.1

The third-party dependencies org.mongodb:mongodb-driver-legacy, org.mongodb:mongodb-driver-core and org.mongodb:bson have been updated from version 4.11.1 to 5.3.1.

No breaking change was required for CoreMedia code, but custom code using MongoDB API may need to be adapted.

(CMS-26000)

Deprecation: Java API Package com.coremedia.cap.server.search

Interfaces and classes of package com.coremedia.cap.server.search have been deprecated in the Java API and should not be used anymore. This includes the Content Server SearchService interface and some related classes that are listed below. They were introduced long time ago for integrating alternative search engines for the Site Manager. The use case does not exist anymore, because the Site Manager has been removed from the product with CMCC 12. Internally, this interface is still used in the Content Server to implement search functionality for the Unified API. However, the now deprecated interface should not be used anymore to customize the implementation of search functionality. In most cases, applications should rather communicate directly with a search engine anyway, and not use the less flexible and less performant Unified API SearchService abstraction.

Note, that there are multiple SearchService interfaces in different packages of the Java API. This deprecation only affects package com.coremedia.cap.server.search.

The following classes and interfaces have been deprecated:

(CMS-25951)

Third-Party Update: Apache Tika 3.1.0 and Transitive Dependencies

Apache Tika has been updated to version 3.1.0. As part of this change, the following transitive dependencies of Apache Tika have been updated.

Updated dependencies:

If you use these libraries in project code, please check their respective release notes for changes and upgrade information.

(CMS-25920)

New Content Server license information metric

Metrics providing information on the used Content Server license are now available. Details are documented in the Operation Basics Manual.

The following new metrics are now available:

(CMS-25393)

CAE Feeder IndexVerifier Configuration

The new CAE Feeder configuration property caefeeder.index-verifier.enabled can be used to disable the check that the configured database and search engine index were initialized by the same CAE Feeder instance.

(CMS-21621)

Multi-Site Manual: Restructuring Sites and Changing Site Type

The Multi-Site manual now contains two new sections:

Both address sensible topics in the lifetime of a multi-site setup, that should be carefully planned and tested.

(CMS-13739)