Headless Server: Persisted-query cache poisoning fixed

The Headless Server now rejects persisted-query requests whose body does not match the query registered under the supplied queryId or sha256Hash. Previously, a request that combined a known persisted-query ID with a foreign query body was executed and the resulting document was pinned under that ID in the per-instance in-memory cache, replacing the effective query on that JVM until the container was restarted. Behind a load balancer this could cause the same client request to return alternating responses depending on which instance handled it.

On mismatch the server now responds with PersistedQueryIdInvalid and does not update the cache. Marker-only requests (PersistedQueryMarker), empty bodies, and Automatic Persisted Query (APQ) registrations with a matching hash continue to work unchanged. No API or configuration changes are required.

(CMS-31338)

Fixed Publisher removing empty Struct Lists during blob conversion

The Publisher no longer removes empty Struct Lists from Struct properties during blob conversion. Previously, when resolving blobs on the MLS, the conversion logic erroneously skipped empty Struct Lists, causing Struct properties to differ between CMS and MLS/RLS. This could lead to unexpected behavior in application code that relies on the presence of empty lists within Struct properties.

(CMS-30789)

Image Editor UI improvements

The image editor's stage is now stateful and remembers its manually set size. In addition, the layout is more compact.

(CMS-30696)

Fixed Issue Styling For Nested Link Lists

If you had an annotated link list with am embedded link list in the annotation, error and warning styles always appeared on both link lists, regardless of whether the embedded link list had issues or not. This is fixed, each link lists displays issue highlights only for itself.

(CMS-29406)