Release Notes

As of the release 2023.7, the following internally used software has been updated.

• Apache Batik (Display, creation and manipulation of scalable vector graphics, SVG)
  Updated from version 1.14 to version 1.16
• TwelveMonkeys ImageIO (extended Java support for image file formats)
  Updated from version 3.8.2 to version 3.9.4

With the current FirstSpirit version the DH ARC4 transport encryption is replaced by ChaCha20 transport encryption.

X25519-ChaCha20-Poly1305 is a replacement to the DH_Arc4 algorithm because it is more secure and has no known vulnerabilities.

With the current FirstSpirit version, another compression mode Zstandard is now available and can be selected in the connection settings. The new compression mode aims to provide fast compression speeds while maintaining a high compression ratio.

Connection settings: Compression

For more information, see FirstSpirit start page / Areas of the start page / User (→Documentation for Administrators), section Configuring connection settings.

Password encryption now also includes the password for configured Tomcat web servers.

Note: The following steps are required when downgrading the FirstSpirit server:

Manual configuration adjustment:

• Shut down FirstSpirit Server.
• Before starting with the old version, replace the encrypted password with the decrypted password in the corresponding ini file of the web server.

OR

Password encryption deactivation before shutting down the new version:

• In fs-server.conf, enter the value 0 in the password.encryption.active parameter.
• Optional: Enable encryption after the downgrade is complete.

For more information, see FirstSpirit Manual for Administrators, Password encryption.

The migration to Jakarta EE 6.0 is an essential step to ensure the security of web applications.

Support and current timeline

Here is the current plan:

• 2023-06 Beta-version of the FirstSpirit JakartaEE Edition is available for testing (available via Support)
• 2023-08 Stable release (2023.9) with support for automatic migration
• 2024-08 Support for automatic migration is removed with FirstSpirit 2024.9

The FirstSpirit installation may be affected if any of the following conditions apply:

• The FirstSpirit installation is not maintained in the Crownpeak Cloud and deploys web-applications to an application server like Apache Tomcat.
• A custom module is used that contains a WebApp component with code that uses the legacy JavaEE API, such as the Servlet API.
• A custom module is used that contains a WebApp component with dependencies that use the old JavaEE API, e.g., Spring Boot 2.x.

The module used could be affected if at least one of the following conditions applies:

• The module contains a WebApp component with code that uses the old JavaEE API, e.g., the Servlet API.
• The module contains a WebApp component with dependencies which use the old JavaEE API, e.g., Spring Boot 2.x.

More information and updates can be found in the Crownpeak Community and the detailed Jakarta FAQ.

Contact Customer Support Team if you have questions or feedback regarding the migration.

The logging of the FOP module has been adjusted. Instead of the fs-wrapper.log the log outputs are now in the fs-server.log. Furthermore, the number of log outputs has been significantly reduced.

In the course of this, relevant errors during PDF generation are now also visible for the generation. To prevent these errors from increasing the number of warnings for a corresponding generation, these messages are temporarily output with the INFO log level.

In a later FirstSpirit version, the log level of the messages will be increased to the log level WARN.

Since corresponding INFO outputs are not output with the previous standard log configuration of FirstSpirit, we recommend setting the log level for the org.apache.fop class to INFO in order to be able to detect any existing problems in FOP generation in advance.

For this purpose, the logging configuration must be extended as follows:

Log4j2

<Logger name="org.apache.fop" level="INFO" additivity="false">
 <AppenderRef ref="fs"/>
</Logger>

Log4j1

log4j.logger.org.apache.fop=INFO

The temporary feature files are now automatically deleted from the server (<FirstSpiritROOT>/data/projects/project_<id>/features directory) after the installation process is complete, if the feature was installed via the GUI or by schedule task.

If features are installed via API, then the deletion itself must be carried out. For this purpose, the FeatureAgent interface (FirstSpirit Developer API, Package de.espirit.firstspirit.feature) has been extended by the following methods. 

• getFeatureFiles() - returns a list of the feature ZIPs currently present in the project
• deleteFeatureFile(<feature file>) - deletes the specified feature ZIP from the <FirstSpiritROOT>/data/projects/project_<id>/features directory of the respective project.

In addition, the unneeded contents of the <FirstSpiritROOT>/data/projects/project_<id>/features directory are no longer included in the project export.

FirstSpirit 2023.7 supports the following module versions for FirstSpirit Content Experience Tools.

With the current release, session handling for the MicroApps has been improved.

In this context, an optional parameter has been introduced. This parameter can be configured either for all MicroApps (file cxt-microapps-common.properties) or individually per MicroApp.

• cxt.platform.connection-cleanup-rate
  Defines when the MicroApps close their FS connection (in minutes).
  Default value: PT30M (30 Minutes)

For more information see Installation / Modules / Installing modules / MicroApp configuration parameters (→Documentation “Content Experience Tools”).

A new method toStream() has been added to the interface de.espirit.common.util.Listable (FirstSpirit Access-API, Package de.espirit.common.util).