Release Notes

With FirstSpirit 2023.9, the integrated Embedded Tomcat Web Server for web applications was introduced.

Starting with version 2024.12, the Embedded Tomcat will replace the previous Jetty Web Server as the default server for web applications.

Support for the Jetty Web Server will be discontinued with FirstSpirit 2026.2.

Crownpeak recommends switching the web applications to the Embedded Tomcat Web Server at an early stage.

As of the release 2025.9, the following internally used software has been updated.

• Apache Commons Net
  Update from version 3.1 to version 3.11.1
  
• Google Web Toolkit („GWT“)
  Update from version 2.11.0 to version 2.12.2
  

The SecurityManager has been part of Java since version 1.0 and allows the configuration of security policies that apply to the entire application. However, it has been discussed for more than four years now to remove it from Java. This goal is now approaching: while Java 17 already marked the class as "to be removed", it is no longer functional in versions from Java 24 onwards.

In addition, the use of the SecurityManager causes further disadvantages:

• Newer software components are no longer compatible, such as Apache Tomcat 11.
• When using concurrency, a set SecurityManager can lead to errors that are difficult to diagnose.
• The permission checks can cause significant performance losses.

FirstSpirit currently uses the SecurityManager in various areas, for example, to secure access to certain program parts or to address potential security vulnerabilities in serialization. Replacement mechanisms have been created for these in recent releases, so disabling it does not pose a security risk. However, there are areas that could not be converted:

• Securing executions in scripts or templates is no longer possible.
• Manual adjustments in the file fs-server.policy no longer have any effect.

The default deactivation of the SecurityManager is scheduled for version 2025.10. If you use one of the two options mentioned above or have any other questions about the SecurityManager, please contact Customer Support.

Modules with resources that are not marked as "isolated" access internal classes of FirstSpirit as well as internally used libraries, and thus run the risk of no longer functioning after a server upgrade.

As already announced with 2025.2, support for modules with legacy resources was discontinued with FirstSpirit 2025.9.

The current FirstSpirit version now supports the UI languages Chinese, Japanese, Korean, and Portuguese in the ContentCreator.

On the FirstSpirit start page, you can select the language in which the labeling of the menu bar and the dialogs are displayed.

FirstSpirit 2025.9 supports the following module versions for FirstSpirit Content Experience Tools.

A new configuration option of the CXT platform now also enables connection to FirstSpirit servers whose homepage is accessible via a customized context path:

cxt.platform.firstspirit.root-context=/fs5root

Support for Function Calls in the FirstSpirit AI API has been implemented to enable the execution of external functions and actions directly via the API.

Modules or project scripts can define functions with this. This allows, among other things, the provision of data or information that can be evaluated in prompts, as well as the triggering of actions such as text changes, alt-text generation, or the creation of new pages.

With the FirstSpirit version 2025.9, the new feature "Collaboration" enters an open beta testing phase.

FirstSpirit Collaboration enables direct collaboration with other project users within the ContentCreator.

• Language-specific comments can be added to individual input components, such as headings or images.
• Other project users can respond to comments.
• The FirstSpirit AI agent is available to assist. It understands the context and provides appropriate responses accordingly.

For more information on installation and user introduction, please also refer to the documentation.

With the FirstSpirit version 2025.9, the new feature "Language-Dependent Release" enters an open beta testing phase.

It enables authorized editors to selectively approve and publish content per language in multilingual projects.

By default, the language-independent release is enabled for all projects.

The feature language-dependent release can be activated individually for each project in the server manager under the project settings.

For more information, see also the documentation.