Release Notes

As already announced with FirstSpirit 2026.3, the FirstSpirit web applications will be migrated to Spring Boot 4. This migration will be carried out with FirstSpirit 2026.5 and requires the use of Tomcat 11.

Please ensure that your web applications, modules, and components are compatible with Tomcat 11 and Servlet API 6.1.
Existing deployments based on Tomcat 10 or older will no longer be supported after the migration.

In this context, we would like to point out that with FirstSpirit 2026.5, the bytecode level will also be switched to Java 21 (see the announcement for FirstSpirit 2026.2). For running the FirstSpirit server, a Java runtime environment of at least version 21 will then be required.
Operation with Java 17 will no longer be possible from that point onwards.

The new FirstSpirit OIDC login module enables authentication of FirstSpirit users through an external OpenID Connect provider.

OpenID Connect (OIDC) is an authentication protocol based on the OAuth 2.0 standard. It allows clients to verify a user's identity through authentication by an authorization server (OpenID Provider). Additionally, basic profile information of the user can be retrieved.

Further information can be found in the documentation.

With Java 24, new, more restrictive default values were introduced for processing XML data via JAXP (Java API for XML Processing). This can lead to errors in XML processing in large FirstSpirit projects – for example, when importing extensive content.

The current version of the FirstSpirit backend now explicitly applies the default values valid up to and including Java 23 for all Java versions, ensuring that existing projects continue to be processed correctly without any adjustments.

Note for particularly large projects

If projects with database contents that include more than 50 million XML tags are to be imported, the parameter -Djdk.xml.totalEntitySizeLimit= can be configured with a correspondingly higher value in the fs-wrapper.isolated.conf file. The associated wrapper.java.additional.## parameter must use an index of 80 or higher.

The creation of external processes from scripts and templates is restricted by a whitelist starting with the current release. By default, only executable files in the directory <FirstSpirit-Server>/shared/bin/ are allowed.

Configuration: The new optional file fs-exec.conf under <FirstSpirit Server>/conf/ allows targeted configuration of constraints (RuntimeExitConstraint, ServerFileConstraint, ProcessStartConstraint) per execution context. Changes are applied automatically at runtime.

Allowing external processes

If external processes need to be started from scripts or templates, there are three options:

• Place the executable file (or a script or symbolic link) in the <FirstSpirit Server>/shared/bin/ directory. This directory is already permitted in the default configuration.
• Extend the whitelist by adding additional entries in fs-exec.conf.
• By setting the parameter execControlConstraints=false in the fs-server.conf, all constraints can be completely disabled.
  

FirstSpirit 2026.4 supports the following module versions for FirstSpirit Content Experience Tools.

The interface StoreElementAgent has been extended with new methods that enable access to store elements via UID and Java class. Specifying the IDProvider.UidType is no longer necessary — the appropriate UidType is automatically derived from the passed class.

New Methods:

• Optional<T> requestStoreElement(String uid, Class<T> type, boolean release)
• Optional<T> requestStoreElement(String uid, Class<T> type)
• T requireStoreElement(String uid, Class<T> type, boolean release)
• T requireStoreElement(String uid, Class<T> type)

Example

So far:

IDProvider element = agent.loadStoreElement(
    "myPage", IDProvider.UidType.PAGESTORE_LEAF, false); 
Page page = (Page) element;

New:

Optional<Page> page = agent.requestStoreElement("myPage", Page.class); 

or

Page page = agent.requireStoreElement("myPage", Page.class); 

Note: The type parameter must be a (sub-)class with its own UID_TYPE field.
Supported types include, among others, Page, Media, PageRef, PageTemplate, SectionTemplate, Script, Schema.

For executing workflows or scripts following the deployment of bundles, a technical user can now be stored in the "Bundle management" ProjectApp.

This is especially necessary when you want to perform modifying operations in the target projects after a deployment.

The FirstSpirit desktop apps (FirstSpirit SiteArchitect and ServerManager) are started and updated (rolled out) via the FirstSpirit Launcher.

The “FirstSpirit Launcher JRE” module enables customers and partners to easily switch between different Java versions for the operation of Java-based applications. The desired Java version can be selected server-wide for Microsoft Windows and macOS separately.

The included Java versions have been updated with the current release.

• 21.0.9+10 -> 21.0.10+7
  (Default - the version delivered with the FirstSpirit Launcher)
• 25.0.1+8 -> 25.0.2+10

With FirstSpirit version 2026.4, the feature "Language-dependent release" will be officially released.

It enables authorized editors to selectively approve and publish content per language in multilingual projects.

By default, the language-independent release is enabled for all projects.

The feature language-dependent release can be activated individually for each project in the server manager under the project settings.

For more information, see also the documentation.