Liferay DXP now allows on-demand migration of Virtual Instances across different installations, making existing environments portable and easier to manage—especially in cloud-based deployments. Whether you're moving from on-premise to Liferay SaaS, or just shifting between environments (like UAT to Production) on the same installation, this feature simplifies the process by allowing instances to be migrated, instead of the entire database.
Feature can be enabled with Beta Feature Flag: LPD-11342
Release Notes
DXP is now certified for use with the MySQL 8.4 database version. Also applies to 2025.Q1 LTS.
Key Benefits:
Allows users to update to the latest LTS version of MySQL database. As an LTS release, MySQL 8.4 is the most stable and predictable version for production environments since it receives bug fixes and security patches for an extended period from Oracle. This longer support window reduces the need for frequent major upgrades.
The AMD Loader is being deprecated and it is not included in the bundle unless deprecation FF LPD-48372 is enabled.
As a result of the AMD Loader deprecation, the npm-bundler will stop working too, it is recommended to use standard bundling tools such as webpack, esbuild, vite, etc.
The JS Component Support Tabs (data-toggle="liferay-tabs" API ) is being deprecated and it is not included in the bundle unless deprecation FF LPD-47713 is enabled.
The two separate option menus currently displayed in the Web Content Display widget have been merged into a single, consolidated dropdown menu for content creators. This new menu will improve the user experience by reducing confusion and unnecessary clicks, ensuring all relevant widget actions (e.g., Hide Widget, Duplicate, Export/Import, etc.) are easily accessible.
Added logging to indicate the completion of fragment deployments via the deploy folder. This provides better visibility into the deployment process and allows for tracking deployment duration.
There are some advantages of including a message like that, for example:
- Count the duration of a deployment
- See the fragment progress deployment until it is deployed.
We’ve introduced robust Content Security Policy (CSP) capabilities to enhance the security of your digital experience platform. This feature supports eight key directives, including script-src
and style-src
among others, ensuring secure handling of scripts, styles, images, and more. By leveraging these directives, developers can mitigate cross-site scripting (XSS) attacks and data injection risks. The CSP implementation aligns with modern web security standards, offering both flexibility and protection. Administrators can now enforce stricter security policies without compromising functionality.
Key benefits:
Enhanced Security: Mitigates risks of XSS and data injection attacks by controlling resource loading and execution.
Compliance-Friendly: Aligns with industry-standard security requirements, supporting stricter compliance protocols.
Customizable Policies: Allows developers to tailor CSP directives to meet specific project or organizational needs.
Improved Trust: Strengthens end-user trust by providing a more secure and reliable platform experience.
To ensure the quality, stability, and modernity of Liferay DXP, we've updated to React 18, bringing significant benefits in security, performance, and compatibility. This update is critical to maintaining DXP's status as a robust and future-proof platform.
Key benefits:
Security Enhancements: Older library versions can expose vulnerabilities. Upgrading to React 18 mitigates these risks by incorporating the latest security patches.
Performance Improvements: React 18 introduces features like concurrent rendering, which enhances responsiveness and load handling for better user experiences.
Enhanced Compatibility: Upgrading ensures DXP aligns with modern tools and frameworks, minimizing integration challenges and future-proofing our development processes.
Continued Support: Staying current with React’s ecosystem ensures ongoing access to community updates, bug fixes, and innovations.
Implemented proactive access token management with automated email notifications. Users will now receive alerts 1 month, 10 days, and 1 day prior to token expiration, allowing for timely renewal and preventing service disruptions. Notifications are automatically cancelled if a new token is generated.
Key benefits:
Users are notified before token expiration, allowing for timely renewal and uninterrupted access.
Reducing administrative overhead, as automated notifications eliminate the need for manual monitoring and intervention.
By prompting timely renewals, the risk of using expired and potentially compromised tokens is minimized.
Data imports, using batch engine, now allows users to preserve content creator information (if required). Previously, imported content with batch was always assigned the user performing the import, resulting in loss of original authorship data when moving content. This update ensures accurate attribution of content ownership (if required).
Key benefits:
Able to keep critical user information during data promotion between environments
Can be configured separately per import process
Users now have the ability to update folder names and other details without being able to modify the workflow settings. This ensures there are no security issues and that all content within the folder follows the correct workflow process.
Key Benefits:
- Granting “Update” Permissions: Granting “Update” permissions to a role enables the user to edit a folder's properties, like its name and description.
Granting “Advance Update” Permissions: Granting “Advance Update” permissions to a role enables the user to update the workflow associated with a folder. The folder's properties, such as name and description fields, remain disabled and cannot be edited.
It is now possible to view where a document is being displayed on a page.
Key Benefits:
- Users can now view a document’s usages through the “View Usage” action in the entry. This will show all locations where the document is mapped or displayed to the end user
Microsoft no longer supports Sharepoint versions 2010/2013. See SharePoint Server 2013 - Microsoft Lifecycle and Microsoft SharePoint Server 2010 - Microsoft Lifecycle.This feature has been in maintenance mode for a very long time and there is just a very small user base. Considering the high costs for us in terms of tests maintenance, we decided to deprecate it.
Style Books in Liferay are now explicitly tied to a specific theme at the moment of creation, using the frontend token definition provided by that theme (via OSGi or themeCSS client extension). This structural link now ensures that each Style Book can only operate within the boundaries of its associated theme, eliminating cross-theme token contamination and enforcing clearer theme-based design governance.
Key Benefits:
Users can no longer save Style Books that accidentally combine tokens from different themes, avoiding visual inconsistencies and design regressions.
Every Style Book now visibly shows which theme it belongs to, reducing errors and making it easier for teams to manage design assets across multiple sites.
When applying a Style Book to a page, the system will only list those created with the same theme as the page’s current one—no more trial-and-error or guesswork.
If a Style Book becomes incompatible with the applied theme (e.g., after a theme change), it will be automatically unlinked to prevent display issues.
During platform upgrades, existing Style Books are automatically linked to the site’s current public theme (as defined in Site Builder > Pages > Options > Configuration), reducing manual cleanup work.
If a Style Book is imported without a valid
themeId
, the user gets a clear warning and knows exactly what’s missing to fix the import.Style Books based on themes that are no longer deployed or no longer provide a valid frontend token definition are automatically marked as inactive—clearly flagged and non-selectable.
The OSGi or themeCSS client extension ID is displayed for inactive Style Books, helping devs or admins identify which theme needs to be re-installed or fixed.
With the release of Liferay DXP 2025.Q2, we are deprecating the Elasticsearch 7 compatibility due to the end-of-maintenance and upcoming EOL of the Elastic Stack 7.17. Liferay strongly recommends all customers with 7.17.x or earlier deployments to upgrade to the latest compatible version of Elasticsearch 8.x. Learn more.
Working with Global Services to identify pain points in Javascript resources distribution and unused code was the trigger to:
Remove unused packages
Deprecate old packages
Set configurations to let users to not use/load some functionalities
Create a JS size comparision report
Create tooling to be able to split modules in smaller submodules
Key Benefits:
Reduced total JS bundle size → Faster portal loading
Reduced total exports → Faster portal loading
Taking as example Masterclass home page:
Reduced JS Size in MB by 20%
Reduced number of request by 12 %
Mobile Lighthouse score from 52 to 56
Desktop Lighthouse score from 70 to 77
Allow teams to divide modules to offer smaller entry points when they detect some part of the module is not commonly used.
Size report tooling able to trigger risks.
To continue broading the CSP support now 2 new directives are supported: base-uri
and object-src
With these two new directives support Liferay DXP covers all the directives recommended in the Google CSP Evaluator.
Key Benefits:
Enhanced Security: Mitigates risks of XSS and data injection attacks by controlling resource loading and execution.
Compliance-Friendly: Aligns with industry-standard security requirements, supporting stricter compliance protocols.
Customizable Policies: Allows developers to tailor CSP directives to meet specific project or organizational needs.
Improved Trust: Strengthens end-user trust by providing a more secure and reliable platform experience.
Supported directives with recommended values:
The Lodash library is being deprecated and it is not included in the bundle unless deprecation FF LPD-48975 is enabled.