We will introduce a deprecation badge within the Segments Editor in DXP. This badge will be visible whenever users attempt to create a new segment or edit an existing one. In addition to the badge, a UI alert will inform users that Segments in DXP are planned to be deprecated and that Analytics Cloud (AC) will become the single source of truth for segmentation. This change is intended to proactively set expectations and guide users toward creating and managing segments in Analytics Cloud moving forward. Starting in 2026.Q1 version, the Segments module in DXP will transition to a read-only experience by default. Users will only be able to view the list of segments created in Analytics Cloud within DXP. Segment creation and editing capabilities in DXP will no longer be available unless the Segments deprecation feature flag is explicitly enabled. The long-term direction is for Analytics Cloud to fully own segment creation and management, ensuring a single, centralized segmentation workflow. |
Release Notes
This mechanism is server-to-server, making it more reliable than front-channel methods that depend on the user's browser. The IdP will directly notify each RP (Relying Party aka Service Provider) that a user's session has ended by sending a signed logout_token. The RP must validate this token and terminate the corresponding local session.
Key Benefits:
Higher reliability and security: Server-to-server logout does not rely on the user’s browser, reducing failures caused by network issues, blocked scripts, or closed sessions.
Consistent session termination: Signed
logout_tokennotifications ensure each RP can securely validate and promptly terminate the correct local user session.
GDPR (EU) requires consent renewal every 12 months. Some national data protection guidelines even recommend more frequent renewal, such as every 6 months. We the renewal periods configurable where the administrator can manually add a number of months (maximum 12) to define the renewal period. Key Benefits:
|
This feature is now fully released.
The feature is now fully released.
The previous OIDC authentication flow identified users based on their email address, which could led to mismatches if users changed their email or if different identity providers shared the same address. To ensure reliable user identification, the system now matches users using the OIDC sub (subject) claim, which is a permanent and unique identifier for each user.
Key Benefits:
Improved identity reliability: Using the OIDC sub claim ensures each user is consistently and uniquely identified, even if their email address changes over time.
Reduced authentication conflicts: Eliminates mismatches caused by shared or reused email addresses across different identity providers, improving security and user experience.
RFC 7591 enables OAuth 2.0 clients to register dynamically with the portal’s Authorization Server, removing the need for manual client setup. It defines how Liferay can securely accept client metadata, endpoints, and credentials on-the-fly. This allows Liferay apps, modules, or external services to integrate seamlessly and scale efficiently. By automating client onboarding, it strengthens Liferay’s identity and access management capabilities.
Key Benefits:
Eliminates manual configuration by allowing apps and external services to self-register securely with the Authorization Server.
Speeds up integrations and scaling by automating client onboarding while improving IAM consistency and security.
RFC 8414 provides the manual and error-prone process of configuring clients to talk to authorization servers by standardizing the way for the Authorization Server to publish its configuration automatically. The specific URLs (endpoints) and capabilities can be managed through the UI.
Key Benefits:
Eliminates the need to hardcode specific URLs, preventing configuration errors and allowing the server endpoints changes to be adapted instantly.
Provides a standard location for clients to find the server's public keys, enabling the server to rotate security keys automatically without breaking your application or requiring a software update.
This features is now fully released.
This features is now fully released.
As the CMS feature flag is removed, this functionality will be promoted from beta to release status.
Object entry pages can now use meaningful, human-readable URLs even when built with custom layouts. Instead of relying on automatically generated numeric identifiers, administrators can define addresses based on business data, such as an event name. This improvement brings the same flexibility already available in other layout experiences to scenarios that require more advanced or tailored UIs. The result is clearer links, easier sharing, better discoverability, and a more consistent navigation pattern across the portal. Key Benefits:
|
As the CMS feature flag is removed, this functionality will be promoted from beta to release status.
Object definition creators can now set default values for specific field types during the object design phase. When a user (or an external system via API) creates a new object entry, these fields will be pre-populated with the specified values if no other data is provided.
Key Benefits:
Reduced Manual Labor: Users no longer have to manually fill in "standard" information for every new entry.
Data Integrity: Ensures that critical fields (like "Status" or "Initial Score") are never left empty or inconsistent during the initial creation phase.
As the CMS feature flag is removed, this functionality will be promoted from beta to release status.
As the CMS feature flag is removed, this functionality will be promoted from beta to release status.
A new notification capability has been added to the Orders Questions & Answers feature (formerly Commerce Order Notes) to improve timely communication between Buyers and Order Managers, ensuring that Order Managers are notified when a Buyer adds a comment and Buyers are notified when an Order Manager responds. To support both user notifications and email notifications, we created a new System Object: Commerce Order Note. By leveraging Object Actions, it is now possible to trigger notifications directly from the Questions & Answers flow. On the Commerce Order Note object, we introduced two terms — Order Note Recipient Emails and Order Note Recipient IDs, to dynamically determine the recipients of email and user notifications. The recipient selection logic respects channel-level configurations, including Open Orders Visibility Scope, Placed Orders Visibility Scope, ensuring that notifications are sent exclusively to users who are authorized and within the configured visibility scope. Additionally, a new toggle was added in the Channel configuration — Enable Notifications User Scope — which, when activated, ensures that only the buyer user who is the owner of the order receives notifications for responses from Order Managers. This ensures that notifications are both permission-aware and contextually relevant, maintaining privacy while improving responsiveness. Key Benefits:
|
Within the Orders Admin Panel, a new “Recalculate” button has been introduced in the Order Summary. This button enables administrators to recompute overall order totals following manual adjustments to order lines, executing a controlled summary-level recalculation without re-triggering the full pricing engine. Key behavior:
Key Benefits:
|
We have introduced account-scoped order visibility to ensure that Order Managers only see and manage orders belonging to the Accounts they are assigned to. This enhancement includes:
By combining the Order Administrator role with the Manage Accounts Scoped Orders permission, Order Managers can directly manage the full order lifecycle for their assigned Accounts through the Administrative Panels—without exposure to unrelated Account data. Key Benefits:
|
The permissions-check modal introduced during content publishing is now optional. While this feature provides additional control by allowing users to review permissions before publishing, we recognize that it may add unnecessary steps for some workflows. Customers can now publish in just one step without having to check the permissions first.
Key Benefits:
Greater flexibility to adapt publishing workflows
Maintains enhanced permission control where needed
Avoids unnecessary steps for existing or streamlined flows
Respects different customer contexts and usage patterns