We will introduce a deprecation badge within the Segments Editor in DXP. This badge will be visible whenever users attempt to create a new segment or edit an existing one. In addition to the badge, a UI alert will inform users that Segments in DXP are planned to be deprecated and that Analytics Cloud (AC) will become the single source of truth for segmentation. This change is intended to proactively set expectations and guide users toward creating and managing segments in Analytics Cloud moving forward. Starting in 2026.Q1 version, the Segments module in DXP will transition to a read-only experience by default. Users will only be able to view the list of segments created in Analytics Cloud within DXP. Segment creation and editing capabilities in DXP will no longer be available unless the Segments deprecation feature flag is explicitly enabled. The long-term direction is for Analytics Cloud to fully own segment creation and management, ensuring a single, centralized segmentation workflow. |
Release Notes
GDPR (EU) requires consent renewal every 12 months. Some national data protection guidelines even recommend more frequent renewal, such as every 6 months. We the renewal periods configurable where the administrator can manually add a number of months (maximum 12) to define the renewal period. Key Benefits:
|
RFC 8414 provides the manual and error-prone process of configuring clients to talk to authorization servers by standardizing the way for the Authorization Server to publish its configuration automatically. The specific URLs (endpoints) and capabilities can be managed through the UI.
Key Benefits:
Eliminates the need to hardcode specific URLs, preventing configuration errors and allowing the server endpoints changes to be adapted instantly.
Provides a standard location for clients to find the server's public keys, enabling the server to rotate security keys automatically without breaking your application or requiring a software update.
This features is now fully released.
This features is now fully released.
This mechanism is server-to-server, making it more reliable than front-channel methods that depend on the user's browser. The IdP will directly notify each RP (Relying Party aka Service Provider) that a user's session has ended by sending a signed logout_token. The RP must validate this token and terminate the corresponding local session.
Key Benefits:
Higher reliability and security: Server-to-server logout does not rely on the user’s browser, reducing failures caused by network issues, blocked scripts, or closed sessions.
Consistent session termination: Signed
logout_tokennotifications ensure each RP can securely validate and promptly terminate the correct local user session.
This feature is now fully released.
The feature is now fully released.
The previous OIDC authentication flow identified users based on their email address, which could led to mismatches if users changed their email or if different identity providers shared the same address. To ensure reliable user identification, the system now matches users using the OIDC sub (subject) claim, which is a permanent and unique identifier for each user.
Key Benefits:
Improved identity reliability: Using the OIDC sub claim ensures each user is consistently and uniquely identified, even if their email address changes over time.
Reduced authentication conflicts: Eliminates mismatches caused by shared or reused email addresses across different identity providers, improving security and user experience.
Object definition creators can now set default values for specific field types during the object design phase. When a user (or an external system via API) creates a new object entry, these fields will be pre-populated with the specified values if no other data is provided.
Key Benefits:
Reduced Manual Labor: Users no longer have to manually fill in "standard" information for every new entry.
Data Integrity: Ensures that critical fields (like "Status" or "Initial Score") are never left empty or inconsistent during the initial creation phase.
As the CMS feature flag is removed, this functionality will be promoted from beta to release status.
Object entry pages can now use meaningful, human-readable URLs even when built with custom layouts. Instead of relying on automatically generated numeric identifiers, administrators can define addresses based on business data, such as an event name. This improvement brings the same flexibility already available in other layout experiences to scenarios that require more advanced or tailored UIs. The result is clearer links, easier sharing, better discoverability, and a more consistent navigation pattern across the portal. Key Benefits:
|
RFC 7591 enables OAuth 2.0 clients to register dynamically with the portal’s Authorization Server, removing the need for manual client setup. It defines how Liferay can securely accept client metadata, endpoints, and credentials on-the-fly. This allows Liferay apps, modules, or external services to integrate seamlessly and scale efficiently. By automating client onboarding, it strengthens Liferay’s identity and access management capabilities.
Key Benefits:
Eliminates manual configuration by allowing apps and external services to self-register securely with the Authorization Server.
Speeds up integrations and scaling by automating client onboarding while improving IAM consistency and security.
As the CMS feature flag is removed, this functionality will be promoted from beta to release status.
As the CMS feature flag is removed, this functionality will be promoted from beta to release status.
As the CMS feature flag is removed, this functionality will be promoted from beta to release status.
A new notification capability has been added to the Orders Questions & Answers feature (formerly Commerce Order Notes) to improve timely communication between Buyers and Order Managers, ensuring that Order Managers are notified when a Buyer adds a comment and Buyers are notified when an Order Manager responds. To support both user notifications and email notifications, we created a new System Object: Commerce Order Note. By leveraging Object Actions, it is now possible to trigger notifications directly from the Questions & Answers flow. On the Commerce Order Note object, we introduced two terms — Order Note Recipient Emails and Order Note Recipient IDs, to dynamically determine the recipients of email and user notifications. The recipient selection logic respects channel-level configurations, including Open Orders Visibility Scope, Placed Orders Visibility Scope, ensuring that notifications are sent exclusively to users who are authorized and within the configured visibility scope. Additionally, a new toggle was added in the Channel configuration — Enable Notifications User Scope — which, when activated, ensures that only the buyer user who is the owner of the order receives notifications for responses from Order Managers. This ensures that notifications are both permission-aware and contextually relevant, maintaining privacy while improving responsiveness. Key Benefits:
|
Within the Orders Admin Panel, a new “Recalculate” button has been introduced in the Order Summary. This button enables administrators to recompute overall order totals following manual adjustments to order lines, executing a controlled summary-level recalculation without re-triggering the full pricing engine. Key behavior:
Key Benefits:
|
We have introduced account-scoped order visibility to ensure that Order Managers only see and manage orders belonging to the Accounts they are assigned to. This enhancement includes:
By combining the Order Administrator role with the Manage Accounts Scoped Orders permission, Order Managers can directly manage the full order lifecycle for their assigned Accounts through the Administrative Panels—without exposure to unrelated Account data. Key Benefits:
|
The permissions-check modal introduced during content publishing is now optional. While this feature provides additional control by allowing users to review permissions before publishing, we recognize that it may add unnecessary steps for some workflows. Customers can now publish in just one step without having to check the permissions first.
Key Benefits:
Greater flexibility to adapt publishing workflows
Maintains enhanced permission control where needed
Avoids unnecessary steps for existing or streamlined flows
Respects different customer contexts and usage patterns
To prepare for Microsoft’s removal of Azure Access Control Service (ACS) for SharePoint in Microsoft 365 starting April 2, 2026, we’ve evolved the SharePoint connector authentication model. This ensures customers can continue accessing SharePoint seamlessly after April 2026, without disruption.
Key Benefit:
Ensures uninterrupted access to SharePoint after ACS deprecation
Aligns with Microsoft’s supported and future-proof authentication standards
Improves long-term security and compliance
This epic delivers a comprehensive solution for exporting and importing vocabularies and categories with associated data across Liferay environments, tackling potential roadblocks to ensure a smooth and efficient migration process.
This epic delivers a comprehensive solution for exporting and importing tags with associated data across Liferay environments, tackling potential roadblocks to ensure a smooth and efficient migration process.
The Question Widget is a legacy application that was primarily maintained to support Liferay Ask. With the recent migration from Ask to Discuss (Liferay's new forum platform), this widget is no longer needed. Therefore, the Question Widget is being deprecated to reduce technical debt and ongoing maintenance costs.
Platform flexibility and enterprise system support is important to our users. With this release we have expanded the Compatibility Matrix to include some new environments. Application Servers:
Databases:
Operating Systems:
Key Benefits:
|
This feature introduces “Lazy References” to ensure import success regardless of deployment order. If an imported item references a missing Vocabulary or Category, the system creates a temporary “incomplete” dummy object. This special status allows the main content import to succeed immediately. The project’s focus is managing the status lifecycle to allow a smooth transition of these incomplete dummies to a fully approved state when the complete taxonomy object is imported later.
This new feature introduces a composable, fragment-based way to build and customize the account selector experience.
It enables developers and business users to assemble panels, buttons, and account/order views without hardcoded dependencies.
The main orchestrator fragment manages navigation, dropdown behavior, and interactions across configurable panels, delivering greater flexibility, improved user experience, and fine-grained control directly from page building.
With Liferay's New Headless Content Management System (CMS), creating, organizing, and publishing content is simpler because all content management tasks are brought together in a single interface. Your content is independent of its presentation, allowing you to reuse it across sites, pages, and APIs. You can work with articles, documents, media, and more, while taking advantage of features like global asset views, organized spaces, and cross-site publishing. Thanks to Liferay Objects, the CMS provides flexible content structures and ensures a smooth, consistent authoring and publishing experience. Key Benefits:
|
We’ve added a Maintenance badge to several applications related to the current CMS. This informs users that these applications are in maintenance mode, meaning no new feature development is planned, as we continue focusing on our new CMS.
As Liferay continues to invest in platform flexibility and enterprise stability, empowered by Jakarta EE, we are pleased to share that DXP is now certified for use with Oracle WebLogic Server 15c. This application server will be fully supported for Enterprise tier customers. Additionally, to empower DXP deployment on Oracle’s server, we have released a dedicated DXP WAR file optimized for WebLogic 15.
Key Benefits:
Modernized Tech Stack: Provides compatibility with the latest release from Oracle, ensuring your infrastructure is ready for the next generation of enterprise Java applications.
Simplified Installation: Streamlined deployment provided through the dedicated Weblogic WAR file.
Security Compliance: Moving to WebLogic 15c ensures you stay ahead of the security and patch lifecycles of older, non-Jakarta-based application servers.
Liferay has released a new version of the Liferay Faces (JSF) portlet bridge framework that is now compatible Jakarta EE, allowing users to migrated JSF portlets for usage with 2026.Q1.
Key Benefits:
Jakarta Support: JSF portlets can now be used on DXP with Jakarta namespace.
Simplified Migration: Liferay continues to support JSF 2.3-built portlets to make it easy to migrate to Jakarta with minimal breaking changes.
PrimeFaces support: Liferay has enabled usage of PrimeFaces portlets with Liferay DXP.
AI Rules Files (.workspace-rules) are now available OOTB with new Liferay Workspaces. These files provide AI agents with the Liferay-specific logic, context, and guardrails needed to generate accurate, best-practice customizations for Liferay DXP. These rules are symlinked for automatic discovery by Claude Code, Cursor, Gemini, GitHub Copilot, and Windsurf. Blade 8.0 or higher is required to automatically set up new Liferay Workspaces with the AI Rules Files. Key Benefits:
|
In order to assist customers with upgrades to newer Liferay versions, Blade and Workspace users now have a dedicated gradle command For customers migrating to Jakarta for the first time, the Jakarta Migration Tool Key Benefits:
This tool simplifies the process for users migrating their code to newer Liferay versions, providing:
|
In order to run integration tests locally, customers previously had to manually identify and set the correct test dependency versions for their corresponding Liferay version in build.gradle, which was a tedious and error prone process. We now provide a dedicated Integration Test Bill of Materials (BOM) file, release.dxp.bom.test, that automatically provides the correct test dependency versions and is included by default with Liferay Workspaces.
Key Benefits:
Liferay Workspaces will automatically pull in the integration test BOM.
Customers can omit the versions when declaring test dependencies in
build.gradle, the integration test BOM will provide the correct versions automatically for their Liferay version.Previous:
testIntegrationImplementation group: "com.liferay.portal", name: "com.liferay.portal.test", version: "24.5.1"Now:
testIntegrationImplementation group: "com.liferay.portal", name: "com.liferay.portal.test"
From now on, most JavaScript files in Liferay DXP have hashed file names generated at build time. For example, a main.js file may appear at runtime with a randomly generated hash value in its name, such as This hash value represents a unique version of the file, so the browser can identify that the file’s contents have not changed. This allows the file to remain in the browser cache indefinitely when the infinite caching strategy is selected. In addition, the frontend caching infrastructure now supports both infinite caching and time/validation-based caching strategies. These strategies can be configured through Instance Settings. For those JavaScript files that cannot be hashed because they are generated at runtime by the server depending on some parameters, a new configuration is available in DXP to define their TTL and the option to add the Also, hashed files have a fallback strategy based on TTL + eTag if they are requested using their canonical name. This acts as a fallback for import map errors or legacy portlets that are not aware of hashed file names. Key Benefits:
The new Liferay DXP caching strategy for JavaScript files improves performance and stability. 1. Faster Page Loads: 2. Elimination of Stale Resources: 3. Reduced Origin Server Load: 4. Cache busting: |
This feature improves how Frontend Data Set view state parameters are represented and managed within URLs, introducing a cleaner, more readable, and user-friendly encoding format. It replaces the previous fully URL-encoded JSON structure with a compact and maintainable serialization strategy while refining how and when view state parameters are persisted. These improvements ensure that URLs remain functional, easier to share, and simpler to debug.
Key Benefits:
Administrators, developers, and end users benefit from significantly shorter and more readable URLs that accurately reflect the current Data Set view state.
View state parameters are only added to URLs when users modify the Data Set view, reducing unnecessary noise and improving clarity.
Data Set states can be reliably shared, bookmarked, and restored across sessions and browsers.
Navigation behavior is improved by establishing push-based history updates as the default, enabling better navigation tracking and user experience.
This feature introduces User Views in Frontend Data Sets, allowing end users to personalize how data is displayed by saving and reusing their preferred filters, sorting, and visualization mode across the platform.
Key Benefits:
Users can easily create and switch between custom views tailored to their needs
Personalized views can be saved and reused, improving productivity and consistency
Administrators can control whether Custom Views are available per Data Set
This change promotes the Save Data Set view state to be recoverable when navigating back to it epic from Beta to General Availability, confirming the feature is stable and fully supported.
This feature introduces a cleaner, more flexible empty-state experience in the Frontend Data Set by allowing the search bar and management bar to be hidden when no content is present.
Key Benefits:
The Dataset Consumer is able to hide Data Set management bar by just clicking a toggle
If toggle is enabled, management bar won’t be rendered in case of a “real” empty state
This can be configured both in system and custom datasets
This change promotes the CK Editor 5 epic from Beta to Release.