Jahia 8.1.9.0
Jahia 8.1.9.0 is the base release of the 8.1.9.x branch. It is a maintenance release primarily addressing security-related issues. You can find more details about the corrected vulnerabilities in the Security section of Jahia Academy.
Adopting it is expected to be simple for environments already running Jahia 8.1.8.
Read before you upgrade
Breaking changes
Apache Portlet removal
Deprecated since Jahia 8.0, the portlet functionality has been removed.
Following investigations, it was discovered that this deprecated feature could expose Jahia to security vulnerabilities, and the decision was made to remove it.
- Impact: Sites still using portlets. Note that portlets were already removed from Jahia 8.2.0.0+, released in 2024.
- Action: Replace any remaining portlet usage before upgrading.
Stricter file upload validations
This release introduces stricter file upload checks configurable via the property jahiaSecuredFileUpload in the jahia.properties file.
- Impact: Environments uploading files through Jahia rendering or actions. In Jahia 8.1.9.0 this property is set to
trueby default. - Action: Review the documentation available in the
jahia.propertiesfile to determine if and how you are impacted.
Documentation and further details are available here.
snakeyaml upgraded from 1.33 to 2.4
To address the CVE-2025-52999 vulnerability in jackson-core, it was necessary to upgrade snakeyaml from 1.33 to 2.4.
If you are not importing snakeyaml, then you are not impacted
If you are using snakeyaml, review the breaking changes in snakeyaml 2.x. You can do so by analyzing this file and searching for actions of type "remove". Removals between v1.33 and v2.4 are:
- v2.4 - Remove external Base64Coder and use provided Base64 (thanks to MithunKhanna) - Commit
- v2.3 - Remove unused BUFFER_SIZE (thanks to Róbert Papp (TWiStErRob)) - Issue, Commit
- v2.1 - Remove Trusted*Inspector classes from main sources tree - Commit
- v2.0 - Remove many deprecated constructors - Commit
- v2.0 - Remove long deprecated methods in FlowStyle - Commit
CSRF protection in /modules/api/bundles
The ability for /modules/api/bundles to rely on sessions for authentication has been removed, which typically means it will not be possible to call this endpoint from Web UIs.
- Impact: Code calling
/modules/api/bundlesfrom a browser session. We expect this use case to be extremely rare, if not inexistent, since this endpoint was primarily created to support Jahia orchestration use cases, which are unaffected by this change. - Action: Reach the endpoint through another Jahia authentication mechanism (token, basic auth).
How to upgrade
Customers can always use the In-Place or Blue-Green upgrade procedure regardless of their current version. The rolling upgrade prerequisites below only apply to the rolling upgrade procedure.
Rolling upgrade to Jahia 8.1.9.0
Rolling upgrade to 8.1.9.x from any version earlier than 8.1.9.0 is not supported: use the In-Place or Blue-Green upgrade procedure.
If you are using Jahia installer, you can download fixAppliers corresponding to your Jahia version here.
Components updated in Jahia 8.1.9.0
Modules
| Component | Jahia 8.1.8.3 | Jahia 8.1.9.0 |
|---|---|---|
| module-manager 📝 | 2.8.0 | 2.8.1 |
| serverSettings 📝 | 9.7.2 | 9.7.4 |
Only components whose version changed in Jahia 8.1.9.0 are listed above.
The full list of Jahia modules and their versions can be found in the Jahia 8.1.9.0 tag in GitHub.
Database drivers
No changes to database drivers in this version.
The full list of Database drivers and their versions can be found in the Jahia 8.1.9.0 tag in GitHub.
Libraries
| Component | Jahia 8.1.8.3 | Jahia 8.1.9.0 |
|---|---|---|
| Apache Commons BeanUtils 📝 | 1.9.4 | 1.11.0 |
| Apache Commons FileUpload 📝 | 1.3.3 | 1.5 |
| Apache Tomcat 📝 | 9.0.104 | 9.0.107 |
| Graphql-java 📝 | 13.0 | 13.0.jahia1 |
| Jackson Core 📝 | 2.15.2 | 2.19.0 |
| snakeyaml 📝 | 1.33 | 2.4 |
Only components whose version changed in Jahia 8.1.9.0 are listed above.
The full list of embedded Jahia libraries can be found in the Jahia 8.1.9.0 tag in GitHub.
Changelog
Security
- 🛡️ Introduced a stricter mechanism to validate file uploads, configurable using the
jahiaSecuredFileUploadproperty. This configuration istrueby default. Please see the "Breaking changes" section of this page.
Modules
- 🐛 ServerSettings 9.7.4 removes portlets, deprecated in Jahia 8.0.0.0.
Legend (icons): ✨ Improvements & new features, 🐛 Bugs, 🛡️ Security fixes, 📚 Documentation, 📦 Packaging, 🛠 Change to Jahia build, ⚙️ Changes to CI, ♻️ chores