Jahia 8.2.2.0
Jahia 8.2.2.0 is the base release of the 8.2.2.x branch. It is a maintenance release primarily addressing security-related issues, detailed in the September 2025 security patch page.
Adopting it is expected to be simple for environments already running Jahia 8.2.1.
Read before you upgrade
Special upgrade instructions
External Provider UI incompatibility
We were made aware of an issue related to the legacy module External Provider UI when upgrading to Jahia 8.2.2.x.
External Provider UI was removed from the distribution alongside the release of Jahia 8.2.0.0, but if this module is still present in your environment, it is recommended to remove it before upgrading to Jahia 8.2.2.x.
Breaking changes
Stricter file upload validations
This release introduces stricter file upload checks configurable via the property jahiaSecuredFileUpload in the jahia.properties file.
- Impact: Environments uploading files through Jahia rendering or actions. In Jahia 8.1.9.0 this property is set to
trueby default. - Action: Review the documentation available in the
jahia.propertiesfile to determine if and how you are impacted.
Documentation and further details are available here.
CSRF protection in /modules/api/bundles
The ability for /modules/api/bundles to rely on sessions for authentication has been removed, which typically means it will not be possible to call this endpoint from Web UIs.
- Impact: Code calling
/modules/api/bundlesfrom a browser session. We expect this use case to be extremely rare, if not inexistent, since this endpoint was primarily created to support Jahia orchestration use cases, which are unaffected by this change. - Action: Reach the endpoint through another Jahia authentication mechanism (token, basic auth).
How to upgrade
Customers can always use the In-Place or Blue-Green upgrade procedure regardless of their current version. The rolling upgrade prerequisites below only apply to the rolling upgrade procedure.
Rolling upgrade to Jahia 8.2.2.0
Rolling upgrade to 8.2.2.x from any version earlier than 8.2.2.0 is not supported: use the In-Place or Blue-Green upgrade procedure.
If you are using Jahia installer, you can download fixAppliers corresponding to your Jahia version here.
Components updated in Jahia 8.2.2.0
Modules
No changes to modules in this version.
The full list of Jahia modules and their versions can be found in the Jahia 8.2.2.0 tag in GitHub.
Database drivers
| Component | Jahia 8.2.1.0 | Jahia 8.2.2.0 |
|---|---|---|
| PostgreSQL driver 📝 | 42.7.5 | 42.7.7 |
Only components whose version changed in Jahia 8.2.2.0 are listed above.
The full list of Database drivers and their versions can be found in the Jahia 8.2.2.0 tag in GitHub.
Libraries
| Component | Jahia 8.2.1.0 | Jahia 8.2.2.0 |
|---|---|---|
| Apache Commons BeanUtils 📝 | 1.9.4 | 1.11.0 |
| Apache Commons compress 📝 | 1.25.0 | 1.27.1 |
| Apache Commons FileUpload 📝 | 1.3.3 | 1.6.0 |
| Apache Commons IO 📝 | 2.14.0 | 2.16.1 |
| Apache Commons lang3 📝 | 3.12.0 | 3.18.0 |
| Apache Commons vfs2 📝 | 2.4.1 | 2.10.0 |
| Apache log4j2 📝 | 2.17.2 | 2.23.1 |
| Apache Tika Parser 📝 | 2.9.1 | 2.9.3 |
| Apache Tomcat 📝 | 9.0.104 | 9.0.107 |
| aws-java-sdk-s3 📝 | 1.12.272 | 1.12.787 |
| Jackson Core 📝 | 2.15.2 | 2.19.0 |
| Joda Time 📝 | 2.10.13 | 2.14.0 |
| snakeyaml 📝 | 2.2 | 2.4 |
Only components whose version changed in Jahia 8.2.2.0 are listed above.
The full list of embedded Jahia libraries can be found in the Jahia 8.2.2.0 tag in GitHub.
Changelog
Docker
- ✨ Simplified Jahia configuration during startup of the Docker images and removed unnecessary dependencies
Security
- 🛡️ Introduced a stricter mechanism to validate file uploads, configurable using the
jahiaSecuredFileUploadproperty. This configuration istrueby default. Please see the "Breaking changes" section of this page.
Legend (icons): ✨ Improvements & new features, 🐛 Bugs, 🛡️ Security fixes, 📚 Documentation, 📦 Packaging, 🛠 Change to Jahia build, ⚙️ Changes to CI, ♻️ chores