Added: support for MFA (multi-factor authentication) by email code, TOTP authenticator apps, backup codes and webauthn (devices, Yubikeys, Passkeys). There is also beta support for SMS code by setting global property smsProvider to console-test or twilio-verify, setting smsProviderApiKey, smsProviderApiSecret, smsProviderServiceId and adding sms-otp to mfaSupport global property. If a user can't sign-in an administrator can create an email authenticator from the Account profile page.

Added: security logs admin page which lists events in the following categories: account change, authentication, CSRF, deletion, email change, username change, password change, configuration change, other.

Fixed: cursor in a markdown property returning to the start after autosave.

Added: check box to run source="publication" publish actions on the publication root from any document in a publication. Also added personal preference "Prioritise publications in navigation (beta)" which always display the current publication in the navigation bar with a drop-down menu if multiple publications.

Added: support for reminder emails for due tasks/workflows (with certain statuses) sent every Monday, enabled by setting global property reminderNotification=true and ticking the "Send reminder emails" group property in the desired project/group configuration pages. The following global properties (default values shown) can be used to customize behavior:

• reminderMaxEmails=2000
• reminderStatuses=Open,Initiated,In Progress,Complete
• reminderTime=04:00

Added: options on server indexing page to select which projects to index and find projects/groups when there are too many to list.

Fixed: line-breaks (shift-enter or <br/>) not being displayed in document view mode when the option "Display white spaces and special characters" is selected.

Added: quick edit option to the fragment menu which allows editing of a single fragment. This is quicker and doesn't scroll the document as edit mode might do.

Added: support for malware scanning when uploading files or attaching them to comments. Requires ClamAV running and global property malwareScanner=[host]:[port] pointing to it. Scanning of email attachments can be enabled by setting malwareMaxEmailThreads to a non-zero value where it is not more than ClamAV MaxThreads.

Added: disable account option to Account profile page which disables sign-in, email notifications and all permissions for the member but preserves all their data. For disabled accounts there is an enable account option.

Added: new <ps:progress> ANT task which sends progress info, log messages and result instructions to PageSeeder. Use this task instead of the <echo> and <echoxml> ANT tasks to simplify the code and open result in a panel, link to a PSML document or reload the current document.

Fixed: deleted sections and xref-fragments not displayed in combined compare and allowed deleted="true" on <section> for processed level PSML when compare-diffx=combined parameter is used.

Fixed: workflow steps being processed individual when indexing and workflows being displayed as discussions in some panels.

Fixed: non-breaking spaces being created when adding bold or other formatting at the end of a line and when pasting into preformat elements.

Added: option on publish dialogs for administrators to "Allow download of the working files" which will display a download icon next to "Show console" to download a ZIP of the script working folder.

Fixed: URL indexing not disabled by disableIndexing=true in config/group.properties.

Added: support for MySQL v8.4. Note that PageSeeder v5 still requires MySQL v5.7.

Added: field psrootpublicationtype to index and updated current index version to 91100.

Added: support for the Argon algorithm to improve security and made it the default for password hashing.

Fixed: comments/tasks disappearing on a document when comparing with a different version.

Fixed: possible corruption of PSML structure when old structure XLinks have status 'Documentation-New'.

Removed: redirect port functionality and made redirectPorts global property obsolete.

Fixed: XML declaration missing from exported PSML. This allows better XML tools support (e.g. the XPath collection function).

Fixed: OAuth scope permissions for comments and URLs.

Added: to the default word-export-template.docx the list styles Table Bulleted List, Table Numbered List and associated paragraph styles plus Subtitle 2, TOC Heading, Front Matter 1, Front Matter 2 for headings. Also added Word sections to the default template for cover page, front matter and landscape pages.

Modified: the database as follows:

• Added the AUTHENTICATOR table for multi-factor authentication.
• Added a unique constraint on the Name field in the HOSTALIAS table to improve integrity.
• Removed the unused Role, Title and Label fields from the CONTENT table.
• Removed the unused Status field from the URI table.
• Removed the unused ShowDefault and ActuateDefault fields from the XLINK table.
• Ensured new PageSeeder servers use the utf8mb4 charset by default as utf8 is deprecated in MySQL 8.

Added: support to schematron for ps:resource?location=x URL to get template resources. Also added a sample general bundle schematron to check the word-export-config.xml against a publication's documents with a quickfix to remove unused block labels.

Added: sending of email notification to new and previous email address when it is changed.

Fixed: quickfix fragment labels not defaulting to transformed *fragment/@labels attribute. Also automatically reload XSLT templates when they change.

Fixed: Tomcat error when URL contains invalid characters. After upgrading on Linux this requires running service pageseeder config on el7 and /opt/pageseeder/bin/setup on el8/9.

Fixed: white space changes inside <heading>, <para> and <preformat> being ignored by upload.

Added: support for the following:

• <source type="publication"> in publish-config.xml and document-config.xml to flag target scripts that are only for publications.
• independent=true parameter/attribute on export services/ANT task which removes the _ from _local and _external folders so they can be uploaded, making the export self-contained.
• Better error/warning messages for publish scripts and uploads.

Added: support for csrfMode global property which determines if non-GET requests require an Anti-CSRF-Token header/parameter as follows: enforce means required, partial means required except for legacy API requests, disabled means not required. Adding a -log suffix means that all requests without the correct token are logged as warnings (default is partial-log).

Fixed: cookies not setting SameSite=lax. After upgrading on Linux this requires running service pageseeder config on el7 and /opt/pageseeder/bin/setup on el8/9.

Fixed: upload option not displayed for word-export-template.docx if it already exists.

Fixed: template admin pages not indicating that the project is using a different template.

Fixed: group documents sorting folders in left panel differently to folders in main content.

Added: markup from headings and resolvable placeholders inside <xref> elements which use template {heading}. NOTE: Character-style elements (except for <image> and <xref>) can now appear inside <xref> elements in PSML with level="processed".

Fixed: non-publication Word/PDF export having multiple heading 1 by not adjusting heading levels in non-publication content. 

Added: support for draft workflows which are automatically saved so users don't lose their text.

Added: options to filter access logs by permission (Administrator, Project manager, Group manager, Member, Public) and method (Read, Write). Logs created before upgrading PageSeeder will not be filtered by permission.

Added: option to organize access logs by group.