Added: support in the UI for files uploaded, when this property is set malwareScanUIOnly=true in global.properties (i.e. requests without an OAuth token) a malware scan will be triggered.

Added: support for errorloglevel="[debug|verbose|info|warn|error]" on ps:request ANT task to set the response level for logging errors.

Fixed: deleting the member to originally upload or create a document could cause the loss of subsequent changes and create an incorrect document, or fragment history.

Fixed: display of draft fragment if the member account has been deleted.

Added: improved shift-click support for archiving fragments in structure view.

Added: separate the files to support the "How to create a shared glossary" tutorial.

Fixed: automatic purging of expired access tokens. Also added total, last purged and token masking to access tokens page.

Added: a mode for editing structure in the document view.

Added: New folder option to “upload” dialog.

Added: the following to “Search and replace” dialog:

• support for shift select on check boxes
• display number of matches
• option to close fragment preview

Added: term highlighting to preview panel search results.

Added: Properties Table DOCX styles to default DOCX export config/template for formatting PSML properties-fragment.

Fixed: failonerror="true" not working for ps:request ANT task when using fileset.

Fixed: inserting fragment before section title element when reverting a deleted fragment.

Added: “Clear all” option to Select columns dialog in search.

Modified: the Compare -> History tab so edits from the same author are split into different days. Made the Other tab under Compare more consistent.

Modified: comment PATCH service to only allow a status to be set on the last comment in a discussion.

Fixed: zoom and image outlining on custom help documents.

Fixed: task and workflow display of status, priority, assignee, and due date when "Most recent first" option is selected.

Modified: OAuth access token creation to update member “last signed in” date and to log the event.

Added: “date created” and “last sign-in” to Admin account page. Also added “status filter” and when status is selected, a bulk option for “disable / enable / activate / unlock” account.

Modified: multi-factor authentication to automatically select code entry field.

Fixed: copy and pasting numbered lists.

Fixed: non-breaking spaces splitting when editing inline labels.

Fixed: possible install error "Signature not supported. Hash algorithm SHA1 not available" on el9 (enterprise linux).

Fixed: document rendering if italic, bold, underline, code or inline PSML elements contain only whitespace.

Added: the following API services:

DELETE /authenticators/{authenticator}
GET    /authenticators/{authenticator}
PATCH  /authenticators/{authenticator}
POST   /authenticators/{authenticator}/challenge
POST   /authenticators/{authenticator}/verify
POST   /groups/{group}/members/{member}/email
DELETE /groups/{group}/publications/{publicationid}
GET    /members/{member}/authenticators
POST   /members/{member}/authenticators
PUT    /members/{member}/groups/{group}/uris/{uri}/structure
GET    /members/{member}/groups/{group}/uris/{uri}/workflow
GET    /self/authenticators
POST   /self/authenticators

Modified: the following API services:

• POST /authenticate – added support for action=challenge and parameters authenticator, challenge, code and credential.
• POST /members/{member}/groups/{group}/uris/{uri}/workflow – added support for parameter draft.
• PATCH /members/{member} – added support for parameter disabled.
• GET /members/find – added support for parameter status.
• POST /members/{member}/groups/{group}/uris/{uri}/fragments/{+fragment}/move – added support for parameter lastmodified.

Fixed: “out of memory” error when comparing large tables in side-by-side mode.

Added: options to import / export markdown files.

Fixed: unedited fragments showing as “changed” when switching between documents in edit mode.

Added: support for underscores in numerical global properties ending with K, M or G, to multiply the number by a thousand, million or giga (e.g. 1_000_000, 100K, 2M, 3G). Also fixed error when maxUploadSize property is set to more than 2G.

Fixed: label display in document versions panel.

Added: Reprocess button to the Template configuration page for adding new document metadata properties to document types. The new properties may be specified in the document template, or they may overwrite property values on existing documents in a group.

Added: a “copy publication” script to sample document type bundles.

Fixed: error when saving multiple edits if the document history panel is open.

Added: to the combined view, a new Gasherbrum III diff algorithm to improve change tracking of certain XML structures such as list items and table rows.

Added: option to download a CSV file of “Document Activity”.

Added: Member details tab to Template configuration page so that project managers can edit custom member fields.

Added: to the <ps:process> ANT task, an option to stop logging warnings:

<warning imagenotfound="false" xrefambiguous="false" 
         xrefnotfound="false"/> 

<ps:process><warning imagenotfound="false"/>

Fixed: custom help images not accessible to some users.

Fixed: links in help, also added a history tab to the help panel.

Modified: the image upload when editing a publication, so the images folder defaults to the same level as the publication root document.

Fixed: systemctl timeout on PageSeeder el8/9 upgrades. Also add display of upgrade progress to the UI.

Modified: the default setting for the “Duplicate” dialog is now to NOT check the "Track the duplicate as a variation of the original document" option.

Added: a “delete publication ID” service to help manage a corrupt publication.

Modified: General / Recent logs, to collapse exceptions by default.

Added: a number of MFA (multi-factor authentication) mechanisms including:

• a code sent to an email address,
• time-based one-time password (TOTP) authenticator apps,
• backup codes, and
• webauthn (devices, Yubikeys, Passkeys).

There is also beta support for SMS code. To access this, set global property smsProvider to console-test or twilio-verify, and then set smsProviderApiKey, smsProviderApiSecret, smsProviderServiceId and adding sms-otp to mfaSupport global property.

Where a user can't sign-in, an administrator can create an email authenticator for them on the Account profile page.

Added: a security log listing the following events:

• account change,
• authentication,
• cross-site request forgery (CSRF),
• deletion,
• email change,
• username change,
• password change,
• configuration change,
• other.

Fixed: cursor in a markdown property jumping to the start of the field after autosave.

Added: check box to any document in a publication so the publish can run source="publication". This saves the user from having to return to the publication root to publish.

Also added personal preference “Prioritise publications in navigation (beta)” to display the current publication in the navigation bar, with a drop-down menu for documents that are in multiple publications.

Added: reminder messages sent each Monday for tasks or workflows that are due, or overdue. To enable this, set global property reminderNotification=true and select the "Send reminder emails" group property in the desired project / group configuration pages. Adjust the values of the following global properties to customize behavior:

• reminderMaxEmails=2000
• reminderStatuses=Open,Initiated,In Progress,Complete
• reminderTime=04:00

Added: “find” and “select” on server indexing page for implementations where the number of projects and groups make the list view impractical.

Fixed: display of line-breaks (shift-enter or <br/>) in document view mode, when the "Display white spaces and special characters" option is selected.

Added: “Quick edit” option to the fragment menu for faster editing of a single fragment, and with less scrolling.

Added: support for malware scanning to file upload, or comment attachments. This requires ClamAV integration through the global property:

malwareScanner=[host]:[port]

To scan email attachments, set malwareMaxEmailThreads to a non-zero value that is not more than ClamAV MaxThreads.

Added: “disable” option on Account profile page to terminate sign-in, email notifications and all permissions, but preserves all member data. Unlike deleted accounts, disabled accounts have an “enable account” option. This is better for preserving data provenance and historical integrity without compromising security.

Added: new <ps:progress> ANT task to send progress info, log messages and result instructions to PageSeeder. In comparison to the <echo> and <echoxml> ANT tasks, code using this is simpler and more powerful. Open the results in a panel, link to a PSML document or reload the current document.

Fixed: display of deleted sections and xref-fragments in combined compare, and allowed deleted="true" on <section> for processed-level PSML when using compare-diffx=combined parameter.

Fixed: indexing and display of workflow steps as discussions in some panels.

Fixed: creation of non-breaking spaces when adding bold or other formatting at the end of a line and when pasting into <preformat> elements.

Added: next to "Show console" option on the administrator publish dialog, an icon to “Allow download of the working files” will create and download a ZIP package of the files in the script working folder.

Fixed: disable URL indexing using disableIndexing=true in config/group.properties.

Added: support for MySQL v8.4.

Added: field psrootpublicationtype to index, and updated current index version to 91100.

Added: the Argon algorithm as the new default for password hashing.

Fixed: disappearing comments and tasks when comparing document versions.

Fixed: possible corruption of PSML structure when the status of old structure XLinks is 'Documentation-New'.

Removed: “redirect port” functionality and made the redirectPorts global property obsolete.

Fixed: PSML export to include XML declaration and enable better XML tool support (e.g. the XPath collection function).

Fixed: OAuth scope permissions for comments and URLs.

• Table Bulleted List, Table Numbered List and associated paragraph styles,
• Subtitle 2, TOC Heading, Front Matter 1, Front Matter 2 for headings.

Also added to the default template, Word sections for cover page, front matter and landscape pages.

DOCX files now display the template version in the Status property under File > Info in Word.

To use the correct Word section, a custom word-export-config.xml may need to add

 <document wordsection="3" />

to the config just under <elements>.

Modified: the database as follows:

• Add the AUTHENTICATOR table for multi-factor authentication.
• Add a unique constraint on the Name field in the HOSTALIAS table to improve integrity.
• Remove from the CONTENT table, the unused Role, Title and Label fields.
• Remove from the URI table, the unused Status field.
• Remove from the XLINK table, the unused ShowDefault and ActuateDefault fields.
• Ensure new PageSeeder servers use the utf8mb4 charset after the deprecation of utf8 in MySQL 8.

du -sh /opt/mysql

Added: to Schematron support for ps:resource?location=x URL to get template resources.

Also added a sample, general bundle Schematron quickfix to check the word-export-config.xml against a publication and remove unused block labels.

Added: email notifications sent to new and previous addresses after changing.

Fixed: quickfix fragment labels not defaulting to transformed *fragment/@labels attribute.

Also, automatically reload XSLT templates when they change.

Fixed: Tomcat error when URL contains invalid characters. After upgrading PageSeeder on an enterprise linux(el) 7 distribution (e.g. CentOS 7) run service pageseeder config. Running this service is not necessary with el 8 or 9 distributions.

Fixed: ignoring white space changes inside <heading>, <para> and <preformat> on upload.

Added: support for the following:

• <source type="publication"> in publish-config.xml and document-config.xml to identify which scripts are only for publications.
• independent=true parameter / attribute on export services/ANT task which removes the _ from _local and _external folders to make them more portable.
• Better error and warning messages for publish scripts and uploads.

Added: support for csrfMode global property which determines if non-GET requests require an Anti-CSRF-Token header/parameter as follows:

• enforce – means required,
• partial – means required except for legacy API requests,
• disable – means not required.
• Adding a -log suffix means that all requests without the correct token are logged as warnings (default is partial-log).

Fixed: cookies not setting SameSite=lax. After upgrading PageSeeder on an enterprise linux(el) 7 distribution (e.g. CentOS 7) run service pageseeder config. On el 8 or 9, run:

/opt/pageseeder/bin/setup

Fixed: display of upload option where word-export-template.docx already exists.

Fixed: template admin pages not indicating that the project is using a different template.

Fixed: group documents in the left panel, sorting folders differently to how it sorts in main content.

Added: markup from headings and resolvable placeholders inside <xref> elements which use template {heading}.

Fixed: adjusting multiple heading 1 paragraphs when exporting non-publication Word/PDF.

ps:process/publication/headingleveladjust="content"

Added: automatic saving of draft workflows, so users don't lose their text.

Added: options to filter access logs by permission (Administrator, Project manager, Group manager, Member, Public), and method (Read, Write).

Added: option to organize access logs by group.