8.0 Changelog

Here is the list of backend dependencies upgraded :

Due to OpenPDF library upgrade, import statements using com.lowagie package should be migrated to org.openpdf.

Extended entities having a super class were wrongly generated in project : Entities in a 'SINGLE_TABLE' hierarchy shouldn’t be annotated with @Table (the root class declares the table mapping for the hierarchy). Issue only happens with entities declared in module dependencies (project dependencies not concerned).

Treat HTML editor output that contains only whitespace or <br> tags as empty. This prevents leftover <br> content when clearing the field and allows required validation to work as expected.

By default, when multi-tenancy is active, the cache automatically segregates entries based on the current tenant context. Use CacheBuilder#nonTenantAware() to disable this behavior and allow the cache to be shared globally across all tenants.

When header/footer is hidden then it should still bind close handler properly so that action handler can close the view.

Allow opening a record in form view from the kanban view when either read or canView permission is granted.

Fix initial email resend timer when email method is default. Fix email resend timer on browser refresh.

When a record is created through the many-to-one widget using the popup form, the record is persisted via an action. After clicking OK, the newly created record should be automatically selected in the M2O widget.

Fix findFields returning wrong field metadata when different JSON models have fields with the same name. The method now correctly filters fields by jsonModel to avoid returning data from unrelated custom models.

Fix changing title of toolbar buttons and menubar items in form view. Also add support for title/hidden/readonly attributes for cards/kanban/dms/grid views.

Keep the DMS upload panel visible briefly after uploads complete, show accurate titles for running/failed/complete states, and add missing translations.

Don’t show automatic attrs on form view when there is at least one manual custom field, e.g. <field name="attrs.customField" /> Static widgets on grid view (like button) do not prevent automatic attrs.

Use tenant-aware caches for MFAService, I18nBundle, and MetaStore. Any cache that contains database-dependent data should be tenant-aware.

In previous version, we removed automatic flush calls from JPA.persist() and JPA.merge() methods to restore JDBC batching for bulk operations. We restored this behavior to ensure backward compatibilities. It was initially added for an eager synchronization model (assume read-your-own-writes consistency immediately after any persist or merge) but also to reduced cognitive load (doesn’t have to wired about potential synchronization issues). We thought the impact will be restricted, but the fact is that lot of process depending the behavior. This requires more preparation and details before we can get ride of this anti-pattern strategy and fit on standard.

Here is the list of backend dependencies upgraded :

Removed automatic flush calls from JPA.persist() and JPA.merge() methods to restore JDBC batching for bulk operations. Previously, calling flush inside these methods forced Hibernate to execute SQL immediately, disabling JDBC batching and causing significant performance degradation. Since entities use SEQUENCE-based ID generation, Hibernate does not require an immediate flush to obtain IDs.

Behavior changes:

Code that expects entity state to be populated by listeners/interceptors immediately after save() must call flush() explicitly. For example, asserting createdBy field after save() now requires flush() to trigger the audit interceptor.

In recent 8.0, we introduced a new task buildApp to build application distribution. Now we rely on built-in Gradle distribution plugin. It provides installDist (replace buildApp) but also adds support to package content into ZIP and TAR archives (ie distZip and distTar). CLI is still in BETA, so both tasks have been disabled by default. Request the tasks explicitly to generate the archives.

Form panel headers now force their title container to shrink so overly long titles are truncated (ellipsis) instead of spilling outside of the panel frame. Applies to standard panels, o2m/m2m grids, and dashlets.

Previously, records were fetched based on the strict start and end of the current month. This caused missing data for the trailing days of the previous month and leading days of the next month that were still visible. The fetch logic now calculates the actual start and end dates of the visible viewport.

Ensures all stream are closed in order to avoid memory leak. S3 now upload files using stream-based uploads instead of file based upload as it costs a bit of extra I/O. S3 caching mechanism stores the entire file content in the Java Heap memory : this cause high memory consumption.

Web workers is required for rich language features (validation, formatting, completion). This ensure these resources are fetched correctly using explicit paths containing /vs.

Display 50x error response in alter, except for the special maintenance mode.

Previously, when a dashlet was not yet rendered (e.g., in an inactive panel tab or hidden state) and refresh: true was set through action-attrs, it would trigger an unnecessary refresh once it became visible. This fix ensures that if the dashlet has already been refreshed during grid initialization, the extra refresh triggered by the earlier refresh: true flag is skipped.

Lazy load application routes, but also ReactDatePicker and libphonenumber-js libraries. This reduce main bundle size by 50% and loaded them on-demand.

While switching from edit/view mode, grid header label was blinking due to style changes.

In case of all grid aggregation type, don’t render grid footer if there is no record. This also ensure the aggregate function doesn’t not crash when no data are available.

Use xAxis type "time" for <category type="date|time" /> Line chart was always using "category" type (equal spacing), which is incorrect when dealing with time.

Sometime when refreshing gradle projects, test sources appears as deployment assembly causing unexpected behavior.

Add script-allowed com.axelor.auth.UserService for passwordMatchesPattern method.

Fix duplicate count decrement upon 401 (session expiration), that caused non-blocking UI after re-login from popup.

On constraint violations, return the violations mentioning the fields and the associated explicit constraint message.

Add the check, not null and too long violations to as explicit messages returned to users. Other cases are default messages.

CSV normalized end-of-lines to \r\n, between CSV records only, not for cell data. CSV cell data is now also normalized to \r\n.

For multiline translation keys, need to normalize back to \n, as that’s what is used in source code, meta views, etc. This fixes translations when keys contain end-of-lines.

This fix enables setting action-attrs (e.g., show/hide columns) for collection fields in O2O/M2O editors. Attributes can now be set both from the main form scope (customer.addresses.country: { hidden: true }) and within the editor scope (addresses.country: { hidden: true }).

Example:

Caused UnknownEntityTypeException

Also don’t show bar group for discrete bar, i.e., when groupBy is not used.

For example, if y-axis has years, top should be earliest, bottom should be latest.

When a form view is opened through the panel-dashlet edit icon in a tab view, the newly opened form view (in tab) record should be treated as the _parent, and the original panel-dashlet record should be passed as a nested _parent within it.

On M2O input autocomplete, as soon as search was triggered, onSelect then search query was triggered. onSelect is a UI blocking action, so any subsequent keyboard input in that time is skipped causing a poor user experience on heavy application.

Now onSelect is triggered if necessary, means only if the context doesn’t change. This reduce the number of calls. Moreover, keyboard input isn’t blocking on input element anymore. This allow users to continue typing smoothly while the onSelect action processes in the background.

An abortion technique is implemented to abort previous search request depending on keyboard input received.

Grid aggregation values had a hard coded scale to 2. Now, grid aggregation values have auto adaptive scale depending on values calculated and trailing zeros are removed.

Exported files are now created as a temporary files instead of being saved to data.export.dir directory. It used to be possible to disable downloading and have exported files only accessible in data.export.dir directory. This is no longer the case: the export files have to be either downloaded or attached to the current record.

By default, search scope to locate users is subtree: search whole subtree of base DN. Use new property auth.ldap.user.search.subtree = true | false, to update the search scope to onelevel if needed.

Added support for authenticating API requests using API keys via the API-KEY HTTP header. Introduced UserToken entity to manage API tokens per user, with secure token generation, hashing, and expiration handling.

Tokens can be created, revoked, and rotated from the User form.

The new Fixture api provides a more clean yaml format.

For example:

The relationships are defined using reference keys.

The new context propagation system is used to propagate context across threads and tasks submission. This is an all in one system combining TenantAware and AuditableRunner behaviors.

Main issue is to propagate in threads and tasks all information’s coming from HTTP requests (only available in servlet environments). Are concerned: the current user, tenant, locale, language and base URL. Some can be determined by application properties, some logic can be dependent from the request. The system is now able to propagate all current context information in threads and tasks. It also allows manually defining them in (case of scheduling / batching).

ContextAwareRunnable or ContextAwareCallable can be used to propagate context information.

Usage :

Re-implemented run and database gradle tasks as JavaExec tasks. This allows running them with vscode java debugger.

Also, as Gradle support in all major IDEs is now matured, the run task should be the preferred way to debug axelor apps.

Added a new checkDuplicateClasses gradle task to detect conflicting dependencies in application projects.

The task analyzes runtime classpath dependencies and identifies duplicate classes between different jar files, helping to prevent classpath conflicts that can cause runtime issues.

Key features:

Cache can be configured for the whole application or for specific components (Hibernate, Shiro).

The command line support can be used to implement custom commands to perform various tasks. The command line runner will locate CliCommand instances using service loader interface. A database command is added to perform various database related tasks.

The Gradle plugin adds a new task installDist to build application distribution. The application bundle will be generated at build/install/{project-name} folder which includes extracted war application in the app/ directory, launcher script dependencies in the lib/ directory and executable scripts in the bin/ directory.

The axelor script is an executable command line tool that can be used to execute various commands provided by the app: ./bin/axelor --help for more details.

Added support for S3-compatible object storage for DMSFile/MetaFile. The default implementation remains disk storage, but it can be switched to an S3-compatible service by configuring the data.object-storage.* properties. This change introduces a storage abstraction layer (FileStoreFactory) that should be used instead of direct file system access to ensure compatibility with both storage types.

The app will now configure scheduled tasks per tenant during startup. Also added support to update/remove tasks per tenant at runtime.

Introduced Multi-Factor Authentication (MFA) as an optional security feature to enhance user account protection. Supported MFA methods:

A scripting policy has been introduced to control which Java classes are accessible from scripts (Groovy, Expression Language, JavaScript). By default, access to most application classes is now restricted.

If your application uses scripts that call custom services or other classes, you will need to explicitly allow them. You can do this in two ways:

Additionally, a script execution timeout has been introduced to prevent infinite loops, which defaults to 5 minutes. This can be configured globally or per script execution.

doInJpa helper has been removed, as it allowed unrestricted database access. To get a bean instance with policy check, \\__bean__ helper has been introduced to replace unrestricted com.axelor.inject.Beans.get usage.

Note that the scripting policy is also applied to Groovy template engines by using the same class scanner and compiler configuration as for Groovy scripts. A side effect is that Groovy templates now use the same JPA class scanner.

Test entities can now be generated from XML files. This enables using the same domain modeling approach for test entities as production code.

By default, search scope to locate groups is subtree: search whole subtree of base DN. Use new property auth.ldap.group.search.subtree = true | false, to update the search scope to onelevel if needed.

Improve form password widget in readonly mode by showing the "show password" button if there is any value and adding a copy button to copy the value to clipboard.

When downloading a file, return the right Content-Type. Only pdf/images and html files can be previewed in browser.

The AxelorCache interface wraps various cache implementations.

Supported implementations include:

The underlying implementation that is used depends on application configuration.

Usage example:

Added DistributedFactory, which is a utility class that facilitates concurrency control in distributed cache environments. It provides static methods to access distributed-aware synchronization primitives, such as locks and atomic longs.

Currently, only fields declared in the grid view marked with the massUpdate attribute are updatable. Now, fields in the entity, even if not declared in the grid view, will also be listed in the mass update popover.

I18n exports are now downloaded as zip archive, instead of being created in data.export.dir directory.

Use Shiro 2 default hash algorithm: argon2id

To migrate passwords to the more secure algorithm, you can force users with old hashes to change their passwords:

When users set their new passwords, the new hash algorithm will be used.

https://shiro.apache.org/blog/2024/02/apache-shiro-200-released.html

The old Interceptor based implementation has several limitations and couldn’t work in cases where persistence session is created manually.

The new implementation uses event listener api and thus can have access to the session for which the events are fired. Fixing, issues caused by persistent session created manually.

Also, new api handles multi-threading cases more effectively.

Here is the list of backend dependencies upgraded :

Many of your reports will likely have rendering changes or may even be broken due to numerous emitter improvements/changes in BIRT.

IPDFRenderOption.PDF_HYPHENATION is renamed to IPDFRenderOption.PDF_WORDBREAK, but enabled by default.

BIRT has a transitive dependency to Apache POI, upgraded from 3.9 to 5.4.0, that includes breaking changes: https://poi.apache.org/changes.html

Also, the XML parser in BIRT has become stricter. Most notably, in your fontsConfig.xml, you need to omit the DOCTYPE declaration <!DOCTYPE font> to avoid validation against a non-existent DTD. Otherwise, your font configuration file will fail validation and will be ignored.

JUnit 4 is no longer actively maintained, and the last maintenance release was JUnit 4.13.2 in February 2021. Support for JUnit Jupiter (JUnit 5) was introduced in v6.0. It is time to drop support for JUnit 4. Migrate your Junit tests to Junit5.

Data export process now requires a token param instead of a file path relative to the export directory. ActionResponse#setExport has been updated and overloaded accordingly:

The file path is copied to a dedicated temporary file for pending export. path filename is used for download name if name is not specified as second parameter.

Initially, the AuthUtils#getUser() method is used to retrieve the current connected user. This is only available in servlet environments. In case of non-servlet environments (batch/schedule/…​), there is no connected user. Now the method retrieves the current user associated with the thread or session (see context propagation system based on ContextAware* classes). It first uses the current user stored in the thread-local if provided. Else it attempts to retrieve the connected user if any.

TagSelect widget is deprecated in favor of Tags. It has the same behavior, it’s just a renaming of the widget name for readability and relevance. Old name can still be used, but we encourage adopting the new name as its usage will be removed in a next version.

https://docs.oracle.com/en/java/javase/21/migrate/index.html

We have switched from servlet-container sessions to Shiro native sessions. This change enables the use of Redis/Valkey server as a session store and simplifies the overall architecture by leveraging Shiro’s SessionDAO.

Key changes to be aware of:

For more details about Shiro’s session management, see the Shiro Session Management documentation.

Move from Java EE to Jakarta EE. This include transition from the javax namespace to the jakarta namespace.

https://github.com/diffplug/spotless/blob/gradle/7.0.4/plugin-gradle/CHANGES.md#704---2025-05-27

In case of multi-tenancy, base url should favor tenant host. Without multi-tenancy, base url should favor app config base url.

Request host is now last fallback.

Removed field name on MetaFilter. Removed unique constraint on name, filterView, and replaced it with index meta_filter_filter_view_idx on filterView.

This allows different users to create filters with the same title.

Database migration script:

This is replaced by a generic context propagation system based on ContextState and ContextAware* wrappers. Use ContextAwareRunnable or ContextAwareCallable instead.

Another consequence of supporting multiple storage providers is the removal of export directory setting data.export.dir. If you used it, you should migrate your code to create temporary files or directories instead, using com.axelor.file.temp.TempFiles, then download or attach the files somewhere for the users to access.

Related ActionExport#getExportPath is also removed.

Top menu support has been removed since 7.0. To ensure compatibility, the attribute was still present in xsd.

Added for backward compatibility, accessing fields now no longer need record. prefix. Update your js expressions, templates and EvalRefSelect x-eval-* attributes according.

As part of the AxelorPlugin, we historically provided built-in support to manage license headers. This support has been removed and licenseFormat, licenseCheck and related tasks no longer exist. The plugin on which support was provided is no longer maintained. This is now application or module responsibility to provide it.

There are many Gradle plugins that can do the job. List is available on the Gradle plugin portal. The awesome Spotless formatting plugin provides support for adding license headers.

This removes Gradle support for database management (init/update/…​) in favor of new CLI.

Use either Material Symbols and Bootstrap Icons.

Remove deprecated ws/files/report/{link:.\*} and ws/files/data-export/{fileName:.*} web services in favor of their equivalencies using query parameters : ws/files/report?link=<link> and ws/files/data-export?fileName=<fileName>.

Help widget css support is removed, use variant instead.

On a grid with multiple groups, the item count displayed on each level was incorrect.

Custom attrs fields/buttons that were auto-added were not properly processed when saving customization.

This fixes preserving and removing of those fields.

When saved, all custom fields are explicitly present as view items.

When a tracked value is lazy proxy and is not in L1 cache, it will give lazy initialization error.

With this change custom field and form field are accessible through same way, i.e. form field can directly be accessed and custom fields are accessed like $attr.customFieldName in both kinds of fields.

When defining an entity in xml, extending an entity not available in project source (defined in dependencies), that super entity was not available in lookup and caused spurious warning "track unknown field".

Now make sure to compute lookup for any super classes if not present.

When there are no custom fields in original grid view, all custom fields visible in grid are added to view.

But in the case when there is at least one custom field defined in original view, only that custom field was listed in grid customization selector. Now all custom fields are listed, even those who aren’t checked are visible in grid.

During massUpdate web service, if any fields are not allowed to be updated through MetaPermissionRule, return an exception and display it to the user.

With Runtime.getRuntime().addShutdownHook(), closing LDAP connection pool will attempt to log something after the web application has already been stopped.

Instead, now observing ShutdownEvent, ensuring we close LDAP connection pool within application lifecycle.

Fixes various NoClassDefFoundError, such as:

java.lang.NoClassDefFoundError: ch/qos/logback/classic/spi/ThrowableProxy Caused by: java.lang.ClassNotFoundException: Illegal access: this web application instance has been stopped already. Caused by: java.lang.IllegalStateException: Illegal access: this web application instance has been stopped already.

Fix json fields handling in customized grid leading to duplication issues.

The template file should be either uploaded MetaFile or should be within the template.search-dir.

Shouldn’t be possible to have a "path" as export name (eg some/foo.xml).