Permalink Generator

Security

• Action endpoint authentication — GeneratePermalinksAction now explicitly requires an authenticated user and the siteAdminPermalinkGenerator permission. Previously these checks were not enforced at the action level.
• Exception details no longer leaked — internal error messages are no longer returned to the client; a generic message is returned and the detail is logged server-side.

Fixed

• Drools re-entrancy guard — removePermalinkMixin() now skips writes when called from a system session, preventing an infinite loop when Drools processes module-initiated saves.
• isPublishedInLive() error handling — unexpected RepositoryException (other than ItemNotFoundException) now preserves the vanity instead of incorrectly treating it as unpublished.
• CSS — help button size — .pl-help-btn restored to 20×20 px (was 44×44 px).
• CSS — legend pills — decorative aria-hidden pills in the legend overridden to compact size.

Changed

• saveVanityWithMixin() split into addMixinToSavedVanity() — single save per operation closes a create/save re-entrancy window.
• Many magic strings extracted to named constants in PermalinkGeneratorService.

Dependencies

• org.assertj:assertj-core 3.24.2 → 3.27.7 (fixes CVE-2026-24400 XXE in test scope)
• cypress 13.17.0 → 15.17.0 / qs 6.14.2 → 6.15.2 (dev/test only)

Full changelog: https://github.com/Jahia/permalink-generator/blob/main/CHANGELOG.md

Upgrading from 1.0.x

Version 1.0.x ran entirely in the background: it generated a vanity URL when a page title was set, and nothing else. There was no admin panel and no configuration.

Version 2.0.0 is a complete rewrite. The background behaviour is preserved and significantly extended; a full admin panel is added; and the Spring service layer is replaced with OSGi Declarative Services.

Existing auto-generated vanities are unaffected. The module upgrades cleanly.

---

New admin panel — Site Settings → Permalink Generator

The module now has a dedicated administration panel, accessible from Site Settings → Permalink Generator. It is the single place to configure the module and operate on vanity URLs in bulk.

Mode selection (SMART or FORCE)

Choose how the module handles pages that already have a vanity URL:

SMART mode (default): Never overwrites a vanity URL that an editor set manually. On rename or move, only the path prefix is updated — the editor's slug is preserved.

FORCE mode: Always applies the computed URL. Manual vanities are replaced and kept as redirects.

Excluded paths — Enter JCR paths (one per line) to suppress automatic generation for entire content subtrees. Individual pages can also be excluded in Content Editor via the jmix:permalinkExcluded mixin.

Missing Permalink Audit — Find all pages with no vanity URL, by language. Select and generate in one click. Useful when first enabling the module on an existing site.

Force Regeneration — Preview exactly which vanity URLs would change (stale, manual, or missing) before writing anything. Each row shows current URL and what it would become. Deselect rows to keep, confirm, done. Old vanities are always kept as redirects.

---

Extended background behaviour (new in 2.0.0)

• Rename — vanity updated when title changes; old URL kept as redirect.
• Move — vanity (and all descendants) updated when page moves in tree; old URLs kept as redirects.
• Delete — vanities deactivated so existing links redirect rather than 404.
• Copy — copied pages start fresh; vanities computed independently from the copy's own title.
• Manual vanity detection — vanities set directly in the SEO tab are marked as manual and never overwritten in SMART mode.
• Vanity undelete — reactivates an existing deactivated vanity instead of creating a duplicate.

---

Removed

• Spring framework dependency — service is now pure OSGi DS. The META-INF/spring/ wiring from 1.0.x is gone. Third-party bundles that imported the Spring bean must rebind to the OSGi service.

---

Full changelog: permalink-generator-1.0.4...permalink-generator-2.0.0

Ignore creating vanity for files

• Bypass the rule on import
• Fix for level 1 pages != home
• Remove jnt:content from the list to handle
• Fix for non-registered namespace prefix (should prevent the following error wemnt: is not a registered namespace prefix)

Fix the rule when updating a title on a node which is out of any site

Rename the rule to avoid conflict with existing one