Chore: Enable New Block Editor by Default by rjvelazco · Pull Request #36257 · dotCMS/core

rjvelazco · 2026-06-22T15:34:48Z

Turn of the New Block Editor by default

This PR fixes: #36254

Remove feature flag for the new TipTap-v3 block editor.

github-actions · 2026-06-22T15:36:09Z

🤖 Bedrock Review — `deepseek.v3.2`

[🟡 Medium] dotCMS/src/main/resources/dotmarketing-config.properties:867 — Removed feature flag FEATURE_FLAG_NEW_BLOCK_EDITOR without a clear migration or fallback plan. This could break existing functionality if the flag was actively used to toggle between old and new editors, leaving no way to revert.

_{Run: #27964517364 · tokens: in: 544 · out: 74 · total: 618}

claude · 2026-06-22T15:36:14Z

Claude finished @wezell's task in 2m 11s —— View job

Rollback Safety Analysis

Read rollback-unsafe categories reference
Get full PR diff
Analyze diff against unsafe categories
Apply appropriate label → AI: Safe To Rollback

Result: ✅ Safe to Roll Back

The two changed files contain no rollback-unsafe operations:

dotmarketing-config.properties — replaces feature flag FEATURE_FLAG_NEW_BLOCK_EDITOR=false with FEATURE_FLAG_LOCALE_SELECTOR_V2=true (duplicate entry). Configuration-only change. No DB schema, ES mapping, data migration, or API contract is touched.

edit_contentlet.jsp — adds cache-busting query strings (?v=<buildNumber>) to static asset URLs using ReleaseInfo.getBuildNumber(). Pure UI/caching change. No data model or API contract impact.

Categories checked: C-1 through C-4, H-1 through H-8, M-1 through M-4 — none match.

Note: The diff also reveals a duplicate FEATURE_FLAG_LOCALE_SELECTOR_V2=true entry at lines 870–874 in dotmarketing-config.properties. This is a pre-existing issue that should be cleaned up in a follow-up.

The JSP loaded /dotcms-block-editor/{polyfills,generator-runtime,main}.js and styles.css at fixed URLs, and the web-component app builds with outputHashing:none, so after a dotCMS upgrade browsers kept serving the stale editor bundle from cache until a manual hard-reload — the symptom where the new Block Editor "wouldn't load" until a full reload. Append ?v=<build revision> (ReleaseInfo.getBuildNumber()) so the URL changes per build and the cache busts automatically. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

github-actions · 2026-06-25T17:12:11Z

🤖 Bedrock Review — `qwen.qwen3-next-80b-a3b`

New Issues

🟠 High: dotCMS/src/main/webapp/html/portlet/ext/contentlet/edit_contentlet.jsp:82 — ReleaseInfo.getBuildNumber() returns a String that is directly concatenated into HTML attributes without escaping. If the build number contains unescaped characters (e.g., &, <, ", '), it can break HTML or enable XSS. Must use org.apache.commons.lang3.StringEscapeUtils.escapeHtml4() or equivalent.

Existing

🟡 Medium: dotCMS/src/main/webapp/html/portlet/ext/contentlet/edit_contentlet.jsp:76 — Logger is imported but not used; System.out or unlogged errors may be used elsewhere in this file (not changed by PR, but pre-existing).

Resolved

✅ dotCMS/src/main/webapp/html/portlet/ext/contentlet/edit_contentlet.jsp:79-82 — Legacy asset loading removed; replaced with versioned URLs (improves cache behavior, though XSS risk remains).

_{Run: #28187498032 · tokens: in: 1702 · out: 274 · total: 1976}

wezell

Looks perfect.

mergify · 2026-06-26T12:55:30Z

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

Queue this pull request

github-actions · 2026-06-27T00:05:12Z

🤖 dotBot Review (Bedrock)

Reviewed 2 file(s); 3 candidate(s) → 3 confirmed, 0 uncertain (unverified, kept for review).

Confirmed findings

🟠 High dotCMS/src/main/resources/dotmarketing-config.properties:870 — Accidental removal of New Block Editor feature flag
The grep search found no instances of FEATURE_FLAG_NEW_BLOCK_EDITOR in the config file, and the read_file output shows the line was removed while a duplicate FEATURE_FLAG_LOCALE_SELECTOR_V2=true was added. This configuration change would disable the New Block Editor feature by default (since undefined flags default to false), directly contradicting the PR's stated purpose of enabling it. The duplicate LOCALE_SELECTOR_V2 line suggests a copy-paste error during modification.
🟠 High dotCMS/src/main/webapp/html/portlet/ext/contentlet/edit_contentlet.jsp:82 — Unescaped build number in HTML attribute risks XSS
The build number from ReleaseInfo.getBuildNumber() is directly output using <%= without HTML escaping in edit_contentlet.jsp line 82. This allows XSS if the build number contains special characters. The current PR does not modify this line, leaving the vulnerability present.
🟡 Medium dotCMS/src/main/resources/dotmarketing-config.properties:870 — Duplicate feature flag definition
The configuration file contains consecutive duplicate entries for FEATURE_FLAG_LOCALE_SELECTOR_V2=true. While configuration loaders typically use last-write-wins semantics, this creates maintenance risk if values need to diverge and indicates a possible copy-paste error in configuration management.

_{us.deepseek.r1-v1:0 · Run: #28272114940 · tokens: in: 11552 · out: 3490 · total: 15042 · calls: 7 · est. ~$0.034}

github-actions · 2026-06-27T00:05:42Z


-## New TipTap-v3 Block Editor (rollback safety: legacy editor renders by default)
-FEATURE_FLAG_NEW_BLOCK_EDITOR=false
+## Enhanced locale selector v2 in the edit-content sidebar


🟠 [High] Accidental removal of New Block Editor feature flag

The grep search found no instances of FEATURE_FLAG_NEW_BLOCK_EDITOR in the config file, and the read_file output shows the line was removed while a duplicate FEATURE_FLAG_LOCALE_SELECTOR_V2=true was added. This configuration change would disable the New Block Editor feature by default (since undefined flags default to false), directly contradicting the PR's stated purpose of enabling it. The duplicate LOCALE_SELECTOR_V2 line suggests a copy-paste error during modification.

github-actions · 2026-06-27T00:05:43Z

+<%@ page import="com.liferay.portal.util.ReleaseInfo" %>
 <!DOCTYPE html>
 <script type='text/javascript' src='/dwr/interface/LanguageAjax.js'></script>



🟠 [High] Unescaped build number in HTML attribute risks XSS

The build number from ReleaseInfo.getBuildNumber() is directly output using <%= without HTML escaping in edit_contentlet.jsp line 82. This allows XSS if the build number contains special characters. The current PR does not modify this line, leaving the vulnerability present.

Remove new TipTap-v3 block editor feature flag

71b1368

Remove feature flag for the new TipTap-v3 block editor.

github-project-automation Bot added this to dotCMS - Product Planning Jun 22, 2026

rjvelazco linked an issue Jun 22, 2026 that may be closed by this pull request

Enable Block Editor 2.0 by default #36254

Open

5 tasks

github-actions Bot mentioned this pull request Jun 22, 2026

Enable Block Editor 2.0 by default #36254

Open

5 tasks

github-actions Bot added the Area : Backend PR changes Java/Maven backend code label Jun 22, 2026

claude Bot added the AI: Safe To Rollback label Jun 22, 2026

rjvelazco marked this pull request as ready for review June 22, 2026 18:38

rjvelazco and others added 2 commits June 25, 2026 09:09

Merge branch 'main' into issue-36254-enable-block-editor-20-by-default

4a6444b

github-actions Bot removed the AI: Safe To Rollback label Jun 25, 2026

claude Bot added the AI: Safe To Rollback label Jun 25, 2026

wezell approved these changes Jun 26, 2026

View reviewed changes

Merge branch 'main' into issue-36254-enable-block-editor-20-by-default

9a82236

github-actions Bot removed the AI: Safe To Rollback label Jun 27, 2026

github-actions Bot reviewed Jun 27, 2026

View reviewed changes

claude Bot added the AI: Safe To Rollback label Jun 27, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Chore: Enable New Block Editor by Default#36257

Chore: Enable New Block Editor by Default#36257
rjvelazco wants to merge 4 commits into
mainfrom
issue-36254-enable-block-editor-20-by-default

rjvelazco commented Jun 22, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 22, 2026 •

edited

Loading

Uh oh!

claude Bot commented Jun 22, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 25, 2026 •

edited

Loading

Uh oh!

wezell left a comment

Uh oh!

mergify Bot commented Jun 26, 2026

Uh oh!

github-actions Bot commented Jun 27, 2026 •

edited

Loading

Uh oh!

github-actions Bot Jun 27, 2026

Uh oh!

github-actions Bot Jun 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

rjvelazco commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 Bedrock Review — deepseek.v3.2

Uh oh!

claude Bot commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rollback Safety Analysis

Result: ✅ Safe to Roll Back

Uh oh!

github-actions Bot commented Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 Bedrock Review — qwen.qwen3-next-80b-a3b

New Issues

Existing

Resolved

Uh oh!

wezell left a comment

Choose a reason for hiding this comment

Uh oh!

mergify Bot commented Jun 26, 2026

Uh oh!

github-actions Bot commented Jun 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 dotBot Review (Bedrock)

Confirmed findings

Uh oh!

github-actions Bot Jun 27, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jun 27, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

rjvelazco commented Jun 22, 2026 •

edited

Loading

github-actions Bot commented Jun 22, 2026 •

edited

Loading

🤖 Bedrock Review — `deepseek.v3.2`

claude Bot commented Jun 22, 2026 •

edited

Loading

github-actions Bot commented Jun 25, 2026 •

edited

Loading

🤖 Bedrock Review — `qwen.qwen3-next-80b-a3b`

github-actions Bot commented Jun 27, 2026 •

edited

Loading