What changed, release by release.

Upgrade Notes

• Content search replaces the text-search module, and is opt-in. Files are only extracted, and found by their content, in folders with a content extraction configuration: after the upgrade no file is found by its content until an admin creates one in the Content Extraction dialog of the Files area and processes the existing files. With the default application.migration.mode = apply, the old data is deleted on startup: the extractedContent and indexed properties of all files, mountDoFulltextIndexing of all folders and the File_extractedContent_fulltext index. Replace file.extractedContent with $.documents.getExtractedText(file), stopWords() with $.documents.stopWords(), searches on extractedContent with $.documents.fulltextSearch(), the fulltext option of the file import with $.documents.processContent(folder), and the application.filesystem.indexing.* settings with contentextraction.*. The Migration chapter of the documentation has the full list.
• The Debian package no longer installs Java. It no longer depends on openjdk-11-jdk-headless, which was outdated: Structr 7 requires GraalVM 25, which is not available as a Debian package. Install GraalVM 25 before installing or upgrading the package, as described in Getting Started. logrotate is now recommended instead of required, like Tesseract for OCR, so apt-get install --no-install-recommends skips both.
• The session cookie is HttpOnly by default. httpservice.cookies.httponly now defaults to true, so JavaScript in the page can no longer read JSESSIONID. The Admin UI and Structr's frontend scripts do not need it. Custom frontend code that reads the cookie, for example to send the session id over its own websocket connection, stops working; set httpservice.cookies.httponly = false to keep the old behaviour. Installations that set the value explicitly in structr.conf are not affected.
• Template expressions with regular expression literals are evaluated now. A ${{ ... }} block containing a regular expression literal with a quote or brace in it, such as /href="([^"]+)'/, used to be skipped silently, so that part of the page rendered empty. The scanner now recognises regular expression literals, so such blocks are evaluated. Check templates whose output changes after the upgrade: they contain a block that was not executed before. A block that is still never closed, for example because of an unbalanced quote, is now logged as a warning naming the template.
• Cron steps in the day and month fields count from 1. A step such as */3 used to be counted wrongly in the day-of-month and month fields: */3 in the months ran in February, May, August and November, and in the days on the 2nd, 5th, 8th and so on. It now counts from the first allowed value, as in the Unix crontab: January, April, July and October, and the 1st, 4th, 7th. Seconds, minutes, hours and days of the week are unaffected. Check cron expressions with a step in the fourth or fifth field. List values outside a field's range, such as 0,60 in the seconds, are now rejected instead of never matching, and the configuration interface checks expressions with the same rules as the server.
• The superuser login is blocked after 3 failed attempts. While the superuser has no second factor, 3 wrong superuser passwords within 15 minutes, counted across all addresses and across the configuration interface, X-User/X-Password and HTTP Basic authentication together, block the superuser everywhere for 15 minutes, including for the right password. Scripts that authenticate as the superuser with a wrong or outdated password trigger it as well. configservlet.login.maxattempts and configservlet.login.lockout.seconds adjust it; 0 seconds turns it off. With superuser.twofactor.enabled on, superuser requests over HTTP need the X-TwoFactor-Code header, so scripts that use the superuser stop working; use an admin user for them.
• assert() aborts on anything but true. Until 7.0, a null argument or a wrong number of arguments made assert() log an error and let the request continue, even when the condition was false. So $.assert($.me, 401, ...) admitted anonymous users, and $.assert(false, status, msg) with status or msg being null let everyone through. Now only the boolean true passes; everything else aborts, with the given status code, or 500 when it is missing or not a number. A condition that is not a boolean is logged as a warning. Check scripts that pass objects to assert() instead of comparisons, such as $.assert($.me, ...): write $.assert($.me != null, ...).
• Mailboxes are no longer fetched automatically. Until 7.0, the MailService checked every Mailbox every mail.updateinterval milliseconds. It now fetches a mailbox only when fetchMails() is called on it. An instance that relied on automatic fetching silently stops receiving mail after the upgrade, so add a scheduled task before or right after upgrading: a user-defined function that calls fetchMails() on the mailboxes you need, registered with the CronService, for example

CronService.tasks = fetchAllMailboxes
fetchAllMailboxes.cronExpression = 0 */5 * * * *

The Email article ("Fetching on a Schedule") has the complete example. mail.updateinterval has been removed; if it is still set in structr.conf, Structr names its replacement at startup. Three settings are new: mail.connecttimeout (default 30 s), mail.readtimeout (default 60 s) and mail.maxconcurrentfetches (default 4).

• IMAP mailboxes are fetched incrementally. A fetch now reads the messages that arrived since the previous one, oldest first, in batches of mail.maxemails, so a burst larger than the batch is fetched over several runs instead of being lost. The first fetch after the upgrade takes the newest mail.maxemails messages, as before. POP3 mailboxes still read the newest mail.maxemails every time.
• Duplicates are detected per mailbox. A mail delivered to two of your mailboxes is now stored once for each of them; until 7.0 only the first mailbox to fetch it received a copy.
• New read-only properties on Mailbox: lastFetchStarted, lastFetchSucceeded, lastFetchError, lastFetchCount and fetchState. Code that counts or lists all properties of Mailbox sees five more.
• HTML, SVG and XML files are displayed again instead of downloaded. 7.0 delivered every such file from the file area as a download. 7.1 delivers files as their content type says (RFC 6266) and protects against the case that made the download necessary, an uploaded page running in your application's origin with the session of whoever opens it:
• A file is trusted when an admin uploaded it through the browser; the new read-only trusted property records that. A trusted file is delivered unchanged.
• Every other file is untrusted: it is displayed sandboxed, without scripts, forms or framing, and is not cached. htmlservlet.filedelivery decides further: auto (default) downloads untrusted files on an instance whose application.instance.stage is production and sandboxes them everywhere else; sandbox, attachment and inline set one behaviour for all stages. Except with inline, an admin opening an untrusted file from outside the application, or with no referrer, always gets the download.
• Files that existed before the upgrade are untrusted. An HTML file that needs its scripts, for example a single-page application kept in the file area, stops working until an admin marks it trusted on the General tab of the file.
• trusted and isTemplate can only be set by an admin now; for anyone else the change is refused with 403, also from scripts that call unlockReadonlyPropertiesOnce().
• A download can still be requested explicitly with the _filename request parameter.
• S/MIME mail files are no longer indexed. To fix the mail fetch failures on S/MIME-signed messages, BouncyCastle's S/MIME support for Jakarta Mail (bcjmail) is no longer shipped. As a side effect, the full-text extraction no longer reads the content of S/MIME-signed or -encrypted mail files stored in the file area; all other file types are unaffected.
• Undeclared method parameters are rejected. A method with declared parameters no longer ignores parameters it does not declare: a REST or script call with such a parameter fails with 422 Unprocessable Entity and the method is not executed. Event action mappings still drop them and log a warning. Declare the parameters, or enable "Allow unknown parameters" in the API tab of the method. Methods without declared parameters accept any parameters as before.
• Two sort calls behave differently. An order of 'desc' after a name, as in $.find('User', $.predicate.sort('createdDate', 'desc')), now sorts in descending order; before, every value except true sorted ascending. An order without a name, as in sort(list, true), now sorts by name in descending order. A value after a name that is neither an order nor a known key, like 'descending', raises an error instead of being ignored.
• Virtual types and the api-builder module are removed. Applications that use virtual types or the api-builder module must replace them before upgrading.
• A fresh installation needs the setup token. Read it from the server log (a line beginning with Initial setup:), or preset it with setup.token in automated installations. Existing installations with a superuser password are not affected.
• Only admins can set skipSecurityRelationships. It can now be enabled for non-admin users as well, but the property is read-only for everyone except admins.
• The sync settings of mounted folders moved to the storage configuration. Scripts that read or write the watch, scan interval or target type properties of a folder, or sync.deleteStale, need to use the entries sync.watchContents, sync.scanInterval, sync.fileType, sync.folderType and sync.onVanished of the mount's storage configuration.