This release introduces Alfresco Content Services Community Edition 26.2, the second release of the 26.x family. It adds several new configuration properties for versioning, auditing and large-result-set query tuning, and a broad set of third-party library security fixes.
authorityDisplayName field is returned by the Node Permissions REST APIItems in this section are already changed or removed, they will cause failures on upgrade without prior action. For items that still work but are scheduled for removal.
As of 26.2.0, Alfresco Search Services (Solr) is no longer supported for any edition, including Community. It may still function, but it will not be supported or maintained: no fixes, no security patches, and no compatibility guarantees. OpenSearch / Elasticsearch support for Community is now available through the new Alfresco Search Community service introduced in this release.
| From Version | Direct Upgrade to 26.2 | Required Intermediate Stop | Notes |
|---|---|---|---|
| 26.1.x | Yes | - | No schema changes. Review the new configuration property defaults. |
| 25.3.x | Yes | - | Java 21 + Tomcat 11 migration required. Review all Breaking Changes above. |
| 7.x / 23.x | No | Upgrade to 25.3 first | Upgrade to 25.3.x, then to 26.2. Review all Breaking Changes (Java 21, Tomcat 11, ActiveMQ authentication, v1 events disabled) before proceeding. |
| Older versions | No | Contact support for upgrade path |
Please ensure the following steps are completed before starting your upgrade:
Full upgrade documentation: https://support.hyland.com/r/Alfresco/Alfresco-Content-Services-Community-Edition/26.2/Alfresco-Cont...
Alfresco Community Edition 26.2 is available as a distribution ZIP file for manual installation, or it can be installed using an Ansible playbook (Linux only) for non-containerised environments. It is also available as a set of Docker images that can be deployed using Docker Compose or Helm charts (Kubernetes).
Full installation documentation: https://support.hyland.com/r/Alfresco/Alfresco-Content-Services-Community-Edition/26.2/Alfresco-Cont...
Alfresco Ubuntu installer: https://github.com/aborroy/alfresco-ubuntu-installer
Ansible deployment: https://github.com/Alfresco/alfresco-ansible-deployment
Reference Docker Compose template: community-compose.yaml
Additional Docker Compose deployment methods:
Helm charts: https://github.com/Alfresco/alfresco-helm-charts
Single canonical reference for all 26.2.0 component versions, download artifacts, SCM tags, and SHA-256 checksums for supply-chain verification.
| Component | Version | Download | SHA-256 | SCM Tag |
|---|---|---|---|---|
| Content Repository | 26.2.0 | ...-distribution-26.2.0.zip | 8c1e22d9dbc8c3289414d789eb6a6c14608645276fa8dc19b4dcc08e715a44fe | 26.2.0 |
| Alfresco Share | 26.2.1 | ...-share-distribution-26.2.1.zip | df20ab0f8e5d9f3f5c0e53d51b72ca0dcfaecec6b47ac1654ea39459501638c4 | alfresco-community-share @ 8eb9eff |
| Transform Core AIO | 5.4.3 | alfresco-transform-core-aio-5.4.3.jar | e9ee01f60fe15d5c7594f58b67f15a30ec0a47fbb5d4b4921aea52e8f46fe91b | 5.4.3 |
| Alfresco Content App | 8.0.0 | alfresco-content-app-8.0.0 | n/a (GitHub source release) | 8.0.0 |
| Governance Services | 26.2.0 | ...-governance-services-community-26.2.0.zip | a11a52849070f8ee5f97779b89feb10837868509a9d1fd9133f3e5dec0d64859 | 26.2.0 |
Source for packaging project: acs-community-packaging 26.2.0
Note: Alfresco Share ships as 26.2.1 in this release. Share 26.2.0 was superseded by 26.2.1 to include a security fix; 26.2.1 is the initial supported Share artifact for the 26.2 release and 26.2.0 should not be used. All other components remain at 26.2.0.
Note: Alfresco Search Services (Solr) is not supported from 26.2.0 and is no longer listed as a release component. It may still function but is not supported or maintained. OpenSearch / Elasticsearch support for Community is now available through the new Alfresco Search Community service.
The following Docker images are available for both AMD64 and ARM64 architectures. All images are hosted on Docker Hub except Alfresco Control Center, which is hosted on Quay.io (see the Registry column).
| Image | Tag | SHA-256 Digest (AMD64) | Registry |
|---|---|---|---|
| alfresco/alfresco-content-repository-community | 26.2.0 | sha256:01c0aa60fe02137d0b73a72575919711a89cf0e75f367f94bc1e7d01832ee8aa | tags |
| alfresco/alfresco-share | 26.2.1 | sha256:b91e19783c052d7110d2c6729ae5dc9de5083959219ae7a5fdaf4624fd0d47bc | tags |
| alfresco/alfresco-activemq | 6.2.6-jre17-rockylinux8 | sha256:4ac06416cc5fb0ed6ed36b4a149cd6231c6718d3fb28b008f79079b1ad93be1f | tags |
| alfresco/alfresco-transform-core-aio | 5.4.3 | sha256:c8e7c4a2119bfb659144a622040c63b0375983ad9b3f46786f0069b96f67a8db | tags |
| alfresco/alfresco-content-app | 8.0.0 | sha256:67d39217559f222226419b9d28606f423cff3417872e5161790423b20f3ae670 | tags |
| alfresco/alfresco-control-center | 11.0.0 | sha256:80b2c3becd2c6ebddd285956d490120730febbf0b284ddb7e98d9cfe919adb68 | Quay.io |
Note: The reference Docker Compose deployment uses Apache ActiveMQ 6.2.6. Authentication is configured by default; custom environments must ensure broker credentials are consistent across connected services.
Provenance: https://github.com/Alfresco/alfresco-docker-base-tomcat
Size: 931 MB (+28 MB)
Packages: 398 (+12)
## Environment Variables
APR_LIBDIR=/usr/local/tomcat/apr
CATALINA_HOME=/usr/local/tomcat
JAVA_HOME=/etc/alternatives/jre
LANG=C.UTF-8
LC_ALL=C.UTF-8
LD_LIBRARY_PATH=/usr/local/tomcat/native-jni-lib:/usr/local/tomcat/apr
PATH=/usr/local/tomcat/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
TOMCAT_NATIVE_LIBDIR=/usr/local/tomcat/native-jni-lib
## Labels
io.buildah.version=1.37.6
license=BSD-3-Clause
name=rockylinux
org.label-schema.build-date=2025-12-01T03:19:14Z
org.label-schema.description=Apache Tomcat Image tailored for Alfresco products
org.label-schema.name=Alfresco Base Tomcat Image
org.label-schema.schema-version=1.0
org.label-schema.url=https://github.com/Alfresco/alfresco-docker-base-tomcat
org.label-schema.vcs-ref=https://github.com/Alfresco/alfresco-docker-base-tomcat
org.label-schema.vcs-url=https://github.com/Alfresco/alfresco-docker-base-tomcat
org.label-schema.vendor=Hyland
org.opencontainers.image.authors=Alfresco OPS-Readiness
org.opencontainers.image.created=2025-12-01T03:19:14Z
org.opencontainers.image.description=Apache Tomcat Image tailored for Alfresco products
org.opencontainers.image.license=BSD-3-Clause
org.opencontainers.image.name=rockylinux
org.opencontainers.image.revision=678
org.opencontainers.image.source=https://github.com/Alfresco/alfresco-docker-base-tomcat
org.opencontainers.image.title=Alfresco Base Tomcat Image
org.opencontainers.image.url=https://github.com/Alfresco/alfresco-docker-base-tomcat
org.opencontainers.image.vendor=Hyland
org.opencontainers.image.version=9
vendor=Rocky Enterprise Software Foundation
version=9
## Packages and Vulnerabilities
+ 12 packages added
- 0 packages removed
⎈ 122 packages changed (↑ 122 upgraded, ↓ 0 downgraded)
264 packages unchanged
Package Version Previous
↑ com.fasterxml.jackson.core/jackson-annotations 2.22 2.17.2
↑ com.fasterxml.jackson.core/jackson-core 2.22.0 2.17.2
↑ com.fasterxml.jackson.core/jackson-databind 2.22.0 2.17.2
↑ com.fasterxml.jackson.dataformat/jackson-dataformat-yaml 2.22.0 2.17.2
↑ io.micrometer/micrometer-commons 1.16.6 1.16.1
↑ io.micrometer/micrometer-observation 1.16.6 1.16.1
↑ io.netty/netty-buffer 4.1.135.Final 4.1.130.Final
↑ io.netty/netty-codec 4.1.135.Final 4.1.130.Final
↑ io.netty/netty-codec-http 4.1.135.Final 4.1.130.Final
↑ io.netty/netty-codec-socks 4.1.135.Final 4.1.130.Final
↑ io.netty/netty-common 4.1.135.Final 4.1.130.Final
↑ io.netty/netty-handler 4.1.135.Final 4.1.130.Final
↑ io.netty/netty-handler-proxy 4.1.135.Final 4.1.130.Final
↑ io.netty/netty-resolver 4.1.135.Final 4.1.130.Final
↑ io.netty/netty-tcnative-classes 2.0.77.Final 2.0.74.Final
↑ io.netty/netty-transport 4.1.135.Final 4.1.130.Final
↑ io.netty/netty-transport-classes-epoll 4.1.135.Final 4.1.130.Final
↑ io.netty/netty-transport-classes-kqueue 4.1.135.Final 4.1.130.Final
↑ io.netty/netty-transport-native-epoll 4.1.135.Final 4.1.130.Final
↑ io.netty/netty-transport-native-kqueue 4.1.135.Final 4.1.130.Final
↑ io.netty/netty-transport-native-unix-common 4.1.135.Final 4.1.130.Final
↑ junrar/junrar 7.5.10 7.5.8
↑ org.alfresco/acs-event-model 1.1.0-A.1 1.0.11
↑ org.alfresco/alfresco-core 26.2.0.96 26.1.0.61
↑ org.alfresco/alfresco-data-model 26.2.0.96 26.1.0.61
↑ org.alfresco/alfresco-mmt 26.2.0.96 26.1.0.61
↑ org.alfresco/alfresco-remote-api 26.2.0.96 26.1.0.61
↑ org.alfresco/alfresco-share-services 26.2.0.96 26.1.0.61
↑ org.alfresco/alfresco-transform-model 5.4.3 5.4.0
↑ org.apache.activemq/activemq-client 6.2.4 6.2.0
↑ org.apache.camel/camel-activemq6 4.18.2 4.17.0
↑ org.apache.camel/camel-amqp 4.18.2 4.17.0
↑ org.apache.camel/camel-api 4.18.2 4.17.0
↑ org.apache.camel/camel-base 4.18.2 4.17.0
↑ org.apache.camel/camel-base-engine 4.18.2 4.17.0
↑ org.apache.camel/camel-bean 4.18.2 4.17.0
↑ org.apache.camel/camel-browse 4.18.2 4.17.0
↑ org.apache.camel/camel-cluster 4.18.2 4.17.0
↑ org.apache.camel/camel-controlbus 4.18.2 4.17.0
↑ org.apache.camel/camel-core 4.18.2 4.17.0
↑ org.apache.camel/camel-core-catalog 4.18.2 4.17.0
↑ org.apache.camel/camel-core-engine 4.18.2 4.17.0
↑ org.apache.camel/camel-core-languages 4.18.2 4.17.0
↑ org.apache.camel/camel-core-model 4.18.2 4.17.0
↑ org.apache.camel/camel-core-processor 4.18.2 4.17.0
↑ org.apache.camel/camel-core-reifier 4.18.2 4.17.0
↑ org.apache.camel/camel-core-xml 4.18.2 4.17.0
↑ org.apache.camel/camel-dataformat 4.18.2 4.17.0
↑ org.apache.camel/camel-dataset 4.18.2 4.17.0
↑ org.apache.camel/camel-direct 4.18.2 4.17.0
↑ org.apache.camel/camel-file 4.18.2 4.17.0
↑ org.apache.camel/camel-health 4.18.2 4.17.0
↑ org.apache.camel/camel-jackson 4.18.2 4.17.0
↑ org.apache.camel/camel-jms 4.18.2 4.17.0
↑ org.apache.camel/camel-language 4.18.2 4.17.0
↑ org.apache.camel/camel-log 4.18.2 4.17.0
↑ org.apache.camel/camel-management 4.18.2 4.17.0
↑ org.apache.camel/camel-management-api 4.18.2 4.17.0
↑ org.apache.camel/camel-mock 4.18.2 4.17.0
↑ org.apache.camel/camel-ref 4.18.2 4.17.0
↑ org.apache.camel/camel-rest 4.18.2 4.17.0
↑ org.apache.camel/camel-saga 4.18.2 4.17.0
↑ org.apache.camel/camel-scheduler 4.18.2 4.17.0
↑ org.apache.camel/camel-seda 4.18.2 4.17.0
↑ org.apache.camel/camel-spring 4.18.2 4.17.0
↑ org.apache.camel/camel-spring-xml 4.18.2 4.17.0
↑ org.apache.camel/camel-stub 4.18.2 4.17.0
↑ org.apache.camel/camel-support 4.18.2 4.17.0
↑ org.apache.camel/camel-timer 4.18.2 4.17.0
↑ org.apache.camel/camel-tooling-model 4.18.2 4.17.0
↑ org.apache.camel/camel-util 4.18.2 4.17.0
↑ org.apache.camel/camel-util-json 4.18.2 4.17.0
↑ org.apache.camel/camel-validator 4.18.2 4.17.0
↑ org.apache.camel/camel-xml-io 4.18.2 4.17.0
↑ org.apache.camel/camel-xml-io-util 4.18.2 4.17.0
↑ org.apache.camel/camel-xml-jaxb 4.18.2 4.17.0
↑ org.apache.camel/camel-xml-jaxp 4.18.2 4.17.0
↑ org.apache.camel/camel-xml-jaxp-util 4.18.2 4.17.0
↑ org.apache.camel/camel-xpath 4.18.2 4.17.0
↑ org.apache.camel/camel-xslt 4.18.2 4.17.0
↑ org.apache.camel/camel-yaml-io 4.18.2 4.17.0
↑ org.apache.cxf/cxf-core 4.1.7 4.1.2
↑ org.apache.cxf/cxf-rt-bindings-soap 4.1.7 4.1.2
↑ org.apache.cxf/cxf-rt-bindings-xml 4.1.7 4.1.2
↑ org.apache.cxf/cxf-rt-databinding-jaxb 4.1.7 4.1.2
↑ org.apache.cxf/cxf-rt-frontend-jaxws 4.1.7 4.1.2
↑ org.apache.cxf/cxf-rt-frontend-simple 4.1.7 4.1.2
↑ org.apache.cxf/cxf-rt-transports-http 4.1.7 4.1.2
↑ org.apache.cxf/cxf-rt-ws-addr 4.1.7 4.1.2
↑ org.apache.cxf/cxf-rt-ws-policy 4.1.7 4.1.2
↑ org.apache.cxf/cxf-rt-wsdl 4.1.7 4.1.2
↑ org.apache.logging.log4j/log4j-api 2.25.4 2.25.3
↑ org.apache.logging.log4j/log4j-core 2.25.4 2.25.3
↑ org.apache.logging.log4j/log4j-slf4j2-impl 2.25.4 2.25.3
↑ org.apache.neethi/neethi 3.2.2 3.2.1
↑ org.apache.qpid/qpid-jms-client 2.10.0 2.9.0
↑ org.apache.ws.xmlschema/xmlschema-core 2.3.2 2.3.1
↑ org.bouncycastle/bcpkix-jdk18on 1.84 1.81
↑ org.bouncycastle/bcprov-jdk18on 1.84 1.81
↑ org.bouncycastle/bcutil-jdk18on 1.84 1.81
↑ org.codehaus.plexus/plexus-utils 3.6.1 3.3.1
↑ org.objectweb.asm/asm 9.10.1 9.8
↑ org.springframework.security/spring-security-core 7.0.6 7.0.0
↑ org.springframework.security/spring-security-crypto 7.0.6 7.0.0
↑ org.springframework.security/spring-security-oauth2-client 7.0.6 7.0.0
↑ org.springframework.security/spring-security-oauth2-core 7.0.6 7.0.0
↑ org.springframework.security/spring-security-oauth2-jose 7.0.6 7.0.0
↑ org.springframework.security/spring-security-oauth2-resource-server 7.0.6 7.0.0
↑ org.springframework.security/spring-security-web 7.0.6 7.0.0
↑ org.springframework/spring-aop 7.0.8 7.0.2
↑ org.springframework/spring-beans 7.0.8 7.0.2
↑ org.springframework/spring-context 7.0.8 7.0.2
↑ org.springframework/spring-context-support 7.0.8 7.0.2
↑ org.springframework/spring-core 7.0.8 7.0.2
↑ org.springframework/spring-expression 7.0.8 7.0.2
↑ org.springframework/spring-jdbc 7.0.8 7.0.2
↑ org.springframework/spring-jms 7.0.8 7.0.2
↑ org.springframework/spring-messaging 7.0.8 7.0.2
↑ org.springframework/spring-orm 7.0.8 7.0.2
↑ org.springframework/spring-tx 7.0.8 7.0.2
↑ org.springframework/spring-web 7.0.8 7.0.2
↑ org.springframework/spring-webmvc 7.0.8 7.0.2
+ jakarta.json.bind/jakarta.json.bind-api 2.0.0
+ jakarta.json/jakarta.json-api 2.1.3
+ opensearch-java/opensearch-java 2.21.0
+ org.apache.httpcomponents/httpasyncclient 4.1.5
+ org.apache.httpcomponents/httpcore-nio 4.4.16
+ org.apache.lucene/lucene-analysis-common 9.7.0
+ org.apache.lucene/lucene-core 9.7.0
+ org.apache.lucene/lucene-queries 9.7.0
+ org.apache.lucene/lucene-queryparser 9.7.0
+ org.apache.lucene/lucene-sandbox 9.7.0
+ org.eclipse.parsson/parsson 1.1.7
+ org.opensearch.client/opensearch-rest-client 2.12.0
Provenance: https://github.com/Alfresco/alfresco-docker-base-tomcat
Size: 648 MB (+2 MB)
Packages: 199 (+0)
## Environment Variables
APR_LIBDIR=/usr/local/tomcat/apr
CATALINA_HOME=/usr/local/tomcat
container=oci
JAVA_HOME=/etc/alternatives/jre
LANG=C.UTF-8
LC_ALL=C.UTF-8
LD_LIBRARY_PATH=/usr/local/tomcat/native-jni-lib:/usr/local/tomcat/apr
PATH=/usr/local/tomcat/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
TOMCAT_NATIVE_LIBDIR=/usr/local/tomcat/native-jni-lib
## Labels
io.buildah.version=1.41.4
license=BSD-3-Clause
name=rockylinux
org.label-schema.build-date=2025-12-17T14:20:30Z
org.label-schema.description=Apache Tomcat Image tailored for Alfresco products
org.label-schema.name=Alfresco Base Tomcat Image
org.label-schema.schema-version=1.0
org.label-schema.url=https://github.com/Alfresco/alfresco-docker-base-tomcat
org.label-schema.vcs-ref=https://github.com/Alfresco/alfresco-docker-base-tomcat
org.label-schema.vcs-url=https://github.com/Alfresco/alfresco-docker-base-tomcat
org.label-schema.vendor=Hyland
org.opencontainers.image.authors=Alfresco OPS-Readiness
org.opencontainers.image.created=2025-12-17T14:20:30Z
org.opencontainers.image.description=Apache Tomcat Image tailored for Alfresco products
org.opencontainers.image.licenses=BSD-3-Clause
org.opencontainers.image.revision=680
org.opencontainers.image.source=https://github.com/Alfresco/alfresco-docker-base-tomcat
org.opencontainers.image.title=Alfresco Base Tomcat Image
org.opencontainers.image.url=https://github.com/Alfresco/alfresco-docker-base-tomcat
org.opencontainers.image.vendor=Hyland
org.opencontainers.image.version=9
quay.expires-after=NEVER
summary=Rocky Linux Base image
vendor=Rocky Enterprise Software Foundation
version=9
## Packages and Vulnerabilities
+ 0 packages added
- 0 packages removed
⎈ 49 packages changed (↑ 49 upgraded, ↓ 0 downgraded)
150 packages unchanged
Package Version Previous
↑ com.fasterxml.jackson.core/jackson-annotations 2.22 2.15.0
↑ com.fasterxml.jackson.core/jackson-core 2.22.1 2.15.2
↑ com.fasterxml.jackson.core/jackson-databind 2.22.1 2.15.0
↑ com.fasterxml.woodstox/woodstox-core 7.2.0 7.1.0
↑ io.micrometer/micrometer-commons 1.16.5 1.16.1
↑ io.micrometer/micrometer-observation 1.16.5 1.16.1
↑ jakarta.xml.ws/jakarta.xml.ws-api 4.0.3 4.0.2
↑ org.alfresco.encryptor.ShareStringEncryption/alfresco-share-encryption 26.2.1.2 26.1.0.45
↑ org.alfresco.integrations/alfresco-googledrive-share 4.1.1 4.1.0
↑ org.alfresco/aikau 1.1.5 1.1.4
↑ org.alfresco/alfresco-core 26.2.1.1 26.1.0.61
↑ org.alfresco/alfresco-mmt 26.2.1.1 26.1.0.61
↑ org.alfresco/alfresco-web-framework-commons 26.2.1.2 26.1.0.45
↑ org.apache.cxf/cxf-core 4.1.7 4.1.1
↑ org.apache.cxf/cxf-rt-bindings-soap 4.1.7 4.1.1
↑ org.apache.cxf/cxf-rt-bindings-xml 4.1.7 4.1.1
↑ org.apache.cxf/cxf-rt-databinding-jaxb 4.1.7 4.1.1
↑ org.apache.cxf/cxf-rt-frontend-jaxws 4.1.7 4.1.1
↑ org.apache.cxf/cxf-rt-frontend-simple 4.1.7 4.1.1
↑ org.apache.cxf/cxf-rt-transports-http 4.1.7 4.1.1
↑ org.apache.cxf/cxf-rt-ws-addr 4.1.7 4.1.1
↑ org.apache.cxf/cxf-rt-ws-policy 4.1.7 4.1.1
↑ org.apache.cxf/cxf-rt-wsdl 4.1.7 4.1.1
↑ org.apache.logging.log4j/log4j-api 2.25.4 2.25.3
↑ org.apache.logging.log4j/log4j-core 2.25.4 2.25.3
↑ org.apache.logging.log4j/log4j-slf4j2-impl 2.25.4 2.25.3
↑ org.apache.neethi/neethi 3.2.2 3.2.1
↑ org.apache.ws.xmlschema/xmlschema-core 2.3.2 2.3.1
↑ org.bouncycastle/bcprov-jdk18on 1.84 1.78.1
↑ org.codehaus.plexus/plexus-utils 4.0.3 3.0.24
↑ org.eclipse.angus/angus-activation 2.0.3 2.0.2
↑ org.objectweb.asm/asm 9.10.1 9.7.1
↑ org.springframework.security/spring-security-core 7.0.5 7.0.2
↑ org.springframework.security/spring-security-crypto 7.0.5 7.0.2
↑ org.springframework.security/spring-security-oauth2-client 7.0.5 7.0.2
↑ org.springframework.security/spring-security-oauth2-core 7.0.5 7.0.2
↑ org.springframework.security/spring-security-oauth2-jose 7.0.5 7.0.2
↑ org.springframework.security/spring-security-web 7.0.5 7.0.2
↑ org.springframework/spring-aop 7.0.8 7.0.2
↑ org.springframework/spring-beans 7.0.7 7.0.2
↑ org.springframework/spring-context 7.0.8 7.0.2
↑ org.springframework/spring-core 7.0.7 7.0.2
↑ org.springframework/spring-expression 7.0.8 7.0.2
↑ org.springframework/spring-jdbc 7.0.8 7.0.2
↑ org.springframework/spring-orm 7.0.8 7.0.2
↑ org.springframework/spring-test 7.0.7 7.0.2
↑ org.springframework/spring-tx 7.0.8 7.0.2
↑ org.springframework/spring-web 7.0.7 7.0.2
↑ org.springframework/spring-webmvc 7.0.7 7.0.2
Provenance: https://github.com/Alfresco/alfresco-docker-base-java
Size: 1880 MB (+8 MB)
Packages: 44 (+0)
## Environment Variables
+ ALFRESCO_PDF_RENDERER_ARM64_LIB_RPM_URL=https://nexus.alfresco.com/nexus/service/local/repositories/releases/org/alfresco/alfresco-pdf-renderer/1.3.0-78/alfresco-pdf-renderer-1.3.0-78-linux-arm.tgz
+ ALFRESCO_PDF_RENDERER_LIB_RPM_URL=https://nexus.alfresco.com/nexus/service/local/repositories/releases/org/alfresco/alfresco-pdf-renderer/1.3.0-78/alfresco-pdf-renderer-1.3.0-78-linux.tgz
- ALFRESCO_PDF_RENDERER_ARM64_LIB_RPM_URL=https://nexus.alfresco.com/nexus/service/local/repositories/releases/org/alfresco/alfresco-pdf-renderer/1.2/alfresco-pdf-renderer-1.2-linux-arm.tgz
- ALFRESCO_PDF_RENDERER_LIB_RPM_URL=https://nexus.alfresco.com/nexus/service/local/repositories/releases/org/alfresco/alfresco-pdf-renderer/1.2/alfresco-pdf-renderer-1.2-linux.tgz
IMAGEMAGICK_DEP_RPM_URL=https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm
IMAGEMAGICK_RPM_URL=https://nexus.alfresco.com/nexus/service/local/repositories/thirdparty/org/imagemagick/imagemagick-distribution/7.1.2-13-ci-1/imagemagick-distribution-7.1.2-13-ci-1
JAVA_HOME=/etc/alternatives/jre
JAVA_OPTS=
LANG=C.UTF-8
LC_ALL=C.UTF-8
LIBREOFFICE_ARM64_RPM_URL=https://dl.rockylinux.org/pub/rocky/9/devel/aarch64/os/Packages/l/
LIBREOFFICE_ARM64_RPM_VERSION=libreoffice-7.1.8.1
LIBREOFFICE_RPM_URL=https://nexus.alfresco.com/nexus/service/local/repositories/thirdparty/org/libreoffice/libreoffice-dist/7.2.5/libreoffice-dist-7.2.5-linux.gz
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
## Labels
org.label-schema.build-date=2025-02-17T02:37:20Z
org.label-schema.name=Alfresco Base Java Image
org.label-schema.schema-version=1.0
org.label-schema.vendor=Alfresco
org.opencontainers.image.created=2025-02-17T02:37:20Z
org.opencontainers.image.revision=338
org.opencontainers.image.source=https://github.com/Alfresco/alfresco-docker-base-java
org.opencontainers.image.title=Alfresco Base Java Image
org.opencontainers.image.vendor=Alfresco
## Packages and Vulnerabilities
+ 0 packages added
- 0 packages removed
⎈ 0 packages changed (↑ 0 upgraded, ↓ 0 downgraded)
44 packages unchanged
Package Version Previous
A Software Bill of Materials (SBOM) is published for the Alfresco Search Community container image. Because the Hyland-authored source code for this component is not published in 26.2 (see Licensing), the SBOM is the authoritative record of what the image contains and under which licenses those components are made available.
The SBOM covers the alfresco/alfresco-elasticsearch-batch-indexing:5.7.0 image and lists 328 components, each with a name, a version, a repository and a license. It is published in CycloneDX 1.6 JSON for tooling and legal review, and as a human-readable table.
Every artifact also ships THIRD-PARTY.txt and a licenses/ directory containing the full text of the licenses that require inclusion. These files travel with the binary and must be preserved when the artifacts are redistributed.
The SBOM describes the linux/amd64 manifest. The image is also published for linux/arm64.
| Item | Detail |
|---|---|
| Image | alfresco/alfresco-elasticsearch-batch-indexing:5.7.0 |
| Digest | sha256:2e523eb3a1c6f6415ee5d6f132a5481d5fe3c877dd4491f91496a5e74099ca59 |
| Platform | linux/amd64. The image is also published for linux/arm64. |
| Base operating system | Rocky Linux 9.3 (Blue Onyx), OpenJDK 17.0.14 |
| Components | 328 total: 160 Java archives, 165 operating system packages (RPM), 3 Python packages |
| Formats | CycloneDX 1.6 JSON, plus a human-readable component table |
| Not covered | The alfresco-elasticsearch-batch-indexing-distribution JAR published to Nexus is a separate artifact containing deployment assets (Dockerfile, Docker Compose files and license texts), not the application itself. It carries its own THIRD-PARTY.txt. |
Of the 328 components, 7 are Hyland-authored and proprietary; the remaining 321 are third-party components that remain governed by their own licenses. 40 distinct license identifiers appear across the image. The most common are listed below; a component under a compound license expression is counted under each license named in it.
| License | Components | Notes |
|---|---|---|
| Apache-2.0 | 137 | Most of the Java dependency set: Spring Boot, Jackson, Netty, Micrometer |
| LGPL-2.1-or-later | 47 | Mainly Rocky Linux system libraries |
| GPL-2.0-or-later | 43 | Operating system packages only; no GPL code is linked into the application |
| BSD-3-Clause | 40 | Mostly Rocky Linux packages; on the Java side, HyperSQL and Hamcrest |
| MIT | 29 | Mostly Rocky Linux packages; on the Java side, SLF4J and Project Lombok |
| GPL-3.0-or-later | 26 | Operating system packages only |
| EPL-2.0 | 17 | Jetty, Jakarta APIs, Logback, AspectJ |
| GPL-2.0-only | 12 | Includes the OpenJDK runtime, which carries the Classpath Exception. Four are Jakarta APIs offered as EPL-2.0 or GPL-2.0-only, at your choice. |
| LGPL-3.0-or-later | 11 | Rocky Linux packages, plus the Alfresco Content Services event model on the Java side |
| MPL-2.0 | 8 | Operating system packages |
| Proprietary (Hyland Software, Inc.) | 7 | Hyland-authored components; source not published for 26.2 |
A further 29 license identifiers each apply to fewer than 8 components. 31 components are dual-licensed, meaning you may choose either of the licenses offered: Jetty is Apache-2.0 or EPL-2.0, Logback is EPL-2.0 or LGPL-2.1-only, and the Jakarta APIs are EPL-2.0 or GPL-2.0-only. 12 components carry a license exception, such as the GCC Runtime Library Exception or the OpenJDK Classpath Exception, which relaxes the copyleft obligations of the license it qualifies. The complete per-component detail is in the published SBOM.
No Java library in the image is licensed under the GPL alone. The GPL-licensed components are operating system packages supplied by Rocky Linux, not libraries linked into the Alfresco application. They are standard base-image content such as glibc, bash, tar and rpm, and are distributed under the same terms as in any Rocky Linux container.
The four Java archives that name the GPL, the Jakarta annotation, JSON and JSON Binding APIs and Eclipse Parsson, are dual-licensed and may be taken under the Eclipse Public License 2.0 instead.
The OpenJDK runtime is GPL v2 with the Classpath Exception, which permits linking application code without the application becoming subject to the GPL. LGPL-licensed Java libraries are used as libraries only, with their notices preserved and their components replaceable, as those licenses require.
If you redistribute the Alfresco Search Community artifacts, whether directly, inside a Docker Compose bundle, a Helm chart or a wider product, you must preserve the files that travel with them:
THIRD-PARTY.txt, which lists each bundled dependency and its licenselicenses/ directory, containing the full text of the licenses that require inclusionThird-party components remain governed by their own licenses regardless of the Hyland binary license, and nothing in that license restricts rights granted to you by an applicable third-party open-source license. See Licensing for the terms that apply to the Hyland-authored components.
Most Alfresco Community Edition components are distributed under the GNU LGPL v3.0 open-source license. Two components introduced or repackaged in 26.2 are exceptions, as described below: Alfresco Search Community and Alfresco Control Center.
For the 26.2 release, Alfresco Search Community is provided as binaries only; the source code is not published for this release.
We plan to publish the source code in a future release. Third-party components remain governed by their respective licenses.
Alfresco Search Community is versioned as 5.7.0, aligned with the Alfresco Search Enterprise version numbering.
| Item | Detail |
|---|---|
| Source code | Provided as binaries only for this release. Source code is planned to be published in a future release. |
| Docker image | alfresco/alfresco-elasticsearch-batch-indexing:5.7.0 AMD64 digest: sha256:2e523eb3a1c6f6415ee5d6f132a5481d5fe3c877dd4491f91496a5e74099ca59 |
| JAR artifact | alfresco-elasticsearch-batch-indexing-distribution-5.7.0.jar SHA-256: 6a981147dcbb659139fb46296f6d28f2e85a32826909dc3fdac2967d5d45eaf8 |
| Third-party components | Governed by their own licenses. See the THIRD-PARTY-NOTICES and SBOM supplied with the artifacts. |
Alfresco Control Center is the Angular administration user interface served at /admin. For the 26.2 release it is provided as binaries only; the source code is not published for this release.
We plan to publish the source code in a future release. Third-party components remain governed by their respective licenses.
Unlike the other Community Edition images, the Control Center image is distributed on Quay.io (quay.io/alfresco/alfresco-control-center), not Docker Hub.
| Item | Detail |
|---|---|
| Source code | Provided as binaries only for this release. Source code is planned to be published in a future release. |
| Docker image | quay.io/alfresco/alfresco-control-center:11.0.0 AMD64 digest: sha256:80b2c3becd2c6ebddd285956d490120730febbf0b284ddb7e98d9cfe919adb68 |
| Registry | Quay.io (not Docker Hub). Pull with docker pull quay.io/alfresco/alfresco-control-center:11.0.0. |
| Access | Served at /admin. Configured via APP_CONFIG_PROVIDER=ECM and APP_CONFIG_AUTH_TYPE=BASIC in the reference Compose file. |
| Third-party components | Governed by their own licenses. See the THIRD-PARTY-NOTICES and SBOM supplied with the artifact. |
Alfresco Search Community and Alfresco Control Center are the only 26.2 components that are not open source. They are provided at no cost as pre-built binaries (Docker image and, for Search Community, a JAR), but their Hyland-authored source code is not published for this release.
When to use them: use them exactly as you would the LGPL components - pull the published image, run it via the reference Docker Compose or Helm deployment, and configure it through documented environment variables. They are required for their respective features: Control Center provides the /admin UI, and Search Community provides OpenSearch / Elasticsearch indexing (the supported replacement for Solr in Community Edition).
What is different: because the source is not published, you cannot build these components from source, fork them, or patch the Hyland-authored code for this release. You can still mirror or retag the images, extend them with your own layers via FROM, mount external configuration, and redistribute the unmodified artifacts. Third-party components bundled inside remain under their own licenses (see the THIRD-PARTY-NOTICES and SBOM shipped with each artifact).
If your deployment policy requires buildable open source for every component, pin these two components to a future release where the source is published, or omit the affected feature. All other 26.2 components remain GNU LGPL v3.0.
| Component | Version | Applies To | Notes |
|---|---|---|---|
| Rocky Linux | 9.x | All images | Base image minor version varies per component build: Repository 9.6, Share 9.7, Transform 9.3. Confirmed from /etc/rocky-release in each image. |
| OpenJDK | 21.0.9 (Repository, Share) 17.0.14 (Transform) |
Repository, Share, Transform | Java 17 no longer supported as a runtime for the Repository and Share as of 26.x; both ship OpenJDK 21.0.9. The Transform Core AIO image still runs on OpenJDK 17.0.14. Confirmed from java -version in each image. |
| Apache Tomcat | 11.0.13 | Repository, Share | Jakarta EE Servlet 6.1 / JSP 4.0. Confirmed from ServerInfo in the Repository and Share images. |
| ImageMagick | 7.1.2-13 | Transform | Unchanged from 26.1.0. Base EPEL repo: el9 (Rocky Linux 9). Confirmed from Transform image env var IMAGEMAGICK_RPM_URL. |
| LibreOffice | 7.2.5 | Transform | Unchanged from 26.1.0. Confirmed from Transform image env var LIBREOFFICE_RPM_URL. |
| Apache ActiveMQ | 6.2.6 | Message broker (separate image) | Authentication required by default. See Breaking Changes. |
| Angular | 20.x | Content App | Content App 8.0.0 is built on Angular 20 (upgraded from Angular 19 in the 26.1 family). |
The following dependency upgrades were introduced in the 26.x family (relative to 25.3.x) and affect extension developers and DevOps teams. All version data is sourced from the Docker image package diffs.
| Dependency | 25.3.x version | 26.1.0 version | Impact | Migration reference |
|---|---|---|---|---|
| Spring Framework | 6.2.11 | 7.0.2 | Extension beans using removed APIs must be updated. Spring MVC dispatcher and context lifecycle changes. | Spring 7 Migration Guide |
| Spring Security | 6.4.11 (repo) / 6.5.6 (Share) | 7.0.0 (repo) / 7.0.2 (Share) | Security filter chain configuration changes. OAuth2 resource server configuration affected. Custom security extensions must be reviewed. | Spring Security 7 Migration |
| Apache Tomcat | 10.1.43 | 11.0.13 | Jakarta EE Servlet API 6.0→6.1; JSP API 3.1→4.0; EL API 5.0→6.0; JASPIC API 3.0→3.1. Web applications and extensions using these APIs must be reviewed. | Tomcat 11 Migration Guide |
| Apache Camel | 4.15.0 | 4.17.0 | ActiveMQ integration switches from camel-activemq (5.x client) to camel-activemq6 (6.x client). Component URI configurations may need updating. |
Camel 4.x Upgrade Guide |
| Apache ActiveMQ Client | activemq-client-jakarta 5.18.6 |
activemq-client 6.2.0 |
Authentication now mandatory in reference deployment. Broker URL and credential configuration must be updated across all connected services. | ActiveMQ 6.x Release Notes |
| OpenJDK | 17.0.15 | 21.0.9 | Java 21 LTS. Extensions compiled against Java 17 remain compatible at bytecode level. JVM startup flags for deprecated security providers may need updating. | Java 21 Migration Guide |
| Log4j | 2.25.1 (repo) / 2.19.0 (Share) | 2.25.3 | Patch upgrade; addresses CVEs. | Log4j Release Notes |
| PostgreSQL JDBC Driver | 42.7.5 | 42.7.7 | Patch upgrade; no API changes. |
Note: The table above reflects 26.1.0 versions as the baseline for the 26.x family. Update the “26.1.0 version” column to 26.2.0 values once the 26.2 diff is available, and add a “26.2.0 version” column if any further upgrades occurred.
No new public REST API endpoints in this release.
No endpoints deprecated in this release.
No endpoints removed in this release.
The Node Permissions REST API response now includes an additional authorityDisplayName field on each PermissionElement, providing the human-readable display name of the authority alongside its identifier. This is an additive change; existing clients are unaffected.
The following issues affecting Community components have been addressed in this release. Each entry lists the affected component area. Enterprise-only items (Alfresco Digital Workspace, Search Enterprise / Elasticsearch, SAP connectors, Enterprise Viewer) and Process Services items from the wider release train are omitted as they do not ship with Community Edition.
version.store.preserveUnsetProperties property. nodes.bulkLoad.*) batch metadata retrieval.cm:autoVersion property. Fix: Auto-versioning behaviour is now respected on content update. /shared-links endpoint ignored the maxItems paging parameter. Fix: Pagination parameters are now applied.| SDK | Version | GitHub Tag | Notes |
|---|---|---|---|
| In-Process SDK (alfresco-sdk) | 4.15.0 | alfresco-sdk releases | Compatible with ACS 26.2 |
| Out-of-Process Event SDK (alfresco-java-sdk) | 7.3.3 | 7.3.3 | Compatible with ACS 26.2; requires Event API v2 |
Explicit record of OS, JDK, database, and container runtime versions added, maintained, or dropped in this release cycle. Operators running custom or hardened base images should review this section carefully.
| Platform | Change | Detail | Target release for removal / addition |
|---|---|---|---|
| OpenJDK 17 | REMOVED | No longer supported as a runtime. All Docker images ship with OpenJDK 21. | Removed in 26.1 (first 26.x release) |
| OpenJDK 21 | ADDED | Required minimum runtime as of 26.x. | Added in 26.1 |
| Rocky Linux 8 (base image) | REMOVED | Docker base images moved to Rocky Linux 9 in the 26.x family. | Removed in 26.1 |
| Rocky Linux 9 (base image) | ADDED | All published Docker images use Rocky Linux 9 base. | Added in 26.1 |
| Apache Tomcat 10.1.x | REMOVED | Upgraded to Tomcat 11.x in the 26.x family (Jakarta EE Servlet 6.1). | Removed in 26.1 |
No new Community-specific repository features in this release. If you were looking for Cascading Dictionaries or the Identity Service bypass for administrative users, Hyland decided to include them only as Enterprise features.
Governance Services Community 26.2.0 adds new configuration to fine-tune the disposition lifecycle query and includes several fixes.
rm.dispositionlifecycletrigger.queryMode selects the query method used to identify records under disposition - fts (default, metadata search through the search engine) or cmis (CMIS query). When set to cmis, rm.dispositionlifecycletrigger.cmisquerylimit (default 100000) limits the number of records retrieved from the database.The latest release of Alfresco Mobile Workspace is compatible with Alfresco Content Services 26.2.
See SDK Compatibility table above for version details.
The documentation has been refreshed for this release: https://support.hyland.com/p/alfresco
The Content Repository supports the following languages: French, German, Italian, Spanish, Japanese, Dutch, Norwegian (Bokmål), Russian, Brazilian Portuguese, Polish, Czech, Danish, Swedish, Finnish and Simplified Chinese.
Share supports the following languages: French, German, Italian, Spanish, Japanese, Dutch, Norwegian (Bokmål), Russian, Brazilian Portuguese and Simplified Chinese.
Alfresco Content Application supports the following languages: French, German, Italian, Spanish, Japanese, Dutch, Norwegian (Bokmål), Russian, Brazilian Portuguese, Polish, Czech, Danish, Swedish, Finnish and Simplified Chinese.
None at time of publication.
Available in History of Alfresco Versions
For version-to-version component compatibility, see the Alfresco Compatibility Matrix.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.