Blogs

Blogs

Liferay Portal 7.4 GA7 and Liferay Commerce 4.0 GA7 Release

We are pleased to announce the release of Liferay Portal 7.4 GA7 and Liferay Commerce 4.0 GA7!

Caption

The Liferay Portal 7.4 GA7 release is primarily focused on fixes so no new notable features will be introduced with this release. This release also includes Log4j 2.17.1 to address CVE-2021-44832

Download options

Liferay Portal and Liferay Commerce share the same Bundle and Docker image.  To get started using either Liferay Portal or Liferay Commerce, choose the best download option suited for your environment below.

Docker image

To use Liferay Portal 7.4 GA7:

docker run -it -p 8080:8080 liferay/portal:7.4.3.7-ga7

For more information on using the official Liferay docker image see the liferay/portal repo on Docker Hub.

Bundles and other download options

If you are used to binary releases, you can find the Liferay Portal 7.4 GA7 and Liferay Commerce 4.0 GA7 release on the download page.  If you need additional files (for example, the source code, or dependency libraries), visit the release page.

Dependency Management

For development using the Liferay Platform, update Liferay Workspace to use the  latest dependencies, by adding the following line to the build.gradle file:

dependencies {
	compileOnly group: "com.liferay.portal", name: "release.portal.api"
}

All portal dependencies are now defined with a single declaration. When using an IDE such as Eclipse or IntelliJ all apis are immediately available in autocomplete for immediate use.  

By setting a product info key property it will be possible to update all dependencies to a new version by updating the liferay.workspace.product property in the liferay workspace projects gradle.property file:

liferay.workspace.product = portal-7.4-ga7

When using an IDE such as Eclipse or IntelliJ all apis are immediately available in autocomplete for immediate use.

Documentation

All documentation for Liferay Portal and Liferay Commerce can now be found on our documentation site: learn.liferay.com.  For more information on upgrading to Liferay Portal 7.4 GA7 see refer to the Upgrade Overview.

Compatibility Matrix

Liferay's general policy is to test Liferay Portal and Liferay Commerce  against newer major releases of operating systems, open source app servers, browsers, and open source databases (we regularly update the bundled upstream libraries to fix bugs or take advantage of new features in the open source we depend on). 

Liferay Portal 7.4 GA7 and Liferay Commerce 4.0 GA7 were tested extensively for use with the following Application/Database Servers: 

Application Server

  • Tomcat 9.0

  • Wildfly 17.0

Database

  • HSQLDB 2 (only for demonstration, development, and testing)

  • MySQL 5.7, 8.0

  • MariaDB 10.2, 10.4

  • PostgreSQL 12.x, 13.x

JDK

  • IBM J9 JDK 8

  • Oracle JDK 8

  • Oracle JDK 11

  • All Java Technical Compatibility Kit (TCK) compliant builds of Java 11 and Java 8

Source Code

Source is available as a zip archive on the release page, or on its home on GitHub. If you're interested in contributing, take a look at our contribution page.

Bug Reporting

If you believe you have encountered a bug in the new release you can report your issue by following the bug reporting instructions.

Getting Support

Support is provided by our awesome community. Please visit helping a developer page for more details on how you can receive support.

Fixes and Known Issues

Blogs

As for Log4j, the Elasticsearch sidecar included in the Docker image and the Tomcat bundles appears to be still based on the vulnerable Log4j 2.11.0. Will you upgrade this later like in GA8?

Yes, it'll be updated.

But please keep in mind that Sidecar is ONLY meant for local development purposes. Such a computer should not be exposed, and a proper internet-visible installation must have a proper Elasticsearch (non-sidecar) setup. This way you'd be the only one who can attack yourself, and that only if the sidecar implementation logs any user-generated content.

This is also what I found.

 

~/Downloads via ☕ v11.0.11 on ☁️  (eu-west-2) ❯ 7za x liferay-ce-portal-tomcat-7.4.3.7-ga7-20220107103529408.7z

7-Zip (a) [64] 17.04 : Copyright (c) 1999-2021 Igor Pavlov : 2017-08-28 p7zip Version 17.04 (locale=utf8,Utf16=on,HugeFiles=on,64 bits,12 CPUs x64)

Scanning the drive for archives: 1 file, 1011676388 bytes (965 MiB)

Extracting archive: liferay-ce-portal-tomcat-7.4.3.7-ga7-20220107103529408.7z -- Path = liferay-ce-portal-tomcat-7.4.3.7-ga7-20220107103529408.7z Type = 7z Physical Size = 1011676388 Headers Size = 34106 Method = LZMA2:24 Solid = + Blocks = 1

Everything is Ok                                                               

Folders: 3384 Files: 2446 Size:       1157065070 Compressed: 1011676388

~/Downloads via ☕ v11.0.11 on ☁️  (eu-west-2) took 16s ❯ cd liferay-ce-portal-7.4.3.7-ga7

~/Downloads/liferay-ce-portal-7.4.3.7-ga7 on ☁️  (eu-west-2) ❯ find . -name "*log4j*.jar" -print ./tomcat-9.0.56/webapps/ROOT/WEB-INF/shielded-container-lib/log4j-1.2-api.jar ./tomcat-9.0.56/webapps/ROOT/WEB-INF/shielded-container-lib/com.liferay.petra.log4j.jar ./tomcat-9.0.56/webapps/ROOT/WEB-INF/shielded-container-lib/log4j-core.jar ./tomcat-9.0.56/webapps/ROOT/WEB-INF/shielded-container-lib/log4j-api.jar ./elasticsearch-sidecar/7.10.2/lib/log4j-api-2.11.1.jar ./elasticsearch-sidecar/7.10.2/lib/log4j-core-2.11.1.jar

 

Hi ,I checked it, blade int -v portal-7.4-ga7. can not find the version.

I have the same problem:

blade init -v portal-7.4-ga7 test-ga7

fails with "init: portal-7.4-ga7 is not a valid value."

While:

blade init -v portal-7.4-ga6 test-ga6

still works.

While I welcome such frequent releases, which add great value to Portal CE, I wish somebody would do a blog post to explain this new release philosophy. Is this change going to be permanent? Or are we sometime going back to the rolling releases of 7.3?

Hi Fernando, I am currently working on an announcement and will post it once it is ready.  But in short yes it is a continuation/improvement of the rolling release of 7.3.

When is planned liferay 7.5*