empty branch for ACS-10154 dependencies

Fix for MNT-25359 Prevent XSS attack during posting a comment keeping the editor styles intact.

.github/workflows/ci.yml

@@ -15,6 +15,7 @@ on:
   workflow_dispatch:
 
 env:
+  JAVA_VERSION: '21'
   DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
   DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
   GITHUB_ACTIONS_DEPLOY_TIMEOUT: 60
@@ -44,6 +45,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - uses: Alfresco/alfresco-build-tools/.github/actions/pre-commit@v8.24.1
       - name: "Init"
         run: bash ./scripts/ci/init.sh
@@ -65,6 +68,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - uses: Alfresco/alfresco-build-tools/.github/actions/veracode@v8.24.1
@@ -88,6 +93,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - uses: Alfresco/alfresco-build-tools/.github/actions/github-download-file@v8.24.1
         with:
           token: ${{ secrets.BOT_GITHUB_TOKEN }}
@@ -104,7 +111,7 @@ jobs:
           mkdir temp-dir-for-sast
           bash ./scripts/ci/remove-sast-exclusions.sh ./packaging/war/target/alfresco.war temp-dir-for-sast/reduced.war
       - name: "Run SAST Scan"
-        uses: veracode/Veracode-pipeline-scan-action@v1.0.16
+        uses: veracode/Veracode-pipeline-scan-action@v1.0.20
         with:
           vid: ${{ secrets.VERACODE_API_ID }}
           vkey: ${{ secrets.VERACODE_API_KEY }}
@@ -144,6 +151,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - uses: Alfresco/ya-pmd-scan@v4.3.0
         with:
           classpath-build-command: "mvn test-compile -ntp -Pags -pl \"-:alfresco-community-repo-docker\""
@@ -177,6 +186,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run tests"
@@ -214,6 +225,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Build"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
         run: |
@@ -249,6 +262,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: Run MariaDB ${{ matrix.version }} database
@@ -276,6 +291,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run MariaDB 10.11 database"
@@ -303,6 +320,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run MySQL 8 database"
@@ -329,6 +348,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run PostgreSQL 14.15 database"
@@ -355,6 +376,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run PostgreSQL 15.10 database"
@@ -381,6 +404,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run PostgreSQL 16.6 database"
@@ -405,6 +430,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run ActiveMQ"
@@ -461,6 +488,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Set transformers tag"
@@ -531,6 +560,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Build"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
         run: |
@@ -570,6 +601,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run Postgres 16.6 database"
@@ -600,6 +633,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Build"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
         run: |
@@ -632,6 +667,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Build"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
         run: |
@@ -660,6 +697,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Build"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
         run: |
@@ -706,6 +745,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Build"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
         run: |

.github/workflows/master_release.yml

@@ -7,6 +7,7 @@ on:
       - release/**
 
 env:
+  JAVA_VERSION: '21'
   GIT_USERNAME: ${{ secrets.BOT_GITHUB_USERNAME }}
   GIT_EMAIL: ${{ secrets.BOT_GITHUB_EMAIL }}
   GIT_PASSWORD: ${{ secrets.BOT_GITHUB_TOKEN }}
@@ -37,6 +38,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - uses: Alfresco/alfresco-build-tools/.github/actions/configure-git-author@v8.24.1
@@ -66,6 +69,8 @@ jobs:
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - uses: Alfresco/alfresco-build-tools/.github/actions/configure-git-author@v8.24.1

.secrets.baseline

@@ -133,7 +133,7 @@
         "filename": ".github/workflows/master_release.yml",
         "hashed_secret": "3e26d6750975d678acb8fa35a0f69237881576b0",
         "is_verified": false,
-        "line_number": 24,
+        "line_number": 25,
         "is_secret": false
       }
     ],

amps/ags/pom.xml

@@ -7,7 +7,7 @@
    <parent>
       <groupId>org.alfresco</groupId>
       <artifactId>alfresco-community-repo-amps</artifactId>
-      <version>25.3.0.46</version>
+      <version>25.3.0.64-SNAPSHOT</version>
    </parent>
 
    <modules>

amps/ags/rm-automation/pom.xml

@@ -7,7 +7,7 @@
    <parent>
       <groupId>org.alfresco</groupId>
       <artifactId>alfresco-governance-services-community-parent</artifactId>
-      <version>25.3.0.46</version>
+      <version>25.3.0.64-SNAPSHOT</version>
    </parent>
 
    <modules>

amps/ags/rm-automation/rm-automation-community-rest-api/pom.xml

@@ -7,7 +7,7 @@
    <parent>
       <groupId>org.alfresco</groupId>
       <artifactId>alfresco-governance-services-automation-community-repo</artifactId>
-      <version>25.3.0.46</version>
+      <version>25.3.0.64-SNAPSHOT</version>
    </parent>
 
    <build>

amps/ags/rm-community/pom.xml

@@ -7,7 +7,7 @@
    <parent>
       <groupId>org.alfresco</groupId>
       <artifactId>alfresco-governance-services-community-parent</artifactId>
-      <version>25.3.0.46</version>
+      <version>25.3.0.64-SNAPSHOT</version>
    </parent>
 
    <modules>

amps/ags/rm-community/rm-community-repo/pom.xml

@@ -8,7 +8,7 @@
    <parent>
       <groupId>org.alfresco</groupId>
       <artifactId>alfresco-governance-services-community-repo-parent</artifactId>
-      <version>25.3.0.46</version>
+      <version>25.3.0.64-SNAPSHOT</version>
    </parent>
 
    <properties>

amps/ags/rm-community/rm-community-repo/source/java/org/alfresco/module/org_alfresco_module_rm/security/ExtendedSecurityServiceImpl.java

@@ -31,6 +31,7 @@ import static org.alfresco.service.cmr.security.PermissionService.GROUP_PREFIX;
 
 import java.util.Collections;
 import java.util.HashSet;
+import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Set;
 
@@ -247,7 +248,7 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
      */
     private Set<String> getAuthorities(String group)
     {
-        Set<String> result = new HashSet<>();
+        Set<String> result = new LinkedHashSet<>();
         result.addAll(authorityService.getContainedAuthorities(null, group, true));
         return result;
     }

amps/ags/rm-community/rm-community-repo/source/java/org/alfresco/repo/security/permissions/impl/ExtendedPermissionServiceImpl.java

@@ -33,6 +33,7 @@ import java.io.Serializable;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.HashSet;
+import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Set;
 
@@ -325,8 +326,8 @@ public class ExtendedPermissionServiceImpl extends PermissionServiceImpl impleme
             return aclReaders;
         }
 
-        HashSet<String> assigned = new HashSet<>();
+        Set<String> assigned = new LinkedHashSet<>();
-        HashSet<String> readers = new HashSet<>();
+        Set<String> readers = new LinkedHashSet<>();
 
         for (AccessControlEntry ace : acl.getEntries())
         {
@@ -412,8 +413,8 @@ public class ExtendedPermissionServiceImpl extends PermissionServiceImpl impleme
             return aclWriters;
         }
 
-        HashSet<String> assigned = new HashSet<>();
+        Set<String> assigned = new LinkedHashSet<>();
-        HashSet<String> readers = new HashSet<>();
+        Set<String> readers = new LinkedHashSet<>();
 
         for (AccessControlEntry ace : acl.getEntries())
         {
@@ -485,7 +486,7 @@ public class ExtendedPermissionServiceImpl extends PermissionServiceImpl impleme
         Set<String> writers = getWriters(aclId);
 
         // add the current owner to the list of extended writers
-        Set<String> modifiedWrtiers = new HashSet<>(writers);
+        Set<String> modifiedWrtiers = new LinkedHashSet<>(writers);
         String owner = ownableService.getOwner(nodeRef);
         if (StringUtils.isNotBlank(owner) &&
                 !owner.equals(OwnableService.NO_OWNER) &&

amps/ags/rm-community/rm-community-rest-api-explorer/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-governance-services-community-repo-parent</artifactId>
-        <version>25.3.0.46</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <build>

amps/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo</artifactId>
-        <version>25.3.0.46</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <modules>

amps/share-services/pom.xml

@@ -8,7 +8,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-amps</artifactId>
-        <version>25.3.0.46</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <properties>

core/pom.xml

@@ -7,7 +7,7 @@
    <parent>
       <groupId>org.alfresco</groupId>
       <artifactId>alfresco-community-repo</artifactId>
-      <version>25.3.0.46</version>
+      <version>25.3.0.64-SNAPSHOT</version>
    </parent>
 
    <dependencies>

data-model/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo</artifactId>
-        <version>25.3.0.46</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <properties>

mmt/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo</artifactId>
-        <version>25.3.0.46</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <dependencies>

packaging/distribution/pom.xml

@@ -9,6 +9,6 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-packaging</artifactId>
-        <version>25.3.0.46</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 </project>

packaging/docker-alfresco/Dockerfile

@@ -1,5 +1,5 @@
 # More infos about this image: https://github.com/Alfresco/alfresco-docker-base-tomcat
-FROM alfresco/alfresco-base-tomcat:tomcat10-jre17-rockylinux9@sha256:00d89fb84bda7bb37c17b0117adb2cfe4f7cbddcd6c1e42b0a67ea8dbb41a734
+FROM alfresco/alfresco-base-tomcat:tomcat10-jre21-rockylinux9@sha256:ed568167f4c28efc9db4c5bc44a882ee117c475463b526b21ada99e1b6d568dd
 # Set default docker_context.
 ARG resource_path=target
 

packaging/docker-alfresco/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-packaging</artifactId>
-        <version>25.3.0.46</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <properties>

packaging/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo</artifactId>
-        <version>25.3.0.46</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <modules>

packaging/tests/pom.xml

@@ -6,7 +6,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-packaging</artifactId>
-        <version>25.3.0.46</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <modules>

packaging/tests/tas-cmis/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>25.3.0.46</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <organization>
@@ -16,11 +16,11 @@
     </organization>
 
     <properties>
-        <maven.build.sourceVersion>17</maven.build.sourceVersion>
+        <maven.build.sourceVersion>21</maven.build.sourceVersion>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <maven-jar-plugin.version>3.1.1</maven-jar-plugin.version>
         <maven-release.version>2.5.3</maven-release.version>
-        <java.version>17</java.version>
+        <java.version>21</java.version>
         <suiteXmlFile>${project.basedir}/src/test/resources/cmis-suite.xml</suiteXmlFile>
         <cmis.binding />
         <cmis.basePath />

packaging/tests/tas-email/pom.xml

@@ -9,7 +9,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>25.3.0.46</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <developers>

packaging/tests/tas-integration/pom.xml

@@ -9,7 +9,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>25.3.0.46</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <developers>

packaging/tests/tas-restapi/pom.xml

@@ -8,18 +8,18 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>25.3.0.46</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <properties>
         <suiteXmlFile>${project.basedir}/src/test/resources/restapi-suite.xml</suiteXmlFile>
-        <maven.build.sourceVersion>17</maven.build.sourceVersion>
+        <maven.build.sourceVersion>21</maven.build.sourceVersion>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <rest.api.explorer.branch>master</rest.api.explorer.branch>
         <httpclient-osgi-version>4.5.6</httpclient-osgi-version>
         <commons-lang3.version>3.18.0</commons-lang3.version>
         <scribejava-apis.version>8.3.3</scribejava-apis.version>
-        <java.version>17</java.version>
+        <java.version>21</java.version>
     </properties>
 
     <profiles>

packaging/tests/tas-restapi/src/main/java/org/alfresco/rest/core/RestWrapper.java

@@ -675,6 +675,11 @@ public class RestWrapper extends DSLWrapper<RestWrapper>
         {
             returnedResponse = onRequest().get(restRequest.getPath(), restRequest.getPathParams()).andReturn();
         }
+        else if (HttpMethod.PATCH.equals(httpMethod))
+        {
+            returnedResponse = onRequest().body(restRequest.getBody())
+                    .patch(restRequest.getPath(), restRequest.getPathParams()).andReturn();
+        }
         else
         {
             returnedResponse = onRequest().get(restRequest.getPath(), restRequest.getPathParams()).andReturn();

packaging/tests/tas-webdav/pom.xml

@@ -9,7 +9,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>25.3.0.46</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <developers>

packaging/war/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-packaging</artifactId>
-        <version>25.3.0.46</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <properties>

pom.xml

@@ -2,7 +2,7 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
     <artifactId>alfresco-community-repo</artifactId>
-    <version>25.3.0.46</version>
+    <version>25.3.0.64-SNAPSHOT</version>
     <packaging>pom</packaging>
     <name>Alfresco Community Repo Parent</name>
 
@@ -38,7 +38,7 @@
         <builder.name>entitled-builder</builder.name>
         <local.registry>127.0.0.1:5000</local.registry>
 
-        <java.version>17</java.version>
+        <java.version>21</java.version>
         <maven.compiler.source>${java.version}</maven.compiler.source>
         <maven.compiler.target>${java.version}</maven.compiler.target>
         <maven.build.sourceVersion>${java.version}</maven.build.sourceVersion>
@@ -51,14 +51,14 @@
         <dependency.alfresco-server-root.version>7.0.2</dependency.alfresco-server-root.version>
         <dependency.activiti-engine.version>5.23.0</dependency.activiti-engine.version>
         <dependency.activiti.version>5.23.0</dependency.activiti.version>
-        <dependency.alfresco-transform-core.version>5.2.2-A.4</dependency.alfresco-transform-core.version>
+        <dependency.alfresco-transform-core.version>5.2.2</dependency.alfresco-transform-core.version>
-        <dependency.alfresco-transform-service.version>4.2.2-A.2</dependency.alfresco-transform-service.version>
+        <dependency.alfresco-transform-service.version>4.2.2</dependency.alfresco-transform-service.version>
         <dependency.alfresco-greenmail.version>7.1</dependency.alfresco-greenmail.version>
         <dependency.acs-event-model.version>1.0.11</dependency.acs-event-model.version>
 
         <dependency.aspectj.version>1.9.22.1</dependency.aspectj.version>
         <dependency.spring.version>6.2.11</dependency.spring.version>
-        <dependency.spring-security.version>6.3.9</dependency.spring-security.version>
+        <dependency.spring-security.version>6.4.11</dependency.spring-security.version>
         <dependency.antlr.version>3.5.3</dependency.antlr.version>
         <dependency.jackson.version>2.17.2</dependency.jackson.version>
         <dependency.cxf.version>4.1.2</dependency.cxf.version>
@@ -115,7 +115,7 @@
         <dependency.jakarta-json-path.version>2.9.0</dependency.jakarta-json-path.version>
         <dependency.json-smart.version>2.5.2</dependency.json-smart.version>
         <alfresco.googledrive.version>4.1.0</alfresco.googledrive.version>
-        <alfresco.aos-module.version>3.3.0</alfresco.aos-module.version>
+        <alfresco.aos-module.version>3.4.0</alfresco.aos-module.version>
         <alfresco.api-explorer.version>25.2.0</alfresco.api-explorer.version> <!-- Also in alfresco-enterprise-share -->
 
         <alfresco.maven-plugin.version>2.2.0</alfresco.maven-plugin.version>
@@ -154,7 +154,7 @@
         <connection>scm:git:https://github.com/Alfresco/alfresco-community-repo.git</connection>
         <developerConnection>scm:git:https://github.com/Alfresco/alfresco-community-repo.git</developerConnection>
         <url>https://github.com/Alfresco/alfresco-community-repo</url>
-        <tag>25.3.0.46</tag>
+        <tag>HEAD</tag>
     </scm>
 
     <distributionManagement>

remote-api/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo</artifactId>
-        <version>25.3.0.46</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <dependencies>

remote-api/src/main/java/org/alfresco/repo/web/scripts/comments/CommentsPost.java

@@ -2,7 +2,7 @@
  * #%L
  * Alfresco Remote API
  * %%
- * Copyright (C) 2005 - 2016 Alfresco Software Limited
+ * Copyright (C) 2005 - 2025 Alfresco Software Limited
  * %%
  * This file is part of the Alfresco software. 
  * If the software was purchased under a paid Alfresco license, the terms of 
@@ -31,7 +31,10 @@ import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 
+import org.apache.commons.lang3.StringUtils;
 import org.json.simple.JSONObject;
+import org.owasp.html.HtmlPolicyBuilder;
+import org.owasp.html.PolicyFactory;
 import org.springframework.extensions.webscripts.Cache;
 import org.springframework.extensions.webscripts.Status;
 import org.springframework.extensions.webscripts.WebScriptRequest;
@@ -67,6 +70,35 @@ public class CommentsPost extends AbstractCommentsWebScript
         // get json object from request
         JSONObject json = parseJSON(req);
 
+        // Validating and Sanitizing comment content to prevent XSS
+        String commentContent = getOrNull(json, "content");
+        if (StringUtils.isBlank(commentContent))
+        {
+            throw new IllegalArgumentException("Comment content must not be empty");
+        }
+        else
+        {
+            // Allowed HTML elements and attributes in comment content e.g. Text formatting ,Lists and Structure & Styling
+            String[] allowedElements = {"b", "i", "u", "strong", "em", "ul", "ol", "li", "p", "br", "span", "div"};
+
+            PolicyFactory policy = new HtmlPolicyBuilder()
+                    .allowElements(allowedElements)
+                    .allowAttributes("style").matching((elementName, attributeName, value) -> {
+                        String lowerValue = value.toLowerCase();
+                        if (lowerValue.matches("(?s).*(color\\s*:\\s*[^;]+).*") ||
+                                lowerValue.matches("(?s).*(background-color\\s*:\\s*[^;]+).*"))
+                        {
+                            return value;
+                        }
+                        return null;
+                    }).onElements("span", "div", "p")
+                    .allowStandardUrlProtocols()
+                    .toFactory();
+
+            String safeContent = policy.sanitize(commentContent);
+            json.replace("content", safeContent);
+        }
+
         /* MNT-10231, MNT-9771 fix */
         this.behaviourFilter.disableBehaviour(nodeRef, ContentModel.ASPECT_AUDITABLE);
 

remote-api/src/main/resources/alfresco/templates/webscripts/org/alfresco/repository/forms/form.post.json.js

@@ -51,6 +51,14 @@ function main()
         }
     }
 
+    var contentChanged = false;
+    if (itemKind === "node") {
+        contentChanged = metadataExtractAction.isContentChanged(itemId,repoFormData);
+    }
+    if(logger.isLoggingEnabled() && contentChanged) {
+        logger.log("Content has been changed");
+    }
+
     var persistedObject = null;
     try
     {
@@ -83,9 +91,50 @@ function main()
        
         return;
     }
+    if (itemKind === "node") {
+        checkAndExtractNodeMetadata(persistedObject, itemId, contentChanged);
+    }
     
     model.persistedObject = persistedObject.toString();
     model.message = "Successfully persisted form for item [" + itemKind + "]" + itemId;
 }
 
+function checkAndExtractNodeMetadata(persistedObject, itemId, isContentChanged) {
+    var nodeRefStr = toNodeRefString(persistedObject, itemId);
+    var node = search.findNode(nodeRefStr);
+
+    if (node == null) {
+        if (logger.isLoggingEnabled()) {
+            logger.log("Node not found: " + nodeRefStr);
+        }
+    } else if(isContentChanged) {
+        extractMetadata(node, isContentChanged);
+    } else {
+        if (logger.isLoggingEnabled()) {
+            logger.log("Content not changed, skipping metadata extraction for node: " + nodeRefStr);
+        }
+    }
+}
+
+
+function extractMetadata(file, isContentChanged) {
+    var emAction = metadataExtractAction.create(isContentChanged);
+    if (emAction) {
+        // readOnly=false, newTransaction=false
+        emAction.execute(file, false, false);
+    }
+}
+
+function toNodeRefString(persistedObject, itemId) {
+    // Prefer the NodeRef returned by saveForm (when kind=node).
+    if (persistedObject instanceof Packages.org.alfresco.service.cmr.repository.NodeRef) {
+        return persistedObject.toString();
+    }
+    // If the client passed a full noderef, keep it.
+    if (itemId && itemId.indexOf("://") !== -1) {
+        return itemId;
+    }
+    // Otherwise assume SpacesStore UUID.
+    return "workspace://SpacesStore/" + itemId;
+}
 main();

remote-api/src/main/resources/alfresco/templates/webscripts/org/alfresco/repository/forms/pickerresults.lib.ftl

@@ -40,7 +40,6 @@
 		"items":
 		[
 		<#list results as row>
-			<#if row.item.hasPermission("Read")>
 			{
 				"type": "${row.item.typeShort}",
 				"parentType": "${row.item.parentTypeShort!""}",
@@ -76,7 +75,6 @@
 				"nodeRef": "${row.item.nodeRef}"<#if row.selectable?exists>,
 				"selectable" : ${row.selectable?string}</#if>
 			}<#if row_has_next>,</#if>
-			</#if>
 		</#list>
 		]
 	}

remote-api/src/main/resources/alfresco/templates/webscripts/org/alfresco/repository/upload/upload.post.js

@@ -2,7 +2,7 @@ function extractMetadata(file)
 {
    // Extract metadata - via repository action for now.
    // This should use the MetadataExtracter API to fetch properties, allowing for possible failures.
-   var emAction = actions.create("extract-metadata");
+   var emAction = metadataExtractAction.create(true);
    if (emAction != null)
    {
       // Call using readOnly = false, newTransaction = false

repository/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo</artifactId>
-        <version>25.3.0.46</version>
+        <version>25.3.0.64-SNAPSHOT</version>
     </parent>
 
     <dependencies>
@@ -840,12 +840,12 @@
                     </execution>
                 </executions>
                 <configuration>
-                    <complianceLevel>17</complianceLevel>
+                    <complianceLevel>${java.version}</complianceLevel>
                     <outxml>false</outxml>
                     <verbose>true</verbose>
                     <showWeaveInfo>true</showWeaveInfo>
-                    <source>17</source>
+                    <source>${java.version}</source>
-                    <target>17</target>
+                    <target>${java.version}</target>
                     <additionalCompilerArgs>
                         <arg>-parameters</arg>
                     </additionalCompilerArgs>

repository/src/main/java/org/alfresco/repo/action/evaluator/CompareContentConditionEvaluator.java

@@ -0,0 +1,67 @@
+/*
+ * #%L
+ * Alfresco Repository
+ * %%
+ * Copyright (C) 2005 - 2025 Alfresco Software Limited
+ * %%
+ * This file is part of the Alfresco software. 
+ * If the software was purchased under a paid Alfresco license, the terms of 
+ * the paid license agreement will prevail.  Otherwise, the software is 
+ * provided under the following open source license terms:
+ * 
+ * Alfresco is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ * 
+ * Alfresco is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ * 
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
+ * #L%
+ */
+package org.alfresco.repo.action.evaluator;
+
+import java.util.List;
+
+import org.alfresco.service.cmr.action.ActionCondition;
+import org.alfresco.service.cmr.action.ParameterDefinition;
+import org.alfresco.service.cmr.repository.NodeRef;
+
+/**
+ * Content change condition evaluator implementation. Required only in Scripted Actions to allow determination if content has changed. <br>
+ * Usage in {@link org.alfresco.repo.jscript.MetaDataExtractAction#create(boolean)}
+ *
+ * @author Sayan Bhattacharya
+ */
+
+public class CompareContentConditionEvaluator extends ActionConditionEvaluatorAbstractBase
+{
+    /**
+     * Evaluator constants
+     */
+    public static final String NAME = "compare-content";
+    public static final String PARAM_IS_CONTENT_CHANGED = "isContentChanged";
+
+    /**
+     * @see ActionConditionEvaluatorAbstractBase#evaluateImpl(ActionCondition, NodeRef)
+     */
+    @Override
+    public boolean evaluateImpl(ActionCondition ruleCondition, NodeRef actionedUponNodeRef)
+    {
+        return true;
+    }
+
+    /**
+     * @see org.alfresco.repo.action.ParameterizedItemAbstractBase#addParameterDefinitions(List)
+     */
+    @Override
+    protected void addParameterDefinitions(List<ParameterDefinition> paramList)
+    {
+        // No parameters to add
+    }
+
+}

repository/src/main/java/org/alfresco/repo/action/executer/ContentMetadataExtracter.java

@@ -51,12 +51,14 @@ import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 import java.util.Set;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
 import org.alfresco.model.ContentModel;
+import org.alfresco.repo.action.evaluator.CompareContentConditionEvaluator;
 import org.alfresco.repo.content.metadata.AbstractMappingMetadataExtracter;
 import org.alfresco.repo.content.metadata.AsynchronousExtractor;
 import org.alfresco.repo.content.metadata.MetadataExtracter;
@@ -403,6 +405,7 @@ public class ContentMetadataExtracter extends ActionExecuterAbstractBase
             ((AbstractMappingMetadataExtracter) extracter).setEnableStringTagging(enableStringTagging);
         }
 
+        MetadataExtracter.OverwritePolicy overwritePolicy = determineOverwritePolicy(ruleAction);
         // Get all the node's properties
         Map<QName, Serializable> nodeProperties = nodeService.getProperties(actionedUponNodeRef);
 
@@ -415,7 +418,7 @@ public class ContentMetadataExtracter extends ActionExecuterAbstractBase
             modifiedProperties = extracter.extract(
                     actionedUponNodeRef,
                     reader,
-                    /* OverwritePolicy.PRAGMATIC, */
+                    overwritePolicy,
                     nodeProperties);
         }
         catch (Throwable e)
@@ -456,6 +459,21 @@ public class ContentMetadataExtracter extends ActionExecuterAbstractBase
                 stringTaggingSeparators);
     }
 
+    private MetadataExtracter.OverwritePolicy determineOverwritePolicy(Action ruleAction)
+    {
+        return Optional.ofNullable(ruleAction.getActionConditions())
+                .flatMap(conditions -> conditions.stream()
+                        .filter(e -> CompareContentConditionEvaluator.NAME.equals(e.getActionConditionDefinitionName()))
+                        .findAny()
+                        .map(e -> {
+                            Serializable contentChanged = e.getParameterValue(CompareContentConditionEvaluator.PARAM_IS_CONTENT_CHANGED);
+                            return Boolean.TRUE.equals(contentChanged)
+                                    ? MetadataExtracter.OverwritePolicy.EAGER
+                                    : MetadataExtracter.OverwritePolicy.PRAGMATIC;
+                        }))
+                .orElse(MetadataExtracter.OverwritePolicy.PRAGMATIC);
+    }
+
     public static void addExtractedMetadataToNode(NodeRef actionedUponNodeRef, Map<QName, Serializable> nodeProperties,
             Map<QName, Serializable> modifiedProperties,
             NodeService nodeService, DictionaryService dictionaryService,

repository/src/main/java/org/alfresco/repo/content/metadata/AbstractMappingMetadataExtracter.java

@@ -2,7 +2,7 @@
  * #%L
  * Alfresco Repository
  * %%
- * Copyright (C) 2005 - 2021 Alfresco Software Limited
+ * Copyright (C) 2005 - 2025 Alfresco Software Limited
  * %%
  * This file is part of the Alfresco software. 
  * If the software was purchased under a paid Alfresco license, the terms of 
@@ -102,6 +102,7 @@ import org.alfresco.service.namespace.QName;
  * @author Jesper Steen Møller
  * @author Derek Hulley
  */
+@SuppressWarnings("PMD.CyclomaticComplexity")
 @AlfrescoPublicApi
 abstract public class AbstractMappingMetadataExtracter implements MetadataExtracter, MetadataEmbedder, BeanNameAware, ApplicationContextAware
 {
@@ -1118,6 +1119,15 @@ abstract public class AbstractMappingMetadataExtracter implements MetadataExtrac
         return extract(nodeRef, reader, overwritePolicy, destination, mapping);
     }
 
+    /**
+     * {@inheritDoc}
+     */
+    @Override
+    public Map<QName, Serializable> extract(NodeRef nodeRef, ContentReader reader, OverwritePolicy overwritePolicy, Map<QName, Serializable> destination)
+    {
+        return extract(nodeRef, reader, overwritePolicy, destination, mapping);
+    }
+
     /**
      * {@inheritDoc}
      */
@@ -1154,7 +1164,7 @@ abstract public class AbstractMappingMetadataExtracter implements MetadataExtrac
             // Check that the content has some meat
             if (reader.getSize() > 0 && reader.exists())
             {
-                rawMetadata = extractRaw(nodeRef, reader, getLimits(reader.getMimetype()));
+                rawMetadata = extractRaw(nodeRef, reader, getLimits(reader.getMimetype()), overwritePolicy);
             }
             else
             {
@@ -2002,7 +2012,7 @@ abstract public class AbstractMappingMetadataExtracter implements MetadataExtrac
     }
 
     /**
-     * Exception wrapper to handle exceeded limits imposed by {@link MetadataExtracterLimits} {@link AbstractMappingMetadataExtracter#extractRaw(NodeRef, ContentReader, MetadataExtracterLimits)}
+     * Exception wrapper to handle exceeded limits imposed by {@link MetadataExtracterLimits} {@link AbstractMappingMetadataExtracter#extractRaw(NodeRef, ContentReader, MetadataExtracterLimits,OverwritePolicy)}
      */
     private class LimitExceededException extends Exception
     {
@@ -2032,7 +2042,7 @@ abstract public class AbstractMappingMetadataExtracter implements MetadataExtrac
      *             All exception conditions can be handled.
      */
     private Map<String, Serializable> extractRaw(NodeRef nodeRef,
-            ContentReader reader, MetadataExtracterLimits limits) throws Throwable
+            ContentReader reader, MetadataExtracterLimits limits, OverwritePolicy overwritePolicy) throws Throwable
     {
         if (reader.getSize() > limits.getMaxDocumentSizeMB() * MEGABYTE_SIZE)
         {
@@ -2059,6 +2069,12 @@ abstract public class AbstractMappingMetadataExtracter implements MetadataExtrac
             }
         }
 
+        return extractRawInThread(nodeRef, reader, limits, overwritePolicy);
+    }
+
+    protected Map<String, Serializable> extractRawInThread(NodeRef nodeRef, ContentReader reader, MetadataExtracterLimits limits, OverwritePolicy policy)
+            throws Throwable
+    {
         return extractRawInThread(nodeRef, reader, limits);
     }
 

repository/src/main/java/org/alfresco/repo/content/metadata/AsynchronousExtractor.java

@@ -93,6 +93,9 @@ public class AsynchronousExtractor extends AbstractMappingMetadataExtracter
     private static final String METADATA = "metadata";
     private static final Map<String, Serializable> EMPTY_METADATA = Collections.emptyMap();
 
+    private static final OverwritePolicy DEFAULT_OVERWRITE_POLICY = OverwritePolicy.PRAGMATIC;
+    private OverwritePolicy extractOverwritePolicy = DEFAULT_OVERWRITE_POLICY;
+
     private final ObjectMapper jsonObjectMapper = new ObjectMapper();
 
     private NodeService nodeService;
@@ -260,9 +263,9 @@ public class AsynchronousExtractor extends AbstractMappingMetadataExtracter
     }
 
     @Override
-    protected Map<String, Serializable> extractRawInThread(NodeRef nodeRef, ContentReader reader, MetadataExtracterLimits limits)
+    protected Map<String, Serializable> extractRawInThread(NodeRef nodeRef, ContentReader reader, MetadataExtracterLimits limits, OverwritePolicy overwritePolicy) throws Throwable
-            throws Throwable
     {
+        this.extractOverwritePolicy = overwritePolicy != null ? overwritePolicy : DEFAULT_OVERWRITE_POLICY;
         Map<String, String> options = getExtractOptions(nodeRef, reader, limits);
         transformInBackground(nodeRef, reader, MIMETYPE_METADATA_EXTRACT, EXTRACT, options);
         return EMPTY_METADATA;
@@ -461,7 +464,7 @@ public class AsynchronousExtractor extends AbstractMappingMetadataExtracter
         }
 
         // Remove well know entries from the map that drive how the real metadata is applied.
-        OverwritePolicy overwritePolicy = removeOverwritePolicy(metadata, "sys:overwritePolicy", OverwritePolicy.PRAGMATIC);
+        OverwritePolicy overwritePolicy = removeOverwritePolicy(metadata, "sys:overwritePolicy", extractOverwritePolicy);
         Boolean enableStringTagging = removeBoolean(metadata, "sys:enableStringTagging", false);
         Boolean carryAspectProperties = removeBoolean(metadata, "sys:carryAspectProperties", true);
         List<String> stringTaggingSeparators = removeTaggingSeparators(metadata, "sys:stringTaggingSeparators",

repository/src/main/java/org/alfresco/repo/content/metadata/MetadataExtracter.java

@@ -404,6 +404,24 @@ public interface MetadataExtracter extends ContentWorker
         return extract(reader, destination);
     }
 
+    /**
+     * Identical to {@link #extract(ContentReader, OverwritePolicy ,Map)} but with the addition of the {@code NodeRef} being acted on. By default, the method without the {@code NodeRef} is called.
+     *
+     * @param nodeRef
+     *            the node being acted on.
+     * @param reader
+     *            the source of the content
+     * @param destination
+     *            the map of properties to populate (essentially a return value)
+     * @return Returns a map of all properties on the destination map that were added or modified. If the return map is empty, then no properties were modified.
+     * @throws ContentIOException
+     *             if a detectable error occurs
+     */
+    default Map<QName, Serializable> extract(NodeRef nodeRef, ContentReader reader, OverwritePolicy overwritePolicy, Map<QName, Serializable> destination)
+    {
+        return extract(reader, overwritePolicy, destination);
+    }
+
     /**
      * Identical to {@link #extract(ContentReader, OverwritePolicy, Map, Map)} but with the addition of the {@code NodeRef} being acted on. By default, the method without the {@code NodeRef} is called.
      *

repository/src/main/java/org/alfresco/repo/event2/EventConsolidator.java

@@ -2,7 +2,7 @@
  * #%L
  * Alfresco Repository
  * %%
- * Copyright (C) 2005 - 2023 Alfresco Software Limited
+ * Copyright (C) 2005 - 2025 Alfresco Software Limited
  * %%
  * This file is part of the Alfresco software.
  * If the software was purchased under a paid Alfresco license, the terms of
@@ -97,19 +97,26 @@ public abstract class EventConsolidator<REF extends EntityRef, RES extends Resou
      * @return the {@link RepoEvent} instance
      */
     public RepoEvent<DataAttributes<RES>> getRepoEvent(EventInfo eventInfo)
+    {
+        final RepoEvent.Builder<DataAttributes<RES>> builder = RepoEvent.builder();
+
+        configureRepoEventBuilder(builder, eventInfo);
+
+        return builder.build();
+    }
+
+    protected void configureRepoEventBuilder(RepoEvent.Builder<DataAttributes<RES>> builder, EventInfo eventInfo)
     {
         EventType eventType = getDerivedEvent();
 
         DataAttributes<RES> eventData = buildEventData(eventInfo, resource, eventType);
 
-        return RepoEvent.<DataAttributes<RES>> builder()
+        builder.setId(eventInfo.getId())
-                .setId(eventInfo.getId())
                 .setSource(eventInfo.getSource())
                 .setTime(eventInfo.getTimestamp())
                 .setType(eventType.getType())
                 .setData(eventData)
-                .setDataschema(EventJSONSchema.getSchemaV1(eventType))
+                .setDataschema(EventJSONSchema.getSchemaV1(eventType));
-                .build();
     }
 
     /**

repository/src/main/java/org/alfresco/repo/jscript/MetaDataExtractAction.java

@@ -0,0 +1,171 @@
+/*
+ * #%L
+ * Alfresco Repository
+ * %%
+ * Copyright (C) 2005 - 2020 Alfresco Software Limited
+ * %%
+ * This file is part of the Alfresco software.
+ * If the software was purchased under a paid Alfresco license, the terms of
+ * the paid license agreement will prevail.  Otherwise, the software is
+ * provided under the following open source license terms:
+ *
+ * Alfresco is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Alfresco is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
+ * #L%
+ */
+/*
+ * Copyright (C) 2005 - 2025 Alfresco Software Limited
+ *
+ * This file is part of Alfresco
+ *
+ * Alfresco is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Alfresco is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.alfresco.repo.jscript;
+
+import org.apache.commons.lang3.Strings;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+import org.alfresco.model.ContentModel;
+import org.alfresco.repo.action.evaluator.CompareContentConditionEvaluator;
+import org.alfresco.repo.forms.FormData;
+import org.alfresco.service.ServiceRegistry;
+import org.alfresco.service.cmr.action.Action;
+import org.alfresco.service.cmr.action.ActionCondition;
+import org.alfresco.service.cmr.action.ActionDefinition;
+import org.alfresco.service.cmr.action.ActionService;
+import org.alfresco.service.cmr.repository.ContentReader;
+import org.alfresco.service.cmr.repository.ContentService;
+import org.alfresco.service.cmr.repository.NodeRef;
+
+/**
+ * JavaScript wrapper for the "extract-metadata" action.
+ * <p>
+ * This class provides a scriptable interface to trigger metadata extraction actions within the Alfresco repository.</br>
+ * It is similar to {@link Actions} class but is dedicated to metadata extraction functionality.
+ *
+ * </br>
+ *
+ * @author Sayan Bhattacharya
+ */
+public final class MetaDataExtractAction extends BaseScopableProcessorExtension
+{
+    private static final Log LOG = LogFactory.getLog(MetaDataExtractAction.class);
+
+    private final static String ACTION_NAME = "extract-metadata";
+
+    private ContentService contentService;
+
+    private ServiceRegistry services;
+
+    /**
+     * Set the service registry
+     *
+     * @param serviceRegistry
+     *            the service registry
+     */
+    public void setServiceRegistry(ServiceRegistry serviceRegistry)
+    {
+        this.services = serviceRegistry;
+    }
+
+    public void setContentService(ContentService contentService)
+    {
+        this.contentService = contentService;
+    }
+
+    /**
+     * Create a new metadata extraction action instance
+     *
+     * @param setActionContext
+     *            if true, sets the action context to "scriptaction".
+     * @return the newly created action
+     */
+
+    public ScriptAction create(boolean isContentChanged)
+    {
+        ScriptAction scriptAction = null;
+        ActionService actionService = services.getActionService();
+        ActionDefinition actionDef = actionService.getActionDefinition(ACTION_NAME);
+        if (actionDef != null)
+        {
+            Action action = actionService.createAction(ACTION_NAME);
+
+            ActionCondition actionCondition = actionService.createActionCondition(CompareContentConditionEvaluator.NAME);
+            actionCondition.setParameterValue(CompareContentConditionEvaluator.PARAM_IS_CONTENT_CHANGED, isContentChanged);
+            action.addActionCondition(actionCondition);
+
+            scriptAction = new ScriptAction(this.services, action, actionDef);
+            scriptAction.setScope(getScope());
+        }
+        return scriptAction;
+    }
+
+    /**
+     * Check if the content has been updated in the form data compared to the existing content of the node.
+     *
+     * @param itemId
+     * @param formData
+     * @return true if content has changed, false otherwise
+     */
+    public boolean isContentChanged(String itemId, FormData formData)
+    {
+
+        try
+        {
+            NodeRef nodeRef = NodeRef.isNodeRef(itemId) ? new NodeRef(itemId) : parseNodeRef(itemId);
+            if (nodeRef == null)
+            {
+                return false;
+            }
+
+            ContentReader reader = contentService.getReader(nodeRef, ContentModel.PROP_CONTENT);
+            String contentString = reader.getContentString();
+            FormData.FieldData fieldData = formData.getFieldData("prop_cm_content");
+
+            if (fieldData == null || fieldData.getValue() == null)
+            {
+                return false;
+            }
+
+            String propCmContent = String.valueOf(fieldData.getValue());
+            return !Strings.CS.equals(contentString, propCmContent);
+        }
+        catch (Exception e)
+        {
+            if (LOG.isDebugEnabled())
+            {
+                LOG.debug("Unable to determine if content has changed for node: " + itemId, e);
+            }
+            return false;
+        }
+    }
+
+    private NodeRef parseNodeRef(String itemId)
+    {
+        String[] parts = itemId.split("/");
+        return (parts.length == 3) ? new NodeRef(parts[0], parts[1], parts[2]) : null;
+    }
+
+}

repository/src/main/resources/alfresco/action-services-context.xml

@@ -237,6 +237,12 @@
     <bean id="no-condition" class="org.alfresco.repo.action.evaluator.NoConditionEvaluator" parent="action-condition-evaluator">
     </bean>
 
+    <bean id="compare-content" class="org.alfresco.repo.action.evaluator.CompareContentConditionEvaluator" parent="action-condition-evaluator">
+        <property name="publicCondition">
+            <value>false</value>
+        </property>
+    </bean>
+
     <bean id="compare-property-value" class="org.alfresco.repo.action.evaluator.ComparePropertyValueEvaluator" parent="action-condition-evaluator">
         <property name="nodeService">
             <ref bean="nodeService" />

repository/src/main/resources/alfresco/script-services-context.xml

@@ -104,6 +104,17 @@
         </property>
     </bean>
 
+    <bean id="metadataExtractServiceScript" parent="baseJavaScriptExtension"
+          class="org.alfresco.repo.jscript.MetaDataExtractAction">
+        <property name="extensionName">
+            <value>metadataExtractAction</value>
+        </property>
+        <property name="contentService" ref="ContentService" />
+        <property name="serviceRegistry">
+            <ref bean="ServiceRegistry"/>
+        </property>
+    </bean>
+
     <bean id="imapScript" parent="baseJavaScriptExtension" class="org.alfresco.repo.jscript.Imap">
         <property name="extensionName">
             <value>imap</value>

repository/src/test/java/org/alfresco/AppContext03TestSuite.java

@@ -2,7 +2,7 @@
  * #%L
  * Alfresco Repository
  * %%
- * Copyright (C) 2005 - 2017 Alfresco Software Limited
+ * Copyright (C) 2005 - 2025 Alfresco Software Limited
  * %%
  * This file is part of the Alfresco software. 
  * If the software was purchased under a paid Alfresco license, the terms of 
@@ -66,6 +66,7 @@ import org.alfresco.util.testing.category.NonBuildTests;
         org.alfresco.repo.importer.FileImporterTest.class,
         org.alfresco.repo.importer.ImporterComponentTest.class,
         org.alfresco.repo.jscript.PeopleTest.class,
+        org.alfresco.repo.jscript.MetaDataExtractActionTest.class,
         org.alfresco.repo.jscript.RhinoScriptTest.class,
 
         // needs a clean DB to run

repository/src/test/java/org/alfresco/repo/action/executer/ContentMetadataExtracterTest.java

@@ -28,6 +28,7 @@ package org.alfresco.repo.action.executer;
 import static org.awaitility.Awaitility.await;
 
 import java.io.Serializable;
+import java.time.Duration;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Objects;
@@ -46,6 +47,8 @@ import org.alfresco.repo.content.MimetypeMap;
 import org.alfresco.repo.content.metadata.AbstractMappingMetadataExtracter;
 import org.alfresco.repo.content.metadata.MetadataExtracterRegistry;
 import org.alfresco.repo.content.transform.AbstractContentTransformerTest;
+import org.alfresco.repo.jscript.MetaDataExtractAction;
+import org.alfresco.repo.jscript.ScriptAction;
 import org.alfresco.repo.security.authentication.AuthenticationComponent;
 import org.alfresco.repo.transaction.RetryingTransactionHelper;
 import org.alfresco.service.cmr.repository.ContentReader;
@@ -74,6 +77,10 @@ public class ContentMetadataExtracterTest extends BaseSpringTest
     protected static final String QUICK_DESCRIPTION = "Pangram, fox, dog, Gym class featuring a brown fox and lazy dog";
     protected static final String QUICK_CREATOR = "Nevin Nollop";
 
+    protected static final String QUICK_UPDATED_TITLE = "The hot dog is eaten by the city fox";
+    protected static final String QUICK_UPDATED_DESCRIPTION = "Pangram, fox, dog, Gym class featuring only brown fox";
+    protected static final String QUICK_UPDATED_CREATOR = "Friday";
+
     private NodeService nodeService;
     private ContentService contentService;
     private MetadataExtracterRegistry registry;
@@ -84,6 +91,8 @@ public class ContentMetadataExtracterTest extends BaseSpringTest
 
     private ContentMetadataExtracter executer;
 
+    private MetaDataExtractAction extractAction;
+
     private final static String ID = GUID.generate();
 
     @Before
@@ -116,6 +125,9 @@ public class ContentMetadataExtracterTest extends BaseSpringTest
 
         // Get the executer instance
         this.executer = (ContentMetadataExtracter) this.applicationContext.getBean("extract-metadata");
+
+        // get the js script action
+        this.extractAction = (MetaDataExtractAction) this.applicationContext.getBean("metadataExtractServiceScript");
     }
 
     /**
@@ -351,4 +363,45 @@ public class ContentMetadataExtracterTest extends BaseSpringTest
             }
         });
     }
+
+    @Test
+    public void testUsingScriptAction_WhenContentChanged() throws Exception
+    {
+
+        // update the content
+        ContentWriter cw = this.contentService.getWriter(nodeRef, ContentModel.PROP_CONTENT, true);
+        cw.setMimetype(MimetypeMap.MIMETYPE_PDF);
+        cw.putContent(AbstractContentTransformerTest.loadNamedQuickTestFile("quickupdated.pdf"));
+
+        // Make the nodeRef visible to other transactions as it will need to be in async requests
+        TestTransaction.flagForCommit();
+        TestTransaction.end();
+
+        // Execute the action
+        transactionService.getRetryingTransactionHelper().doInTransaction(new RetryingTransactionHelper.RetryingTransactionCallback<Void>() {
+            public Void execute() throws Throwable
+            {
+                ScriptAction action = extractAction.create(true);
+                action.execute(nodeRef, false, false);
+                return null;
+            }
+        });
+
+        // Need to wait for the async extract
+        await().pollInSameThread()
+                .atMost(Duration.ofSeconds(100))
+                .until(() -> nodeService.getProperty(nodeRef, ContentModel.PROP_DESCRIPTION), Objects::nonNull);
+
+        // Check that the properties have been preserved, but that description has been set
+        transactionService.getRetryingTransactionHelper().doInTransaction(new RetryingTransactionHelper.RetryingTransactionCallback<Void>() {
+            public Void execute() throws Throwable
+            {
+                assertEquals(QUICK_UPDATED_TITLE, nodeService.getProperty(nodeRef, ContentModel.PROP_TITLE));
+                assertEquals(QUICK_UPDATED_CREATOR, nodeService.getProperty(nodeRef, ContentModel.PROP_AUTHOR));
+
+                assertEquals(QUICK_UPDATED_DESCRIPTION, nodeService.getProperty(nodeRef, ContentModel.PROP_DESCRIPTION));
+                return null;
+            }
+        });
+    }
 }

repository/src/test/java/org/alfresco/repo/jscript/MetaDataExtractActionTest.java

@@ -0,0 +1,128 @@
+/*
+ * #%L
+ * Alfresco Repository
+ * %%
+ * Copyright (C) 2005 - 2025 Alfresco Software Limited
+ * %%
+ * This file is part of the Alfresco software.
+ * If the software was purchased under a paid Alfresco license, the terms of
+ * the paid license agreement will prevail.  Otherwise, the software is
+ * provided under the following open source license terms:
+ *
+ * Alfresco is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Alfresco is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
+ * #L%
+ */
+/*
+ * Copyright (C) 2005 Jesper Steen Møller
+ *
+ * This file is part of Alfresco
+ *
+ * Alfresco is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Alfresco is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package org.alfresco.repo.jscript;
+
+import static org.junit.Assert.*;
+
+import org.junit.Test;
+import org.mockito.Mockito;
+
+import org.alfresco.repo.forms.FormData;
+import org.alfresco.service.ServiceRegistry;
+import org.alfresco.service.cmr.action.Action;
+import org.alfresco.service.cmr.action.ActionCondition;
+import org.alfresco.service.cmr.action.ActionDefinition;
+import org.alfresco.service.cmr.action.ActionService;
+import org.alfresco.service.cmr.repository.ContentReader;
+import org.alfresco.service.cmr.repository.ContentService;
+
+public class MetaDataExtractActionTest
+{
+
+    @Test
+    public void testIsContentChangedReturnsTrue()
+    {
+        MetaDataExtractAction action = new MetaDataExtractAction();
+        ContentService contentService = Mockito.mock(ContentService.class);
+        ContentReader reader = Mockito.mock(ContentReader.class);
+        FormData formData = Mockito.mock(FormData.class);
+        FormData.FieldData fieldData = Mockito.mock(FormData.FieldData.class);
+
+        String nodeRefStr = "workspace://SpacesStore/abc/def";
+        Mockito.when(contentService.getReader(Mockito.any(), Mockito.any())).thenReturn(reader);
+        Mockito.when(reader.getContentString()).thenReturn("oldContent");
+        Mockito.when(formData.getFieldData("prop_cm_content")).thenReturn(fieldData);
+        Mockito.when(fieldData.getValue()).thenReturn("newContent");
+
+        action.setContentService(contentService);
+
+        boolean result = action.isContentChanged(nodeRefStr, formData);
+        assertTrue(result);
+    }
+
+    @Test
+    public void testIsContentChangedReturnsFalse()
+    {
+        MetaDataExtractAction action = new MetaDataExtractAction();
+        ContentService contentService = Mockito.mock(ContentService.class);
+        ContentReader reader = Mockito.mock(ContentReader.class);
+        FormData formData = Mockito.mock(FormData.class);
+        FormData.FieldData fieldData = Mockito.mock(FormData.FieldData.class);
+
+        String nodeRefStr = "workspace://SpacesStore/abc/def";
+        Mockito.when(contentService.getReader(Mockito.any(), Mockito.any())).thenReturn(reader);
+        Mockito.when(reader.getContentString()).thenReturn("sameContent");
+        Mockito.when(formData.getFieldData("prop_cm_content")).thenReturn(fieldData);
+        Mockito.when(fieldData.getValue()).thenReturn("sameContent");
+
+        action.setContentService(contentService);
+
+        boolean result = action.isContentChanged(nodeRefStr, formData);
+        assertFalse(result);
+    }
+
+    @Test
+    public void testCreateWhenContentChangedReturnsScriptAction()
+    {
+        MetaDataExtractAction action = new MetaDataExtractAction();
+
+        ServiceRegistry serviceRegistry = Mockito.mock(ServiceRegistry.class);
+        ActionService actionService = Mockito.mock(ActionService.class);
+        ActionDefinition actionDefinition = Mockito.mock(ActionDefinition.class);
+        Action alfrescoAction = Mockito.mock(Action.class);
+        ActionCondition actionCondition = Mockito.mock(ActionCondition.class);
+
+        Mockito.when(serviceRegistry.getActionService()).thenReturn(actionService);
+        Mockito.when(actionService.getActionDefinition(Mockito.anyString())).thenReturn(actionDefinition);
+        Mockito.when(actionService.createAction(Mockito.anyString())).thenReturn(alfrescoAction);
+        Mockito.when(actionService.createActionCondition(Mockito.anyString())).thenReturn(actionCondition);
+
+        action.setServiceRegistry(serviceRegistry);
+
+        ScriptAction result = action.create(true);
+
+        assertNotNull("ScriptAction should not be null when content has changed", result);
+    }
+}