Every Core dna product, release by release, newest first. Each product ships on its own schedule.
Platform2026.9
What’s new in Core dna Platform 2026.9
Books, Custom Field Search and Bug Fixes
Books, units and book pages now work wherever pages do: in templates, site search, menus and the sitemap. The API can find records by a custom field's value, and the HTTP Request job action only calls public addresses.
Key highlights
Books wherever pages are: query them in templates, find them in site search, link them from menus and list them in the sitemap.
Find records by a custom field: API filters on the value of a named custom field.
HTTP Request steps call public addresses only: jobs can no longer reach internal networks.
Changes in behaviour
Filters on the same relation now apply to the same related record. API list requests, $_query in templates, the criteria of Retrieve Records and Merge Files actions and filter fields in a site's .settings.json can return fewer records than before. Review jobs whose criteria combine filters on the same relation: a narrower result shows up as missing output, not as an error.
HTTP Request actions that call an internal address on purpose now fail, and need a public address instead.
Textarea and Code areas keep links and images exactly as entered. A Textarea's Maximum length is checked against the value as entered, so a value with images can exceed a limit it passed before.
Twig templates: is empty is now true for a layout area with no content, so a theme that relied on such an area counting as not empty takes its empty branch.
Login jobs: with Log login event switched on, every way of signing in now creates a Login entry and fires the User Login job event, so existing Login jobs run more often.
Books, units and book pages wherever pages are
Books, units and book pages now work in the same places as pages:
Templates can read them with $_query.
Site search indexes them, and a search view can offer Book, Unit and Page in its entity filter under Search › Views. Existing records join the index when they are next edited or at the next reindex.
Menus can link to them from the new Books group of the record picker. Menu links to pages, blogs, FAQ pages and books now follow the record when its slug or custom URL changes, and links to its children follow too.
The sitemap lists them when Generate books in sitemap, Generate units in sitemap and Generate pages in sitemap are switched on in the Books settings. All three are off by default, and each level is independent.
Scheduled publishing: books, units and book pages go live and expire on their scheduled dates.
Template code
{* Every book, in the order set in the admin *}
{foreach $_query->findBy('Books\Entities\Book', [], ['position' => 'ASC']) as $book}
<a href="{$book->getFullPath()}">{$book->getName()|escape}</a>
{/foreach}
{# Every book, in the order set in the admin #}
{% for book in _query.findBy('Books\\Entities\\Book', [], {'position': 'ASC'}) %}
<a href="{{ book.getFullPath() }}">{{ book.getName()|e }}</a>
{% endfor %}
Find records by a custom field's value
The API can now find records by the value of a named custom field: customFieldValues_customField_name names the field and customFieldValues_content_text gives the value. These are the elements of menu 1 whose icon field is coffee:
Menu elements with a given icon
GET /cdna-api/menus/elements/1?customFieldValues_customField_name=icon&customFieldValues_content_text=coffee HTTP/1.1
Host: hub.coredna.com
Authorization: Bearer YOUR_ACCESS_TOKEN
Accept: application/json
When several filters go through the same related records, they now all apply to the same related record. Before, each filter could match a different one, so a result could include records that did not meet the combined condition.
HTTP Request steps call public addresses only
The HTTP Request action of a job now sends requests to public internet addresses only. Requests to localhost, private networks and internal hosting services are blocked, and every redirect is checked the same way. A blocked request fails the step at once, without retrying, and the step's output names the blocked host. Authorization and cookie headers are no longer passed on when a redirect leads to another host, and the timeout covers the whole redirect chain.
Textarea and Code areas keep what was typed
Textarea and Code areas now keep links and images exactly as entered; only Richtext areas convert them. In Richtext areas every link is tracked, not only the first, so each one keeps following the page it points at.
Other improvements and bug fixes
Fixed an issue where writing custom fields through the API could move or delete the values of other custom fields on the same record, or keep only the last field sent. A PUT with customFields now updates only the fields named in the request, and null empties a field. Image and file custom fields can now be written with an image or file id instead of returning a server error, and two validation errors that showed a raw translation key now show readable text.
On sites using Twig templates, the is empty test now returns true for layout areas with no content, such as an image area whose image was cleared or a text area saved blank. Themes that relied on these areas counting as not empty will now take their empty branch. Templates can also call the new isAreaBlank('areaName') method on pages, records and global components, and a site can set Globals.template.twig.blankObjects to false in its .settings.json to receive empty areas as null. The response cache should be flushed after changing this setting.
Fixed an issue where PayPal card payments on forms with a billing address always failed. The billing country and state are now sent to PayPal as codes, and forms with custom billing address markup need a two-letter code on each country option, otherwise the address is left off the payment. A failed or declined payment now shows an error and can be retried without reloading the page. The submit button shows a spinner while any payment is processed and stays disabled after a successful payment.
When Log login event is switched on, every successful sign-in now creates a Login entry in the audit log and fires the User Login hook event, recording the sign-in method, the provider and whether it was on the website, the admin area or the API. This now includes registration, SSO, passkey, password reset link, remember me and OAuth password grant sign-ins, so existing Login hooks will fire more often. Sign-ins that are refused or not completed no longer create an entry.
Fixed an issue where exporting all form submissions left out submissions with no field data, so the export had fewer rows than the submissions list. Forms no longer save an empty submission when a request names a step that does not exist, and some malformed form requests that returned a server error now load normally. Empty submissions saved before this release are exported as rows with empty field cells.
Fixed an issue where a required file upload field on a JavaScript form always failed validation, even with a file attached.
Abandoned cart detection no longer starts a new run for a site while the previous run is still in progress, and only checks carts changed within the new Abandoned Max Age setting in the Carts settings, which defaults to 24 hours. Carts older than this that were never marked abandoned are no longer picked up later.
Fixed an issue where custom entity records created while positioning was switched off could not be reordered by drag and drop. These records are now given a position when the record list is opened, and existing positions are kept.
Fixed an issue where the file revisions API could delete a file's active revision, leaving the file unusable. Deleting the active revision now returns a 409 error, and requests for a revision the file does not have return 404 instead of a server error.
Fixed an issue where record read permissions were not always updated after a record was created, edited or deleted.
Fixed an issue where the Image Alt Text Audit, Sales Report and Order Fraud & Refund Decision agents ran without their image, payment and refund data. Image Alt Text Audit recommendations now also apply to the correct image. Sites that have forked one of these agents need to update the tool list in their copy.
The content search field in the page, blog, FAQ and product editors has been restyled to match other admin inputs, with a clear button that appears while typing.