This is the release notes for XWiki Commons, XWiki Rendering and XWiki Platform. They share the same release notes as they are released together and have the same version.

This is a bug fix release that fixes important bugs and upgrades or removes dependencies with security vulnerabilities.

New and Noteworthy (since XWiki 16.10.14)

Full list of issues fixed and Dashboard for 16.10.15.

Upgrades

The following runtime dependencies have been upgraded (they have a different release cycle than XWiki Commons, XWiki Rendering and XWiki Platform):

Translations

The following translations have been updated: 

• German
• French
• Korean
• Romanian

Tested Browsers & Databases

Automated testing

XWiki executes a lot of automated tests during its build, testing all supported configurations. In addition, some manual QA is also executed to try to discover additional problems (see below):

Manual testing

Here is the list of browsers we support and how they have been manually tested for this release:

	Browser	Tested on:
	Mozilla Firefox 146	Not Tested
	Microsoft Edge 145	Not Tested
	Google Chrome 145	Jira Tickets Marked as Fixed in the Release Notes
	Safari 18	Not Tested

Here is the list of databases we support and how they have been manually tested for this release:

	Database	Tested on:
	HyperSQL 2.7.4	Not Tested
	MariaDB 11.8	Jira Tickets Marked as Fixed in the Release Notes
	PostgreSQL 17	Not Tested
	MySQL 9.3.0	Not Tested
	Oracle 19c	Not Tested

Here is the list of Servlet Containers we support and how they have been manually tested for this release:

	Servlet Container	Tested on:
	Tomcat 9.0.115	Not Tested
	Jetty 12.0.15 (XWiki Standalone packaging)	Jira Tickets Marked as Fixed in the Release Notes
	Jetty 12.0.15	Not Tested

Security Issues

Security issues are not listed in issue lists or dashboards to avoid disclosing ways to use them, but they will appear automatically in them once they're disclosed. See the XWiki Security Policy for more details.

Known issues

• Bugs we know about

Backward Compatibility and Migration Notes

General Notes

• When upgrading make sure you compare and merge the following XWiki configuration files since some parameters may have been modified, removed or added:
  • xwiki.cfg
  • xwiki.properties
  • web.xml
  • hibernate.cfg.xml
• Add xwiki.store.migration=1 in xwiki.cfg so that XWiki will attempt to automatically migrate your current database to any new schema. Make sure you backup your Database before doing anything.

Issues specific to XWiki 16.10.15

Apache HttpClient 3 is not included in XWiki Standard anymore

Apache HttpClient 3 having an important vulnerability, it was removed from XWiki Standard 17.10.0-rc-1, 17.4.8 and 16.10.15. This means that an extension that relies on the fact that it's there without declaring it as a dependency won't work anymore. Of course it's true also for any custom script that expects it to exist.

While it's technically easy to reinstall extension commons-httpclient:commons-httpclient (last version is 3.1), it's highly recommended to instead rewrite whatever code which needed it to use another library (like HttpClient 5, for example).

Note that to fully remove that dependency, we also had to remove the com.xpn.xwiki.XWiki#getHttpClient API.

Removal of withTip and useTitleAsTip CSS class behaviour

Two CSS classes were defined in the past for working around Internet Explorer limitations regarding values in form inputs: withTip and useTitleAsTip. However it was advised to not rely on those CSS class anymore and to rely on placeholder input attribute only. We now removed the support of those CSS classes in XWiki.

API Breakages

The following APIs were modified since XWiki 16.10.14:

Real breakages

Real backward compatibility breakages that we have unwillingly accepted to do for the reasons mentioned in each violation below.

• Expose a vulnerable and long dead library, and should have never been public in the first place
  • Violation type:

    java.method.removed

  • Code:

    ## Old:
    method org.apache.commons.httpclient.HttpClient com.xpn.xwiki.XWiki::getHttpClient(int, java.lang.String)

• Expose a vulnerable and long dead library, and should have never been public in the first place
  • Violation type:

    java.method.returnTypeChanged

  • Code:

    ## Old:
    method org.apache.commons.httpclient.Credentials com.xpn.xwiki.plugin.feed.XWikiFeedFetcher.CredentialSupplier::getCredentials(java.lang.String, java.lang.String)
    
    ## New:
    method org.apache.hc.client5.http.auth.Credentials com.xpn.xwiki.plugin.feed.XWikiFeedFetcher.CredentialSupplier::getCredentials(java.lang.String, java.lang.String)

Credits

The following people have contributed code and translations to this release (sorted alphabetically):

• 이경철
• Alex Cotiugă 
• Cédric LAMBLIN 
• LucasC 
• Manuel Leduc 
• Marius Dumitru Florea 
• Michael Hamann 
• Simon Urli 
• Simpel 
• Thomas Mortagne 
• xrichard