This is the release notes for XWiki Commons, XWiki Rendering and XWiki Platform. They share the same release notes as they are released together and have the same version.

This releases improves the DocumentTree and Children macro usage from WYSIWYG by adding new pickers for some parameters, and provides a refresh look for the Search results page. A new experimental features is provided for admins (and developers) with the ability to save page attachments in Amazon S3 (or compatible stores).

New and Noteworthy (since XWiki 17.9.0)

Full list of issues fixed and Dashboard for 17.10.0.

For Users

New picker for DocumentTree and Children macro

 
A new picker has been implemented to ease the configuration of some parameters of Document Tree macro and Children macro, such as the root parameter. This allows for most types to use a suggester to select the node. For some specific type, users still have to enter a specific reference but this should be only for advanced usages. Check the documentation for more details.

Updated the Solr Search interface

 
The Solr search landing page has been refreshed. Among other things, the search filters and pagination have received changes that should make them fit better in the modern XWiki. Learn more about this design change.

For Admins

• Attachments and recycle bins can be stored in S3: XWiki now optionally supports storing attachments, deleted attachments and deleted pages in Amazon S3 or S3-compatible storage as it is provided by many cloud providers and open source implementations. This eliminates the need for a shared file system in clustering setups. Even with S3, XWiki currently still needs permanent file storage, we'll continue removing the need for permanent file storage in the next releases.

  By default, XWiki still uses the file system for storing attachments, deleted attachments and deleted pages, and we have no plans to discontinue support for it. Currently, S3 support needs to be installed explicitly before enabling it. When configured, existing data is migrated on the first start. See how to configure the S3 blob store for details.

For Developers

New Blob Store API

 
A new blob store API has been introduced for storing blobs of data. By default, this data is stored in the file system in the data directory, but admins can configure XWiki to store the data on S3, which makes the data centrally available on clustered XWiki instances. Extensions should use this API as a replacement for permanent file storage. By choosing appropriate store names or customizing the storage location, it is possible to switch from plain file system access to the blob store API without any data migration. XWiki supports automatically migrating between the configured store and a migration store, allowing for automatic migration of the existing file system data to S3 when configured.

Miscellaneous

• Run integration tests against S3: Docker-based integration tests can be executed with S3 as blob store using the -Dxwiki.test.ui.blobStore=s3 command line flag. A MinIO instance is automatically started and configured as blob store in this case. This can be used to verify that the tested code isn't relying on blobs being stored in the file system when using the blob store API.

Upgrades

The following runtime dependencies have been upgraded (they have a different release cycle than XWiki Commons, XWiki Rendering and XWiki Platform):

Translations

The following translations have been updated:

• Catalan
• Danish
• German
• Spanish
• French
• Croatian
• Latvian
• Romanian
• Russian
• Ukrainian

Tested Browsers & Databases

Automated testing

XWiki executes a lot of automated tests during its build, testing all supported configurations. In addition, some manual QA is also executed to try to discover additional problems (see below):

Manual testing

Here is the list of browsers we support and how they have been manually tested for this release:

	Browser	Tested on:
	Mozilla Firefox 145	Jira Tickets Marked as Fixed in the Release Notes
	Google Chrome 142	Tests run and results
	Microsoft Edge 142
	Safari 18	Not Tested

Here is the list of databases we support and how they have been manually tested for this release:

	Database	Tested on:
	HyperSQL 2.7.4	Not Tested
	MariaDB 11.8	Tests run and results
	PostgreSQL 17
	MySQL 9.3	Not Tested
	Oracle 19c	Jira Tickets Marked as Fixed in the Release Notes

Here is the list of Servlet Containers we support and how they have been manually tested for this release:

	Servlet Container	Tested on:
	Tomcat 11.0.14	Jira Tickets Marked as Fixed in the Release Notes Tests run and results
	Jetty 12.1.4 (XWiki Standalone packaging)
	Jetty 12.1.4	Not Tested

Security Issues

Security issues are not listed in issue lists or dashboards to avoid disclosing ways to use them, but they will appear automatically in them once they're disclosed. See the XWiki Security Policy for more details.

Known issues

• Bugs we know about

Backward Compatibility and Migration Notes

General Notes

• When upgrading make sure you compare and merge the following XWiki configuration files since some parameters may have been modified, removed or added:
  • xwiki.cfg
  • xwiki.properties
  • web.xml
  • hibernate.cfg.xml
• Add xwiki.store.migration=1 in xwiki.cfg so that XWiki will attempt to automatically migrate your current database to any new schema. Make sure you backup your Database before doing anything.

Issues specific to XWiki 17.10.0-rc-1

Apache HttpClient 3 is not included in XWiki Standard anymore

Apache HttpClient 3 having an important vulnerability, it was removed from XWiki Standard 17.10.0-rc-1 and 17.4.8. This means that an extension that relies on the fact that it's there without declaring it as a dependency won't work anymore. Of course it's true also for any custom script that expects it to exist.

While it's technically easy to reinstall extension commons-httpclient:commons-httpclient (last version is 3.1), it's highly recommended to instead rewrite whatever code which needed it to use another library (like HttpClient 5, for example).

Note that to fully remove that dependency, we also had to remove the com.xpn.xwiki.XWiki#getHttpClient API.

Possible change in the wiki on which a REST request is authenticated

Starting with 17.10.0-rc-1, REST requests are authenticated on the wiki indicated in the path when using the format /rest/wikis/<wikiid>/. It used to be authenticated based on the wiki matching the domain (so always the main wiki in the case of path-based multiwiki).

The webjar-node handler is now using pnpm

The webjar-node Handler, introduced in 17.5.0 is now using pnpm instead of npm. All the packages using this handler in xwiki-platform have been migrated.

If you are using this handler in a contrib extension, the main change is to remove the package-lock.json located in src/main/node and to produce a pnpm-lock.yml instead by running pnpm install in the directory.

Removal of withTip and useTitleAsTip CSS class behaviour

Two CSS classes were defined in the past for working around Internet Explorer limitations regarding values in form inputs: withTip and useTitleAsTip. However it was advised to not rely on those CSS class anymore and to rely on placeholder input attribute only. We now removed the support of those CSS classes in XWiki.

API Breakages

The following APIs were modified since XWiki 17.9.0:

Real breakages

Real backward compatibility breakages that we have unwillingly accepted to do for the reasons mentioned in each violation below.

• Expose a vulnerable and long dead library, and should have never been public in the first place
  • Violation type:

    java.method.removed

  • Code:

    ## Old:
    method org.apache.commons.httpclient.HttpClient com.xpn.xwiki.XWiki::getHttpClient(int, java.lang.String)

Credits

The following people have contributed code and translations to this release (sorted alphabetically):

• Alex Cotiugă 
• Cédric LAMBLIN 
• Farcasut 
• Josue-T 
• LucasC 
• Manuel Leduc 
• Marius Dumitru Florea 
• Michael Hamann 
• Simon Urli 
• Simpel 
• Thomas Mortagne 
• Vincent Massol 
• xrichard