This is the release notes for XWiki Commons, XWiki Rendering and XWiki Platform. They share the same release notes as they are released together and have the same version.

This is a bug fix release. It also contains security fixes, with the highest severity being 9.3/10.

New and Noteworthy (since XWiki 17.10.13)

You can view the list of issues in our tracker to be able to filter or sort it by following this link.

Upgrades

The following runtime dependencies have been upgraded (they have a different release cycle than XWiki Commons, XWiki Rendering and XWiki Platform):

Translations

The following translations have been updated: 

• German
• English (British)
• French

Tested Browsers & Databases

Automated Testing

XWiki executes a lot of automated tests during its build, testing all supported configurations.

Security Issues

Security issues are not listed in issue lists or dashboards to avoid disclosing ways to use them, but they will appear automatically in them once they're disclosed. See the XWiki Security Policy for more details.

Known issues

• Bugs we know about

Backward Compatibility and Migration Notes

General Notes

• When upgrading make sure you compare and merge the following XWiki configuration files since some parameters may have been modified, removed or added:
  • xwiki.cfg
  • xwiki.properties
  • web.xml
  • hibernate.cfg.xml
• Add xwiki.store.migration=1 in xwiki.cfg so that XWiki will attempt to automatically migrate your current database to any new schema. Make sure you backup your Database before doing anything.

Issues specific to XWiki 17.10.14

Change in password format

The passwords handled by PasswordClass in XWiki (so including standard XWiki users passwords as well as any XClass password property) used to be stored following the format: hash:<algorithmName>:<salt>:<hash>. This format is no longer used in XWiki and has been replaced by the more standard format: {algorithmKey}<encodedHash>, where the format of the hash itself depends on the algorithm and contains information about the salt etc. For more information check the PasswordClass documentation.

Migration of passwords

The security of algorithms used for hashing passwords has been reinforced as part of this release. As a result, we're automatically performing a re-hash operations of all passwords during a migration: this operation doesn't perform any reset of the passwords, so they can still be used properly.

API Breakages

The following APIs were modified since XWiki 17.10.13:

Real breakages

Real backward compatibility breakages that we have unwillingly accepted to do for the reasons mentioned in each violation below.

• The removed methods were not implemented nor used. As for setxWikiClass the implementation was expecting already a PropertyMetaClass and not using it would cause errors.
  • Violation type:

    java.method.removed

  • Code:

    ## Old:
    method void com.xpn.xwiki.objects.classes.PropertyClass::initLazyCollections()

• The removed methods were not implemented nor used. As for setxWikiClass the implementation was expecting already a PropertyMetaClass and not using it would cause errors.
  • Violation type:

    java.method.removed

  • Code:

    ## Old:
    method boolean com.xpn.xwiki.objects.classes.PropertyClass::isValidColumnTypes(org.hibernate.mapping.Property)

• We changed the default algorithm for PasswordClass hash computation for something more robust and we also changed the format of the hash for better handling in the future.
  • Violation type:

    java.field.constantValueChanged

  • Code:

    ## Old:
    field com.xpn.xwiki.objects.classes.PasswordClass.DEFAULT_HASH_ALGORITHM
    
    ## New:
    field com.xpn.xwiki.objects.classes.PasswordClass.DEFAULT_HASH_ALGORITHM

• We changed the default algorithm for PasswordClass hash computation for something more robust and we also changed the format of the hash for better handling in the future.
  • Violation type:

    java.method.removed

  • Code:

    ## Old:
    method java.lang.String com.xpn.xwiki.objects.classes.PasswordClass::getPasswordHash(java.lang.String, java.lang.String, java.lang.String)

• We changed the default algorithm for PasswordClass hash computation for something more robust and we also changed the format of the hash for better handling in the future.
  • Violation type:

    java.method.removed

  • Code:

    ## Old:
    method java.lang.String com.xpn.xwiki.objects.classes.PasswordClass::getSaltFromPassword(java.lang.String)

• We changed the default algorithm for PasswordClass hash computation for something more robust and we also changed the format of the hash for better handling in the future.
  • Violation type:

    java.method.removed

  • Code:

    ## Old:
    method java.lang.String com.xpn.xwiki.objects.classes.PasswordClass::randomSalt()

Credits

• Andi Chandler
• ciaens
• Claude Opus 4.8/5/5.5
• LucasC
• Manuel Leduc
• Marius Dumitru Florea
• Michael Hamann
• Raphael
• Simon Urli
• Simpel
• Thomas Mortagne
• Vincent Massol