This is the release notes for XWiki Commons, XWiki Rendering and XWiki Platform. They share the same release notes as they are released together and have the same version.

This release introduces a new edition mode for Live Data, as well as a new link insertion dialog for the Blocknote editor. This release contains security fixes, with the highest severity being 8.7/10.

New and Noteworthy (since XWiki 18.6.0)

Full list of issues fixed and Dashboard for 18.7.0.

For Users

Edit mode and row creation support for Live Data

 
Live Data now offer a new "Edit Mode", that can be enabled in Live Data instances using a livetable source with the parameter hasEditMode set to true.

This mode offers support for bulk edition of Live Data content (including keyboard navigation), and also the ability to create new rows (which requires also setting the livetable source parameters newRowLocation and newRowNamingStrategy).

Please note that this feature is still experimental and the user experience will be improved in future releases.

New link insertion/edition UI

 
Links insertion and edition now use the new UI, which adapts automatically to the design system. This new UI also exposes new options, such as creating links to email addresses.

New layout for LiveData card view

 
Live Data Card View now has a new content layout with all fields and descriptions aligning to the left.

Improved contrast on background for the quick actions hint in the editor

 
Made it italic so that it could still be identifiable easily as different from regular text content. More about the quick actions.

For Admins

• Non-existing documents are not showed in the Recently visited documents panel: The recently visited panel now checks if a document exists before displaying it.

For Developers

Reproducible builds

 
XWiki's Maven build is now configured to produce reproducible artifacts by setting project.build.outputTimestamp to the time of the release. This means that for most release artifacts, it should be possible now to obtain byte-identical versions by rebuilding the sources. This also affects all extensions with a parent version of at least 18.7.0. Extensions can explicitly set their own timestamp to override the fixed timestamp of the parent when desired, or set it to a value like "X" to explicitly disable reproducible builds if it should cause any issues. We have also fixed several modules that were not reproducible before. We're aware that some class files in many legacy modules (those are included in the released WAR) still contain absolute paths of the build environment, and the WAR, XIP and Debian packaging as well as the pre-installed demo distribution are also not reproducible for additional reasons. You can track XWIKI-24698 for the progress towards a fully reproducible build.

LiveTable New Row Naming Strategy

 
When creating a new row for a Live Data using a livetable source, the XWiki instance needs to create a new document. Naming this new document automatically requires a naming strategy, which can be customized by implementing a new LiveTableNewRowNamingStrategy.

Design System CSS Variables

 
The Flamingo Design System now declares the CSS variables of the Abstract Design System, deriving them from the style variables of the skin. Code styled with them follows the Color Theme, and stays portable to the other implementations of the Design System.

Miscellaneous

• New random string APIs in $stringtool: The $stringtool velocity tool now provides a new API allowing to create secure random Strings, by reusing RandomStringUtils API:

  public String nextAlphanumeric(final int count)

• UserAuthenticatedEventNotifier: A new UserAuthenticatedEventNotifier component has been introduced to make easier to send notifications about newly authenticated users. It's especially important for custom authenticators which support older versions of XWiki, for which the component is provided as part of User Authenticated Event Backport.

Upgrades

The following runtime dependencies have been upgraded (they have a different release cycle than XWiki Commons, XWiki Rendering and XWiki Platform):

Translations

The following translations have been updated: 

• German
• French
• Ukrainian

Security Issues

Security issues are not listed in issue lists or dashboards to avoid disclosing ways to use them, but they will appear automatically in them once they're disclosed. See the XWiki Security Policy for more details.

Known issues

• Bugs we know about

Backward Compatibility and Migration Notes

General Notes

• When upgrading make sure you compare and merge the following XWiki configuration files since some parameters may have been modified, removed or added:
  • xwiki.cfg
  • xwiki.properties
  • web.xml
  • hibernate.cfg.xml
• Add xwiki.store.migration=1 in xwiki.cfg so that XWiki will attempt to automatically migrate your current database to any new schema. Make sure you backup your Database before doing anything.

Issues specific to XWiki 18.7.0-rc-1

UserAuthenticatedEvent event matching change

The constructor of org.xwiki.security.authentication.UserAuthenticatedEvent which takes a UserReference used to match any UserAuthenticatedEvent. It's now only matching events related to that specific user, unless the reference is null (which still mean "any user", like the new constructor without any parameter).

API Breakages

The following APIs were modified since XWiki 18.6.0:

Real breakages

Real backward compatibility breakages that we have unwillingly accepted to do for the reasons mentioned in each violation below.

• These utility classes (only static members) had their implicit public constructor made private to follow SonarQube rule java:S1118 (utility classes should not be instantiable). Instantiating them was never useful, but this is technically a real breakage since existing code calling the constructor will fail at runtime.
  • Violation type:

    java.method.visibilityReduced

  • Code:

    ## Old:
    method void com.xpn.xwiki.XWikiConstant::<init>()
    
    ## New:
    method void com.xpn.xwiki.XWikiConstant::<init>()

• These utility classes (only static members) had their implicit public constructor made private to follow SonarQube rule java:S1118 (utility classes should not be instantiable). Instantiating them was never useful, but this is technically a real breakage since existing code calling the constructor will fail at runtime.
  • Violation type:

    java.method.visibilityReduced

  • Code:

    ## Old:
    method void com.xpn.xwiki.i18n.i18n::<init>()
    
    ## New:
    method void com.xpn.xwiki.i18n.i18n::<init>()

• These utility classes (only static members) had their implicit public constructor made private to follow SonarQube rule java:S1118 (utility classes should not be instantiable). Instantiating them was never useful, but this is technically a real breakage since existing code calling the constructor will fail at runtime.
  • Violation type:

    java.method.visibilityReduced

  • Code:

    ## Old:
    method void com.xpn.xwiki.util.TOCGenerator::<init>()
    
    ## New:
    method void com.xpn.xwiki.util.TOCGenerator::<init>()

• These utility classes (only static members) had their implicit public constructor made private to follow SonarQube rule java:S1118 (utility classes should not be instantiable). Instantiating them was never useful, but this is technically a real breakage since existing code calling the constructor will fail at runtime.
  • Violation type:

    java.method.visibilityReduced

  • Code:

    ## Old:
    method void com.xpn.xwiki.web.Utils::<init>()
    
    ## New:
    method void com.xpn.xwiki.web.Utils::<init>()

Credits

The following people have contributed code to this release (sorted alphabetically):

• Alex Cotiugă
• Aly Serry
• Andi Chandler
• Andreas Jonsson
• Christian Fröhlich
• ClementEXWiki
• Clément Aubin
• DenisF
• Dobromił Peszko
• Farcasut
• Francisco García Moreno
• Gianmarco
• Guilherme Sautner
• hongsikum
• Jan Prokop
• Jarle Sandmo
• Jiadong Feng
• Kimi Code
• LucasC
• Manuel Leduc
• Mariana Batista
• Marius Dumitru Florea
• Michael Hamann
• michitux
• Nikita Petrenko
• ParkHK
• Pierre Jeanjean
• Santiago W. Fernández Lorenzo
• Simon Urli
• Simpel
• stoyanK7
• Suguru Hirahara
• Thiago Krieck
• Thomas Mortagne
• u74a8 zhou
• Valdis Vitolins
• Vincent Massol
• xrichard
• 一颗小土豆