Wiki source code of Release Notes for XWiki 18.9.0
Last modified by Marius Dumitru Florea on 2026/10/26 18:24
Show last authors
| author | version | line-number | content |
|---|---|---|---|
| 1 | {{velocity}} | ||
| 2 | #if ($doc.getValue('released') != 1) | ||
| 3 | {{warning}}This version has not yet been released.{{/warning}} | ||
| 4 | #end | ||
| 5 | {{/velocity}} | ||
| 6 | |||
| 7 | {{velocity}} | ||
| 8 | #set ($rnObject = $doc.getObject('ReleaseNotes.Code.ReleaseNoteClass')) | ||
| 9 | #set ($product = $rnObject.product) | ||
| 10 | #set ($version = $rnObject.version) | ||
| 11 | #set ($versionPrefix = $stringtool.substringBefore($version, '-')) | ||
| 12 | #set ($versionParts = $stringtool.split($versionPrefix, '.')) | ||
| 13 | #set ($isRC = $version.contains('rc')) | ||
| 14 | #set ($isFinal = !$isRC) | ||
| 15 | #set ($isFirstFinal = $isFinal && ($versionParts.size() == 2 || $versionParts[2] == 0)) | ||
| 16 | #set ($isBugFix = $isFinal && $versionParts.size() == 3 && $versionParts[2] > 0) | ||
| 17 | {{/velocity}} | ||
| 18 | |||
| 19 | {{box cssClass="floatinginfobox" title="**Contents**"}} | ||
| 20 | {{toc/}} | ||
| 21 | {{/box}} | ||
| 22 | |||
| 23 | This is the release notes for [[XWiki Commons>>http://commons.xwiki.org]], [[XWiki Rendering>>http://rendering.xwiki.org]] and [[XWiki Platform>>http://platform.xwiki.org]]. They share the same release notes as they are released together and have the same version. | ||
| 24 | |||
| 25 | This release brings several Live Data improvements: new entries are saved automatically, entries keep their positions while being edited, and edit mode is now turned on and off with a dedicated button. The experimental BlockNote editor now lets you edit Code macros in place, as code blocks, and shows the same realtime edit actions as the WYSIWYG editor. In addition, following a link to an export, such as a bookmarked export URL, now asks you to confirm the export instead of starting it right away. For developers, there are new Velocity macros to pick one or more locations, a way for extensions to add or replace export formats, new Live Data APIs to fetch and delete single entries, and plain CSS skin customizations. This release contains security fixes, with the [[highest severity being 9.3/10>>doc:dev:Community.SecurityPolicy.WebHome||anchor="HSeverity"]]. | ||
| 26 | |||
| 27 | {{velocity}} | ||
| 28 | {{jiraBlockersFor version="$version" id="xwikiorg"/}} | ||
| 29 | {{/velocity}} | ||
| 30 | |||
| 31 | = New and Noteworthy (since {{velocity}}$product{{/velocity}} 18.8.0) = | ||
| 32 | |||
| 33 | [[Full list of issues fixed and Dashboard for 18.9.0>>https://jira.xwiki.org/secure/Dashboard.jspa?selectPageId=16890]]. | ||
| 34 | |||
| 35 | {{velocity}} | ||
| 36 | #if ($isBugFix) | ||
| 37 | {{jira style="list" url="https://jira.xwiki.org" fields="type, key, summary" source="jql"}} | ||
| 38 | resolution in (Fixed, "Solved By") AND component != "Development Issues only" AND component != "Development Issues only - Test" AND component != "Dependency Upgrades" AND project in (XCOMMONS, XRENDERING, XWIKI) AND fixVersion in ($version) | ||
| 39 | {{/jira}} | ||
| 40 | #else | ||
| 41 | {{releasenotechanges/}} | ||
| 42 | #end | ||
| 43 | {{/velocity}} | ||
| 44 | |||
| 45 | = Upgrades = | ||
| 46 | |||
| 47 | The following runtime dependencies have been upgraded (they have a different release cycle than [[XWiki Commons>>http://commons.xwiki.org]], [[XWiki Rendering>>http://rendering.xwiki.org]] and [[XWiki Platform>>http://platform.xwiki.org]]): | ||
| 48 | |||
| 49 | {{velocity}} | ||
| 50 | #if ($isFirstFinal) | ||
| 51 | #set ($affectedVersions = "${version}-rc-1, ${version}") | ||
| 52 | #else | ||
| 53 | #set ($affectedVersions = "${version}") | ||
| 54 | #end | ||
| 55 | {{jira url="https://jira.xwiki.org" fields="key, summary" source="jql" style="list"}} | ||
| 56 | project in (XWIKI, XCOMMONS, XRENDERING) AND issuetype = Task AND fixVersion in ($affectedVersions) AND component = "Dependency Upgrades" ORDER BY summary | ||
| 57 | {{/jira}} | ||
| 58 | {{/velocity}} | ||
| 59 | |||
| 60 | = Translations = | ||
| 61 | |||
| 62 | The following translations have been updated: | ||
| 63 | |||
| 64 | {{language codes="de, fr"/}} | ||
| 65 | |||
| 66 | = Tested Browsers & Databases = | ||
| 67 | |||
| 68 | == Automated Testing == | ||
| 69 | |||
| 70 | XWiki executes a lot of [[automated tests during its build>>dev:Community.Testing.WebHome||anchor="HTestingStrategy"]], testing all [[supported configurations>>dev:Community.SupportStrategy.WebHome]]. | ||
| 71 | |||
| 72 | {{comment}} | ||
| 73 | TODO: uncomment and update with proper link when the report is ready. | ||
| 74 | == Manual Testing == | ||
| 75 | |||
| 76 | Manual QA is also executed to try to discover additional problems: | ||
| 77 | |||
| 78 | {{include reference="TestReports.<test report page>"/}} | ||
| 79 | {{/comment}} | ||
| 80 | |||
| 81 | {{comment}} | ||
| 82 | TODO: uncomment and update with proper links when the report is ready. | ||
| 83 | |||
| 84 | = Performances tests compared to <last super stable version> = | ||
| 85 | |||
| 86 | {{display reference="test:Performances.Jetty HSQLDB single wiki xxx to yyy" section="HSummary"/}} | ||
| 87 | |||
| 88 | More details on [[performance comparison on single wiki between x.x and y.y>>test:Performances.Jetty HSQLDB single wiki xxx to yyy]]. | ||
| 89 | {{/comment}} | ||
| 90 | |||
| 91 | = Security Issues = | ||
| 92 | |||
| 93 | Security issues are not listed in issue lists or dashboards to avoid disclosing ways to use them, but they will appear automatically in them once they're disclosed. See the [[XWiki Security Policy>>dev:Community.SecurityPolicy.WebHome]] for more details. | ||
| 94 | |||
| 95 | = Known issues = | ||
| 96 | |||
| 97 | * [[Bugs we know about>>https://jira.xwiki.org/issues/?jql=category%20%3D%2010000%20AND%20issuetype%20%3D%20Bug%20AND%20resolution%20%3D%20Unresolved%20ORDER%20BY%20updated%20DESC]] | ||
| 98 | |||
| 99 | = Backward Compatibility and Migration Notes = | ||
| 100 | |||
| 101 | == General Notes == | ||
| 102 | |||
| 103 | * When upgrading make sure you compare and merge the following XWiki configuration files since some parameters may have been modified, removed or added: | ||
| 104 | ** ##xwiki.cfg## | ||
| 105 | ** ##xwiki.properties## | ||
| 106 | ** ##web.xml## | ||
| 107 | ** ##hibernate.cfg.xml## | ||
| 108 | * Add ##xwiki.store.migration=1## in ##xwiki.cfg## so that XWiki will attempt to automatically migrate your current database to any new schema. Make sure you backup your Database before doing anything. | ||
| 109 | |||
| 110 | == Issues specific to {{velocity}}$product $version{{/velocity}} == | ||
| 111 | |||
| 112 | === Prototype.js String#stripTags() and String#unescapeHTML() removed === | ||
| 113 | |||
| 114 | For security reasons, XWiki no longer lets [[Prototype.js>>https://github.com/prototypejs/prototype]] add the ##stripTags()## and ##unescapeHTML()## methods to JavaScript strings: Prototype.js' ##stripTags()##, which ##unescapeHTML()## calls, is vulnerable to a regular expression denial of service ([[CVE-2020-27511>>https://nvd.nist.gov/vuln/detail/CVE-2020-27511]]), and there is no fixed Prototype.js version. XWiki itself doesn't use these methods, but JavaScript code (e.g. from extensions) that still calls them now fails with ##TypeError: ... is not a function##. This also affects the ##Autocompleter## and ##InPlaceEditor## of Script.aculo.us' ##controls.js##, which XWiki doesn't load itself. | ||
| 115 | |||
| 116 | To fix such code, stop calling these methods. To get the text of an HTML string without its tags, parse it with ##DOMParser## and read the ##textContent## of the result. The other string methods added by Prototype.js, such as ##escapeHTML()##, are still available. | ||
| 117 | |||
| 118 | === CSRF tokens can no longer be cleared === | ||
| 119 | |||
| 120 | The [[CSRF token>>doc:extensions:Extension.XWiki Platform - CSRF.WebHome||anchor="HTokenlifetime"]] of a user is now derived from the authentication validation key, the user and the current time period instead of being stored, so it cannot be cleared anymore: ##CSRFToken#clearToken()## and ##$services.csrf.clearToken()## are deprecated and do nothing. Code calling them to invalidate the token of the current user should stop relying on it: the token now only changes when its lifetime (##csrf.tokenLifetime## in ##xwiki.properties##) expires or when the validation key changes. | ||
| 121 | |||
| 122 | === Export URLs require a POST request === | ||
| 123 | |||
| 124 | The export action now performs an export only for a POST request. Opening an export URL in a browser shows a "Confirm the Export" page from which the export is resubmitted, and a script calling the export action (a ##curl## or ##wget## backup, for instance) has to send a POST request instead of a GET one. An export format added through the ##org.xwiki.platform.template.exportFormats## UI extension point whose URL targets the export action has to declare ##method=post##. | ||
| 125 | |||
| 126 | == API Breakages == | ||
| 127 | |||
| 128 | The following APIs were modified since {{velocity}}$product{{/velocity}} 18.8.0: | ||
| 129 | |||
| 130 | {{velocity}} | ||
| 131 | {{backwardCompatibilityReport134 version="$version"/}} | ||
| 132 | {{/velocity}} | ||
| 133 | |||
| 134 | = Credits = | ||
| 135 | |||
| 136 | {{releasenotecontributors/}} |
