Skip to Content
Last modified by Lucas Charpentier on 2026/10/15 16:19
Show last authors
1 {{velocity}}
2 #if ($doc.getValue('released') != 1)
3 {{warning}}This version has not yet been released.{{/warning}}
4 #end
5 {{/velocity}}
6
7 {{velocity}}
8 #set ($rnObject = $doc.getObject('ReleaseNotes.Code.ReleaseNoteClass'))
9 #set ($product = $rnObject.product)
10 #set ($version = $rnObject.version)
11 #set ($versionPrefix = $stringtool.substringBefore($version, '-'))
12 #set ($versionParts = $stringtool.split($versionPrefix, '.'))
13 #set ($isRC = $version.contains('rc'))
14 #set ($isFinal = !$isRC)
15 #set ($isFirstFinal = $isFinal && ($versionParts.size() == 2 || $versionParts[2] == 0))
16 #set ($isBugFix = $isFinal && $versionParts.size() == 3 && $versionParts[2] > 0)
17 {{/velocity}}
18
19 {{box cssClass="floatinginfobox" title="**Contents**"}}
20 {{toc/}}
21 {{/box}}
22
23 This is the release notes for [[XWiki Commons>>http://commons.xwiki.org]], [[XWiki Rendering>>http://rendering.xwiki.org]] and [[XWiki Platform>>http://platform.xwiki.org]]. They share the same release notes as they are released together and have the same version.
24
25 <insert description of release here>
26
27 {{velocity}}
28 {{jiraBlockersFor version="$version" id="xwikiorg"/}}
29 {{/velocity}}
30
31 = New and Noteworthy (since {{velocity}}$product{{/velocity}} <version - 1>) =
32
33 [[Full list of issues fixed and Dashboard for <final version here even for RC, e.g. 10.5~>>>https://jira.xwiki.org/secure/Dashboard.jspa?selectPageId=<fill id here>]].
34
35 {{velocity}}
36 #if ($isBugFix)
37 {{jira style="list" url="https://jira.xwiki.org" fields="type, status, key, summary" source="jql"}}
38 resolution in (Fixed, "Solved By") AND component != "Development Issues only" AND component != "Development Issues only - Test" AND component != "Dependency Upgrades" AND project in (XCOMMONS, XRENDERING, XWIKI) AND fixVersion in ($version)
39 {{/jira}}
40 #else
41 {{releasenotechanges/}}
42 #end
43 {{/velocity}}
44
45 = Upgrades =
46
47 The following runtime dependencies have been upgraded (they have a different release cycle than [[XWiki Commons>>http://commons.xwiki.org]], [[XWiki Rendering>>http://rendering.xwiki.org]] and [[XWiki Platform>>http://platform.xwiki.org]]):
48
49 {{velocity}}
50 #if ($isFirstFinal)
51 #set ($affectedVersions = "${version}-rc-1, ${version}")
52 #else
53 #set ($affectedVersions = "${version}")
54 #end
55 {{jira url="https://jira.xwiki.org" source="jql" style="list"}}
56 project in (XWIKI, XCOMMONS, XRENDERING) AND issuetype = Task AND fixVersion in ($affectedVersions) AND component = "Dependency Upgrades" ORDER BY summary
57 {{/jira}}
58 {{/velocity}}
59
60 = Moved Modules =
61
62 <description deprecated, retired and moved projects>
63
64 = Translations =
65
66 The following translations have been updated:
67
68 {{language codes="none, none"/}}
69
70 = Tested Browsers & Databases =
71
72 == Automated Testing ==
73
74 XWiki executes a lot of [[automated tests during its build>>dev:Community.Testing.WebHome||anchor="HTestingStrategy"]], testing all [[supported configurations>>dev:Community.SupportStrategy.WebHome]].
75
76 {{comment}}
77 TODO: uncomment and update with proper link when the report is ready.
78 == Manual Testing ==
79
80 Manual QA is also executed to try to discover additional problems:
81
82 {{include reference="TestReports.<test report page>"/}}
83 {{/comment}}
84
85 {{comment}}
86 TODO: uncomment and update with proper links when the report is ready.
87
88 = Performances tests compared to <last super stable version> =
89
90 {{display reference="test:Performances.Jetty HSQLDB single wiki xxx to yyy" section="HSummary"/}}
91
92 More details on [[performance comparison on single wiki between x.x and y.y>>test:Performances.Jetty HSQLDB single wiki xxx to yyy]].
93 {{/comment}}
94
95 = Security Issues =
96
97 Security issues are not listed in issue lists or dashboards to avoid disclosing ways to use them, but they will appear automatically in them once they're disclosed. See the [[XWiki Security Policy>>dev:Community.SecurityPolicy.WebHome]] for more details.
98
99 = Known issues =
100
101 * [[Bugs we know about>>https://jira.xwiki.org/issues/?jql=category%20%3D%2010000%20AND%20issuetype%20%3D%20Bug%20AND%20resolution%20%3D%20Unresolved%20ORDER%20BY%20updated%20DESC]]
102
103 = Backward Compatibility and Migration Notes =
104
105 == General Notes ==
106
107 * When upgrading make sure you compare and merge the following XWiki configuration files since some parameters may have been modified, removed or added:
108 ** ##xwiki.cfg##
109 ** ##xwiki.properties##
110 ** ##web.xml##
111 ** ##hibernate.cfg.xml##
112 * Add ##xwiki.store.migration=1## in ##xwiki.cfg## so that XWiki will attempt to automatically migrate your current database to any new schema. Make sure you backup your Database before doing anything.
113
114 == Issues specific to {{velocity}}$product $version{{/velocity}} ==
115
116 === Prototype.js String#stripTags() and String#unescapeHTML() removed ===
117
118 For security reasons, XWiki no longer lets [[Prototype.js>>https://github.com/prototypejs/prototype]] add the ##stripTags()## and ##unescapeHTML()## methods to JavaScript strings: Prototype.js' ##stripTags()##, which ##unescapeHTML()## calls, is vulnerable to a regular expression denial of service ([[CVE-2020-27511>>https://nvd.nist.gov/vuln/detail/CVE-2020-27511]]), and there is no fixed Prototype.js version. XWiki itself doesn't use these methods, but JavaScript code (e.g. from extensions) that still calls them now fails with ##TypeError: ... is not a function##. This also affects the ##Autocompleter## and ##InPlaceEditor## of Script.aculo.us' ##controls.js##, which XWiki doesn't load itself.
119
120 To fix such code, stop calling these methods. To get the text of an HTML string without its tags, parse it with ##DOMParser## and read the ##textContent## of the result. The other string methods added by Prototype.js, such as ##escapeHTML()##, are still available.
121
122 === CSRF tokens can no longer be cleared ===
123
124 The [[CSRF token>>doc:extensions:Extension.XWiki Platform - CSRF.WebHome||anchor="HTokenlifetime"]] of a user is now derived from the authentication validation key, the user and the current time period instead of being stored, so it cannot be cleared anymore: ##CSRFToken#clearToken()## and ##$services.csrf.clearToken()## are deprecated and do nothing. Code calling them to invalidate the token of the current user should stop relying on it: the token now only changes when its lifetime (##csrf.tokenLifetime## in ##xwiki.properties##) expires or when the validation key changes.
125
126 === Export URLs require a POST request ===
127
128 The export action now performs an export only for a POST request. Opening an export URL in a browser shows a "Confirm the Export" page from which the export is resubmitted, and a script calling the export action (a ##curl## or ##wget## backup, for instance) has to send a POST request instead of a GET one. An export format added through the ##org.xwiki.platform.template.exportFormats## UI extension point whose URL targets the export action has to declare ##method=post##.
129
130 == API Breakages ==
131
132 The following APIs were modified since {{velocity}}$product{{/velocity}} <version - 1>:
133
134 {{comment}}
135 Remove!
136 {{velocity}}
137 {{backwardCompatibilityReport134 version="$version"/}}
138 {{/velocity}}
139 {{/comment}}
140
141 = Credits =
142
143 {{releasenotecontributors/}}

About

About

Support

Platform

User Guide

Admin Guide

Developer Guide

Projects

XWiki

Extensions

Other

Contribute

Status

Practices

Under the Hood

Get Involved

Get Connected