This is the release notes for XWiki Commons, XWiki Rendering and XWiki Platform. They share the same release notes as they are released together and have the same version.

This is a bug fix release. It also contains security fixes, with the highest severity being 9.3/10.

New and Noteworthy (since XWiki 17.10.13)

You can view the list of issues in our tracker to be able to filter or sort it by following this link.

Upgrades

The following runtime dependencies have been upgraded (they have a different release cycle than XWiki Commons, XWiki Rendering and XWiki Platform):

Translations

The following translations have been updated: 

• German
• English (British)
• French

Tested Browsers & Databases

Automated Testing

XWiki executes a lot of automated tests during its build, testing all supported configurations.

Manual Testing

Manual QA is also executed to try to discover additional problems:

Here is the list of browsers we support and how they have been manually tested for this release:

	Browser	Tested on:
	Mozilla Firefox 157	Jira Tickets Marked as Fixed in the Release Notes
	Google Chrome 155	Tests run and results
	Microsoft Edge 155
	Safari 26	Not Tested

Here is the list of databases we support and how they have been manually tested for this release:

	Database	Tested on:
	HyperSQL 2.7.4	Not Tested
	PostgreSQL 17	Jira Tickets Marked as Fixed in the Release Notes
	MariaDB 12.3	Tests run and results
	MySQL 9.7
	Oracle 19c	Not Tested

Here is the list of Servlet Containers we support and how they have been manually tested for this release:

	Servlet Container	Tested on:
	Tomcat 11.0.26	Jira Tickets Marked as Fixed in the Release Notes Tests run and results
	Jetty 12.1.11 (XWiki Standalone packaging)
	Jetty 12.1.11	Not Tested

NOTE: This XWki version has been manually tested by the QA and has been validated.

Security Issues

Security issues are not listed in issue lists or dashboards to avoid disclosing ways to use them, but they will appear automatically in them once they're disclosed. See the XWiki Security Policy for more details.

Known issues

• Bugs we know about

Backward Compatibility and Migration Notes

General Notes

• When upgrading make sure you compare and merge the following XWiki configuration files since some parameters may have been modified, removed or added:
  • xwiki.cfg
  • xwiki.properties
  • web.xml
  • hibernate.cfg.xml
• Add xwiki.store.migration=1 in xwiki.cfg so that XWiki will attempt to automatically migrate your current database to any new schema. Make sure you backup your Database before doing anything.

Issues specific to XWiki 17.10.14

Change in password format

The passwords handled by PasswordClass in XWiki (so including standard XWiki users passwords as well as any XClass password property) used to be stored following the format: hash:<algorithmName>:<salt>:<hash>. This format is no longer used in XWiki and has been replaced by the more standard format: {algorithmKey}<encodedHash>, where the format of the hash itself depends on the algorithm and contains information about the salt etc. For more information check the PasswordClass documentation.

Migration of passwords

The security of algorithms used for hashing passwords has been reinforced as part of this release. As a result, we're automatically performing a re-hash operations of all passwords during a migration: this operation doesn't perform any reset of the passwords, so they can still be used properly.

API Breakages

The following APIs were modified since XWiki 17.10.13:

Real breakages

Real backward compatibility breakages that we have unwillingly accepted to do for the reasons mentioned in each violation below.

• The removed methods were not implemented nor used. As for setxWikiClass the implementation was expecting already a PropertyMetaClass and not using it would cause errors.
  • Violation type:

    java.method.removed

  • Code:

    ## Old:
    method void com.xpn.xwiki.objects.classes.PropertyClass::initLazyCollections()

• The removed methods were not implemented nor used. As for setxWikiClass the implementation was expecting already a PropertyMetaClass and not using it would cause errors.
  • Violation type:

    java.method.removed

  • Code:

    ## Old:
    method boolean com.xpn.xwiki.objects.classes.PropertyClass::isValidColumnTypes(org.hibernate.mapping.Property)

• We changed the default algorithm for PasswordClass hash computation for something more robust and we also changed the format of the hash for better handling in the future.
  • Violation type:

    java.field.constantValueChanged

  • Code:

    ## Old:
    field com.xpn.xwiki.objects.classes.PasswordClass.DEFAULT_HASH_ALGORITHM
    
    ## New:
    field com.xpn.xwiki.objects.classes.PasswordClass.DEFAULT_HASH_ALGORITHM

• We changed the default algorithm for PasswordClass hash computation for something more robust and we also changed the format of the hash for better handling in the future.
  • Violation type:

    java.method.removed

  • Code:

    ## Old:
    method java.lang.String com.xpn.xwiki.objects.classes.PasswordClass::getPasswordHash(java.lang.String, java.lang.String, java.lang.String)

• We changed the default algorithm for PasswordClass hash computation for something more robust and we also changed the format of the hash for better handling in the future.
  • Violation type:

    java.method.removed

  • Code:

    ## Old:
    method java.lang.String com.xpn.xwiki.objects.classes.PasswordClass::getSaltFromPassword(java.lang.String)

• We changed the default algorithm for PasswordClass hash computation for something more robust and we also changed the format of the hash for better handling in the future.
  • Violation type:

    java.method.removed

  • Code:

    ## Old:
    method java.lang.String com.xpn.xwiki.objects.classes.PasswordClass::randomSalt()

Credits

• Andi Chandler
• ciaens
• Claude Opus 4.8/5/5.5
• LucasC
• Manuel Leduc
• Marius Dumitru Florea
• Michael Hamann
• Raphael
• Simon Urli
• Simpel
• Thomas Mortagne
• Vincent Massol