This is the release notes for XWiki Commons, XWiki Rendering and XWiki Platform. They share the same release notes as they are released together and have the same version.

This release brings performance improvements for icons, more control over the sorting in document trees. You will also be able to install and test a new (still very experimental) BlockNote-based WYSIWYG editor, and developers will benefit from a new, also still experimental, endpoint to help implementing Yjs-based real-time collaboration. This release contains security fixes, with the highest severity being 8.7/10.

New and Noteworthy (since XWiki 17.5.0)

Full list of issues fixed and Dashboard for 17.6.0.

For Users

• Faster loading of icons:

  We've made rendering icons faster, leading to slightly improved loading times of all pages and significantly improved loading times of UIs that involve lots of icons like the quick action for inserting icons in the editor.

For Admins

New BlockNote WYSIWYG editor

A new experimental BlockNote based editor has been introduced. You can try it by installing the BlockNote Integration (Experimental) extension, which will add two new editors (if you are "Advanced" in your user profile preferences).

Miscellaneous

• Sorting behavior of document trees can be configured:

  The ordering of special characters in document trees like the navigation panel can be configured to control how different kinds of characters like accented characters are sorted. This makes it possible to, e.g., sort "Ä" directly after "A" instead of after "Z".

• VirtualMachineError always logged:

  Any log with a VirtualMachineError (for example, OutOfMemoryError or StackOverflowError) are now forced to go through any job log filtering and will always end up in the main log. It's important to be able to catch them there, since they are very often death sentences for the instance.

For Developers

yjs websocket endpoint

A new Yjs WebSocket endpoint is now available. This WebSocket endpoint allows editors with Yjs-based real-time collaboration features (e.g., Blocknote, Tiptap) to use XWiki as the server to synchronize changes between editors.

Miscellaneous

• Override Default WYSIWYG Editor from Request:

  XWiki already supports configuring the default WYSIWYG editor from the dedicated administration section, but this affects all users. When testing an experimental editor it's better to overwrite the default WYSIWYG editor from request, i.e. for a single editing session. Starting with this version, you can use a request parameter like this to overwrite the WYSIWYG editor:

  <simpleTypeName>.<category>.editor

  For instance, for a WYSIWYG editor with hint "blocknote", registered for the data type "org.xwiki.rendering.syntax.SyntaxContent" and category "wysiwyg" you can use a URL like this to change the editor:

  ## Standalone edit mode
  /xwiki/bin/edit/Some/Page?editor=wysiwyg&SyntaxContent.wysiwyg.editor=blocknote
  
  ## Inplace edit mode
  /xwiki/bin/view/Some/Page?SyntaxContent.wysiwyg.editor=blocknote#edit

Upgrades

The following runtime dependencies have been upgraded (they have a different release cycle than XWiki Commons, XWiki Rendering and XWiki Platform):

Translations

The following translations have been updated: 

• German
• French
• Simplified Chinese

Tested Browsers & Databases

Automated testing

XWiki executes a lot of automated tests during its build, testing all supported configurations. In addition, some manual QA is also executed to try to discover additional problems (see below):

Manual testing

Here is the list of browsers we support and how they have been manually tested for this release:

	Browser	Tested on:
	Mozilla Firefox 143	Jira Tickets Marked as Fixed in the Release Notes
	Google Chrome 138	Not Tested
	Microsoft Edge 138	Not Tested
	Safari 18	Not Tested

Here is the list of databases we support and how they have been manually tested for this release:

	Database	Tested on:
	HyperSQL 2.7.4	Not Tested
	MariaDB 11.8	Jira Tickets Marked as Fixed in the Release Notes
	MySQL 9.3	Not Tested
	PostgreSQL 17	Not Tested
	Oracle 19c	Not Tested

Here is the list of Servlet Containers we support and how they have been manually tested for this release:

	Servlet Container	Tested on:
	Tomcat 11.0.9	Not Tested
	Jetty 12.0.22 (XWiki Standalone packaging)	Jira Tickets Marked as Fixed in the Release Notes
	Jetty 12.0.22	Not Tested

Security Issues

Security issues are not listed in issue lists or dashboards to avoid disclosing ways to use them, but they will appear automatically in them once they're disclosed. See the XWiki Security Policy for more details.

Known issues

• Bugs we know about

Backward Compatibility and Migration Notes

General Notes

• When upgrading make sure you compare and merge the following XWiki configuration files since some parameters may have been modified, removed or added:
  • xwiki.cfg
  • xwiki.properties
  • web.xml
  • hibernate.cfg.xml
• Add xwiki.store.migration=1 in xwiki.cfg so that XWiki will attempt to automatically migrate your current database to any new schema. Make sure you backup your Database before doing anything.

Issues specific to XWiki 17.6.0

Stop bundling Commons Lang 2.x

Commons Lang 2.x is not maintained anymore and has known security vulnerabilities which is why we decided to stop bundling it (as a core extension). XWiki extensions that use Commons Lang 2.x APIs without declaring the dependency will stop working as a consequence.

If you find that you have Extensions not working anymore, you have 3 options:

1. Check if there's a newer version available and upgrade (recommended).
2. If not, please contact the XWiki Support.
3. You can also install back Apache Commons Lang 2 version in your wiki, but please be aware that this library has a known CVE. To do so, go to the Admin UI and then select the "Extensions" section, then click on the "More" button and "Advanced Search" and enter commons-lang:commons-lang as the Extension id and 2.6 as the Extension version, as shown on the following screenshot:

   

We also stopped bundling the json-lib library which is also unmaintained and requires Commons Lang 2.x. See the API Breakages below for more information about the affected APIs.

API Breakages

The following APIs were modified since XWiki 17.5.0:

Real breakages

Real backward compatibility breakages that we have unwillingly accepted to do for the reasons mentioned in each violation below.

• Drop dependency on json-lib that requires commons-lang which has known security vulnerabilities.
  • Violation type:

    java.method.returnTypeChanged

  • Code:

    ## Old:
    method net.sf.json.JSON org.xwiki.velocity.tools.JSONTool::parse(java.lang.String)
    
    ## New:
    method java.lang.Object org.xwiki.velocity.tools.JSONTool::parse(java.lang.String)

• Stop using json-lib because it hasn't been maintained for a long time and it depends on the old commons-lang (2.x) which has known security vulnerabilities.
  • Violation type:

    java.method.returnTypeChanged

  • Code:

    ## Old:
    method net.sf.json.JSONObject com.xpn.xwiki.plugin.packaging.Package::toJSON(com.xpn.xwiki.XWikiContext)
    
    ## New:
    method java.lang.Object com.xpn.xwiki.plugin.packaging.Package::toJSON(com.xpn.xwiki.XWikiContext)

• Velocity scripts using this API should continue to work as long as they don't rely on the fact that the return value is of type net.sf.json.JSONObject
  • Violation type:

    java.method.returnTypeChanged

  • Code:

    ## Old:
    method net.sf.json.JSONObject com.xpn.xwiki.plugin.packaging.PackageAPI::toJSON()
    
    ## New:
    method java.lang.Object com.xpn.xwiki.plugin.packaging.PackageAPI::toJSON()

Credits

The following people have contributed code and translations to this release (sorted alphabetically):

• Cédric LAMBLIN 
• Farcasut 
• LucasC 
• Manuel Leduc 
• Marius Dumitru Florea 
• Michael Hamann 
• Simon Urli 
• Simpel 
• Thomas Mortagne 
• Valdis Vitolins 
• Vincent Massol 
• Xiaofei Cui 
• xrichard