October 2026 - notifications

[xwiki/xwiki-platform] 0d77f9: XWIKI-25243: Make CSRF tokens identical on all nod...
by XWiki Notifications 14 Oct '26

14 Oct '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-platform Commit: 0d77f91a9512bd32c9daf527e618a17c9fe6a022 https://github.com/xwiki/xwiki-platform/commit/0d77f91a9512bd32c9daf527e618… Author: ciaens <github.elongated262(a)passmail.net> Date: 2026-10-14 (Wed, 14 Oct 2026) Changed paths: M xwiki-platform-core/xwiki-platform-csrf/pom.xml M xwiki-platform-core/xwiki-platform-csrf/src/main/java/org/xwiki/csrf/CSRFToken.java M xwiki-platform-core/xwiki-platform-csrf/src/main/java/org/xwiki/csrf/CSRFTokenConfiguration.java M xwiki-platform-core/xwiki-platform-csrf/src/main/java/org/xwiki/csrf/internal/DefaultCSRFToken.java M xwiki-platform-core/xwiki-platform-csrf/src/main/java/org/xwiki/csrf/internal/DefaultCSRFTokenConfiguration.java M xwiki-platform-core/xwiki-platform-csrf/src/main/java/org/xwiki/csrf/script/CSRFTokenScriptService.java M xwiki-platform-core/xwiki-platform-csrf/src/test/java/org/xwiki/csrf/DefaultCSRFTokenConfigurationTest.java M xwiki-platform-core/xwiki-platform-csrf/src/test/java/org/xwiki/csrf/DefaultCSRFTokenTest.java M xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-test/xwiki-platform-flamingo-skin-test-docker/src/test/it/org/xwiki/flamingo/test/docker/WikiEditIT.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-api/src/main/java/org/xwiki/security/authentication/AuthenticationConfiguration.java M xwiki-platform-tools/xwiki-platform-tool-configuration-resources/src/main/resources/xwiki.properties.vm Log Message: ----------- XWIKI-25243: Make CSRF tokens identical on all nodes of a cluster (#6769) * DefaultCSRFToken derives the token (first 16 bytes of HMAC-SHA256 keyed with the authentication validation key, message "csrf:" + serialized user reference (or "guest") + ":" + time period) instead of storing random tokens in memory, so every node sharing the key computes the same token and tokens survive restarts * The tokens rotate with a time period: new csrf.tokenLifetime property (hours, default 24, 0 = never expire), the token of the previous period is still accepted * Add CSRFTokenConfiguration#getTokenLifetime (default method) and document the property in xwiki.properties.vm * The validation key is read once and a blank or missing key fails with an explicit IllegalStateException * Token validation uses a constant-time comparison and the warning no longer logs the expected token * Deprecate CSRFToken#clearToken and CSRFTokenScriptService#clearToken, a no-op for the default implementation * Document in AuthenticationConfiguration that the keys must be stable across calls and across cluster nodes * Depend on xwiki-platform-security-authentication-api, drop the SecureRandom and Initializable code * Expand the one-line Javadoc comments of the touched files to the multi-line form * Rewrite DefaultCSRFTokenTest for the derived tokens (key cache, blank key, period rotation, previous period, lifetime 0) and raise the coverage threshold of the module to 0.86 * WikiEditIT.allowForceSaveWhenCSRFIssue tampers the form_token field instead of clearing the server token Co-authored-by: Claude <noreply(a)anthropic.com> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki/xwiki-dev-llm]
by XWiki Notifications 14 Oct '26

14 Oct '26

Branch: refs/heads/vmassol/ci-check-gaps Home: https://github.com/xwiki/xwiki-dev-llm To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm]
by XWiki Notifications 14 Oct '26

14 Oct '26

Branch: refs/tags/v1.19.5 Home: https://github.com/xwiki/xwiki-dev-llm To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] 8acb6c: [Misc] Release 1.19.5
by XWiki Notifications 14 Oct '26

14 Oct '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-dev-llm Commit: 8acb6cd2886165e2161c903e75859547be85b3f6 https://github.com/xwiki/xwiki-dev-llm/commit/8acb6cd2886165e2161c903e75859… Author: github-actions[bot] <41898282+github-actions[bot](a)users.noreply.github.com> Date: 2026-10-14 (Wed, 14 Oct 2026) Changed paths: M .claude-plugin/marketplace.json M kimi.plugin.json M opencode.jsonc M xwiki/.claude-plugin/plugin.json Log Message: ----------- [Misc] Release 1.19.5 * content edits only (no capability added or removed) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] 23e136: [Misc] CI check skill: fix the gaps the trial and ...
by XWiki Notifications 14 Oct '26

14 Oct '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-dev-llm Commit: 23e1363c1d7e453d7a85429b73bbfeb3ee2e9df6 https://github.com/xwiki/xwiki-dev-llm/commit/23e1363c1d7e453d7a85429b73bbf… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-10-14 (Wed, 14 Oct 2026) Changed paths: M xwiki/scripts/jenkins.mjs M xwiki/scripts/jira-flickers.mjs M xwiki/skills/xwiki-ci-check/SKILL.md M xwiki/skills/xwiki-ci-check/references/deep-analysis.md M xwiki/skills/xwiki-ci-check/references/fix-signals.md M xwiki/skills/xwiki-ci-check/references/flicker-issues.md M xwiki/skills/xwiki-ci-check/references/local-run.md M xwiki/skills/xwiki-ci-check/references/paste.md M xwiki/skills/xwiki-ci-check/references/quality-gate.md M xwiki/skills/xwiki-ci-check/tools/ci-check.mjs Log Message: ----------- [Misc] CI check skill: fix the gaps the trial and the routine dry run found (#276) * jira-flickers.mjs: closed flicker issues carry `resolution`; ci-check.mjs no longer prints "closed as fixed" or "already fixed" for one closed Cannot Reproduce / Won't Fix (XWIKI-22818, XWIKI-18540), and fix-signals.md says such an issue is no backport candidate. * ci-check.mjs: `flickerGroup` only on the incident that carries the cause, never on a `primary: false` peer, which also stops the paste dropping a group member (HomepageTourIT on 18.4.x); flicker-issues.md loses the paragraph the code now applies. * ci-check.mjs: `summary.stabilise.blockers` lists every blocker, not the first five; `summary.stabilise.configuration` is the worst configuration on the pick's own branch. * ci-check.mjs: the stale-snapshot check counts `-pageobjects/src/main/` as taken from Nexus, so a commit adding a page-object method and the IT calling it is recognised (LikeIT, PanelsAdministrationIT). * jenkins.mjs: drops script and style content when turning a log page into lines, so the Cloudflare beacon no longer lands in `evidence`. * SKILL.md, deep-analysis.md, flicker-issues.md, paste.md: "an incident with a fixState" becomes one a fixState answers whole, matching the code (a `partial` or `candidate` answer leaves the incident live). * SKILL.md: the description no longer says a local run never touches JIRA (§0 and flicker-issues.md ask before filing), the §0 row covers a comment on a closed issue, and §1 says the run's files go to a scratch directory. * fix-signals.md: no JIRA comment naming the line release.md keeps out of public artifacts; quality-gate.md: a routine opens the gate fix PR with pull-request.mjs, not the gh that xwiki-fix-sonarqube-issue names; local-run.md: a local fix PR is asked about before it is prepared. Co-authored-by: Claude Opus 5.5 (1M context) <noreply(a)anthropic.com> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] 819b64: [Misc] Release 1.19.4
by XWiki Notifications 14 Oct '26

14 Oct '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-dev-llm Commit: 819b64a1e483c1103e7a07375d449f3ef00bb968 https://github.com/xwiki/xwiki-dev-llm/commit/819b64a1e483c1103e7a07375d449… Author: github-actions[bot] <41898282+github-actions[bot](a)users.noreply.github.com> Date: 2026-10-14 (Wed, 14 Oct 2026) Changed paths: M .claude-plugin/marketplace.json M kimi.plugin.json M opencode.jsonc M xwiki/.claude-plugin/plugin.json Log Message: ----------- [Misc] Release 1.19.4 * content edits only (no capability added or removed) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm]
by XWiki Notifications 14 Oct '26

14 Oct '26

Branch: refs/tags/v1.19.4 Home: https://github.com/xwiki/xwiki-dev-llm To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] 52dd1e: [Misc] CI check skill: fix the gaps the trial and ...
by XWiki Notifications 14 Oct '26

14 Oct '26

Branch: refs/heads/vmassol/ci-check-gaps Home: https://github.com/xwiki/xwiki-dev-llm Commit: 52dd1e9163ec2dcbbcdc67719f35c34a1a9d0e3a https://github.com/xwiki/xwiki-dev-llm/commit/52dd1e9163ec2dcbbcdc67719f35c… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-10-14 (Wed, 14 Oct 2026) Changed paths: M xwiki/scripts/jenkins.mjs M xwiki/scripts/jira-flickers.mjs M xwiki/skills/xwiki-ci-check/SKILL.md M xwiki/skills/xwiki-ci-check/references/deep-analysis.md M xwiki/skills/xwiki-ci-check/references/fix-signals.md M xwiki/skills/xwiki-ci-check/references/flicker-issues.md M xwiki/skills/xwiki-ci-check/references/local-run.md M xwiki/skills/xwiki-ci-check/references/paste.md M xwiki/skills/xwiki-ci-check/references/quality-gate.md M xwiki/skills/xwiki-ci-check/tools/ci-check.mjs Log Message: ----------- [Misc] CI check skill: fix the gaps the trial and the routine dry run found * jira-flickers.mjs: closed flicker issues carry `resolution`; ci-check.mjs no longer prints "closed as fixed" or "already fixed" for one closed Cannot Reproduce / Won't Fix (XWIKI-22818, XWIKI-18540), and fix-signals.md says such an issue is no backport candidate. * ci-check.mjs: `flickerGroup` only on the incident that carries the cause, never on a `primary: false` peer, which also stops the paste dropping a group member (HomepageTourIT on 18.4.x); flicker-issues.md loses the paragraph the code now applies. * ci-check.mjs: `summary.stabilise.blockers` lists every blocker, not the first five; `summary.stabilise.configuration` is the worst configuration on the pick's own branch. * ci-check.mjs: the stale-snapshot check counts `-pageobjects/src/main/` as taken from Nexus, so a commit adding a page-object method and the IT calling it is recognised (LikeIT, PanelsAdministrationIT). * jenkins.mjs: drops script and style content when turning a log page into lines, so the Cloudflare beacon no longer lands in `evidence`. * SKILL.md, deep-analysis.md, flicker-issues.md, paste.md: "an incident with a fixState" becomes one a fixState answers whole, matching the code (a `partial` or `candidate` answer leaves the incident live). * SKILL.md: the description no longer says a local run never touches JIRA (§0 and flicker-issues.md ask before filing), the §0 row covers a comment on a closed issue, and §1 says the run's files go to a scratch directory. * fix-signals.md: no JIRA comment naming the line release.md keeps out of public artifacts; quality-gate.md: a routine opens the gate fix PR with pull-request.mjs, not the gh that xwiki-fix-sonarqube-issue names; local-run.md: a local fix PR is asked about before it is prepared. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply(a)anthropic.com> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm]
by XWiki Notifications 14 Oct '26

14 Oct '26

Branch: refs/heads/vmassol/ci-check-tool-rules Home: https://github.com/xwiki/xwiki-dev-llm To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] 8ffa62: [Misc] CI check skill: move §4's skip list, the re...
by XWiki Notifications 14 Oct '26

14 Oct '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-dev-llm Commit: 8ffa6258b0676a8f5d51340f484505f929a10a76 https://github.com/xwiki/xwiki-dev-llm/commit/8ffa6258b0676a8f5d51340f48450… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-10-14 (Wed, 14 Oct 2026) Changed paths: M scripts/size-budgets.json M xwiki/skills/xwiki-ci-check/SKILL.md M xwiki/skills/xwiki-ci-check/references/commit-comment.md M xwiki/skills/xwiki-ci-check/references/digest.md M xwiki/skills/xwiki-ci-check/references/fix-prs.md M xwiki/skills/xwiki-ci-check/tools/ci-check.mjs M xwiki/skills/xwiki-ci-check/tools/commit-comment.mjs M xwiki/skills/xwiki-ci-check/tools/matrix.mjs M xwiki/skills/xwiki-ci-check/tools/pull-request.mjs Log Message: ----------- [Misc] CI check skill: move §4's skip list, the reference triggers, the digest's shape and the exit-3 remedy into the tools (#275) * ci-check.mjs: each incident carries `commentable` (repo, state, tier and the commit or PR §4 may comment on), computed from the skip list: answered, non-primary, already said, beyond the horizon, no certain/likely culprit, no unequivocal gate author. * commit-comment.mjs: requires --work-order and answers `not posted: <why>` for an incident, target or state the work order does not make commentable, in a rehearsal too; --repo and --state default to the incident's. * ci-check.mjs: `summary.read` names the reference files this run's fields call for, each with the step it is read before. * ci-check.mjs --render-digest: renders the Matrix digest from the work order and --previous (grid, rows chosen and ordered, one row per cause, green rows never cut, fromChat rows always kept, counts, the full-snapshot line), with PASTE / DONE / STABILISE / SILENT markers for what only the run knows; no culprit is named in a row before the run decides to comment. * matrix.mjs: refuses a digest still holding a marker. * pull-request.mjs: on exit 3 prints the remedy (unsubscribe, "unlocked PR #N" first, hands off) with the PR number. * SKILL.md (19,993 to 19,388 bytes, budget lowered to 19,400), digest.md, commit-comment.md, fix-prs.md: the rules the tools now apply shrink to pointers; every safety rule the code does not enforce stays. Co-authored-by: Claude Opus 5.5 (1M context) <noreply(a)anthropic.com> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0