October 2026 - notifications

[[email protected]][Issue] Updates for BLOG-270: Convert the functional tests to Docker-based tests
by XWiki Notifications 14 Oct '26

14 Oct '26

1 0

[xwiki/xwiki-platform] aa1880: XWIKI-25243: Make CSRF tokens identical on all nod...
by XWiki Notifications 14 Oct '26

14 Oct '26

Branch: refs/heads/stable-18.9.x Home: https://github.com/xwiki/xwiki-platform Commit: aa1880bb813f10b001011bf78f149aa3c59fd96e https://github.com/xwiki/xwiki-platform/commit/aa1880bb813f10b001011bf78f14… Author: ciaens <github.elongated262(a)passmail.net> Date: 2026-10-14 (Wed, 14 Oct 2026) Changed paths: M xwiki-platform-core/xwiki-platform-csrf/pom.xml M xwiki-platform-core/xwiki-platform-csrf/src/main/java/org/xwiki/csrf/CSRFToken.java M xwiki-platform-core/xwiki-platform-csrf/src/main/java/org/xwiki/csrf/CSRFTokenConfiguration.java M xwiki-platform-core/xwiki-platform-csrf/src/main/java/org/xwiki/csrf/internal/DefaultCSRFToken.java M xwiki-platform-core/xwiki-platform-csrf/src/main/java/org/xwiki/csrf/internal/DefaultCSRFTokenConfiguration.java M xwiki-platform-core/xwiki-platform-csrf/src/main/java/org/xwiki/csrf/script/CSRFTokenScriptService.java M xwiki-platform-core/xwiki-platform-csrf/src/test/java/org/xwiki/csrf/DefaultCSRFTokenConfigurationTest.java M xwiki-platform-core/xwiki-platform-csrf/src/test/java/org/xwiki/csrf/DefaultCSRFTokenTest.java M xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-test/xwiki-platform-flamingo-skin-test-docker/src/test/it/org/xwiki/flamingo/test/docker/WikiEditIT.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-api/src/main/java/org/xwiki/security/authentication/AuthenticationConfiguration.java M xwiki-platform-tools/xwiki-platform-tool-configuration-resources/src/main/resources/xwiki.properties.vm Log Message: ----------- XWIKI-25243: Make CSRF tokens identical on all nodes of a cluster (#6769) * DefaultCSRFToken derives the token (first 16 bytes of HMAC-SHA256 keyed with the authentication validation key, message "csrf:" + serialized user reference (or "guest") + ":" + time period) instead of storing random tokens in memory, so every node sharing the key computes the same token and tokens survive restarts * The tokens rotate with a time period: new csrf.tokenLifetime property (hours, default 24, 0 = never expire), the token of the previous period is still accepted * Add CSRFTokenConfiguration#getTokenLifetime (default method) and document the property in xwiki.properties.vm * The validation key is read once and a blank or missing key fails with an explicit IllegalStateException * Token validation uses a constant-time comparison and the warning no longer logs the expected token * Deprecate CSRFToken#clearToken and CSRFTokenScriptService#clearToken, a no-op for the default implementation * Document in AuthenticationConfiguration that the keys must be stable across calls and across cluster nodes * Depend on xwiki-platform-security-authentication-api, drop the SecureRandom and Initializable code * Expand the one-line Javadoc comments of the touched files to the multi-line form * Rewrite DefaultCSRFTokenTest for the derived tokens (key cache, blank key, period rotation, previous period, lifetime 0) and raise the coverage threshold of the module to 0.86 * WikiEditIT.allowForceSaveWhenCSRFIssue tampers the form_token field instead of clearing the server token Co-authored-by: Claude <noreply(a)anthropic.com> (cherry picked from commit 0d77f91a9512bd32c9daf527e618a17c9fe6a022) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki/xwiki-platform] d1dcbc: XWIKI-25275: Attachments stored in the S3 blob sto...
by XWiki Notifications 14 Oct '26

14 Oct '26

Branch: refs/heads/backport/stable-17.10.x/pr-6865 Home: https://github.com/xwiki/xwiki-platform Commit: d1dcbc49c3c75ceb78c0927a221980352d2b45b8 https://github.com/xwiki/xwiki-platform/commit/d1dcbc49c3c75ceb78c0927a2219… Author: ciaens <github.elongated262(a)passmail.net> Date: 2026-10-14 (Wed, 14 Oct 2026) Changed paths: M xwiki-platform-core/xwiki-platform-filter/xwiki-platform-filter-streams/xwiki-platform-filter-stream-xar/pom.xml M xwiki-platform-core/xwiki-platform-filter/xwiki-platform-filter-streams/xwiki-platform-filter-stream-xar/src/main/java/org/xwiki/filter/xar/internal/output/XAROutputFilterStream.java A xwiki-platform-core/xwiki-platform-filter/xwiki-platform-filter-streams/xwiki-platform-filter-stream-xar/src/test/java/org/xwiki/filter/xar/internal/output/XAROutputFilterStreamTest.java Log Message: ----------- XWIKI-25275: Attachments stored in the S3 blob store are truncated when a page is deleted or exported as XAR (#6865) * Fill each 4095-byte chunk of attachment content with InputStream#readNBytes in XAROutputFilterStream instead of stopping at the first read returning fewer bytes, which a network stream such as an S3 object does before its end * Add XAROutputFilterStreamTest: attachment and attachment revision content read from a stream returning short reads, contents of 0, 4095, 8190 and 13140 bytes read with short reads (same output as with a stream filling each read), XAR to XAR conversion of a multi-chunk attachment, read error after several short reads * Raise the coverage threshold of xwiki-platform-filter-stream-xar from 0.72 to 0.84 Co-authored-by: Claude <noreply(a)anthropic.com> (cherry picked from commit 6286e0557c1efd44989b293a12d5faa51cd298fc) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki/xwiki-platform] 0d77f9: XWIKI-25243: Make CSRF tokens identical on all nod...
by XWiki Notifications 14 Oct '26

14 Oct '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-platform Commit: 0d77f91a9512bd32c9daf527e618a17c9fe6a022 https://github.com/xwiki/xwiki-platform/commit/0d77f91a9512bd32c9daf527e618… Author: ciaens <github.elongated262(a)passmail.net> Date: 2026-10-14 (Wed, 14 Oct 2026) Changed paths: M xwiki-platform-core/xwiki-platform-csrf/pom.xml M xwiki-platform-core/xwiki-platform-csrf/src/main/java/org/xwiki/csrf/CSRFToken.java M xwiki-platform-core/xwiki-platform-csrf/src/main/java/org/xwiki/csrf/CSRFTokenConfiguration.java M xwiki-platform-core/xwiki-platform-csrf/src/main/java/org/xwiki/csrf/internal/DefaultCSRFToken.java M xwiki-platform-core/xwiki-platform-csrf/src/main/java/org/xwiki/csrf/internal/DefaultCSRFTokenConfiguration.java M xwiki-platform-core/xwiki-platform-csrf/src/main/java/org/xwiki/csrf/script/CSRFTokenScriptService.java M xwiki-platform-core/xwiki-platform-csrf/src/test/java/org/xwiki/csrf/DefaultCSRFTokenConfigurationTest.java M xwiki-platform-core/xwiki-platform-csrf/src/test/java/org/xwiki/csrf/DefaultCSRFTokenTest.java M xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-test/xwiki-platform-flamingo-skin-test-docker/src/test/it/org/xwiki/flamingo/test/docker/WikiEditIT.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-api/src/main/java/org/xwiki/security/authentication/AuthenticationConfiguration.java M xwiki-platform-tools/xwiki-platform-tool-configuration-resources/src/main/resources/xwiki.properties.vm Log Message: ----------- XWIKI-25243: Make CSRF tokens identical on all nodes of a cluster (#6769) * DefaultCSRFToken derives the token (first 16 bytes of HMAC-SHA256 keyed with the authentication validation key, message "csrf:" + serialized user reference (or "guest") + ":" + time period) instead of storing random tokens in memory, so every node sharing the key computes the same token and tokens survive restarts * The tokens rotate with a time period: new csrf.tokenLifetime property (hours, default 24, 0 = never expire), the token of the previous period is still accepted * Add CSRFTokenConfiguration#getTokenLifetime (default method) and document the property in xwiki.properties.vm * The validation key is read once and a blank or missing key fails with an explicit IllegalStateException * Token validation uses a constant-time comparison and the warning no longer logs the expected token * Deprecate CSRFToken#clearToken and CSRFTokenScriptService#clearToken, a no-op for the default implementation * Document in AuthenticationConfiguration that the keys must be stable across calls and across cluster nodes * Depend on xwiki-platform-security-authentication-api, drop the SecureRandom and Initializable code * Expand the one-line Javadoc comments of the touched files to the multi-line form * Rewrite DefaultCSRFTokenTest for the derived tokens (key cache, blank key, period rotation, previous period, lifetime 0) and raise the coverage threshold of the module to 0.86 * WikiEditIT.allowForceSaveWhenCSRFIssue tampers the form_token field instead of clearing the server token Co-authored-by: Claude <noreply(a)anthropic.com> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki/xwiki-dev-llm]
by XWiki Notifications 14 Oct '26

14 Oct '26

Branch: refs/heads/vmassol/ci-check-gaps Home: https://github.com/xwiki/xwiki-dev-llm To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm]
by XWiki Notifications 14 Oct '26

14 Oct '26

Branch: refs/tags/v1.19.5 Home: https://github.com/xwiki/xwiki-dev-llm To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] 8acb6c: [Misc] Release 1.19.5
by XWiki Notifications 14 Oct '26

14 Oct '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-dev-llm Commit: 8acb6cd2886165e2161c903e75859547be85b3f6 https://github.com/xwiki/xwiki-dev-llm/commit/8acb6cd2886165e2161c903e75859… Author: github-actions[bot] <41898282+github-actions[bot](a)users.noreply.github.com> Date: 2026-10-14 (Wed, 14 Oct 2026) Changed paths: M .claude-plugin/marketplace.json M kimi.plugin.json M opencode.jsonc M xwiki/.claude-plugin/plugin.json Log Message: ----------- [Misc] Release 1.19.5 * content edits only (no capability added or removed) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] 23e136: [Misc] CI check skill: fix the gaps the trial and ...
by XWiki Notifications 14 Oct '26

14 Oct '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-dev-llm Commit: 23e1363c1d7e453d7a85429b73bbfeb3ee2e9df6 https://github.com/xwiki/xwiki-dev-llm/commit/23e1363c1d7e453d7a85429b73bbf… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-10-14 (Wed, 14 Oct 2026) Changed paths: M xwiki/scripts/jenkins.mjs M xwiki/scripts/jira-flickers.mjs M xwiki/skills/xwiki-ci-check/SKILL.md M xwiki/skills/xwiki-ci-check/references/deep-analysis.md M xwiki/skills/xwiki-ci-check/references/fix-signals.md M xwiki/skills/xwiki-ci-check/references/flicker-issues.md M xwiki/skills/xwiki-ci-check/references/local-run.md M xwiki/skills/xwiki-ci-check/references/paste.md M xwiki/skills/xwiki-ci-check/references/quality-gate.md M xwiki/skills/xwiki-ci-check/tools/ci-check.mjs Log Message: ----------- [Misc] CI check skill: fix the gaps the trial and the routine dry run found (#276) * jira-flickers.mjs: closed flicker issues carry `resolution`; ci-check.mjs no longer prints "closed as fixed" or "already fixed" for one closed Cannot Reproduce / Won't Fix (XWIKI-22818, XWIKI-18540), and fix-signals.md says such an issue is no backport candidate. * ci-check.mjs: `flickerGroup` only on the incident that carries the cause, never on a `primary: false` peer, which also stops the paste dropping a group member (HomepageTourIT on 18.4.x); flicker-issues.md loses the paragraph the code now applies. * ci-check.mjs: `summary.stabilise.blockers` lists every blocker, not the first five; `summary.stabilise.configuration` is the worst configuration on the pick's own branch. * ci-check.mjs: the stale-snapshot check counts `-pageobjects/src/main/` as taken from Nexus, so a commit adding a page-object method and the IT calling it is recognised (LikeIT, PanelsAdministrationIT). * jenkins.mjs: drops script and style content when turning a log page into lines, so the Cloudflare beacon no longer lands in `evidence`. * SKILL.md, deep-analysis.md, flicker-issues.md, paste.md: "an incident with a fixState" becomes one a fixState answers whole, matching the code (a `partial` or `candidate` answer leaves the incident live). * SKILL.md: the description no longer says a local run never touches JIRA (§0 and flicker-issues.md ask before filing), the §0 row covers a comment on a closed issue, and §1 says the run's files go to a scratch directory. * fix-signals.md: no JIRA comment naming the line release.md keeps out of public artifacts; quality-gate.md: a routine opens the gate fix PR with pull-request.mjs, not the gh that xwiki-fix-sonarqube-issue names; local-run.md: a local fix PR is asked about before it is prepared. Co-authored-by: Claude Opus 5.5 (1M context) <noreply(a)anthropic.com> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] 819b64: [Misc] Release 1.19.4
by XWiki Notifications 14 Oct '26

14 Oct '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-dev-llm Commit: 819b64a1e483c1103e7a07375d449f3ef00bb968 https://github.com/xwiki/xwiki-dev-llm/commit/819b64a1e483c1103e7a07375d449… Author: github-actions[bot] <41898282+github-actions[bot](a)users.noreply.github.com> Date: 2026-10-14 (Wed, 14 Oct 2026) Changed paths: M .claude-plugin/marketplace.json M kimi.plugin.json M opencode.jsonc M xwiki/.claude-plugin/plugin.json Log Message: ----------- [Misc] Release 1.19.4 * content edits only (no capability added or removed) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm]
by XWiki Notifications 14 Oct '26

14 Oct '26

Branch: refs/tags/v1.19.4 Home: https://github.com/xwiki/xwiki-dev-llm To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0