July 2026 - notifications - lists.xwiki.org

[xwiki/xwiki-docker] e30aa1: XDOCKER-18: Strengthen smokeTest with a REST versi...
by XWiki Notifications 25 Jul '26

25 Jul '26

Branch: refs/heads/XDOCKER-18-automate-docker-images-release Home: https://github.com/xwiki/xwiki-docker Commit: e30aa1c17eedc285b2d73d59518e3f33ee9c0dbd https://github.com/xwiki/xwiki-docker/commit/e30aa1c17eedc285b2d73d59518e3f… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-07-25 (Sat, 25 Jul 2026) Changed paths: M build.gradle Log Message: ----------- XDOCKER-18: Strengthen smokeTest with a REST version check and add runAll/stopAll tasks smokeTest now polls /rest and asserts the response carries the expected XWiki version, verifying XWiki actually initialized rather than just that Tomcat serves HTTP 200. The new runAll/stopAll tasks start each cycle/variant on its own host port as an isolated compose project and leave them running for manual inspection (stopAll tears them back down). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply(a)anthropic.com> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-docker/settings/notifications

1 0

[xwiki/xwiki-platform] 46c145: XWIKI-24587: Create/check for automated tests for ...
by XWiki Notifications 25 Jul '26

25 Jul '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-platform Commit: 46c1457a74674458dd0e9c2e3cdb43b3ce347e67 https://github.com/xwiki/xwiki-platform/commit/46c1457a74674458dd0e9c2e3cdb… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-07-25 (Sat, 25 Jul 2026) Changed paths: M xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/src/test/it/org/xwiki/administration/test/ui/UsersGroupsRightsManagementIT.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authorization/xwiki-platform-security-authorization-api/src/test/java/org/xwiki/security/authorization/DefaultAuthorizationManagerIntegrationTest.java A xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authorization/xwiki-platform-security-authorization-api/src/test/resources/testwikis/groupRightsAtSpaceLevelVersusUserDenyAtWikiLevel.xml Log Message: ----------- XWIKI-24587: Create/check for automated tests for "Deny the rights for a user at wiki level and give rights to a group at page level" The manual test denies the "edit" right to a user at wiki level, then grants view, comment and edit to a group that user belongs to at page level, and expects the user to have no Edit option on the wiki but to have one on that page. No existing test covered that combination: tieResolutionPolicy() pits a user DENY against a group ALLOW but with both rules at the same (wiki) level, the inheritancePolicyFor*() tests do override a wiki-level DENY at a lower level but with user rules only, and UsersGroupsRightsManagementIT.groupRights() sets a page-level group DENY with no wiki-level rule. Add the functional test driving the same UI path as the manual test: deny from Administer Wiki > Users & Rights > Rights > Users, then grant from Administer Page > Users & Rights > Rights: Page & Children. It asserts the Edit option is absent on a page outside the space and present on the granted page. The two assertions cross-validate each other, so the test cannot pass vacuously: the first one proves the wiki-level deny is really in effect, hence the second one can only pass if the page-level group rules override it. Also pin the underlying authorization semantics at the settler level with a testwiki fixture, so that a regression in the rule resolution fails in under a second rather than only inside the Selenium run. A velocity hasAccess() probe against the running instance confirmed both levels agree: the user genuinely holds the edit right on the granted page, so the visible Edit option is not a side effect of the comment right. Co-Authored-By: Claude Opus 5 (1M context) <noreply(a)anthropic.com> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki/xwiki-docker] a8fad3: XDOCKER-18: Automate updating the stable version
by XWiki Notifications 25 Jul '26

25 Jul '26

Branch: refs/heads/XDOCKER-18-automate-docker-images-release Home: https://github.com/xwiki/xwiki-docker Commit: a8fad35d9222863622984d022b7691ad3553d077 https://github.com/xwiki/xwiki-docker/commit/a8fad35d9222863622984d022b7691… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-07-24 (Fri, 24 Jul 2026) Changed paths: M README.md M build.gradle Log Message: ----------- XDOCKER-18: Automate updating the stable version Automate the manual "Update Docker Images" release step as Gradle tasks, mirroring the existing updateLibreOffice precedent: - updateXWiki: resolve the latest final XWiki version on each existing cycle's line from XWiki's Maven metadata and, for changed cycles, download the WAR and compute its sha256. - updateJDBC: read the three JDBC driver versions from each cycle's own xwiki-platform POM and, for changed ones, download the driver from Maven Central and compute its sha256. Driver versions/sha256 are now stored per cycle (the shared mysql/mariadb/postgres maps are removed); this also corrects a latent cycle-16 mismatch (hence the regenerated 16/*). - smokeTest: boot the postgres-tomcat variant of each changed cycle with docker compose and wait for HTTP 200, then tear it down. - release: pre-push umbrella chaining updateXWiki -> updateJDBC -> updateLibreOffice -> generate -> smokeTest (the update tasks also mutate the in-memory token model so the chained generate sees fresh values). - submitOfficialImage: generate the docker-library library/xwiki file from the token model and open the official-images PR from your GitHub fork (contents API, no clone). -PdryRun previews the file and diff only. Also refactor the tokens data model (per-cycle role + JDBC values + optional libraryComment) and replace the Gradle exec API (removed in Gradle 9) with a Groovy Process helper, which also fixes the previously never-run smokeTest docker calls. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply(a)anthropic.com> Commit: 260b15309b39339e367a91759c7f67675fea589b https://github.com/xwiki/xwiki-docker/commit/260b15309b39339e367a91759c7f67… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-07-24 (Fri, 24 Jul 2026) Changed paths: M build.gradle A versions.json Log Message: ----------- XDOCKER-18: Extract the version data into versions.json and rename the "previous" role Address the PR review feedback: - Move the version data model (the per-cycle XWiki + JDBC driver versions/sha256 and the shared LibreOffice version/sha256) out of build.gradle into a dedicated versions.json data file, separating the configuration from the build logic and making it straightforward to update programmatically. The updateXWiki, updateJDBC and updateLibreOffice tasks now mutate the parsed model and persist it with JsonOutput, which removes the fragile rewriteCycleFields line-rewriting helper. - Rename the cycle-16 role from "previous" to "old-lts", which is clearer. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply(a)anthropic.com> Compare: https://github.com/xwiki/xwiki-docker/compare/e9407583b374...260b15309b39 To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-docker/settings/notifications

1 0

[xwiki/xwiki-dev-llm]
by XWiki Notifications 25 Jul '26

25 Jul '26

Branch: refs/heads/okf-prchecker-log-meaning Home: https://github.com/xwiki/xwiki-dev-llm To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] 75b8be: [Misc] Document how to read a PRChecker log line i...
by XWiki Notifications 25 Jul '26

25 Jul '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-dev-llm Commit: 75b8be55acc3247a6a64960af26e2f80241c2d8b https://github.com/xwiki/xwiki-dev-llm/commit/75b8be55acc3247a6a64960af26e2… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-07-25 (Sat, 25 Jul 2026) Changed paths: M .claude-plugin/marketplace.json M kimi.plugin.json M opencode.jsonc M xwiki/.claude-plugin/plugin.json M xwiki/okf/index.md M xwiki/okf/testing/strategy.md Log Message: ----------- [Misc] Document how to read a PRChecker log line in the OKF testing strategy A "PRChecker: Block programming right for page [X]" line only tells that some code evaluated the Programming Right while X was the secure document and was denied. It is routinely read as "X requires the Programming Right", which sends developers looking for a defect in pages that work correctly on their non-privileged branch. Commit: 030449adc1b2220e75cd8c5453dda97fda3dd766 https://github.com/xwiki/xwiki-dev-llm/commit/030449adc1b2220e75cd8c5453dda… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-07-25 (Sat, 25 Jul 2026) Changed paths: M .claude-plugin/marketplace.json M kimi.plugin.json M opencode.jsonc M xwiki/.claude-plugin/plugin.json M xwiki/okf/index.md M xwiki/okf/testing/strategy.md Log Message: ----------- [Misc] Document how to read a PRChecker log line in the OKF testing strategy Compare: https://github.com/xwiki/xwiki-dev-llm/compare/f1e52e6a09d6...030449adc1b2 To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] 75b8be: [Misc] Document how to read a PRChecker log line i...
by XWiki Notifications 25 Jul '26

25 Jul '26

Branch: refs/heads/okf-prchecker-log-meaning Home: https://github.com/xwiki/xwiki-dev-llm Commit: 75b8be55acc3247a6a64960af26e2f80241c2d8b https://github.com/xwiki/xwiki-dev-llm/commit/75b8be55acc3247a6a64960af26e2… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-07-25 (Sat, 25 Jul 2026) Changed paths: M .claude-plugin/marketplace.json M kimi.plugin.json M opencode.jsonc M xwiki/.claude-plugin/plugin.json M xwiki/okf/index.md M xwiki/okf/testing/strategy.md Log Message: ----------- [Misc] Document how to read a PRChecker log line in the OKF testing strategy A "PRChecker: Block programming right for page [X]" line only tells that some code evaluated the Programming Right while X was the secure document and was denied. It is routinely read as "X requires the Programming Right", which sends developers looking for a defect in pages that work correctly on their non-privileged branch. To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-platform]
by XWiki Notifications 25 Jul '26

25 Jul '26

Branch: refs/heads/claude/laughing-goodall-v2mdyk Home: https://github.com/xwiki/xwiki-platform To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki/xwiki-platform] d8ed80: [Misc] Use isEmpty() instead of length() compariso...
by XWiki Notifications 25 Jul '26

25 Jul '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-platform Commit: d8ed80d12314f8a8574adad3212ffec5214bda24 https://github.com/xwiki/xwiki-platform/commit/d8ed80d12314f8a8574adad3212f… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-07-25 (Sat, 25 Jul 2026) Changed paths: M xwiki-platform-core/xwiki-platform-annotation/xwiki-platform-annotation-core/src/main/java/org/xwiki/annotation/internal/content/SpaceNormalizerContentAlterer.java M xwiki-platform-core/xwiki-platform-annotation/xwiki-platform-annotation-core/src/main/java/org/xwiki/annotation/internal/renderer/AnnotationMarkersXHTMLPrinter.java M xwiki-platform-core/xwiki-platform-annotation/xwiki-platform-annotation-core/src/test/java/org/xwiki/annotation/MockDocument.java M xwiki-platform-core/xwiki-platform-annotation/xwiki-platform-annotation-core/src/test/java/org/xwiki/annotation/TestDocumentFactory.java M xwiki-platform-core/xwiki-platform-annotation/xwiki-platform-annotation-io/src/main/java/org/xwiki/annotation/internal/AnnotationEventGeneratorEventListener.java M xwiki-platform-core/xwiki-platform-annotation/xwiki-platform-annotation-io/src/main/java/org/xwiki/annotation/io/internal/DefaultIOService.java M xwiki-platform-core/xwiki-platform-annotation/xwiki-platform-annotation-maintainer/src/main/java/org/xwiki/annotation/maintainer/AbstractAnnotationMaintainer.java M xwiki-platform-core/xwiki-platform-model/xwiki-platform-model-api/src/main/java/org/xwiki/model/internal/reference/AbstractStringEntityReferenceResolver.java M xwiki-platform-core/xwiki-platform-model/xwiki-platform-model-api/src/main/java/org/xwiki/model/internal/reference/DefaultStringEntityReferenceSerializer.java M xwiki-platform-core/xwiki-platform-model/xwiki-platform-model-api/src/main/java/org/xwiki/model/reference/EntityReferenceTreeNode.java M xwiki-platform-core/xwiki-platform-query/xwiki-platform-query-xwql/src/main/java/org/xwiki/query/xwql/internal/hql/TreePrinter.java M xwiki-platform-core/xwiki-platform-query/xwiki-platform-query-xwql/src/main/java/org/xwiki/query/xwql/internal/hql/XWQLtoHQLTranslator.java M xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-async/xwiki-platform-rendering-async-api/src/main/java/org/xwiki/rendering/async/internal/AsyncRendererExecutorResponse.java M xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-async/xwiki-platform-rendering-async-default/src/main/java/org/xwiki/rendering/async/internal/service/AsyncRendererResourceReferenceHandler.java M xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-code/src/main/java/org/xwiki/rendering/internal/parser/pygments/BlocksGeneratorPygmentsListener.java M xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-code/src/main/java/org/xwiki/rendering/internal/parser/pygments/PygmentsParser.java M xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-gallery/src/main/java/org/xwiki/rendering/internal/macro/gallery/GalleryMacro.java M xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-velocity/src/main/java/org/xwiki/rendering/internal/macro/velocity/filter/HTMLVelocityMacroFilter.java M xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-wikimacro/xwiki-platform-rendering-wikimacro-store/src/main/java/org/xwiki/rendering/wikimacro/internal/DefaultWikiMacro.java M xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-jersey/src/main/java/org/xwiki/rest/jersey/internal/ConsumedBodyRestoringRequestWrapper.java M xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/Utils.java M xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/url/resources/AbstractJobRestURLGenerator.java M xwiki-platform-core/xwiki-platform-url/xwiki-platform-url-api/src/main/java/org/xwiki/url/internal/AbstractParentResourceReferenceResolver.java M xwiki-platform-core/xwiki-platform-user/xwiki-platform-user-default/src/main/java/org/xwiki/user/internal/group/MemberGroupsCache.java M xwiki-platform-core/xwiki-platform-xar/xwiki-platform-xar-model/src/main/java/org/xwiki/xar/internal/XarUtils.java M xwiki-platform-core/xwiki-platform-zipexplorer/src/main/java/com/xpn/xwiki/plugin/zipexplorer/ZipExplorerPlugin.java Log Message: ----------- [Misc] Use isEmpty() instead of length() comparisons flagged by SonarCloud (#5964) Replace StringBuilder/StringBuffer/String length() == 0 and length() > 0 comparisons with isEmpty()/!isEmpty() as reported by SonarCloud rule java:S7158. Behaviour-neutral mechanical change across 26 files. To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki/xwiki-platform] ef149f: [Misc] Convert the flavor extension-security funct...
by XWiki Notifications 25 Jul '26

25 Jul '26

Branch: refs/heads/misc-flavor-security-docker-test Home: https://github.com/xwiki/xwiki-platform Commit: ef149f412c978299879f685f341f375fa68549ae https://github.com/xwiki/xwiki-platform/commit/ef149f412c978299879f685f341f… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-07-24 (Fri, 24 Jul 2026) Changed paths: M xwiki-platform-distribution/xwiki-platform-distribution-flavor/xwiki-platform-distribution-flavor-test/pom.xml M xwiki-platform-distribution/xwiki-platform-distribution-flavor/xwiki-platform-distribution-flavor-test/xwiki-platform-distribution-flavor-test-security/pom.xml A xwiki-platform-distribution/xwiki-platform-distribution-flavor/xwiki-platform-distribution-flavor-test/xwiki-platform-distribution-flavor-test-security/src/test/it/org/xwiki/test/security/AllIT.java R xwiki-platform-distribution/xwiki-platform-distribution-flavor/xwiki-platform-distribution-flavor-test/xwiki-platform-distribution-flavor-test-security/src/test/it/org/xwiki/test/security/AllTests.java R xwiki-platform-distribution/xwiki-platform-distribution-flavor/xwiki-platform-distribution-flavor-test/xwiki-platform-distribution-flavor-test-security/src/test/it/org/xwiki/test/security/ExtensionSecurityTest.java A xwiki-platform-distribution/xwiki-platform-distribution-flavor/xwiki-platform-distribution-flavor-test/xwiki-platform-distribution-flavor-test-security/src/test/it/org/xwiki/test/security/FlavorExtensionSecurityScanIT.java Log Message: ----------- [Misc] Convert the flavor extension-security functional test to the Docker framework Convert ExtensionSecurityTest from the JUnit4 legacy framework (AbstractTest + a PageObjectSuite runner starting XWiki out of process) to the JUnit5 Docker framework, in place: the test keeps its own xwiki-platform-distribution-flavor-test-security module and its own 'Flavor Test - Security' CI job. The test keeps its scenario and its assertion unchanged: index the installed extensions, open the Extension Vulnerabilities admin section, and require that no CVE is left to review. It runs on @UITest(standardFlavor = true), so the scan still covers the extensions of a standard flavor instance. Module changes: - Packaging pom -> jar, with src/test/it as test sources and failsafe, which runs AllIT. The legacy compiler/resources/dependency/surefire configuration goes away, and so does the AllTests runner: the framework now configures the maven-local extension repository and the test logs in itself. - The extension security UI is not bundled by the standard flavor nor by the WAR core extensions, so it still has to be provisioned. Instead of installing it from the test body over REST, it is declared as a runtime-scoped xar dependency, which the framework installs at startup. The REST installer dependencies (xwiki-platform-test-rest, jakarta.servlet-api) are dropped. - banneddependencytype-xar is skipped: that rule keeps JAR extensions from pulling XAR extensions at runtime, and it exempts modules named *-test-docker only. This module is a functional test module, never installed as an extension, and it needs the XAR to provision the feature under test. - The module moves to the docker profile of the flavor test parent pom, as is done for every other Docker test module, so that a build without a Docker daemon does not pick it up. The CI job is unaffected since it builds the module pom directly. The test class is named FlavorExtensionSecurityScanIT to keep it distinct from ExtensionSecurityIT in xwiki-platform-extension-security-test-docker, which covers the same feature against mocked vulnerability sources. To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki/xwiki-platform] 7ac736: [Misc] Fix a NullPointerException when an OSV resp...
by XWiki Notifications 25 Jul '26

25 Jul '26

Branch: refs/heads/misc-osv-optional-list-fields Home: https://github.com/xwiki/xwiki-platform Commit: 7ac736357295b7d00878b8a757ee449b34b7013c https://github.com/xwiki/xwiki-platform/commit/7ac736357295b7d00878b8a757ee… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-07-25 (Sat, 25 Jul 2026) Changed paths: M xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/pom.xml M xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/src/main/java/org/xwiki/extension/security/internal/analyzer/osv/OsvResponseAnalyzer.java M xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/src/main/java/org/xwiki/extension/security/internal/analyzer/osv/model/response/AffectObject.java M xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/src/main/java/org/xwiki/extension/security/internal/analyzer/osv/model/response/VulnObject.java M xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/src/test/java/org/xwiki/extension/security/internal/analyzer/osv/OsvResponseAnalyzerTest.java A xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/src/test/java/org/xwiki/extension/security/internal/analyzer/osv/model/response/AffectObjectTest.java A xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/src/test/java/org/xwiki/extension/security/internal/analyzer/osv/model/response/VulnObjectTest.java A xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/src/test/resources/osvResponseWithoutRanges.json A xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/src/test/resources/osvResponseWithoutRangesPlatform.json Log Message: ----------- [Misc] Fix a NullPointerException when an OSV response omits an optional list field The "ranges", "affected" and "references" fields are all optional in the OSV schema (an affected entry can enumerate the affected versions instead of declaring ranges, for example), but the response model returned them as-is and the analyzer streamed over them, which failed the analysis of such a vulnerability with: Unexpected error [NullPointerException: Cannot invoke "java.util.List.stream()" because the return value of "...osv.model.response.AffectObject.getRanges()" is null] AffectObject#getRanges(), VulnObject#getAffected() and VulnObject#getReferences() now return an empty list when the field is absent, and the callers inside VulnObject go through the getters rather than the fields. The now-dead emptiness check in OsvResponseAnalyzer#checkRanges goes away. To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0