September 2026 - notifications

[[email protected]][Issue] Updates for XWIKI-24999: Path traversal protection during WebJar export can be bypassed through a sibling of the export directory
by XWiki Notifications 16 Sep '26

16 Sep '26

1 0

[xwiki/xwiki-platform] f01948: XWIKI-24875: Trusted domains aren't updated after ...
by XWiki Notifications 16 Sep '26

16 Sep '26

Branch: refs/heads/stable-18.8.x Home: https://github.com/xwiki/xwiki-platform Commit: f01948398408a4d36d669340c6dbeea1887ca0a5 https://github.com/xwiki/xwiki-platform/commit/f01948398408a4d36d669340c6db… Author: Michael Hamann <michael.hamann(a)xwiki.com> Date: 2026-09-16 (Wed, 16 Sep 2026) Changed paths: M xwiki-platform-core/xwiki-platform-url/xwiki-platform-url-default/src/main/java/org/xwiki/url/internal/DefaultURLSecurityManager.java M xwiki-platform-core/xwiki-platform-url/xwiki-platform-url-default/src/test/java/org/xwiki/url/internal/DefaultURLSecurityManagerTest.java Log Message: ----------- XWIKI-24875: Trusted domains aren't updated after wiki descriptor change * remove the nullable return of maybeInitializeWithDomain(), reported by Sonar as a possible NPE (java:S2259): the method re-read URLConfiguration#isTrustedDomainsEnabled() even though isDomainTrusted() had just checked it, so the two reads could disagree and return null to a caller that doesn't expect it. The flag is now checked by the callers and the method, renamed to initializeWithDomain(), always returns the set. The only other caller, parseToSafeURI(String, String), discarded the return value anyway. * suppress java:S3077 on the trustedDomains field with a comment explaining why volatile is both necessary and sufficient here: the only mutation of the field is the wholesale replacement of the supplier by invalidateCache(), and both the memoizing supplier and the ConcurrentHashMap key set it computes are thread-safe on their own. * cover the case of parseToSafeURI(String, String) with trusted domains disabled, which wasn't tested before. Co-Authored-By: Claude Opus 5 (1M context) <noreply(a)anthropic.com> (cherry picked from commit 72be05a450758edfdcbac1b135a35a23a4f5f964) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki/xwiki-platform] 8fb8ef: XWIKI-24875: Trusted domains aren't updated after ...
by XWiki Notifications 16 Sep '26

16 Sep '26

Branch: refs/heads/stable-18.4.x Home: https://github.com/xwiki/xwiki-platform Commit: 8fb8ef4f9e30027be25ce2a8e8044aebd69066d7 https://github.com/xwiki/xwiki-platform/commit/8fb8ef4f9e30027be25ce2a8e804… Author: Michael Hamann <michael.hamann(a)xwiki.com> Date: 2026-09-16 (Wed, 16 Sep 2026) Changed paths: M xwiki-platform-core/xwiki-platform-url/xwiki-platform-url-default/src/main/java/org/xwiki/url/internal/DefaultURLSecurityManager.java M xwiki-platform-core/xwiki-platform-url/xwiki-platform-url-default/src/test/java/org/xwiki/url/internal/DefaultURLSecurityManagerTest.java Log Message: ----------- XWIKI-24875: Trusted domains aren't updated after wiki descriptor change * remove the nullable return of maybeInitializeWithDomain(), reported by Sonar as a possible NPE (java:S2259): the method re-read URLConfiguration#isTrustedDomainsEnabled() even though isDomainTrusted() had just checked it, so the two reads could disagree and return null to a caller that doesn't expect it. The flag is now checked by the callers and the method, renamed to initializeWithDomain(), always returns the set. The only other caller, parseToSafeURI(String, String), discarded the return value anyway. * suppress java:S3077 on the trustedDomains field with a comment explaining why volatile is both necessary and sufficient here: the only mutation of the field is the wholesale replacement of the supplier by invalidateCache(), and both the memoizing supplier and the ConcurrentHashMap key set it computes are thread-safe on their own. * cover the case of parseToSafeURI(String, String) with trusted domains disabled, which wasn't tested before. Co-Authored-By: Claude Opus 5 (1M context) <noreply(a)anthropic.com> (cherry picked from commit 72be05a450758edfdcbac1b135a35a23a4f5f964) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki/xwiki-platform] 2417a1: XWIKI-24875: Trusted domains aren't updated after ...
by XWiki Notifications 16 Sep '26

16 Sep '26

Branch: refs/heads/stable-17.10.x Home: https://github.com/xwiki/xwiki-platform Commit: 2417a12ab6ce7624eab6bea84444f9defca05d91 https://github.com/xwiki/xwiki-platform/commit/2417a12ab6ce7624eab6bea84444… Author: Michael Hamann <michael.hamann(a)xwiki.com> Date: 2026-09-16 (Wed, 16 Sep 2026) Changed paths: M xwiki-platform-core/xwiki-platform-url/xwiki-platform-url-default/src/main/java/org/xwiki/url/internal/DefaultURLSecurityManager.java M xwiki-platform-core/xwiki-platform-url/xwiki-platform-url-default/src/test/java/org/xwiki/url/internal/DefaultURLSecurityManagerTest.java Log Message: ----------- XWIKI-24875: Trusted domains aren't updated after wiki descriptor change * remove the nullable return of maybeInitializeWithDomain(), reported by Sonar as a possible NPE (java:S2259): the method re-read URLConfiguration#isTrustedDomainsEnabled() even though isDomainTrusted() had just checked it, so the two reads could disagree and return null to a caller that doesn't expect it. The flag is now checked by the callers and the method, renamed to initializeWithDomain(), always returns the set. The only other caller, parseToSafeURI(String, String), discarded the return value anyway. * suppress java:S3077 on the trustedDomains field with a comment explaining why volatile is both necessary and sufficient here: the only mutation of the field is the wholesale replacement of the supplier by invalidateCache(), and both the memoizing supplier and the ConcurrentHashMap key set it computes are thread-safe on their own. * cover the case of parseToSafeURI(String, String) with trusted domains disabled, which wasn't tested before. Co-Authored-By: Claude Opus 5 (1M context) <noreply(a)anthropic.com> (cherry picked from commit 72be05a450758edfdcbac1b135a35a23a4f5f964) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki/xwiki-platform] 72be05: XWIKI-24875: Trusted domains aren't updated after ...
by XWiki Notifications 16 Sep '26

16 Sep '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-platform Commit: 72be05a450758edfdcbac1b135a35a23a4f5f964 https://github.com/xwiki/xwiki-platform/commit/72be05a450758edfdcbac1b135a3… Author: Michael Hamann <michael.hamann(a)xwiki.com> Date: 2026-09-16 (Wed, 16 Sep 2026) Changed paths: M xwiki-platform-core/xwiki-platform-url/xwiki-platform-url-default/src/main/java/org/xwiki/url/internal/DefaultURLSecurityManager.java M xwiki-platform-core/xwiki-platform-url/xwiki-platform-url-default/src/test/java/org/xwiki/url/internal/DefaultURLSecurityManagerTest.java Log Message: ----------- XWIKI-24875: Trusted domains aren't updated after wiki descriptor change * remove the nullable return of maybeInitializeWithDomain(), reported by Sonar as a possible NPE (java:S2259): the method re-read URLConfiguration#isTrustedDomainsEnabled() even though isDomainTrusted() had just checked it, so the two reads could disagree and return null to a caller that doesn't expect it. The flag is now checked by the callers and the method, renamed to initializeWithDomain(), always returns the set. The only other caller, parseToSafeURI(String, String), discarded the return value anyway. * suppress java:S3077 on the trustedDomains field with a comment explaining why volatile is both necessary and sufficient here: the only mutation of the field is the wholesale replacement of the supplier by invalidateCache(), and both the memoizing supplier and the ConcurrentHashMap key set it computes are thread-safe on their own. * cover the case of parseToSafeURI(String, String) with trusted domains disabled, which wasn't tested before. Co-Authored-By: Claude Opus 5 (1M context) <noreply(a)anthropic.com> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki-contrib/application-security-advisory] 20b2e0: Translated using Weblate (French)
by XWiki Notifications 16 Sep '26

16 Sep '26

Branch: refs/heads/master Home: https://github.com/xwiki-contrib/application-security-advisory Commit: 20b2e05c7733969801058ac56320189673653fa5 https://github.com/xwiki-contrib/application-security-advisory/commit/20b2e… Author: Simon Urli <simon.urli(a)xwiki.com> Date: 2026-09-16 (Wed, 16 Sep 2026) Changed paths: M application-security-advisory-ui/src/main/resources/SecurityAdvisoryApplication/Code/SecurityAdvisoryApplicationTranslations.fr.xml Log Message: ----------- Translated using Weblate (French) Currently translated at 90.4% (95 of 105 strings) Translation: XWiki Contrib/Application Security Advisory UI Translate-URL: https://l10n.xwiki.org/projects/xwiki-contrib/application-security-advisory… To unsubscribe from these emails, change your notification settings at https://github.com/xwiki-contrib/application-security-advisory/settings/not…

1 0

[xwiki/xwiki-dev-llm]
by XWiki Notifications 16 Sep '26

16 Sep '26

Branch: refs/tags/v1.10.1 Home: https://github.com/xwiki/xwiki-dev-llm To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] 1d5332: [Misc] Release 1.10.1
by XWiki Notifications 16 Sep '26

16 Sep '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-dev-llm Commit: 1d5332d0601c6226556259eb387d114a2195829a https://github.com/xwiki/xwiki-dev-llm/commit/1d5332d0601c6226556259eb387d1… Author: github-actions[bot] <41898282+github-actions[bot](a)users.noreply.github.com> Date: 2026-09-16 (Wed, 16 Sep 2026) Changed paths: M .claude-plugin/marketplace.json M kimi.plugin.json M opencode.jsonc M xwiki/.claude-plugin/plugin.json Log Message: ----------- [Misc] Release 1.10.1 * content edits only (no capability added or removed) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm]
by XWiki Notifications 16 Sep '26

16 Sep '26

Branch: refs/heads/sonar-s1214-policy Home: https://github.com/xwiki/xwiki-dev-llm To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] 6e18c6: [Misc] Record the java:S1214 policy agreed on the ...
by XWiki Notifications 16 Sep '26

16 Sep '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-dev-llm Commit: 6e18c6a9c84690c531abd03e5f557e1a68c18d41 https://github.com/xwiki/xwiki-dev-llm/commit/6e18c6a9c84690c531abd03e5f557… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-09-16 (Wed, 16 Sep 2026) Changed paths: M xwiki/okf/conventions/code-style.md M xwiki/okf/sonarqube/constant-and-resource-rules.md M xwiki/okf/sonarqube/index.md Log Message: ----------- [Misc] Record the java:S1214 policy agreed on the forum * On a published API, java:S1214 is retired in the code with @SuppressWarnings plus its reason, not refactored and not merely marked Accepted in SonarCloud. * In an internal package it is a normal fix, so it moves out of the denylist and into the constant-and-resource family file. * In a -legacy module it is excluded pom-wide, so document the sonar.issue.ignore.multicriteria mechanism next to the @SuppressWarnings convention. Co-Authored-By: Claude Opus 5 (1M context) <noreply(a)anthropic.com> Commit: 3f1d83ec2a15701fb791f11635e85d9f746246ba https://github.com/xwiki/xwiki-dev-llm/commit/3f1d83ec2a15701fb791f11635e85… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-09-16 (Wed, 16 Sep 2026) Changed paths: M xwiki/okf/servers/index.md Log Message: ----------- [Misc] Parse ~/.xwiki-credentials instead of sourcing it * An unquoted password containing shell metacharacters makes `source` a syntax error, and bash quotes the offending line — password included — into the output, so sourcing leaks the secret exactly when it is strong. Co-Authored-By: Claude Opus 5 (1M context) <noreply(a)anthropic.com> Commit: 24ca1242cdaf83762a11a877fbf8f7b813ae4dd1 https://github.com/xwiki/xwiki-dev-llm/commit/24ca1242cdaf83762a11a877fbf8f… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-09-16 (Wed, 16 Sep 2026) Changed paths: M xwiki/okf/conventions/code-style.md M xwiki/okf/servers/index.md M xwiki/okf/sonarqube/constant-and-resource-rules.md M xwiki/okf/sonarqube/index.md Log Message: ----------- Merge pull request #141 from xwiki/sonar-s1214-policy [Misc] Record the java:S1214 policy agreed on the forum Compare: https://github.com/xwiki/xwiki-dev-llm/compare/60276034848f...24ca1242cdaf To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0