September 2026 - notifications

[xwiki/xwiki-dev-llm] 6d217c: [Misc] Release 1.9.9
by XWiki Notifications 12 Sep '26

12 Sep '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-dev-llm Commit: 6d217c6e91545f1655101688f950689d0b695c6b https://github.com/xwiki/xwiki-dev-llm/commit/6d217c6e91545f1655101688f9506… Author: github-actions[bot] <41898282+github-actions[bot](a)users.noreply.github.com> Date: 2026-09-12 (Sat, 12 Sep 2026) Changed paths: M .claude-plugin/marketplace.json M kimi.plugin.json M opencode.jsonc M xwiki/.claude-plugin/plugin.json Log Message: ----------- [Misc] Release 1.9.9 * content edits only (no capability added or removed) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm]
by XWiki Notifications 12 Sep '26

12 Sep '26

Branch: refs/heads/cvss-source-mandate Home: https://github.com/xwiki/xwiki-dev-llm To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] 9f7fe5: [Misc] Take every CVSS metric from the security po...
by XWiki Notifications 12 Sep '26

12 Sep '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-dev-llm Commit: 9f7fe5965819236a6e3b1cbc626fb05b05c75cea https://github.com/xwiki/xwiki-dev-llm/commit/9f7fe5965819236a6e3b1cbc626fb… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-09-12 (Sat, 12 Sep 2026) Changed paths: M xwiki/okf/index.md M xwiki/okf/processes/security-policy.md Log Message: ----------- [Misc] Take every CVSS metric from the security policy instead of scoring from memory The scoring section listed a subset of the policy's rules and only asked for a re-read "when the exact scoring matters", which is weak enough that a score can be computed from generic CVSS instinct and still look policy-compliant. * Make reading the policy's "Best practices for computing CVSS" section mandatory before setting a vector, and link that section's anchor directly rather than the page. * Carry the rules that were missing and that generic instinct gets wrong: Attack Vector is always Network; XSS fixes the subsequent-system impacts (C/I Low, A None) as well as the vulnerable-system ones, so high subsequent impact asserts code execution and has to be established; the Script-right caveat drops all impacts to Low and is about the right the attack needs, not the one it yields; Attack Complexity, Attack Requirements and User Interaction have no XWiki best practice, and viewing a page is passive interaction. * Reword the verify recipe to say the values must not be scored from, replacing the softer "do not quote as gospel", and fold the calculator sentence into the new lead-in. Co-Authored-By: Claude Opus 5 (1M context) <noreply(a)anthropic.com> Commit: bf0366f3bd41fc3e90ff45c0572a5c2809b07f8e https://github.com/xwiki/xwiki-dev-llm/commit/bf0366f3bd41fc3e90ff45c0572a5… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-09-12 (Sat, 12 Sep 2026) Changed paths: M xwiki/okf/index.md M xwiki/okf/processes/security-policy.md M xwiki/skills/xwiki-security-advisory/SKILL.md Log Message: ----------- [Misc] Point CVSS scoring at the policy section instead of caching its values * Keep the mandate and the anchored link to "Best practices for computing CVSS", but hold no per-metric values in the OKF file: the verify: block says not to score from the file, so caching the values it forbids scoring from is pure liability. * What stays is XWiki's interpretation - the rights-to-Privileges-Required mapping - and the traps: subsequent-system impact asserts code execution rather than XSS, the right-required caveat is about the right the attack needs and not the one it yields, viewing a page is passive interaction. * Drop the same cached values from xwiki-security-advisory Step 2, which fetches that section live anyway. The two copies had already diverged: the skill carried SSRF, the OKF file did not. * Trim the okf/index.md entry back to routing - the imperative belongs in the file, not the map - and restore the (volatile; verify) marker the corpus uses to flag a volatile fact. Co-Authored-By: Claude Opus 5 (1M context) <noreply(a)anthropic.com> Commit: 07ad4ffd6f83024f072cbf68c9d97204a24dc7db https://github.com/xwiki/xwiki-dev-llm/commit/07ad4ffd6f83024f072cbf68c9d97… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-09-12 (Sat, 12 Sep 2026) Changed paths: M xwiki/okf/index.md M xwiki/okf/processes/security-policy.md M xwiki/skills/xwiki-security-advisory/SKILL.md Log Message: ----------- Merge pull request #105 from xwiki/cvss-source-mandate [Misc] Take every CVSS metric from the security policy instead of scoring from memory Compare: https://github.com/xwiki/xwiki-dev-llm/compare/418f55ab9e35...07ad4ffd6f83 To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] 9f7fe5: [Misc] Take every CVSS metric from the security po...
by XWiki Notifications 12 Sep '26

12 Sep '26

Branch: refs/heads/cvss-source-mandate Home: https://github.com/xwiki/xwiki-dev-llm Commit: 9f7fe5965819236a6e3b1cbc626fb05b05c75cea https://github.com/xwiki/xwiki-dev-llm/commit/9f7fe5965819236a6e3b1cbc626fb… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-09-12 (Sat, 12 Sep 2026) Changed paths: M xwiki/okf/index.md M xwiki/okf/processes/security-policy.md Log Message: ----------- [Misc] Take every CVSS metric from the security policy instead of scoring from memory The scoring section listed a subset of the policy's rules and only asked for a re-read "when the exact scoring matters", which is weak enough that a score can be computed from generic CVSS instinct and still look policy-compliant. * Make reading the policy's "Best practices for computing CVSS" section mandatory before setting a vector, and link that section's anchor directly rather than the page. * Carry the rules that were missing and that generic instinct gets wrong: Attack Vector is always Network; XSS fixes the subsequent-system impacts (C/I Low, A None) as well as the vulnerable-system ones, so high subsequent impact asserts code execution and has to be established; the Script-right caveat drops all impacts to Low and is about the right the attack needs, not the one it yields; Attack Complexity, Attack Requirements and User Interaction have no XWiki best practice, and viewing a page is passive interaction. * Reword the verify recipe to say the values must not be scored from, replacing the softer "do not quote as gospel", and fold the calculator sentence into the new lead-in. Co-Authored-By: Claude Opus 5 (1M context) <noreply(a)anthropic.com> Commit: bf0366f3bd41fc3e90ff45c0572a5c2809b07f8e https://github.com/xwiki/xwiki-dev-llm/commit/bf0366f3bd41fc3e90ff45c0572a5… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-09-12 (Sat, 12 Sep 2026) Changed paths: M xwiki/okf/index.md M xwiki/okf/processes/security-policy.md M xwiki/skills/xwiki-security-advisory/SKILL.md Log Message: ----------- [Misc] Point CVSS scoring at the policy section instead of caching its values * Keep the mandate and the anchored link to "Best practices for computing CVSS", but hold no per-metric values in the OKF file: the verify: block says not to score from the file, so caching the values it forbids scoring from is pure liability. * What stays is XWiki's interpretation - the rights-to-Privileges-Required mapping - and the traps: subsequent-system impact asserts code execution rather than XSS, the right-required caveat is about the right the attack needs and not the one it yields, viewing a page is passive interaction. * Drop the same cached values from xwiki-security-advisory Step 2, which fetches that section live anyway. The two copies had already diverged: the skill carried SSRF, the OKF file did not. * Trim the okf/index.md entry back to routing - the imperative belongs in the file, not the map - and restore the (volatile; verify) marker the corpus uses to flag a volatile fact. Co-Authored-By: Claude Opus 5 (1M context) <noreply(a)anthropic.com> Compare: https://github.com/xwiki/xwiki-dev-llm/compare/b3bef903edde...bf0366f3bd41 To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm]
by XWiki Notifications 12 Sep '26

12 Sep '26

Branch: refs/tags/v1.9.8 Home: https://github.com/xwiki/xwiki-dev-llm To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] 418f55: [Misc] Release 1.9.8
by XWiki Notifications 12 Sep '26

12 Sep '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-dev-llm Commit: 418f55ab9e35e6731b694e13e6457b0a93153b19 https://github.com/xwiki/xwiki-dev-llm/commit/418f55ab9e35e6731b694e13e6457… Author: github-actions[bot] <41898282+github-actions[bot](a)users.noreply.github.com> Date: 2026-09-12 (Sat, 12 Sep 2026) Changed paths: M .claude-plugin/marketplace.json M kimi.plugin.json M opencode.jsonc M xwiki/.claude-plugin/plugin.json Log Message: ----------- [Misc] Release 1.9.8 * content edits only (no capability added or removed) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm]
by XWiki Notifications 12 Sep '26

12 Sep '26

Branch: refs/heads/okf-event-listener-cluster-convention Home: https://github.com/xwiki/xwiki-dev-llm To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] df772a: [Misc] Document AbstractEventListener vs AbstractL...
by XWiki Notifications 12 Sep '26

12 Sep '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-dev-llm Commit: df772a972fd2d038285cb431f29032b471a67c90 https://github.com/xwiki/xwiki-dev-llm/commit/df772a972fd2d038285cb431f2903… Author: Simon Urli <simon.urli(a)xwiki.com> Date: 2026-09-11 (Fri, 11 Sep 2026) Changed paths: M xwiki/okf/architecture/component-system.md M xwiki/okf/index.md Log Message: ----------- [Misc] Document AbstractEventListener vs AbstractLocalEventListener choice * Add a convention to okf/architecture/component-system.md: when writing a new EventListener, decide whether it must run only for locally-originated events (AbstractLocalEventListener) or also for cluster-replicated remote ones (AbstractEventListener), and ask when it's not obvious. * Update the topic's one-line summary in okf/index.md accordingly. Co-Authored-By: Claude Sonnet 5 <noreply(a)anthropic.com> Commit: dac7fef40e9584683698baccffae8918d9987bf9 https://github.com/xwiki/xwiki-dev-llm/commit/dac7fef40e9584683698baccffae8… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-09-12 (Sat, 12 Sep 2026) Changed paths: M xwiki/okf/architecture/component-system.md M xwiki/okf/index.md Log Message: ----------- [Misc] Trim the event-listener entry to one statement of the rule * Keep the `okf/index.md` map line to routing ("local-only vs. cluster-wide event listeners") instead of restating the rule, the two class names and the method to override — an index entry that answers the question makes opening the topic file pointless and pays for it in every read. * Restore the one-line `summary:` frontmatter, which was a third copy of the same fact. * Tighten the section itself: drop the restatement of "runs for remote events too", and name the added `xwiki-platform-observation-remote` dependency as the consequence it is. Co-Authored-By: Claude Opus 5 (1M context) <noreply(a)anthropic.com> Commit: 6a6eb776a190e8df8ea3ed5a6b202563a377aa7a https://github.com/xwiki/xwiki-dev-llm/commit/6a6eb776a190e8df8ea3ed5a6b202… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-09-12 (Sat, 12 Sep 2026) Changed paths: M xwiki/okf/architecture/component-system.md M xwiki/okf/index.md Log Message: ----------- Merge pull request #134 from xwiki/okf-event-listener-cluster-convention [Misc] Document AbstractEventListener vs AbstractLocalEventListener choice Compare: https://github.com/xwiki/xwiki-dev-llm/compare/b898281b7991...6a6eb776a190 To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] dac7fe: [Misc] Trim the event-listener entry to one statem...
by XWiki Notifications 12 Sep '26

12 Sep '26

Branch: refs/heads/okf-event-listener-cluster-convention Home: https://github.com/xwiki/xwiki-dev-llm Commit: dac7fef40e9584683698baccffae8918d9987bf9 https://github.com/xwiki/xwiki-dev-llm/commit/dac7fef40e9584683698baccffae8… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-09-12 (Sat, 12 Sep 2026) Changed paths: M xwiki/okf/architecture/component-system.md M xwiki/okf/index.md Log Message: ----------- [Misc] Trim the event-listener entry to one statement of the rule * Keep the `okf/index.md` map line to routing ("local-only vs. cluster-wide event listeners") instead of restating the rule, the two class names and the method to override — an index entry that answers the question makes opening the topic file pointless and pays for it in every read. * Restore the one-line `summary:` frontmatter, which was a third copy of the same fact. * Tighten the section itself: drop the restatement of "runs for remote events too", and name the added `xwiki-platform-observation-remote` dependency as the consequence it is. Co-Authored-By: Claude Opus 5 (1M context) <noreply(a)anthropic.com> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm]
by XWiki Notifications 12 Sep '26

12 Sep '26

Branch: refs/tags/v1.9.7 Home: https://github.com/xwiki/xwiki-dev-llm To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0