September 2026 - notifications

[xwiki/xwiki-dev-llm] b3bef9: [Misc] Take every CVSS metric from the security po...
by XWiki Notifications 03 Sep '26

03 Sep '26

Branch: refs/heads/cvss-source-mandate Home: https://github.com/xwiki/xwiki-dev-llm Commit: b3bef903eddec1d0b968f2adff6a7e1dc54d8396 https://github.com/xwiki/xwiki-dev-llm/commit/b3bef903eddec1d0b968f2adff6a7… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-09-03 (Thu, 03 Sep 2026) Changed paths: M xwiki/okf/index.md M xwiki/okf/processes/security-policy.md Log Message: ----------- [Misc] Take every CVSS metric from the security policy instead of scoring from memory The scoring section listed a subset of the policy's rules and only asked for a re-read "when the exact scoring matters", which is weak enough that a score can be computed from generic CVSS instinct and still look policy-compliant. * Make reading the policy's "Best practices for computing CVSS" section mandatory before setting a vector, and link that section's anchor directly rather than the page. * Carry the rules that were missing and that generic instinct gets wrong: Attack Vector is always Network; XSS fixes the subsequent-system impacts (C/I Low, A None) as well as the vulnerable-system ones, so high subsequent impact asserts code execution and has to be established; the Script-right caveat drops all impacts to Low and is about the right the attack needs, not the one it yields; Attack Complexity, Attack Requirements and User Interaction have no XWiki best practice, and viewing a page is passive interaction. * Reword the verify recipe to say the values must not be scored from, replacing the softer "do not quote as gospel", and fold the calculator sentence into the new lead-in. Co-Authored-By: Claude Opus 5 (1M context) <noreply(a)anthropic.com> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki-contrib/cristal-integration] 8f6c69: CRISTALINT-36: Upgrade to Cristal 1.7.0
by XWiki Notifications 03 Sep '26

03 Sep '26

Branch: refs/heads/CRISTALINT-36 Home: https://github.com/xwiki-contrib/cristal-integration Commit: 8f6c69eaac6968df4ac63f481f87c39f0b6b2d09 https://github.com/xwiki-contrib/cristal-integration/commit/8f6c69eaac6968d… Author: Pierre Jeanjean <pierre.jeanjean(a)xwiki.com> Date: 2026-09-03 (Thu, 03 Sep 2026) Changed paths: M cristal-integration-webjar/src/main/node/package.json M cristal-integration-webjar/src/main/node/pnpm-lock.yaml Log Message: ----------- CRISTALINT-36: Upgrade to Cristal 1.7.0 To unsubscribe from these emails, change your notification settings at https://github.com/xwiki-contrib/cristal-integration/settings/notifications

1 0

[xwiki-contrib/application-releasenotes] 4ac593: RN-102: Escape the screenshot and video references...
by XWiki Notifications 03 Sep '26

03 Sep '26

Branch: refs/heads/RN-102 Home: https://github.com/xwiki-contrib/application-releasenotes Commit: 4ac593079d0762643f8b8a3bd3be203ee3891557 https://github.com/xwiki-contrib/application-releasenotes/commit/4ac593079d… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-09-03 (Thu, 03 Sep 2026) Changed paths: M application-releasenotes-ui/src/main/resources/ReleaseNotes/Code/Change/ChangeDisplayerVelocityMacros.xml M application-releasenotes-ui/src/test/java/org/xwiki/releasenotes/ChangeScreenshotsPageTest.java M application-releasenotes-ui/src/test/java/org/xwiki/releasenotes/RenderingScriptServiceStub.java Log Message: ----------- RN-102: Escape the screenshot and video references in the change displayer macros * Pass each media reference of a change through $services.rendering.escape in #displayScreenshots before it is emitted, both into the reference part of the gallery and standalone image links and into the attachment parameter of the html5video macro, so that a reference is carried as a single value rather than being re-parsed as wiki syntax, consistent with how the change title is escaped in the displayers. * Extend the screenshots page test with the display of the media block, asserting that a reference holding a link or parameter delimiter stays one image and one player, that nothing of it ends up rendered on its own, and that a plain attachment reference still reaches the image and the player unchanged. Co-Authored-By: Claude Opus 5 (1M context) <noreply(a)anthropic.com> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki-contrib/application-releasenotes/settings/notifica…

1 0

[xwiki/xwiki-platform] 952247: XWIKI-24747: Improve user document events handling
by XWiki Notifications 03 Sep '26

03 Sep '26

Branch: refs/heads/stable-16.10.x Home: https://github.com/xwiki/xwiki-platform Commit: 952247add7f9a47eefac2b5f9169d2b023f45c3a https://github.com/xwiki/xwiki-platform/commit/952247add7f9a47eefac2b5f9169… Author: Thomas Mortagne <thomas.mortagne(a)gmail.com> Date: 2026-09-03 (Thu, 03 Sep 2026) Changed paths: M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java M xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/XWikiTest.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authorization/xwiki-platform-security-authorization-bridge/src/main/java/org/xwiki/security/authorization/internal/RightsFilterListener.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authorization/xwiki-platform-security-authorization-bridge/src/test/java/org/xwiki/security/authorization/internal/RightsFilterListenerTest.java Log Message: ----------- XWIKI-24747: Improve user document events handling XWIKI-24780: A listener cannot modify a renamed document through DocumentUpdating/CreatingEvent * added a hack which modify the document with changes made by listener right before the actual store rename, with with dirty=false and skipping events so that in the end it looks like it was modified as part of the rename * modify RightsFilterListener to apply filtering also during renames, now that it's possible XWIKI-24791: A rename always produce a DocumentCreating/edEvent even when the target location already exist * use the document currently located at the target as original document in the simulated renamind/ed XWikiDocument XWIKI-24794: Only cancel forbidden right changes instead of all of them (cherry picked from commit ce147b6da23a354ed498efa5fd8267a1fbd9ea12) (cherry picked from commit 0e8c792b38a5b852bd1d8282b3e622540fcf1e13) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki/xwiki-platform] 3e248d: XWIKI-24776: Wrong display of children tab
by XWiki Notifications 03 Sep '26

03 Sep '26

Branch: refs/heads/stable-16.10.x Home: https://github.com/xwiki/xwiki-platform Commit: 3e248da0c87d89ecee8a594ec825d30ecc0c8ef9 https://github.com/xwiki/xwiki-platform/commit/3e248da0c87d89ecee8a594ec825… Author: Simon Urli <simon.urli(a)xwiki.com> Date: 2026-09-03 (Thu, 03 Sep 2026) Changed paths: M xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/children.vm Log Message: ----------- XWIKI-24776: Wrong display of children tab (cherry picked from commit 37d17557c5790d6e67ce6b5b558db5a280ac18c4) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki/xwiki-platform] 3e248d: XWIKI-24776: Wrong display of children tab
by XWiki Notifications 03 Sep '26

03 Sep '26

Branch: refs/heads/stable-16.10.x Home: https://github.com/xwiki/xwiki-platform Commit: 3e248da0c87d89ecee8a594ec825d30ecc0c8ef9 https://github.com/xwiki/xwiki-platform/commit/3e248da0c87d89ecee8a594ec825… Author: Simon Urli <simon.urli(a)xwiki.com> Date: 2026-09-03 (Thu, 03 Sep 2026) Changed paths: M xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/children.vm Log Message: ----------- XWIKI-24776: Wrong display of children tab (cherry picked from commit 37d17557c5790d6e67ce6b5b558db5a280ac18c4) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki-contrib/application-releasenotes] 9677ea: RN-101: Escape the product and version values pass...
by XWiki Notifications 03 Sep '26

03 Sep '26

Branch: refs/heads/RN-101 Home: https://github.com/xwiki-contrib/application-releasenotes Commit: 9677eaeb771ffe371ce1aebce728832fee12e96a https://github.com/xwiki-contrib/application-releasenotes/commit/9677eaeb77… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-09-03 (Thu, 03 Sep 2026) Changed paths: M application-releasenotes-ui/src/main/resources/ReleaseNotes/Code/Change/ReleaseNotesChangesMacro.xml M application-releasenotes-ui/src/test/java/org/xwiki/releasenotes/ReleaseNotesChangesMacroPageTest.java M application-releasenotes-ui/src/test/java/org/xwiki/releasenotes/RenderingScriptServiceStub.java Log Message: ----------- RN-101: Escape the product and version values passed to the getChanges macro calls * Pass the product read from the release note xobject and the versions derived from the page name through $services.rendering.escape before placing them into the six getChanges calls the release note body builds, so a value carrying a double quote stays inside its macro parameter instead of closing it and having the rest of the value re-parsed as wiki syntax. The versions are escaped only once the milestone/RC/final parsing has built them, since that parsing works on the raw page name. * Add two page tests asserting that a product and a version space name carrying a quote and a macro reach the query as a single filter with their own value, and make the $services.rendering stand-in escape the way the platform does so the aggregation of a final release note is checked through it. Co-Authored-By: Claude Opus 5 (1M context) <noreply(a)anthropic.com> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki-contrib/application-releasenotes/settings/notifica…

1 0

[xwiki/xwiki-platform] c18578: XWIKI-24747: Improve user document events handling
by XWiki Notifications 03 Sep '26

03 Sep '26

Branch: refs/heads/stable-17.10.x Home: https://github.com/xwiki/xwiki-platform Commit: c185786d3435329ef65a46d094c50594a555cbae https://github.com/xwiki/xwiki-platform/commit/c185786d3435329ef65a46d094c5… Author: Thomas Mortagne <thomas.mortagne(a)gmail.com> Date: 2026-09-03 (Thu, 03 Sep 2026) Changed paths: M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java M xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/XWikiTest.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authorization/xwiki-platform-security-authorization-bridge/src/main/java/org/xwiki/security/authorization/internal/RightsFilterListener.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authorization/xwiki-platform-security-authorization-bridge/src/test/java/org/xwiki/security/authorization/internal/RightsFilterListenerTest.java Log Message: ----------- XWIKI-24747: Improve user document events handling XWIKI-24780: A listener cannot modify a renamed document through DocumentUpdating/CreatingEvent * added a hack which modify the document with changes made by listener right before the actual store rename, with with dirty=false and skipping events so that in the end it looks like it was modified as part of the rename * modify RightsFilterListener to apply filtering also during renames, now that it's possible XWIKI-24791: A rename always produce a DocumentCreating/edEvent even when the target location already exist * use the document currently located at the target as original document in the simulated renamind/ed XWikiDocument XWIKI-24794: Only cancel forbidden right changes instead of all of them (cherry picked from commit ce147b6da23a354ed498efa5fd8267a1fbd9ea12) (cherry picked from commit 0e8c792b38a5b852bd1d8282b3e622540fcf1e13) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki/xwiki-platform] 0e8c79: XWIKI-24747: Improve user document events handling
by XWiki Notifications 03 Sep '26

03 Sep '26

Branch: refs/heads/stable-18.4.x Home: https://github.com/xwiki/xwiki-platform Commit: 0e8c792b38a5b852bd1d8282b3e622540fcf1e13 https://github.com/xwiki/xwiki-platform/commit/0e8c792b38a5b852bd1d8282b3e6… Author: Thomas Mortagne <thomas.mortagne(a)gmail.com> Date: 2026-09-03 (Thu, 03 Sep 2026) Changed paths: M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java M xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/XWikiTest.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authorization/xwiki-platform-security-authorization-bridge/src/main/java/org/xwiki/security/authorization/internal/RightsFilterListener.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authorization/xwiki-platform-security-authorization-bridge/src/test/java/org/xwiki/security/authorization/internal/RightsFilterListenerTest.java Log Message: ----------- XWIKI-24747: Improve user document events handling XWIKI-24780: A listener cannot modify a renamed document through DocumentUpdating/CreatingEvent * added a hack which modify the document with changes made by listener right before the actual store rename, with with dirty=false and skipping events so that in the end it looks like it was modified as part of the rename * modify RightsFilterListener to apply filtering also during renames, now that it's possible XWIKI-24791: A rename always produce a DocumentCreating/edEvent even when the target location already exist * use the document currently located at the target as original document in the simulated renamind/ed XWikiDocument XWIKI-24794: Only cancel forbidden right changes instead of all of them (cherry picked from commit ce147b6da23a354ed498efa5fd8267a1fbd9ea12) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki/xwiki-platform] ce147b: XWIKI-24747: Improve user document events handling
by XWiki Notifications 03 Sep '26

03 Sep '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-platform Commit: ce147b6da23a354ed498efa5fd8267a1fbd9ea12 https://github.com/xwiki/xwiki-platform/commit/ce147b6da23a354ed498efa5fd82… Author: Thomas Mortagne <thomas.mortagne(a)gmail.com> Date: 2026-09-03 (Thu, 03 Sep 2026) Changed paths: M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java M xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/XWikiTest.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authorization/xwiki-platform-security-authorization-bridge/src/main/java/org/xwiki/security/authorization/internal/RightsFilterListener.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authorization/xwiki-platform-security-authorization-bridge/src/test/java/org/xwiki/security/authorization/internal/RightsFilterListenerTest.java Log Message: ----------- XWIKI-24747: Improve user document events handling XWIKI-24780: A listener cannot modify a renamed document through DocumentUpdating/CreatingEvent * added a hack which modify the document with changes made by listener right before the actual store rename, with with dirty=false and skipping events so that in the end it looks like it was modified as part of the rename * modify RightsFilterListener to apply filtering also during renames, now that it's possible XWIKI-24791: A rename always produce a DocumentCreating/edEvent even when the target location already exist * use the document currently located at the target as original document in the simulated renamind/ed XWikiDocument XWIKI-24794: Only cancel forbidden right changes instead of all of them To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0