September 2026 - notifications

[[email protected]][Issue] Updates for XCOMMONS-3791: Upgrade to AWS SDK 2.54.19
by XWiki Notifications 16 Sep '26

16 Sep '26

1 0

[xwiki/xwiki-platform] 7832c2: XWIKI-24999: Path traversal protection during WebJ...
by XWiki Notifications 16 Sep '26

16 Sep '26

Branch: refs/heads/XWIKI-24999 Home: https://github.com/xwiki/xwiki-platform Commit: 7832c2de3af4b2e540979447099a006f68f7d474 https://github.com/xwiki/xwiki-platform/commit/7832c2de3af4b2e540979447099a… Author: Simon Urli <simon.urli(a)xwiki.com> Date: 2026-09-16 (Wed, 16 Sep 2026) Changed paths: M xwiki-platform-core/xwiki-platform-webjars/xwiki-platform-webjars-api/pom.xml M xwiki-platform-core/xwiki-platform-webjars/xwiki-platform-webjars-api/src/main/java/org/xwiki/webjars/internal/FilesystemResourceReferenceCopier.java M xwiki-platform-core/xwiki-platform-webjars/xwiki-platform-webjars-api/src/test/java/org/xwiki/webjars/internal/FilesystemResourceReferenceCopierTest.java Log Message: ----------- XWIKI-24999: Path traversal protection during WebJar export can be bypassed through a sibling of the export directory * Bulletproof against unlikely path traversal To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki/xwiki-commons] a7452e: XCOMMONS-3791: Upgrade to AWS SDK 2.54.19
by XWiki Notifications 16 Sep '26

16 Sep '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-commons Commit: a7452eb5e3692499cb776f2ec017650f53f62c12 https://github.com/xwiki/xwiki-commons/commit/a7452eb5e3692499cb776f2ec0176… Author: Thomas Mortagne <thomas.mortagne(a)gmail.com> Date: 2026-09-16 (Wed, 16 Sep 2026) Changed paths: M pom.xml Log Message: ----------- XCOMMONS-3791: Upgrade to AWS SDK 2.54.19 To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-commons/settings/notifications

1 0

[[email protected]][Issue] Updates for XWIKI-24999: Path traversal protection during WebJar export can be bypassed through a sibling of the export directory
by XWiki Notifications 16 Sep '26

16 Sep '26

1 0

[xwiki/xwiki-platform] f01948: XWIKI-24875: Trusted domains aren't updated after ...
by XWiki Notifications 16 Sep '26

16 Sep '26

Branch: refs/heads/stable-18.8.x Home: https://github.com/xwiki/xwiki-platform Commit: f01948398408a4d36d669340c6dbeea1887ca0a5 https://github.com/xwiki/xwiki-platform/commit/f01948398408a4d36d669340c6db… Author: Michael Hamann <michael.hamann(a)xwiki.com> Date: 2026-09-16 (Wed, 16 Sep 2026) Changed paths: M xwiki-platform-core/xwiki-platform-url/xwiki-platform-url-default/src/main/java/org/xwiki/url/internal/DefaultURLSecurityManager.java M xwiki-platform-core/xwiki-platform-url/xwiki-platform-url-default/src/test/java/org/xwiki/url/internal/DefaultURLSecurityManagerTest.java Log Message: ----------- XWIKI-24875: Trusted domains aren't updated after wiki descriptor change * remove the nullable return of maybeInitializeWithDomain(), reported by Sonar as a possible NPE (java:S2259): the method re-read URLConfiguration#isTrustedDomainsEnabled() even though isDomainTrusted() had just checked it, so the two reads could disagree and return null to a caller that doesn't expect it. The flag is now checked by the callers and the method, renamed to initializeWithDomain(), always returns the set. The only other caller, parseToSafeURI(String, String), discarded the return value anyway. * suppress java:S3077 on the trustedDomains field with a comment explaining why volatile is both necessary and sufficient here: the only mutation of the field is the wholesale replacement of the supplier by invalidateCache(), and both the memoizing supplier and the ConcurrentHashMap key set it computes are thread-safe on their own. * cover the case of parseToSafeURI(String, String) with trusted domains disabled, which wasn't tested before. Co-Authored-By: Claude Opus 5 (1M context) <noreply(a)anthropic.com> (cherry picked from commit 72be05a450758edfdcbac1b135a35a23a4f5f964) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki/xwiki-platform] 8fb8ef: XWIKI-24875: Trusted domains aren't updated after ...
by XWiki Notifications 16 Sep '26

16 Sep '26

Branch: refs/heads/stable-18.4.x Home: https://github.com/xwiki/xwiki-platform Commit: 8fb8ef4f9e30027be25ce2a8e8044aebd69066d7 https://github.com/xwiki/xwiki-platform/commit/8fb8ef4f9e30027be25ce2a8e804… Author: Michael Hamann <michael.hamann(a)xwiki.com> Date: 2026-09-16 (Wed, 16 Sep 2026) Changed paths: M xwiki-platform-core/xwiki-platform-url/xwiki-platform-url-default/src/main/java/org/xwiki/url/internal/DefaultURLSecurityManager.java M xwiki-platform-core/xwiki-platform-url/xwiki-platform-url-default/src/test/java/org/xwiki/url/internal/DefaultURLSecurityManagerTest.java Log Message: ----------- XWIKI-24875: Trusted domains aren't updated after wiki descriptor change * remove the nullable return of maybeInitializeWithDomain(), reported by Sonar as a possible NPE (java:S2259): the method re-read URLConfiguration#isTrustedDomainsEnabled() even though isDomainTrusted() had just checked it, so the two reads could disagree and return null to a caller that doesn't expect it. The flag is now checked by the callers and the method, renamed to initializeWithDomain(), always returns the set. The only other caller, parseToSafeURI(String, String), discarded the return value anyway. * suppress java:S3077 on the trustedDomains field with a comment explaining why volatile is both necessary and sufficient here: the only mutation of the field is the wholesale replacement of the supplier by invalidateCache(), and both the memoizing supplier and the ConcurrentHashMap key set it computes are thread-safe on their own. * cover the case of parseToSafeURI(String, String) with trusted domains disabled, which wasn't tested before. Co-Authored-By: Claude Opus 5 (1M context) <noreply(a)anthropic.com> (cherry picked from commit 72be05a450758edfdcbac1b135a35a23a4f5f964) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki/xwiki-platform] 2417a1: XWIKI-24875: Trusted domains aren't updated after ...
by XWiki Notifications 16 Sep '26

16 Sep '26

Branch: refs/heads/stable-17.10.x Home: https://github.com/xwiki/xwiki-platform Commit: 2417a12ab6ce7624eab6bea84444f9defca05d91 https://github.com/xwiki/xwiki-platform/commit/2417a12ab6ce7624eab6bea84444… Author: Michael Hamann <michael.hamann(a)xwiki.com> Date: 2026-09-16 (Wed, 16 Sep 2026) Changed paths: M xwiki-platform-core/xwiki-platform-url/xwiki-platform-url-default/src/main/java/org/xwiki/url/internal/DefaultURLSecurityManager.java M xwiki-platform-core/xwiki-platform-url/xwiki-platform-url-default/src/test/java/org/xwiki/url/internal/DefaultURLSecurityManagerTest.java Log Message: ----------- XWIKI-24875: Trusted domains aren't updated after wiki descriptor change * remove the nullable return of maybeInitializeWithDomain(), reported by Sonar as a possible NPE (java:S2259): the method re-read URLConfiguration#isTrustedDomainsEnabled() even though isDomainTrusted() had just checked it, so the two reads could disagree and return null to a caller that doesn't expect it. The flag is now checked by the callers and the method, renamed to initializeWithDomain(), always returns the set. The only other caller, parseToSafeURI(String, String), discarded the return value anyway. * suppress java:S3077 on the trustedDomains field with a comment explaining why volatile is both necessary and sufficient here: the only mutation of the field is the wholesale replacement of the supplier by invalidateCache(), and both the memoizing supplier and the ConcurrentHashMap key set it computes are thread-safe on their own. * cover the case of parseToSafeURI(String, String) with trusted domains disabled, which wasn't tested before. Co-Authored-By: Claude Opus 5 (1M context) <noreply(a)anthropic.com> (cherry picked from commit 72be05a450758edfdcbac1b135a35a23a4f5f964) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki/xwiki-platform] 72be05: XWIKI-24875: Trusted domains aren't updated after ...
by XWiki Notifications 16 Sep '26

16 Sep '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-platform Commit: 72be05a450758edfdcbac1b135a35a23a4f5f964 https://github.com/xwiki/xwiki-platform/commit/72be05a450758edfdcbac1b135a3… Author: Michael Hamann <michael.hamann(a)xwiki.com> Date: 2026-09-16 (Wed, 16 Sep 2026) Changed paths: M xwiki-platform-core/xwiki-platform-url/xwiki-platform-url-default/src/main/java/org/xwiki/url/internal/DefaultURLSecurityManager.java M xwiki-platform-core/xwiki-platform-url/xwiki-platform-url-default/src/test/java/org/xwiki/url/internal/DefaultURLSecurityManagerTest.java Log Message: ----------- XWIKI-24875: Trusted domains aren't updated after wiki descriptor change * remove the nullable return of maybeInitializeWithDomain(), reported by Sonar as a possible NPE (java:S2259): the method re-read URLConfiguration#isTrustedDomainsEnabled() even though isDomainTrusted() had just checked it, so the two reads could disagree and return null to a caller that doesn't expect it. The flag is now checked by the callers and the method, renamed to initializeWithDomain(), always returns the set. The only other caller, parseToSafeURI(String, String), discarded the return value anyway. * suppress java:S3077 on the trustedDomains field with a comment explaining why volatile is both necessary and sufficient here: the only mutation of the field is the wholesale replacement of the supplier by invalidateCache(), and both the memoizing supplier and the ConcurrentHashMap key set it computes are thread-safe on their own. * cover the case of parseToSafeURI(String, String) with trusted domains disabled, which wasn't tested before. Co-Authored-By: Claude Opus 5 (1M context) <noreply(a)anthropic.com> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki-contrib/application-security-advisory] 20b2e0: Translated using Weblate (French)
by XWiki Notifications 16 Sep '26

16 Sep '26

Branch: refs/heads/master Home: https://github.com/xwiki-contrib/application-security-advisory Commit: 20b2e05c7733969801058ac56320189673653fa5 https://github.com/xwiki-contrib/application-security-advisory/commit/20b2e… Author: Simon Urli <simon.urli(a)xwiki.com> Date: 2026-09-16 (Wed, 16 Sep 2026) Changed paths: M application-security-advisory-ui/src/main/resources/SecurityAdvisoryApplication/Code/SecurityAdvisoryApplicationTranslations.fr.xml Log Message: ----------- Translated using Weblate (French) Currently translated at 90.4% (95 of 105 strings) Translation: XWiki Contrib/Application Security Advisory UI Translate-URL: https://l10n.xwiki.org/projects/xwiki-contrib/application-security-advisory… To unsubscribe from these emails, change your notification settings at https://github.com/xwiki-contrib/application-security-advisory/settings/not…

1 0

[xwiki/xwiki-dev-llm]
by XWiki Notifications 16 Sep '26

16 Sep '26

Branch: refs/tags/v1.10.1 Home: https://github.com/xwiki/xwiki-dev-llm To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0