September 2026 - notifications

[xwiki/xwiki-dev-llm] 066732: [Misc] Share the Jenkins client between skills, an...
by XWiki Notifications 12 Sep '26

12 Sep '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-dev-llm Commit: 066732e7a0972260153d39a8a32ff6620b7316f3 https://github.com/xwiki/xwiki-dev-llm/commit/066732e7a0972260153d39a8a32ff… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-09-12 (Sat, 12 Sep 2026) Changed paths: M xwiki/okf/servers/jenkins.md A xwiki/scripts/jenkins.mjs M xwiki/skills/xwiki-release-test-triage/tools/triage.mjs Log Message: ----------- [Misc] Share the Jenkins client between skills, and fix the revision it reads * Extract job addressing, build listing, test reports and revision resolution out of xwiki-release-test-triage's triage.mjs into xwiki/scripts/jenkins.mjs, so that the traps making each of them subtle are written down once and fixed once for every consumer. * Fix which revision a build is reported to have run. Every build carries two lastBuiltRevision actions, because every job checks out the shared xwiki-jenkins-pipeline library alongside the project. triage.mjs selected on the branch name and the library is itself built from master, so on --branch master it returned the library's constant SHA for every repo, and the "commits behind the branch" figure derived from it was meaningless. Select on remoteUrls instead. * Record that trap in okf/servers/jenkins.md, which previously pointed at lastBuiltRevision without saying which of the two to take. Co-Authored-By: Claude Opus 5 (1M context) <noreply(a)anthropic.com> Commit: 1bcb23bea526aa4bc48c359c697a4e9783d1ed5d https://github.com/xwiki/xwiki-dev-llm/commit/1bcb23bea526aa4bc48c359c697a4… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-09-12 (Sat, 12 Sep 2026) Changed paths: M xwiki/okf/servers/jenkins.md A xwiki/scripts/jenkins.mjs M xwiki/skills/xwiki-release-test-triage/tools/triage.mjs Log Message: ----------- Merge pull request #135 from xwiki/ci-jenkins-shared-layer [Misc] Share the Jenkins client between skills, and fix the revision it reads Compare: https://github.com/xwiki/xwiki-dev-llm/compare/6d217c6e9154...1bcb23bea526 To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] 066732: [Misc] Share the Jenkins client between skills, an...
by XWiki Notifications 12 Sep '26

12 Sep '26

Branch: refs/heads/ci-jenkins-shared-layer Home: https://github.com/xwiki/xwiki-dev-llm Commit: 066732e7a0972260153d39a8a32ff6620b7316f3 https://github.com/xwiki/xwiki-dev-llm/commit/066732e7a0972260153d39a8a32ff… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-09-12 (Sat, 12 Sep 2026) Changed paths: M xwiki/okf/servers/jenkins.md A xwiki/scripts/jenkins.mjs M xwiki/skills/xwiki-release-test-triage/tools/triage.mjs Log Message: ----------- [Misc] Share the Jenkins client between skills, and fix the revision it reads * Extract job addressing, build listing, test reports and revision resolution out of xwiki-release-test-triage's triage.mjs into xwiki/scripts/jenkins.mjs, so that the traps making each of them subtle are written down once and fixed once for every consumer. * Fix which revision a build is reported to have run. Every build carries two lastBuiltRevision actions, because every job checks out the shared xwiki-jenkins-pipeline library alongside the project. triage.mjs selected on the branch name and the library is itself built from master, so on --branch master it returned the library's constant SHA for every repo, and the "commits behind the branch" figure derived from it was meaningless. Select on remoteUrls instead. * Record that trap in okf/servers/jenkins.md, which previously pointed at lastBuiltRevision without saying which of the two to take. Co-Authored-By: Claude Opus 5 (1M context) <noreply(a)anthropic.com> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm]
by XWiki Notifications 12 Sep '26

12 Sep '26

Branch: refs/tags/v1.9.9 Home: https://github.com/xwiki/xwiki-dev-llm To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] 6d217c: [Misc] Release 1.9.9
by XWiki Notifications 12 Sep '26

12 Sep '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-dev-llm Commit: 6d217c6e91545f1655101688f950689d0b695c6b https://github.com/xwiki/xwiki-dev-llm/commit/6d217c6e91545f1655101688f9506… Author: github-actions[bot] <41898282+github-actions[bot](a)users.noreply.github.com> Date: 2026-09-12 (Sat, 12 Sep 2026) Changed paths: M .claude-plugin/marketplace.json M kimi.plugin.json M opencode.jsonc M xwiki/.claude-plugin/plugin.json Log Message: ----------- [Misc] Release 1.9.9 * content edits only (no capability added or removed) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm]
by XWiki Notifications 12 Sep '26

12 Sep '26

Branch: refs/heads/cvss-source-mandate Home: https://github.com/xwiki/xwiki-dev-llm To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] 9f7fe5: [Misc] Take every CVSS metric from the security po...
by XWiki Notifications 12 Sep '26

12 Sep '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-dev-llm Commit: 9f7fe5965819236a6e3b1cbc626fb05b05c75cea https://github.com/xwiki/xwiki-dev-llm/commit/9f7fe5965819236a6e3b1cbc626fb… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-09-12 (Sat, 12 Sep 2026) Changed paths: M xwiki/okf/index.md M xwiki/okf/processes/security-policy.md Log Message: ----------- [Misc] Take every CVSS metric from the security policy instead of scoring from memory The scoring section listed a subset of the policy's rules and only asked for a re-read "when the exact scoring matters", which is weak enough that a score can be computed from generic CVSS instinct and still look policy-compliant. * Make reading the policy's "Best practices for computing CVSS" section mandatory before setting a vector, and link that section's anchor directly rather than the page. * Carry the rules that were missing and that generic instinct gets wrong: Attack Vector is always Network; XSS fixes the subsequent-system impacts (C/I Low, A None) as well as the vulnerable-system ones, so high subsequent impact asserts code execution and has to be established; the Script-right caveat drops all impacts to Low and is about the right the attack needs, not the one it yields; Attack Complexity, Attack Requirements and User Interaction have no XWiki best practice, and viewing a page is passive interaction. * Reword the verify recipe to say the values must not be scored from, replacing the softer "do not quote as gospel", and fold the calculator sentence into the new lead-in. Co-Authored-By: Claude Opus 5 (1M context) <noreply(a)anthropic.com> Commit: bf0366f3bd41fc3e90ff45c0572a5c2809b07f8e https://github.com/xwiki/xwiki-dev-llm/commit/bf0366f3bd41fc3e90ff45c0572a5… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-09-12 (Sat, 12 Sep 2026) Changed paths: M xwiki/okf/index.md M xwiki/okf/processes/security-policy.md M xwiki/skills/xwiki-security-advisory/SKILL.md Log Message: ----------- [Misc] Point CVSS scoring at the policy section instead of caching its values * Keep the mandate and the anchored link to "Best practices for computing CVSS", but hold no per-metric values in the OKF file: the verify: block says not to score from the file, so caching the values it forbids scoring from is pure liability. * What stays is XWiki's interpretation - the rights-to-Privileges-Required mapping - and the traps: subsequent-system impact asserts code execution rather than XSS, the right-required caveat is about the right the attack needs and not the one it yields, viewing a page is passive interaction. * Drop the same cached values from xwiki-security-advisory Step 2, which fetches that section live anyway. The two copies had already diverged: the skill carried SSRF, the OKF file did not. * Trim the okf/index.md entry back to routing - the imperative belongs in the file, not the map - and restore the (volatile; verify) marker the corpus uses to flag a volatile fact. Co-Authored-By: Claude Opus 5 (1M context) <noreply(a)anthropic.com> Commit: 07ad4ffd6f83024f072cbf68c9d97204a24dc7db https://github.com/xwiki/xwiki-dev-llm/commit/07ad4ffd6f83024f072cbf68c9d97… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-09-12 (Sat, 12 Sep 2026) Changed paths: M xwiki/okf/index.md M xwiki/okf/processes/security-policy.md M xwiki/skills/xwiki-security-advisory/SKILL.md Log Message: ----------- Merge pull request #105 from xwiki/cvss-source-mandate [Misc] Take every CVSS metric from the security policy instead of scoring from memory Compare: https://github.com/xwiki/xwiki-dev-llm/compare/418f55ab9e35...07ad4ffd6f83 To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] 9f7fe5: [Misc] Take every CVSS metric from the security po...
by XWiki Notifications 12 Sep '26

12 Sep '26

Branch: refs/heads/cvss-source-mandate Home: https://github.com/xwiki/xwiki-dev-llm Commit: 9f7fe5965819236a6e3b1cbc626fb05b05c75cea https://github.com/xwiki/xwiki-dev-llm/commit/9f7fe5965819236a6e3b1cbc626fb… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-09-12 (Sat, 12 Sep 2026) Changed paths: M xwiki/okf/index.md M xwiki/okf/processes/security-policy.md Log Message: ----------- [Misc] Take every CVSS metric from the security policy instead of scoring from memory The scoring section listed a subset of the policy's rules and only asked for a re-read "when the exact scoring matters", which is weak enough that a score can be computed from generic CVSS instinct and still look policy-compliant. * Make reading the policy's "Best practices for computing CVSS" section mandatory before setting a vector, and link that section's anchor directly rather than the page. * Carry the rules that were missing and that generic instinct gets wrong: Attack Vector is always Network; XSS fixes the subsequent-system impacts (C/I Low, A None) as well as the vulnerable-system ones, so high subsequent impact asserts code execution and has to be established; the Script-right caveat drops all impacts to Low and is about the right the attack needs, not the one it yields; Attack Complexity, Attack Requirements and User Interaction have no XWiki best practice, and viewing a page is passive interaction. * Reword the verify recipe to say the values must not be scored from, replacing the softer "do not quote as gospel", and fold the calculator sentence into the new lead-in. Co-Authored-By: Claude Opus 5 (1M context) <noreply(a)anthropic.com> Commit: bf0366f3bd41fc3e90ff45c0572a5c2809b07f8e https://github.com/xwiki/xwiki-dev-llm/commit/bf0366f3bd41fc3e90ff45c0572a5… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-09-12 (Sat, 12 Sep 2026) Changed paths: M xwiki/okf/index.md M xwiki/okf/processes/security-policy.md M xwiki/skills/xwiki-security-advisory/SKILL.md Log Message: ----------- [Misc] Point CVSS scoring at the policy section instead of caching its values * Keep the mandate and the anchored link to "Best practices for computing CVSS", but hold no per-metric values in the OKF file: the verify: block says not to score from the file, so caching the values it forbids scoring from is pure liability. * What stays is XWiki's interpretation - the rights-to-Privileges-Required mapping - and the traps: subsequent-system impact asserts code execution rather than XSS, the right-required caveat is about the right the attack needs and not the one it yields, viewing a page is passive interaction. * Drop the same cached values from xwiki-security-advisory Step 2, which fetches that section live anyway. The two copies had already diverged: the skill carried SSRF, the OKF file did not. * Trim the okf/index.md entry back to routing - the imperative belongs in the file, not the map - and restore the (volatile; verify) marker the corpus uses to flag a volatile fact. Co-Authored-By: Claude Opus 5 (1M context) <noreply(a)anthropic.com> Compare: https://github.com/xwiki/xwiki-dev-llm/compare/b3bef903edde...bf0366f3bd41 To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm]
by XWiki Notifications 12 Sep '26

12 Sep '26

Branch: refs/tags/v1.9.8 Home: https://github.com/xwiki/xwiki-dev-llm To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] 418f55: [Misc] Release 1.9.8
by XWiki Notifications 12 Sep '26

12 Sep '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-dev-llm Commit: 418f55ab9e35e6731b694e13e6457b0a93153b19 https://github.com/xwiki/xwiki-dev-llm/commit/418f55ab9e35e6731b694e13e6457… Author: github-actions[bot] <41898282+github-actions[bot](a)users.noreply.github.com> Date: 2026-09-12 (Sat, 12 Sep 2026) Changed paths: M .claude-plugin/marketplace.json M kimi.plugin.json M opencode.jsonc M xwiki/.claude-plugin/plugin.json Log Message: ----------- [Misc] Release 1.9.8 * content edits only (no capability added or removed) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm]
by XWiki Notifications 12 Sep '26

12 Sep '26

Branch: refs/heads/okf-event-listener-cluster-convention Home: https://github.com/xwiki/xwiki-dev-llm To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0