This is the release notes for XWiki Commons, XWiki Rendering and XWiki Platform. They share the same release notes as they are released together and have the same version.

This is a bug fix release which also contains security fixes, with the highest severity being 9.3/10.

New and Noteworthy (since XWiki 18.4.4)

Full list of issues fixed and Dashboard for 18.4.5.

Upgrades

The following runtime dependencies have been upgraded (they have a different release cycle than XWiki Commons, XWiki Rendering and XWiki Platform):

Translations

The following translations have been updated: 

• German
• French

Tested Browsers & Databases

Automated Testing

XWiki executes a lot of automated tests during its build, testing all supported configurations.

Security Issues

Security issues are not listed in issue lists or dashboards to avoid disclosing ways to use them, but they will appear automatically in them once they're disclosed. See the XWiki Security Policy for more details.

Known issues

• Bugs we know about

Backward Compatibility and Migration Notes

General Notes

• When upgrading make sure you compare and merge the following XWiki configuration files since some parameters may have been modified, removed or added:
  • xwiki.cfg
  • xwiki.properties
  • web.xml
  • hibernate.cfg.xml
• Add xwiki.store.migration=1 in xwiki.cfg so that XWiki will attempt to automatically migrate your current database to any new schema. Make sure you backup your Database before doing anything.

Issues specific to XWiki 18.4.5

Change in password format

The passwords handled by PasswordClass in XWiki (so including standard XWiki users passwords as well as any XClass password property) used to be stored following the format: hash:<algorithmName>:<salt>:<hash>. This format is no longer used in XWiki and has been replaced by the more standard format: {algorithmKey}<encodedHash>, where the format of the hash itself depends on the algorithm and contains information about the salt etc. For more information check the PasswordClass documentation.

Migration of passwords

The security of algorithms used for hashing passwords has been reinforced as part of this release. As a result, we're automatically performing a re-hash operations of all passwords during a migration: this operation doesn't perform any reset of the passwords, so they can still be used properly. However, you might see warnings in your instance related to usage of old-style passwords: it is recommended to ask users to reset their passwords to use the new format.

API Breakages

The following APIs were modified since XWiki 18.4.4:

Real breakages

Real backward compatibility breakages that we have unwillingly accepted to do for the reasons mentioned in each violation below.

• We changed the default algorithm for PasswordClass hash computation for something more robust and we also changed the format of the hash for better handling in the future.
  • Violation type:

    java.field.constantValueChanged

  • Code:

    ## Old:
    field com.xpn.xwiki.objects.classes.PasswordClass.DEFAULT_HASH_ALGORITHM
    
    ## New:
    field com.xpn.xwiki.objects.classes.PasswordClass.DEFAULT_HASH_ALGORITHM

• We changed the default algorithm for PasswordClass hash computation for something more robust and we also changed the format of the hash for better handling in the future.
  • Violation type:

    java.method.removed

  • Code:

    ## Old:
    method java.lang.String com.xpn.xwiki.objects.classes.PasswordClass::getPasswordHash(java.lang.String, java.lang.String, java.lang.String)

• We changed the default algorithm for PasswordClass hash computation for something more robust and we also changed the format of the hash for better handling in the future.
  • Violation type:

    java.method.removed

  • Code:

    ## Old:
    method java.lang.String com.xpn.xwiki.objects.classes.PasswordClass::getSaltFromPassword(java.lang.String)

• We changed the default algorithm for PasswordClass hash computation for something more robust and we also changed the format of the hash for better handling in the future.
  • Violation type:

    java.method.removed

  • Code:

    ## Old:
    method java.lang.String com.xpn.xwiki.objects.classes.PasswordClass::randomSalt()

Unstable APIs

Not real backward compatibility breakages since they were done on APIs marked @Unstable (a.k.a Young APIs). Thus it's part of the contract that they can be broken until they become stable. They're listed purely for reference in case you decided to still use them (and thus agreed to be broken).

• UserManager#hasAccess() is an unstable API. Checking any right on a user through the user API was too broad, checking view access makes sense but others are out of scope. It is now replaced by UserManager#hasViewAccess().
  • Violation type:

    java.method.removed

  • Code:

    ## Old:
    method boolean org.xwiki.user.UserManager::hasAccess(org.xwiki.security.authorization.Right, org.xwiki.user.UserReference, org.xwiki.user.UserReference)

• UserManager#hasAccess() is an unstable API. Checking any right on a user through the user API was too broad, checking view access makes sense but others are out of scope. It is now replaced by UserManager#hasViewAccess().
  • Violation type:

    java.method.addedToInterface

  • Code:

    ## Old:
    
    
    ## New:
    method boolean org.xwiki.user.UserManager::hasViewAccess(org.xwiki.user.UserReference, org.xwiki.user.UserReference)

Credits

• * Claude Opus 5
• * Claude Opus 5 (1M context)
• * Claude Sonnet 5
• * Farcasut
• * LucasC
• * Manuel Leduc
• * Marius Dumitru Florea
• * Mend Renovate
• * Michael Hamann
• * Pierre Jeanjean
• * Simon Urli
• * Simpel
• * Thomas Mortagne
• * Vincent Massol
• * xrichard