This is the release notes for XWiki Commons, XWiki Rendering and XWiki Platform. They share the same release notes as they are released together and have the same version.

This release brings performance improvements for icons, more control over the sorting in document trees. You will also be able to install and test a new (still very experimental) BlockNote-based WYSIWYG editor, and developers will benefit from a new, also still experimental, endpoint to help implementing Yjs-based real-time collaboration. This release contains security fixes, with the highest severity being 8.7/10.

New and Noteworthy (since XWiki 17.5.0)

Full list of issues fixed and Dashboard for 17.6.0.

For Users

• Faster loading of icons: We've made rendering icons faster, leading to slightly improved loading times of all pages and significantly improved loading times of UIs that involve lots of icons like the quick action for inserting icons in the editor.

For Admins

New BlockNote WYSIWYG editor

 
A new experimental BlockNote based editor has been introduced. You can try it by installing the BlockNote Integration (Experimental) extension, which will add two new editors (if you are "Advanced" in your user profile preferences).

Miscellaneous

• Sorting behavior of document trees can be configured: The ordering of special characters in document trees like the navigation panel can be configured to control how different kinds of characters like accented characters are sorted. This makes it possible to, e.g., sort "Ä" directly after "A" instead of after "Z".

• VirtualMachineError always logged: Any log with a VirtualMachineError (for example, OutOfMemoryError or StackOverflowError) are now forced to go through any job log filtering and will always end up in the main log. It's important to be able to catch them there, since they are very often death sentences for the instance.

For Developers

yjs websocket endpoint

 
A new Yjs WebSocket endpoint is now available. This WebSocket endpoint allows editors with Yjs-based real-time collaboration features (e.g., Blocknote, Tiptap) to use XWiki as the server to synchronize changes between editors.

Miscellaneous

• Override Default WYSIWYG Editor from Request: XWiki already supports configuring the default WYSIWYG editor from the dedicated administration section, but this affects all users. When testing an experimental editor it's better to overwrite the default WYSIWYG editor from request, i.e. for a single editing session. Starting with this version, you can use a request parameter like this to overwrite the WYSIWYG editor:

  <simpleTypeName>.<category>.editor

  For instance, for a WYSIWYG editor with hint "blocknote", registered for the data type "org.xwiki.rendering.syntax.SyntaxContent" and category "wysiwyg" you can use a URL like this to change the editor:

  ## Standalone edit mode
  /xwiki/bin/edit/Some/Page?editor=wysiwyg&SyntaxContent.wysiwyg.editor=blocknote
  
  ## Inplace edit mode
  /xwiki/bin/view/Some/Page?SyntaxContent.wysiwyg.editor=blocknote#edit

Upgrades

The following runtime dependencies have been upgraded (they have a different release cycle than XWiki Commons, XWiki Rendering and XWiki Platform):

Translations

The following translations have been updated: 

• German
• French
• Simplified Chinese

Security Issues

Security issues are not listed in issue lists or dashboards to avoid disclosing ways to use them, but they will appear automatically in them once they're disclosed. See the XWiki Security Policy for more details.

Known issues

• Bugs we know about

Backward Compatibility and Migration Notes

General Notes

• When upgrading make sure you compare and merge the following XWiki configuration files since some parameters may have been modified, removed or added:
  • xwiki.cfg
  • xwiki.properties
  • web.xml
  • hibernate.cfg.xml
• Add xwiki.store.migration=1 in xwiki.cfg so that XWiki will attempt to automatically migrate your current database to any new schema. Make sure you backup your Database before doing anything.

Issues specific to XWiki 17.6.0-rc-1

Stop bundling Commons Lang 2.x

Commons Lang 2.x is not maintained anymore and has known security vulnerabilities which is why we decided to stop bundling it (as a core extension). XWiki extensions that use Commons Lang 2.x APIs without declaring the dependency will stop working as a consequence.

We also stopped bundling the json-lib library which is also unmaintained and requires Commons Lang 2.x. See the API Breakages below for more information about the affected APIs.

API Breakages

The following APIs were modified since XWiki 17.5.0:

Real breakages

Real backward compatibility breakages that we have unwillingly accepted to do for the reasons mentioned in each violation below.

• Drop dependency on json-lib that requires commons-lang which has known security vulnerabilities.
  • Violation type:

    java.method.returnTypeChanged

  • Code:

    ## Old:
    method net.sf.json.JSON org.xwiki.velocity.tools.JSONTool::parse(java.lang.String)
    
    ## New:
    method java.lang.Object org.xwiki.velocity.tools.JSONTool::parse(java.lang.String)

• Stop using json-lib because it hasn't been maintained for a long time and it depends on the old commons-lang (2.x) which has known security vulnerabilities.
  • Violation type:

    java.method.returnTypeChanged

  • Code:

    ## Old:
    method net.sf.json.JSONObject com.xpn.xwiki.plugin.packaging.Package::toJSON(com.xpn.xwiki.XWikiContext)
    
    ## New:
    method java.lang.Object com.xpn.xwiki.plugin.packaging.Package::toJSON(com.xpn.xwiki.XWikiContext)

• Velocity scripts using this API should continue to work as long as they don't rely on the fact that the return value is of type net.sf.json.JSONObject
  • Violation type:

    java.method.returnTypeChanged

  • Code:

    ## Old:
    method net.sf.json.JSONObject com.xpn.xwiki.plugin.packaging.PackageAPI::toJSON()
    
    ## New:
    method java.lang.Object com.xpn.xwiki.plugin.packaging.PackageAPI::toJSON()

Credits

The following people have contributed code and translations to this release (sorted alphabetically):

• Cédric LAMBLIN
• Farcasi Alexandru
• Lucas Charpentier
• Manuel Leduc
• Marius Dumitru Florea
• Michael Hamann
• Simon Urli
• Simpel
• Thomas Mortagne
• Valdis Vitolins
• Vincent Massol
• Xiaofei Cui
• xrichard