What's new in XWiki

The Unified Documents Application Extension 1.2.8 have been released.

The XWiki development team is proud to announce the availability of XWiki 18.9.0. This release brings several Live Data improvements: new entries are saved automatically, entries keep their positions while being edited, and edit mode is now turned on and off with a dedicated button. The experimental BlockNote editor now lets you edit Code macros in place, as code blocks, and shows the same realtime edit actions as the WYSIWYG editor. In addition, following a link to an export, such as a bookmarked export URL, now asks you to confirm the export instead of starting it right away. For developers, there are new Velocity macros to pick one or more locations, a way for extensions to add or replace export formats, new Live Data APIs to fetch and delete single entries, and plain CSS skin customizations. This release contains security fixes, with the highest severity being 9.3/10. See the release notes for more information.

The RSS Macro extension 15.7 has been released. It fixes security issues by restricting where and how feeds are fetched, and improves how feed entries, their titles and links are displayed.

The Blog Application 9.15.15 has been released. This release focuses on resolving several bugs to improve stability and display consistency.

The PlantUML extension 2.5 has been released. It fixes several security issues, no longer configures a remote PlantUML server by default, upgrades to PlantUML 1.2026.9 and now requires XWiki 16.10 or later.

The Prism.js Macro 1.3 has been released. It makes the highlighted code meet the WCAG AA contrast ratio and fixes some security issues, so upgrading is recommended.

The Change Request Application 1.25 has been released. The error reported when storing changes in a change request fails now includes the reason of the failure.

The LLM extension 0.11 has been released. It contains security fixes with the highest severity of 7.4/10, per-page rights checks and a one-time re-index for collections over wiki pages, opt-in guest access for the MCP endpoint, and a trust check on the MCP configuration.

The AntiSpam Tool Application 1.13 has been released. It adds navigation in the list of events, fixes several security issues and now reads the last entry of the X-Forwarded-For header by default.

The Documentation extension 1.18 has been released. It lets documentation pages hold content fragments that other pages display with the new Content Fragment macro, stops renaming a documentation page from logging an error, and fixes false reports from the verb, video attachment and Related link label checks.