commits  

Messages by Thread

• (commons-io) branch master updated (a8c5a8c36 -> f720b2422) ggregory
• (commons-io) branch master updated (fbf2fa83e -> a8c5a8c36) ggregory
• (commons-io) branch master updated (edd1cd734 -> fbf2fa83e) ggregory
• (commons-imaging) branch master updated: Bump org.apache.commons:commons-parent from 104 to 105. ggregory
• (commons-graph) branch master updated: Bump org.apache.commons:commons-parent from 104 to 105. ggregory
• (commons-collections) branch dependabot/maven/org.apache.commons-commons-parent-105 created (now 40c9714fc) github-bot
• (commons-collections) branch dependabot/maven/com.google.guava-guava-testlib-33.7.1-jre created (now 0c3459459) github-bot
• (commons-collections) branch dependabot/maven/org.easymock-easymock-5.7.0 created (now bd1c67c85) github-bot
• (commons-dbutils) branch master updated: Bump org.apache.commons:commons-parent from 104 to 105. ggregory
• (commons-fileupload) branch master updated: Bump org.apache.commons:commons-parent from 104 to 105. ggregory
• (commons-fileupload) branch 1.x updated: Bump org.apache.commons:commons-parent from 104 to 105. ggregory
• (commons-exec) branch master updated: Bump org.apache.commons:commons-parent from 104 to 105. ggregory
• (commons-email) branch 1.x updated: Bump org.apache.commons:commons-parent from 104 to 105. ggregory
• (commons-email) branch master updated: Bump org.apache.commons:commons-parent from 104 to 105. ggregory
• (commons-digester) branch master updated: Bump org.apache.commons:commons-parent from 104 to 105. ggregory
• (commons-dbcp) branch master updated: Bump org.apache.commons:commons-parent from 104 to 105. ggregory
• (commons-daemon) branch master updated: Bump org.apache.commons:commons-parent from 104 to 105. ggregory
• (commons-csv) branch master updated: Bump org.apache.commons:commons-parent from 104 to 105. ggregory
• (commons-configuration) branch master updated: Bump org.apache.commons:commons-parent from 104 to 105. ggregory
• (commons-compress) branch master updated: Bump org.apache.commons:commons-parent from 104 to 105. ggregory
• (commons-codec) branch master updated: Bump org.apache.commons:commons-parent from 104 to 105. ggregory
• (commons-cli) branch master updated: Bump org.apache.commons:commons-parent from 104 to 105. ggregory
• (commons-build-plugin) branch master updated: Bump org.apache.commons:commons-parent from 104 to 105. ggregory
• (commons-beanutils) branch master updated: Bump org.apache.commons:commons-parent from 104 to 105. ggregory
  • (commons-beanutils) branch master updated: Bump org.apache.commons:commons-parent from 104 to 105. ggregory
• (commons-beanutils) branch 1.X updated: Bump org.apache.commons:commons-parent from 104 to 105. ggregory
• (commons-bsf) branch master updated: Bump org.apache.commons:commons-parent from 104 to 105. ggregory
• svn commit: r87315 - dev/commons/parent/105-RC1 ggregory
• (commons-parent) branch release updated (f26020f -> 7a8a297) ggregory
• (commons-parent) branch master updated (76013b5 -> 7a8a297) ggregory
• (commons-parent) annotated tag rel/commons-parent-105 updated (f26020f -> de49845) ggregory
• svn commit: r87314 - release/commons/parent/source ggregory
• svn commit: r87313 - dev/commons/parent/105-RC1 dev/commons/parent/105-RC1/source release/commons/parent release/commons/parent/source ggregory
• (commons-build-plugin) branch master updated: Update OpenSSF badge link in readme-md-template.md (#425). ggregory
• (commons-build-plugin) branch master updated: Update OpenSSF badge link in readme-md-template.md (#425) ggregory
• (commons-csv) branch master updated: Fix Javadoc for CSVPrinter.getRecordCount(): the header record written by the constructor is counted (#633). ggregory
• (commons-csv) branch master updated (fb71dcb6 -> 66c88c77) ggregory
  • (commons-csv) 01/01: Merge pull request #633 from lenamonj/csv-printer-record-count-javadoc ggregory
• (commons-csv) branch master updated: Escape-mode printer and parser mishandles value ending in multi-char delimiter prefix (f001). ggregory
• (commons-lang) branch master updated: FastDateFormat static caches grow without bound per distinct pattern/zone/locale, untrusted patterns pin several KB each, forever (f033). ggregory
• (commons-lang) branch master updated: Reflection builders' cycle registry unregisters per-visit: cycle-SAFE but DAG-exponential, a 40-level reference diamond drives ~2^40 traversals and unbounded output (f032). ggregory
  • (commons-lang) branch master updated: Reflection builders' cycle registry unregisters per-visit: cycle-SAFE but DAG-exponential, a 40-level reference diamond drives ~2^40 traversals and unbounded output (f032). ggregory
• (commons-jelly) branch feat/use-commons-xml updated (4c8213b5 -> e5592064) pkarwasz
• (commons-jelly) branch feat/use-commons-xml updated (9c0e5110 -> 4c8213b5) pkarwasz
• (commons-lang) branch master updated: ExceptionUtils.getThrowableList() cycle check is O(n^2) over deep cause chains; all chain-walking consumers inherit it (f031). ggregory
• (commons-jxpath) branch dependabot/maven/org.jdom-jdom-2.0.2 updated (56558d37 -> 18579de7) ggregory
• (commons-secure-xml) branch main updated: Fix the OpenRewrite migration recipe to add a dependency on org.apache.commons:commons-secure-xml:1.0.0. ggregory
• (commons-secure-xml) branch main updated: The OpenRewrite receipe now adds a dependency on commons-secure-xml. ggregory
• svn commit: r87299 - in dev/commons/bcel/6.13.0-RC1: . binaries site site/apidocs site/apidocs/legal site/apidocs/org site/apidocs/org/apache site/apidocs/org/apache/bcel site/apidocs/org/apache/bcel/class-use site/apidocs/org/apache/bcel/classfile sit... ggregory
• (commons-bcel) annotated tag commons-bcel-6.13.0-RC1 updated (be4bc45e -> 0945d4dd) ggregory
• (commons-bcel) branch release updated: Prepare for the release candidate 6.13.0 RC1 ggregory
• (commons-bcel) branch release updated (45b3a158 -> 13fe5d91) ggregory
• (commons-bcel) branch master updated: Prepare for the release candidate ggregory
• (commons-secure-xml) branch main updated: Update logo with new component name. ggregory
• (commons-secure-xml) branch main updated: Fix download link ggregory
• (commons-geometry) branch feat/use-commons-xml updated (7abf4a4a -> d4764afa) ggregory
• (commons-secure-xml) branch main updated: Fix the OpenRewrite migration recipe to target static method calls instead of class references. ggregory
• (commons-graph) branch master updated (d7698af -> b285412) ggregory
  • (commons-graph) 01/01: Merge pull request #50 from apache/feat/use-commons-xml ggregory
• (commons-digester) branch feat/use-commons-xml deleted (was 48ad2c6c) ggregory
• (commons-configuration) branch master updated: Harden XML parsing via commons-xml (#647) ggregory
• (commons-configuration) branch feat/use-commons-xml deleted (was d43075a87) ggregory
• (commons-jxpath) branch feat/use-commons-xml deleted (was d2466f88) ggregory
• (commons-bsf) branch feat/use-commons-xml deleted (was 1eccdfb) ggregory
• (commons-graph) branch feat/use-commons-xml deleted (was 87cd1d0) ggregory
• (commons-geometry) branch feat/use-commons-xml deleted (was e1241bc5) ggregory
• (commons-geometry) branch master updated: Harden XML output via commons-secure-xml (#300) ggregory
• (commons-geometry) branch feat/use-commons-xml updated (d4764afa -> e1241bc5) ggregory
• (commons-digester) branch master updated: Harden XML parsing via commons-secure-xml (#289) ggregory
• (commons-vfs) branch master updated: Harden XML parsing via commons-secure-xml (#781) ggregory
• (commons-vfs) branch feat/use-commons-xml deleted (was 634d55e06) ggregory
• (commons-jxpath) branch master updated: Harden XML parsing via commons-secure-xml (#288) ggregory
• (commons-jcs) branch master updated: Use Atomic* for statistics tv
• (commons-bsf) branch master updated (6400516 -> 3922289) ggregory
  • (commons-bsf) 01/01: Merge pull request #280 from apache/feat/use-commons-xml ggregory
• (commons-graph) branch feat/use-commons-xml updated (be774d1 -> 87cd1d0) ggregory
• (commons-jelly) branch feat/use-commons-xml updated (6bcde77f -> 9c0e5110) ggregory
• (commons-jxpath) branch feat/use-commons-xml updated (49e6c1fd -> d2466f88) ggregory
• (commons-vfs) branch feat/use-commons-xml updated (377637feb -> 634d55e06) ggregory
• (commons-digester) branch feat/use-commons-xml updated (cad08f69 -> 48ad2c6c) ggregory
• (commons-text) branch feat/use-commons-xml updated (ac4f28fc -> d4205be7) ggregory
• (commons-scxml) branch feat/use-commons-xml updated (d48f1442 -> 27e4b697) ggregory
• (commons-bsf) branch feat/use-commons-xml updated (776e95e -> 1eccdfb) ggregory
• (commons-configuration) branch feat/use-commons-xml updated (327d76221 -> d43075a87) ggregory
• (commons-secure-xml) branch main updated: Updates for the next release ggregory
  • (commons-secure-xml) branch main updated: Updates for the next release ggregory
  • (commons-secure-xml) branch main updated: Updates for the next release ggregory
• (commons-secure-xml) branch release updated (f240d75 -> e399b14) ggregory
• svn commit: r87296 - dev/commons/secure-xml/1.0.0-RC2 ggregory
• (commons-secure-xml) branch main updated (15e2597 -> e399b14) ggregory
• svn commit: r1937932 - commons/cms-site/trunk/conf ggregory
• svn commit: r87294 - release/commons/secure-xml ggregory
• (commons-secure-xml) annotated tag rel/commons-secure-xml-1.0.0 updated (f240d75 -> 8aa56cd) ggregory
• svn commit: r87295 - release/commons/secure-xml ggregory
• svn commit: r87293 - dev/commons/secure-xml/1.0.0-RC2 dev/commons/secure-xml/1.0.0-RC2/binaries dev/commons/secure-xml/1.0.0-RC2/source release/commons/secure-xml release/commons/secure-xml/binaries release/commons/secure-xml/source ggregory
• svn commit: r87292 - in release/commons/secure-xml: binaries source ggregory
• (commons-lang) branch master updated: ThresholdCircuitBreaker accepts negative increments and overflows its accumulator, silently keeping the breaker closed (f027). ggregory
• (commons-lang) branch master updated: StrBuilder.indexOf materializes the whole builder as a String per call; deleteAll/replaceAll multiply it into ~750 GB churn on a 1 MB builder (f026). ggregory
• (commons-lang) branch master updated: Attacker-controlled exception message forges frames in getRootCauseStackTrace output AND suppresses all real frames, beyond cosmetic log spoofing (f025). ggregory
• (commons-lang) branch master updated: FormattableUtils.append pads right-justified output with insert(0) per char; O(width^2); '%500000s' costs ~1.25e11 char moves (f024). ggregory
• (commons-lang) branch master updated: ArrayUtils.addAll/insert length arithmetic overflows (undeclared NegativeArraySizeException) while sibling concat is overflow-checked (f023). ggregory
• (commons-lang) branch master updated: StringEscapeUtils.escapeHtml4/3 apostrophe gap: single-quoted and unquoted HTML attribute contexts are trivially breakable, and the javadoc discloses the gap only as an HTML4 entity-legality footnote (f022). ggregory
• (commons-lang) branch master updated: Fraction.getFraction(String) throws undeclared ArithmeticException on crafted numeric strings ('9999999999.5', '1/0', mixed-number overflow) (f021). ggregory
• (commons-lang) branch master updated: ClassUtils.getClass() name normalization (whitespace stripping + dot-to-dollar rewriting) defeats host-side class-name string checks (f020). ggregory
• (commons-lang) branch master updated: BitField long-mask fields silently mis-answer int/short/byte accessors: shifts masked mod 32, and sign extension makes above-bit-31 flags read as set on any negative holder (f019). ggregory
• (commons-lang) branch master updated: DoubleRange/Range accept NaN endpoints, silently producing a half-unbounded range, contains()/fit() fail open for every value above the minimum (f018). ggregory
• (commons-lang) branch master updated: Fix LockingVisitors Javadoc to match code (f017). ggregory
• (commons-lang) branch master updated: Match Javadoc to code in SystemProperties.getProperty() and SystemUtils.getEnvironmentVariable() and update inline comments (f016). ggregory
• (commons-lang) branch master updated: JavaVersion.get() throws NumberFormatException where javadoc promises null (f015). ggregory
• (commons-lang) branch master updated: DurationFormatUtils.formatPeriod walks the calendar one year per iteration, Long.MAX_VALUE endMillis forces ~292 million Calendar round trips on one thread (f014). ggregory
• (commons-lang) branch master updated: StrSubstitutor (deprecated) recursive expansion has a cycle check but no fan-out, depth, or size bound. ggregory
• (commons-lang) branch master updated: StringEscapeUtils.escapeEcmaScript() misses backtick/template-literal (`, ${) and inline-script parser-state sequences (<!--, <script) - claim 'Deals correctly with quotes' is falsified by ES6 (f012). ggregory
• (commons-lang) branch master updated: Memoizer: default caches the first failure forever, has no size bound or eviction, and runs the user computation inside the ConcurrentHashMap bin lock (blocking unrelated keys, deadlocking reentrant use) (f011). ggregory
• (commons-jcs) branch master updated (61215aac -> 638611a9) tv
  • (commons-jcs) 06/06: Use same locking as in AbstractMemoryCache tv
  • (commons-jcs) 03/06: Make DoubleLinkedList Iterable tv
  • (commons-jcs) 01/06: Move misc code out of the lock tv
  • (commons-jcs) 05/06: Re-add ASL tv
  • (commons-jcs) 04/06: Simplify tv
  • (commons-jcs) 02/06: Move payload to derived classes tv
• (commons-lang) branch master updated: FastDateParser.parse throws undeclared IllegalArgumentException, NullPointerException, and IllegalStateException on crafted date strings (f010). ggregory
• (commons-lang) branch master updated: WordUtils.wrap(wrapLongWords=false, the 2-arg default) copies the entire remaining string every iteration (f009). ggregory
• (commons-lang) branch master updated: ExtendedMessageFormat.applyPattern() is quadratic: full pattern.toCharArray() per token (f008). ggregory
• (commons-lang) branch master updated: Add missing test ggregory
• (commons-lang) branch master updated: LocaleUtils static caches no longer grows on invalid input to LocaleUtils.countriesByLanguage(String) (f007). ggregory
• (commons-lang) branch master updated: EventUtils.EventBindingInvocationHandler.invoke() dispatches Object.hashCode/equals/toString into the bound business method (empty-eventTypes default), or returns null -> NPE from hash collections (non-empty) (f006). ggregory
• (commons-lang) branch master updated: StringUtils.replaceEachRepeatedly derives its recursion budget from the input itself - the documented StackOverflowError protection fails on large tables, and expanding rules amplify text 64x even at the default TTL (f005). ggregory
• (commons-lang) branch master updated: UnicodeUnescaper.unescapeJava/EcmaScript/Json: malformed \u sequences throw undeclared IllegalArgumentException, AND non-ASCII digit spellings of \u escapes are silently accepted; both arms of one missing ASCII-hex prescan (f004). ggregory
• (commons-lang) branch master updated: FastDateParser parses 'Y' (week year) as plain calendar year; asymmetric with FastDatePrinter and with SimpleDateFormat; boundary dates shift by a full year, silently (f002). ggregory
  • (commons-lang) branch master updated: FastDateParser parses 'Y' (week year) as plain calendar year; asymmetric with FastDatePrinter and with SimpleDateFormat; boundary dates shift by a full year, silently (f002). ggregory
• (commons-bcel) branch master updated: Sort members ggregory
• (commons-bcel) branch master updated: Utility.JavaReader escape decoding: OOB table index, bad-hex crash, silent non-canonical aliasing (f026). ggregory
• (commons-bcel) branch master updated: Static WIDE ThreadLocal survives exceptions, corrupting the next class's disassembly on the same thread (f025). ggregory
• (commons-bcel) branch master updated (b0c3e6a1 -> 4a4b7577) ggregory
  • (commons-bcel) 02/02: org.apache.bcel.verifier.VerifierFactory.DEFAULT_MAX_CACHE_SIZE doesn't need to be public. ggregory
  • (commons-bcel) 01/02: Verifier cache grows unboundedly with attacker-chosen class names (f024). ggregory
• (commons-bcel) branch master updated: Verifier pass 3a delayed checks are quadratic in attribute and code size (f023). ggregory
• (commons-bcel) branch master updated: BCELifier interpolates attacker class/package names into generated Java source unescaped (f022). ggregory
• (commons-bcel) branch master updated: Utility.decode fixed 3x buffer breaks the encode/decode round trip and throws unchecked AIOOBE (f021). ggregory
• (commons-bcel) branch master updated: Signature.matchGJIdent recurses unboundedly on nested generic signatures (Signature.translate) (f020). ggregory
• (commons-bcel) branch master updated: PMG attribute ignores declared length, enabling BCEL-vs-JVM parse divergence (f019). ggregory
• (commons-jcs) branch dependabot/maven/commons-jcs4-jcache-extras/org.apache.tomcat-tomcat-catalina-11.0.25 deleted (was 79bf6aa7) github-bot
• (commons-jcs) branch master updated: 10.16.1.2 does not exist tv
• (commons-bcel) branch master updated: ClassPath.getBytes() sizes its buffer from the forged ZIP uncompressed-size field (f016). ggregory
• (commons-jcs) branch dependabot/maven/commons-jcs4-jcache-openjpa/org.apache.derby-derby-10.17.1.0 deleted (was 8a8544cc) github-bot
• (commons-jcs) branch master updated (c493ae79 -> 22c86674) tv
  • (commons-jcs) 01/01: Merge pull request #419 from apache/dependabot/maven/commons-jcs4-jcache-openjpa/org.apache.derby-derby-10.17.1.0 tv
• (commons-jcs) branch dependabot/maven/commons-jcs4-jcache-openjpa/org.apache.derby-derby-10.17.1.0 updated (2f3256aa -> 8a8544cc) tv
• (commons-jcs) branch dependabot/maven/commons-jcs4-jcache-openjpa/org.apache.derby-derby-10.17.1.0 created (now 2f3256aa) github-bot
• (commons-bcel) branch master updated: Class2HTML builds output file paths from the unvalidated class name (f015). ggregory
• (commons-jcs) branch master updated: Potential fix for code scanning alert no. 124: Failure to use secure cookies tv
• (commons-jcs) branch master updated: Remove declaration of exceptions never thrown tv
• (commons-bcel) branch master updated (512a70bb -> fb72c225) ggregory
  • (commons-bcel) 02/03: Silent u2/u1 count truncation across dump paths corrupts emitted bytecode. (f013). ggregory
  • (commons-bcel) 03/03: Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports) (f014). ggregory
  • (commons-bcel) 01/03: Repositories cache classes under the input-defined this_class name; global static Repository/VerifierFactory make the poisoning ClassLoader-wide. (f012). ggregory
• (commons-jcs) branch master updated (816923b3 -> 735ba195) tv
  • (commons-jcs) 01/01: Merge pull request #418 from apache/dependabot/maven/commons-jcs4-jcache-extras/org.apache.tomcat-tomcat-catalina-11.0.25 tv
• (commons-bcel) branch master updated: Silent u2/u1 count truncation across dump paths corrupts emitted bytecode (f013). ggregory
• (commons-bcel) branch master updated: Repositories cache classes under the input-defined this_class name; global static Repository/VerifierFactory make the poisoning ClassLoader-wide (f012). ggregory
• (commons-jcs) branch master updated (ecc6241d -> 593885cb) tv
  • (commons-jcs) 02/02: A bit of reorganization in basic structures tv
  • (commons-jcs) 01/02: Better data encapsulation tv
• (commons-bcel) branch master updated: f011: typeSignatureToString recurses per generic-nesting level, unbounded, with quadratic substring copies ggregory
• (commons-bcel) branch master updated: ConstantPool.constantToString recurses forever on self-referencing CONSTANT_MethodHandle (f010). ggregory
• (commons-bcel) branch master updated: Disassembler and Class2HTML re-implement the unchecked switch-table allocation (f009). ggregory
• (commons-bcel) branch master updated: Subroutines.noRecursiveCalls enumerates exponentially many JSR call paths (f008). ggregory
• (commons-bcel) branch master updated: Cubic handlers × range × subroutines scan in Subroutines constructor hangs JustIce Pass 3b (f007). ggregory
• (commons-bcel) branch master updated: Pass 3b dataflow stores frames per instruction and clones ever-growing execution chains (f006). ggregory
• (commons-bcel) branch master updated: JustIce Pass 2 LVT check amplifies each 10-byte entry into ~131k hashtable operations (f005). ggregory
• (commons-bcel) branch master updated: JustIce Pass 2 hangs on cyclic superclass chain of a referenced exception class (f004). ggregory
• (commons-bcel) branch master updated: Opcodes tableswitch and lookupswitch add boundary checks (f003). ggregory
• (commons-bcel) branch master updated (b27feadf -> ad48367d) ggregory
  • (commons-bcel) 02/02: Nested annotation element values recurse unboundedly; MAX_ARRAY_DIMENSIONS cap bypassed (f002). ggregory
  • (commons-bcel) 01/02: Sort members ggregory
• (commons-bcel) branch master updated: f001 Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser. ggregory
• (commons-bcel) branch master updated: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser (f001). ggregory
• (commons-text) branch master updated (81de4f7a -> 5d882dca) ggregory
  • (commons-text) 01/02: Typo ggregory
  • (commons-text) 02/02: StringMatcher.isMatch(CharSequence, int, int, int) forwards bufferEnd as bufferStart (#768). ggregory
• (commons-text) branch master updated: StringMatcher.isMatch(CharSequence, int, int, int) forwards bufferEnd as bufferStart (#768) ggregory
• (commons-jcs) branch master updated: Relax test timing for windows build tv
• svn commit: r87183 - in dev/commons/parent/105-RC1: . binaries site site/css site/images site/images/logos site/img site/js source ggregory
• (commons-parent) annotated tag commons-parent-105-RC1 updated (f26020f -> c41c050) ggregory
• (commons-parent) branch release updated: Prepare for the release candidate 105 RC1 ggregory
• (commons-build-plugin) branch master updated: Bump graalvm.version from 25.1.3 to 25.3.4.1 on Java 25 and up ggregory
• (commons-parent) branch master updated: Prepare for the release candidate ggregory
• (commons-parent) branch release updated (029a890 -> 76013b5) ggregory
• (commons-text) branch master updated: Move profile from Java 22 to 25 (LTS) boundary. ggregory
• (commons-text) branch master updated (ad7bce75 -> 8f11af0b) ggregory
  • (commons-text) 02/02: Bump net.bytebuddy:byte-buddy from 1.18.10 to 1.18.13 ggregory
  • (commons-text) 01/02: [test] Bump org.graalvm.js:js from 25.0.2 to 25.3.4.1 on Java 22 and up. ggregory
• (commons-parent) branch master updated: Bump maven-failsafe-plugin from 3.5.6 to 3.6.0. ggregory
• (commons-parent) branch master updated (cd35faf -> d172e0f) ggregory
  • (commons-parent) 01/03: Bump maven-surefire-report-plugin to 3.5.6 to 3.6.0. ggregory
  • (commons-parent) 02/03: Bump org.apache.felix:maven-bundle-plugin from 6.1.0 to 6.1.2 on Java 17 and up. ggregory
  • (commons-parent) 03/03: Bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.26.1 to 0.26.2. ggregory
• (commons-parent) branch master updated (6f3fdc9 -> cd35faf) ggregory
  • (commons-parent) 02/02: Bump maven-surefire-plugin to 3.5.6 to 3.6.0. ggregory
  • (commons-parent) 01/02: Bump commons.checkstyle.version from 14.0.0 to 14.1.0 on Java 21 and up. ggregory

• Earlier messages
• Later messages