dev  

Messages by Date

• 2026/10/07 Re: [PR] Turn Planet off by default and require POST for its admin changes [roller] via GitHub
• 2026/10/07 Re: [PR] Serve AtomPub through a Roller servlet [roller] via GitHub
• 2026/10/07 Re: [PR] Fix bugs found while testing the 6.1.7 integration build [roller] via GitHub
• 2026/10/07 Re: [PR] ROL-2184: Preserve pasted entry images when publishing [roller] via GitHub
• 2026/10/05 Re: [PR] Adopt Apache Commons Secure XML for XML parsing [roller] via GitHub
• 2026/10/05 Re: [PR] Serve AtomPub through a Roller servlet [roller] via GitHub
• 2026/10/05 Re: [PR] Serve AtomPub through a Roller servlet [roller] via GitHub
• 2026/10/04 Re: [PR] Add three responsive light and dark blog themes [roller] via GitHub
• 2026/10/04 Roller 6.1.7 PR status Dave
• 2026/10/04 Re: [PR] ROL-2184: Preserve pasted entry images when publishing [roller] via GitHub
• 2026/10/04 Re: [PR] Fix blogroll, category and ping target dialogs, AtomPub media, the Planet feed title, and double image paste [roller] via GitHub
• 2026/10/04 Re: [PR] Serve AtomPub through a Roller servlet [roller] via GitHub
• 2026/10/04 Re: [PR] No single quotes in media file insert url on mediaFileAdd!save.rol [roller] via GitHub
• 2026/10/04 Re: [PR] Turn Planet off by default and require POST for its admin changes [roller] via GitHub
• 2026/10/04 Re: [PR] Fix blogroll, category and ping target dialogs, and AtomPub media collections [roller] via GitHub
• 2026/10/04 Re: [PR] Keep wrapped pojos out of the template surface [roller] via GitHub
• 2026/10/04 Re: [PR] Adopt Apache Commons Secure XML for XML parsing [roller] via GitHub
• 2026/10/04 [PR] Fix blogroll, category and ping target dialogs after an AJAX save [roller] via GitHub
• 2026/10/04 Re: [PR] ROL-2184: Preserve pasted entry images when publishing [roller] via GitHub
• 2026/10/04 Re: [PR] Adopt Apache Commons Secure XML for XML parsing [roller] via GitHub
• 2026/10/04 Re: [PR] Turn Planet off by default and require POST for its admin changes [roller] via GitHub
• 2026/10/04 Re: [PR] Turn Planet off by default and require POST for its admin changes [roller] via GitHub
• 2026/10/04 Re: [PR] Turn Planet off by default and require POST for its admin changes [roller] via GitHub
• 2026/10/04 Re: [PR] Turn Planet off by default and require POST for its admin changes [roller] via GitHub
• 2026/10/04 Re: [PR] ROL-2184: Preserve pasted entry images when publishing [roller] via GitHub
• 2026/10/04 Re: [PR] Keep wrapped pojos out of the template surface [roller] via GitHub
• 2026/10/04 Re: [PR] Keep wrapped pojos out of the template surface [roller] via GitHub
• 2026/10/04 Re: [PR] Serve AtomPub through a Roller servlet [roller] via GitHub
• 2026/10/04 Re: [PR] Serve AtomPub through a Roller servlet [roller] via GitHub
• 2026/10/04 Re: [PR] Serve AtomPub through a Roller servlet [roller] via GitHub
• 2026/10/04 Re: [PR] ROL-2184: Preserve pasted entry images when publishing [roller] via GitHub
• 2026/10/04 Re: [PR] ROL-2184: Preserve pasted entry images when publishing [roller] via GitHub
• 2026/10/04 Re: [PR] Turn Planet off by default and require POST for its admin changes [roller] via GitHub
• 2026/10/04 Re: [PR] Turn Planet off by default and require POST for its admin changes [roller] via GitHub
• 2026/10/04 Re: [PR] Adopt Apache Commons Secure XML for XML parsing [roller] via GitHub
• 2026/10/04 Re: [PR] Keep wrapped pojos out of the template surface [roller] via GitHub
• 2026/10/04 Re: [PR] Keep wrapped pojos out of the template surface [roller] via GitHub
• 2026/10/04 Re: [PR] Serve AtomPub through a Roller servlet [roller] via GitHub
• 2026/10/04 Re: [PR] Serve AtomPub through a Roller servlet [roller] via GitHub
• 2026/10/04 Re: [PR] Run CI and CodeQL on roller-6.1.x [roller] via GitHub
• 2026/10/03 Re: [PR] Add security model and SECURITY.md [roller] via GitHub
• 2026/10/03 [PR] Run CI and CodeQL on roller-6.1.x [roller] via GitHub
• 2026/10/03 [PR] ROL-2184: Preserve pasted entry images when publishing [roller] via GitHub
• 2026/10/03 Re: [PR] Roller 6.1.x [roller] via GitHub
• 2026/10/03 [PR] Roller 6.1.x [roller] via GitHub
• 2026/10/03 Re: [PR] ROL-2183: Migrate from javax to Jakarta EE 11 [roller] via GitHub
• 2026/10/03 Re: [PR] ROL-2183: Migrate from javax to Jakarta EE 11 [roller] via GitHub
• 2026/10/03 Re: [PR] Turn Planet off by default and require POST for its admin changes [roller] via GitHub
• 2026/10/03 Re: [PR] Adopt Apache Commons Secure XML for XML parsing [roller] via GitHub
• 2026/10/03 Re: [PR] Keep wrapped pojos out of the template surface [roller] via GitHub
• 2026/10/03 Re: [PR] Turn Planet off by default and require POST for its admin changes [roller] via GitHub
• 2026/10/03 Re: [PR] Keep wrapped pojos out of the template surface [roller] via GitHub
• 2026/10/03 Re: [PR] Serve AtomPub through a Roller servlet [roller] via GitHub
• 2026/10/03 Re: [PR] Serve AtomPub through a Roller servlet [roller] via GitHub
• 2026/10/03 Re: [PR] ROL-2184: Preserve pasted entry images when publishing [roller] via GitHub
• 2026/10/03 Re: [PR] ROL-2184: Preserve pasted entry images when publishing [roller] via GitHub
• 2026/10/03 Re: [PR] No single quotes in media file insert url on mediaFileAdd!save.rol [roller] via GitHub
• 2026/10/03 Re: [PR] Add security model and SECURITY.md [roller] via GitHub
• 2026/10/03 Re: [PR] Add security model and SECURITY.md [roller] via GitHub
• 2026/10/03 Re: [PR] Preserve pasted entry images when publishing [roller] via GitHub
• 2026/10/03 [PR] Preserve pasted entry images when publishing [roller] via GitHub
• 2026/10/03 [PR] Add security model and SECURITY.md [roller] via GitHub
• 2026/10/02 [PR] Adopt Apache Commons Secure XML for XML parsing [roller] via GitHub
• 2026/10/02 [PR] Turn Planet off by default and require POST for its admin changes [roller] via GitHub
• 2026/10/02 Re: 6.1.7 release to struts v6 Greg Huber
• 2026/09/29 [PR] Keep wrapped pojos out of the template surface [roller] via GitHub
• 2026/09/29 [PR] Serve AtomPub through a Roller servlet [roller] via GitHub
• 2026/09/28 [PR] No single quotes in media file insert url on mediaFileAdd!save.rol [roller] via GitHub
• 2026/09/27 Re: [PR] No single quotes in media file insert url on mediaFileAdd!save.rol [roller] via GitHub
• 2026/09/27 Re: [PR] Update the gaurav theme's jQuery and Bootstrap, drop unused jQuery 2.1.1 [roller] via GitHub
• 2026/09/27 [ANNOUNCE] Apache Roller 6.1.6 fixes 18 security vulnerabilities Dave
• 2026/09/27 Re: [PR] Add missing ASF license headers and check them with Apache RAT [roller] via GitHub
• 2026/09/27 Re: [PR] No single quotes in media file insert url on mediaFileAdd!save.rol [roller] via GitHub
• 2026/09/27 Re: [PR] Use double-quoted attributes in media file links inserted into new entries [roller] via GitHub
• 2026/09/27 Re: [PR] Use double-quoted attributes in media file links inserted into new entries [roller] via GitHub
• 2026/09/27 Re: [PR] Fold release and disclosure lessons into the release and security skills [roller] via GitHub
• 2026/09/27 roller on struts v7 Greg Huber
• 2026/09/27 6.1.7 release to struts v6 Greg Huber
• 2026/09/26 Re: [VOTE] Release Apache Roller 6.1.6 (RC4) Dave
• 2026/09/26 [PR] Update the gaurav theme's jQuery and Bootstrap, drop unused jQuery 2.1.1 [roller] via GitHub
• 2026/09/26 Re: [PR] Add the ASF license header to source files that were missing it [roller] via GitHub
• 2026/09/25 Re: [PR] Fix incorrect PostgreSQL port in Dockerfile [roller] via GitHub
• 2026/09/25 [PR] Fold release and disclosure lessons into the release and security skills [roller] via GitHub
• 2026/09/25 CVE-2026-82546: Apache Roller: Stored cross-site scripting through incoming Trackback links David M. Johnson
• 2026/09/25 CVE-2026-86507: Apache Roller: Stored XSS in comment moderation via comment author URL David M. Johnson
• 2026/09/25 CVE-2026-82387: Apache Roller: Stored cross-site scripting via uploaded media content type David M. Johnson
• 2026/09/25 CVE-2026-82348: Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups David M. Johnson
• 2026/09/25 CVE-2026-82376: Apache Roller: XML external entity processing in trackback response parser David M. Johnson
• 2026/09/25 CVE-2026-82375: Apache Roller: Server-side request forgery via entry trackback and enclosure URLs David M. Johnson
• 2026/09/25 CVE-2026-82386: Apache Roller: XML external entity processing in OPML bookmark import David M. Johnson
• 2026/09/25 CVE-2026-82385: Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files David M. Johnson
• 2026/09/25 CVE-2026-82378: Apache Roller: OAuth authorization endpoint trusts request-supplied identity David M. Johnson
• 2026/09/25 CVE-2026-82377: Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers David M. Johnson
• 2026/09/25 CVE-2026-82383: Apache Roller: Anonymous setup action allows frontpage configuration tampering David M. Johnson
• 2026/09/25 CVE-2026-82384: Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint David M. Johnson
• 2026/09/25 CVE-2026-82379: Apache Roller: WSSE digest authentication headers can be replayed David M. Johnson
• 2026/09/25 CVE-2026-82382: Apache Roller: Reflected cross-site scripting in the frontpage directory parameter David M. Johnson
• 2026/09/25 CVE-2026-82381: Apache Roller: Stored cross-site scripting in the authoring UI David M. Johnson
• 2026/09/25 CVE-2026-82380: Apache Roller: CSRF protection bypass via self-generated salt validation David M. Johnson
• 2026/09/25 Re: [PR] Add the ASF license header to source files that were missing it [roller] via GitHub
• 2026/09/25 Re: [PR] ROL-2183: Migrate from javax to Jakarta EE 11 [roller] via GitHub
• 2026/09/25 Re: [PR] Use double-quoted attributes in media file links inserted into new entries [roller] via GitHub
• 2026/09/25 Re: [PR] ROL-2183: Migrate from javax to Jakarta EE 11 [roller] via GitHub
• 2026/09/25 [PR] Add the ASF license header to source files that were missing it [roller] via GitHub
• 2026/09/25 Re: [PR] Include jquery instead of getting it from ajax.googleapis.com [roller-website] via GitHub
• 2026/09/25 Re: [PR] [INFRA] Set up default rulesets for default and release branches [roller-website] via GitHub
• 2026/09/25 Re: [PR] Bump org.freemarker:freemarker from 2.3.23 to 2.3.35 in /sources [roller-website] via GitHub
• 2026/09/25 Re: [VOTE] Release Apache Roller 6.1.6 (RC4) Greg Huber
• 2026/09/24 [ANNOUNCE] Apache Roller 6.1.6 released Dave
• 2026/09/24 [RESULT][VOTE] Release Apache Roller 6.1.6 (RC4) Dave
• 2026/09/24 [PR] Bump org.freemarker:freemarker from 2.3.23 to 2.3.35 in /sources [roller-website] via GitHub
• 2026/09/24 Re: [VOTE] Release Apache Roller 6.1.6 (RC4) Matt Raible
• 2026/09/24 Re: [VOTE] Release Apache Roller 6.1.6 (RC4) Dave
• 2026/09/22 Re: [PR] No single quotes in media file insert url on mediaFileAdd!save.rol [roller] via GitHub
• 2026/09/19 Re: [PR] No single quotes in media file insert url on mediaFileAdd!save.rol [roller] via GitHub
• 2026/09/19 [PR] No single quotes in media file insert url on mediaFileAdd!save.rol [roller] via GitHub
• 2026/09/17 Re: [VOTE] Release Apache Roller 6.1.6 (RC4) Michael Bien
• 2026/09/17 [VOTE] Release Apache Roller 6.1.6 (RC4) Dave
• 2026/09/17 Re: [PR] Bump org.apache.struts:struts2-core from 2.5.29 to 6.8.0 in /app [roller] via GitHub
• 2026/09/17 Re: [PR] Bump org.apache.struts:struts2-core from 2.5.29 to 6.8.0 in /app [roller] via GitHub
• 2026/09/17 Re: [PR] Make sure bootstrap tables.less .table-striped > tbody > tr:nth-of-type(2n+1) is overridden [roller] via GitHub
• 2026/09/17 [PR] Bump org.apache.struts:struts2-core from 2.5.29 to 6.8.0 in /app [roller] via GitHub
• 2026/09/17 Re: [PR] Secure initial Roller setup with one-time operator token [roller] via GitHub
• 2026/09/17 Re: [PR] Secure initial Roller setup with one-time operator token [roller] via GitHub
• 2026/09/17 Re: [PR] Secure initial Roller setup with one-time operator token [roller] via GitHub
• 2026/09/17 Re: [PR] Secure initial Roller setup with one-time operator token [roller] via GitHub
• 2026/09/17 Re: [PR] Normalize links in HTML subset formatting [roller] via GitHub
• 2026/09/17 Re: [PR] Normalize links in HTML subset formatting [roller] via GitHub
• 2026/09/17 Re: [PR] Normalize links in HTML subset formatting [roller] via GitHub
• 2026/09/17 Re: [PR] Normalize links in HTML subset formatting [roller] via GitHub
• 2026/09/17 Re: [PR] Normalize links in HTML subset formatting [roller] via GitHub
• 2026/09/17 Re: [PR] Format LDAP comment form values consistently [roller] via GitHub
• 2026/09/17 Re: [PR] Format LDAP comment form values consistently [roller] via GitHub
• 2026/09/17 Re: [PR] Format LDAP comment form values consistently [roller] via GitHub
• 2026/09/17 Re: [PR] Format LDAP comment form values consistently [roller] via GitHub
• 2026/09/15 Re: [VOTE] Release Apache Roller 6.1.6 RC3 Matt Raible
• 2026/09/15 Re: [VOTE] Release Apache Roller 6.1.6 RC3 Dave
• 2026/09/15 Re: [PR] Secure initial Roller setup with one-time operator token [roller] via GitHub
• 2026/09/14 [PR] Format LDAP comment form values consistently [roller] via GitHub
• 2026/09/14 [PR] Normalize links in HTML subset formatting [roller] via GitHub
• 2026/09/14 Re: [PR] Secure initial Roller setup with one-time operator token [roller] via GitHub
• 2026/09/14 Re: [PR] Secure initial Roller setup with one-time operator token [roller] via GitHub
• 2026/09/13 [PR] Secure initial Roller setup with one-time operator token [roller] via GitHub
• 2026/09/13 [PR] Make sure bootstrap tables.less .table-striped > tbody > tr:nth-of-type(2n+1) is overridden [roller] via GitHub
• 2026/09/11 Re: [PR] Add a roller-release developer skill documenting the release procedure [roller] via GitHub
• 2026/09/11 Re: [PR] Add a roller-security developer skill for report triage and coordination [roller] via GitHub
• 2026/09/11 [PR] Add a roller-security developer skill for report triage and coordination [roller] via GitHub
• 2026/09/11 [PR] Add a roller-release developer skill documenting the release procedure [roller] via GitHub
• 2026/09/10 [VOTE] Release Apache Roller 6.1.6 RC3 Dave
• 2026/09/10 [CANCEL][VOTE] Release Apache Roller 6.1.6 RC2 Dave
• 2026/09/10 Re: [PR] Fix blank Font Awesome icons in preset themes (CSP font-src) and document H2 VALUE workaround [roller] via GitHub
• 2026/09/10 Re: [PR] Track schema upgrades with a flag instead of a hardcoded version check [roller] via GitHub
• 2026/09/10 Re: [PR] Fix jQuery UI 404 on authoring pages (drop webjar +1 suffix from head.jsp URL) [roller] via GitHub
• 2026/09/09 Re: [VOTE] Release Apache Roller 6.1.6 RC2 Dave
• 2026/09/09 [PR] Fix jQuery UI 404 on authoring pages (drop webjar +1 suffix from head.jsp URL) [roller] via GitHub
• 2026/09/09 Re: [VOTE] Release Apache Roller 6.1.6 RC2 Dave
• 2026/09/09 Re: [VOTE] Release Apache Roller 6.1.6 RC2 Matt Raible
• 2026/09/08 Re: [PR] Replace the Selenium suite with Playwright browser tests run across all auth methods [roller] via GitHub
• 2026/09/08 Re: Note on Roller compatibility with the latest H2 database (H2 2.5.250) Richard via dev
• 2026/09/08 Re: Note on Roller compatibility with the latest H2 database (H2 2.5.250) Dave
• 2026/09/08 Re: [PR] Improve installer form initialization and preview navigation [roller] via GitHub
• 2026/09/08 [PR] Track schema upgrades with a flag instead of a hardcoded version check [roller] via GitHub
• 2026/09/08 [PR] Fix blank Font Awesome icons in preset themes (CSP font-src) and document H2 VALUE workaround [roller] via GitHub
• 2026/09/08 Re: [PR] Improve installer form initialization and preview navigation [roller] via GitHub
• 2026/09/08 Re: [PR] Improve installer form initialization and preview navigation [roller] via GitHub
• 2026/09/07 Note on Roller compatibility with the latest H2 database (H2 2.5.250) Richard via dev
• 2026/09/07 [PR] Use double-quoted href attributes on the comment management page [roller] via GitHub
• 2026/09/07 Re: [PR] Improve installer form initialization and preview navigation [roller] via GitHub
• 2026/09/07 [VOTE] Release Apache Roller 6.1.6 RC2 Dave
• 2026/09/07 [CANCEL][VOTE] Release Apache Roller 6.1.6 RC1 Dave
• 2026/09/07 Re: [PR] Improve installer form initialization and preview navigation [roller] via GitHub
• 2026/09/07 Re: [PR] Improve installer form initialization and preview navigation [roller] via GitHub
• 2026/09/07 Re: testing 6.1.6 RC1 Dave
• 2026/09/07 [PR] Improve installer form initialization and preview navigation [roller] via GitHub
• 2026/09/07 Re: [PR] Use double-quoted href attributes on the comment management page [roller] via GitHub
• 2026/09/07 testing 6.1.6 RC1 Greg Huber
• 2026/09/06 Re: [PR] Bump spring-web from 5.3.20 to 6.0.0 in /app [roller] via GitHub
• 2026/09/06 Re: [PR] Bump spring-web from 5.3.20 to 6.0.0 in /app [roller] via GitHub
• 2026/09/06 Re: [PR] Bump spring-web from 5.3.20 to 6.0.0 in /app [roller] via GitHub
• 2026/09/06 Re: [PR] Bump struts2-core from 2.5.29 to 2.5.31 in /app [roller] via GitHub
• 2026/09/06 Re: [PR] Bump struts2-core from 2.5.29 to 2.5.31 in /app [roller] via GitHub
• 2026/09/06 Re: [PR] Bump struts2-core from 2.5.29 to 2.5.31 in /app [roller] via GitHub
• 2026/09/06 Re: [PR] Bump spring-security-config from 5.8.3 to 5.8.5 in /app [roller] via GitHub
• 2026/09/06 Re: [PR] Bump spring-security-config from 5.8.3 to 5.8.5 in /app [roller] via GitHub
• 2026/09/06 Re: [PR] Bump spring-security-config from 5.8.3 to 5.8.5 in /app [roller] via GitHub
• 2026/09/06 Re: [VOTE] Release Apache Roller 6.1.6 RC1 Dave
• 2026/09/06 Re: [PR] Update dependencies across project and add JDK 25 to test matrix [roller] via GitHub
• 2026/09/06 [VOTE] Release Apache Roller 6.1.6 RC1 Dave
• 2026/09/05 Re: [PR] build and sonar added [roller] via GitHub
• 2026/09/05 Re: [PR] build and sonar added [roller] via GitHub
• 2026/09/05 Re: [PR] Replace the Selenium suite with Playwright browser tests run across all auth methods [roller] via GitHub
• 2026/09/05 Re: [PR] Update dependencies across project and add JDK 25 to test matrix [roller] via GitHub
• 2026/09/05 [PR] Update dependencies across project and add JDK 25 to test matrix [roller] via GitHub
• 2026/09/05 Re: [PR] Retire incoming Trackback support and normalize comment links [roller] via GitHub
• 2026/09/05 Re: [PR] Add release notes and stop shipping third-party jars in the source release [roller] via GitHub
• 2026/09/05 [PR] Add release notes and stop shipping third-party jars in the source release [roller] via GitHub
• 2026/09/05 [PR] Retire incoming Trackback support and normalize comment links [roller] via GitHub
• 2026/09/05 Re: [PR] Store enclosure metadata without fetching remote URLs [roller] via GitHub
• 2026/09/05 Re: [PR] Check weblog permission in XML-RPC Blogger/MetaWeblog handlers [roller] via GitHub
• 2026/09/05 Re: [PR] Use the current Roller session during OAuth authorization [roller] via GitHub

• Earlier messages