snoopdave commented on PR #190: URL: https://github.com/apache/roller/pull/190#issuecomment-5720359737
🐞Claude Issue: **PR-Review: General Issues** The following issues were found but cannot be attached to a specific line in the diff: - **Blocking:** `CHANGES.md` is not updated. The repo keeps its changelog there and the `## 6.1.6` section is open, with "Behaviour changes worth reading before upgrading" and "Improvements" subsections. This PR changes how every HTML comment renders — anchors are now reconstructed from a validated href instead of passed through, and anchors that are not recognised lose their `href` — which is user-visible behaviour of exactly the kind that section documents. Please add a short entry (a sentence plus a couple of bullets), with a link to the associated GitHub issue if there is one. - **Important:** Public API documentation does not reflect the narrowed contract. `transformToHTMLSubset` is exposed to templates as `$utils.transformToHTMLSubset` (`UtilitiesModel.java:346`) and is documented in `docs/roller-template-guide.adoc:881` as "Transform any HTML in the string to a safe HTML subset". After this change, anchor `href` values are limited to `http`, `https` and `mailto`, and every other anchor attribute is dropped. Neither the template guide nor the method javadoc (`Utilities.java:949-957`, which still describes support for `<a href>` without qualification) mentions either restriction. Both are outside the diff hunks, hence this general comment. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
