mraible commented on PR #154: URL: https://github.com/apache/roller/pull/154#issuecomment-6104043282
Thanks for the thorough pass. Master is merged in (merge commit, no rebase), so the branch no longer conflicts and all checks pass, including CodeQL. - The three `java/path-injection` alerts are gone: master's `MediaCollection` names temp files with a random UUID, so the `Slug` header never reaches `File.createTempFile`. I kept master's form so the two stay identical. - `CHANGES.md` now has 7.0.0 upgrade notes linked to ROL-2183 for the Java 17 / Tomcat 11 / Servlet 6.1 baseline, the OAuth 1.0a and consumer key removal, and the OpenID 2.0 removal. The OIDC replacement is in #155. - All 479 app tests pass locally on JDK 17. Understood on the scope note. The Struts 7, `@StrutsParameter` and JPA changes still need a line-by-line look. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
