jamesfredley commented on PR #15803: URL: https://github.com/apache/grails-core/pull/15803#issuecomment-4992629459
## Maintenance pass Merged the latest `8.0.x` (a large base gap - clean merge, no conflicts) and re-verified. - The two Copilot eviction comments are already resolved: both the URL-count eviction (`while (currentTokens.size() > DEFAULT_MAX_TOKEN_URLS)`) and the per-URL token eviction loop-trim an already-oversized session down to the bound in a single `generateToken()` call, and are covered by tests. - `:grails-test-suite-web:test --tests SynchronizerTokensHolderTests` and `:grails-test-suite-uber:test --tests WithFormMethodTests` both pass after the merge. On @jdaugherty's URL-scope question: this PR keeps the existing URL-keyed holder contract (it only bounds that storage and makes validate+reset atomic) rather than changing token scope. Note for reviewers: the exactly-once guarantee is per in-memory holder - a clustered deployment without session affinity/replication would still need sticky sessions for it to hold, which is already true of the existing session-scoped synchronizer-token mechanism; distributed locking is out of scope for this hardening PR. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
