[jira] [Commented] (MSITE-828) Jdk 1.8 required / Upgrade Jetty Version 9.4.12

[ASF GitHub Bot (JIRA)]

[ 
https://issues.apache.org/jira/browse/MSITE-828?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16683025#comment-16683025
 ] 

ASF GitHub Bot commented on MSITE-828:
--

michael-o commented on issue #3: [MSITE-828] Upgrade jetty to recent version. 
Update to java 1.8 (required for jetty)
URL: https://github.com/apache/maven-site-plugin/pull/3#issuecomment-437709471
 
 
   I see the point, though 9.2 is updated regularily: 9.2.26.v20180806. I don't 
mind updating per se, but I don't understand how it will improve security if 
this is testing only and not a compile/runtime dependency. In other words, it 
is never pulled by a third party.
   
   Anyway, I don't see it fixed with 
https://github.com/eclipse/jetty.project/commits/jetty-9.2.x.
   
   It seems fine to me to make this bump for 3.8. BUT I'd like to see "Upgrade 
to Java 8" with a seperate ticket and a subsequent one with Jetty. It makes the 
stuff transparent for our users.


This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


> Jdk 1.8 required / Upgrade Jetty Version 9.4.12
> ---
>
> Key: MSITE-828
> URL: https://issues.apache.org/jira/browse/MSITE-828
> Project: Maven Site Plugin
>  Issue Type: Task
>Reporter: Olivier Lamy (*$^¨%`£)
>Assignee: Olivier Lamy (*$^¨%`£)
>Priority: Major
>




--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

[jira] [Commented] (MSITE-828) Jdk 1.8 required / Upgrade Jetty Version 9.4.12

[ASF GitHub Bot (JIRA)]

[ 
https://issues.apache.org/jira/browse/MSITE-828?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16683017#comment-16683017
 ] 

ASF GitHub Bot commented on MSITE-828:
--

oflebbe commented on issue #3: [MSITE-828] Upgrade jetty to recent version. 
Update to java 1.8 (required for jetty)
URL: https://github.com/apache/maven-site-plugin/pull/3#issuecomment-437706811
 
 
   Hi Michael,
   
   latest jetty 9.2.26 has at least four known vulnerabilities: CVE-2017-7656, 
CVE-2017-7658, CVE-2017-7657, CVE-2017-9735
   
   Some seem pretty serious to me. There seems to be a reason why it is not 
maintained any more.
   
   Do you want to argue that an Apache project can deliver insecure software 
since it is only used for "testing" ?
   
   Please keep in mind that the versions chosen will be picked up by 3rd party 
project through transitive dependencies.
   
   Best Regards,
   Olaf
   
   
   
   > Am 10.11.2018 um 13:17 schrieb Michael Osipov :
   > 
   > @olamy  @oflebbe  I 
definitvely see your point, but Jetty 9.2 does its job for testing. As for 
bumping a Java version: I see this as valid as soon as someone provides good 
code using those features. When I see how slow we are changing stuff, I don't 
see this happening beyond 2019. Just for the sake of upgrading, I wouldn't do 
this.
   > 
   > —
   > You are receiving this because you were mentioned.
   > Reply to this email directly, view it on GitHub 
, or 
mute the thread 
.
   > 
   
   


This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


> Jdk 1.8 required / Upgrade Jetty Version 9.4.12
> ---
>
> Key: MSITE-828
> URL: https://issues.apache.org/jira/browse/MSITE-828
> Project: Maven Site Plugin
>  Issue Type: Task
>Reporter: Olivier Lamy (*$^¨%`£)
>Assignee: Olivier Lamy (*$^¨%`£)
>Priority: Major
>




--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

[jira] [Commented] (MSITE-828) Jdk 1.8 required / Upgrade Jetty Version 9.4.12

[ASF GitHub Bot (JIRA)]

[ 
https://issues.apache.org/jira/browse/MSITE-828?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16682363#comment-16682363
 ] 

ASF GitHub Bot commented on MSITE-828:
--

michael-o commented on issue #3: [MSITE-828] Upgrade jetty to recent version. 
Update to java 1.8 (required for jetty)
URL: https://github.com/apache/maven-site-plugin/pull/3#issuecomment-437579945
 
 
   @olamy @oflebbe I definitvely see your point, but Jetty 9.2 does its job for 
testing. As for bumping a Java version: I see this as valid as soon as someone 
provides good code using those features. When I see how slow we are changing 
stuff, I don't see this happening beyond 2019. Just for the sake of upgrading, 
I wouldn't do this.


This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


> Jdk 1.8 required / Upgrade Jetty Version 9.4.12
> ---
>
> Key: MSITE-828
> URL: https://issues.apache.org/jira/browse/MSITE-828
> Project: Maven Site Plugin
>  Issue Type: Task
>Reporter: Olivier Lamy (*$^¨%`£)
>Assignee: Olivier Lamy (*$^¨%`£)
>Priority: Major
>




--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

[jira] [Commented] (MSITE-828) Jdk 1.8 required / Upgrade Jetty Version 9.4.12

[ASF GitHub Bot (JIRA)]

[ 
https://issues.apache.org/jira/browse/MSITE-828?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16680911#comment-16680911
 ] 

ASF GitHub Bot commented on MSITE-828:
--

oflebbe commented on issue #3: [MSITE-828] Upgrade jetty to recent version. 
Update to java 1.8 (required for jetty)
URL: https://github.com/apache/maven-site-plugin/pull/3#issuecomment-437258056
 
 
   Hi Michael,
   
   nice to meet again :-)
   
   the change was done on purpose: You know I am hunting down insecure maven 
configurations in Big Data and IoT projects, though it is the first time I 
found a maven plugin to be the trigger. The old, deprecated jetty version 
included an insecure pluginRepository in transitive dependencies to 3rd parties 
(Fortunately I could arrange the codehaus.org domain to be hosted by apache, 
but it is still accessed over http). 
   
   All maintained jetty versions need java 1.8
   http://www.eclipse.org/jetty/documentation/current/what-jetty-version.html
   
   Seriously, my concern was more that we break compatibility through 
transitive dependecies. Fortunately you don't see this as a problem.
   
   Best Regards,
   Olaf
   
   
   
   Von meinem iPad gesendet
   
   > Am 08.11.2018 um 22:08 schrieb Michael Osipov :
   > 
   > Seriously, because of the tests we need to force Java 8 with zero benefit? 
I Have the latest 1.7 Jetty in Wagon which does the job for testing.
   > 
   > —
   > You are receiving this because you authored the thread.
   > Reply to this email directly, view it on GitHub, or mute the thread.
   


This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


> Jdk 1.8 required / Upgrade Jetty Version 9.4.12
> ---
>
> Key: MSITE-828
> URL: https://issues.apache.org/jira/browse/MSITE-828
> Project: Maven Site Plugin
>  Issue Type: Task
>Reporter: Olivier Lamy (*$^¨%`£)
>Assignee: Olivier Lamy (*$^¨%`£)
>Priority: Major
>




--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

[jira] [Commented] (MSITE-828) Jdk 1.8 required / Upgrade Jetty Version 9.4.12

[ASF GitHub Bot (JIRA)]

[ 
https://issues.apache.org/jira/browse/MSITE-828?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16680795#comment-16680795
 ] 

ASF GitHub Bot commented on MSITE-828:
--

olamy edited a comment on issue #3: [MSITE-828] Upgrade jetty to recent 
version. Update to java 1.8 (required for jetty)
URL: https://github.com/apache/maven-site-plugin/pull/3#issuecomment-437158167
 
 
   @michael-o  I would say seriously in November 2018 with 1.8 already EOL and 
even 9 or 10 what is the point having 1.7. 
https://www.oracle.com/technetwork/java/javase/eol-135779.html
   After this we can then change the code to use 1.8 features. 
   But come on we should try being an attractive project and get new 
committers!! And saying "we must be 1.7" is definitely not the way to do it


This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


> Jdk 1.8 required / Upgrade Jetty Version 9.4.12
> ---
>
> Key: MSITE-828
> URL: https://issues.apache.org/jira/browse/MSITE-828
> Project: Maven Site Plugin
>  Issue Type: Task
>Reporter: Olivier Lamy (*$^¨%`£)
>Assignee: Olivier Lamy (*$^¨%`£)
>Priority: Major
>




--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

[jira] [Commented] (MSITE-828) Jdk 1.8 required / Upgrade Jetty Version 9.4.12

[ASF GitHub Bot (JIRA)]

[ 
https://issues.apache.org/jira/browse/MSITE-828?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16680393#comment-16680393
 ] 

ASF GitHub Bot commented on MSITE-828:
--

olamy commented on issue #3: [MSITE-828] Upgrade jetty to recent version. 
Update to java 1.8 (required for jetty)
URL: https://github.com/apache/maven-site-plugin/pull/3#issuecomment-437158167
 
 
   @michael-o  I would say seriously!! in November 2018 with 1.8 already EOL 
and even 9 or 10 what is the point having 1.7. 
https://www.oracle.com/technetwork/java/javase/eol-135779.html
   After this we can then change the code to use 1.8 features. 
   But come on we should try being an attractive project and get new 
committers!! And saying "we must be 1.7" is definitely not the way to do it


This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


> Jdk 1.8 required / Upgrade Jetty Version 9.4.12
> ---
>
> Key: MSITE-828
> URL: https://issues.apache.org/jira/browse/MSITE-828
> Project: Maven Site Plugin
>  Issue Type: Task
>Reporter: Olivier Lamy (*$^¨%`£)
>Assignee: Olivier Lamy (*$^¨%`£)
>Priority: Major
>




--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

[jira] [Commented] (MSITE-828) Jdk 1.8 required / Upgrade Jetty Version 9.4.12

[ASF GitHub Bot (JIRA)]

[ 
https://issues.apache.org/jira/browse/MSITE-828?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16680385#comment-16680385
 ] 

ASF GitHub Bot commented on MSITE-828:
--

michael-o commented on issue #3: [MSITE-828] Upgrade jetty to recent version. 
Update to java 1.8 (required for jetty)
URL: https://github.com/apache/maven-site-plugin/pull/3#issuecomment-437156499
 
 
   Seriously,  because of the tests we need to force Java 8 with zero benefit? 
I Have the latest 1.7 Jetty in Wagon which does the job for testing.


This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


> Jdk 1.8 required / Upgrade Jetty Version 9.4.12
> ---
>
> Key: MSITE-828
> URL: https://issues.apache.org/jira/browse/MSITE-828
> Project: Maven Site Plugin
>  Issue Type: Task
>Reporter: Olivier Lamy (*$^¨%`£)
>Assignee: Olivier Lamy (*$^¨%`£)
>Priority: Major
>




--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

[jira] [Commented] (MSITE-828) Jdk 1.8 required / Upgrade Jetty Version 9.4.12

[ASF GitHub Bot (JIRA)]

[ 
https://issues.apache.org/jira/browse/MSITE-828?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16671021#comment-16671021
 ] 

ASF GitHub Bot commented on MSITE-828:
--

olamy commented on issue #3: [MSITE-828] Upgrade jetty to recent version. 
Update to java 1.8 (required for jetty)
URL: https://github.com/apache/maven-site-plugin/pull/3#issuecomment-434906079
 
 
   @rfscholte @hboutemy any objections? Dohh might be the first plugin being 
java8 required!! :)


This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


> Jdk 1.8 required / Upgrade Jetty Version 9.4.12
> ---
>
> Key: MSITE-828
> URL: https://issues.apache.org/jira/browse/MSITE-828
> Project: Maven Site Plugin
>  Issue Type: Task
>Reporter: Olivier Lamy (*$^¨%`£)
>Assignee: Olivier Lamy (*$^¨%`£)
>Priority: Major
>




--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

[jira] [Commented] (MSITE-828) Jdk 1.8 required / Upgrade Jetty Version 9.4.12

[ASF GitHub Bot (JIRA)]

[ 
https://issues.apache.org/jira/browse/MSITE-828?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16670685#comment-16670685
 ] 

ASF GitHub Bot commented on MSITE-828:
--

oflebbe commented on issue #3: [MSITE-828] Upgrade jetty to recent version. 
Update to java 1.8 (required for jetty)
URL: https://github.com/apache/maven-site-plugin/pull/3#issuecomment-434836813
 
 
   Fixed 
   
   > mvn install org.apache.maven.plugins:maven-site-plugin:3.8-SNAPSHOT:run


This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


> Jdk 1.8 required / Upgrade Jetty Version 9.4.12
> ---
>
> Key: MSITE-828
> URL: https://issues.apache.org/jira/browse/MSITE-828
> Project: Maven Site Plugin
>  Issue Type: Task
>Reporter: Olivier Lamy (*$^¨%`£)
>Assignee: Olivier Lamy (*$^¨%`£)
>Priority: Major
>




--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

[jira] [Commented] (MSITE-828) Jdk 1.8 required / Upgrade Jetty Version 9.4.12

[ASF GitHub Bot (JIRA)]

[ 
https://issues.apache.org/jira/browse/MSITE-828?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16670486#comment-16670486
 ] 

ASF GitHub Bot commented on MSITE-828:
--

oflebbe commented on issue #3: [MSITE-828] Upgrade jetty to recent version. 
Update to java 1.8 (required for jetty)
URL: https://github.com/apache/maven-site-plugin/pull/3#issuecomment-434794612
 
 
   However I see a problem right now: 
   `mvn site:run` fails with maven 3.5.4 but runs with maven 3.3.9 ?! Have to 
look into it


This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


> Jdk 1.8 required / Upgrade Jetty Version 9.4.12
> ---
>
> Key: MSITE-828
> URL: https://issues.apache.org/jira/browse/MSITE-828
> Project: Maven Site Plugin
>  Issue Type: Task
>Reporter: Olivier Lamy (*$^¨%`£)
>Assignee: Olivier Lamy (*$^¨%`£)
>Priority: Major
>




--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

[jira] [Commented] (MSITE-828) Jdk 1.8 required / Upgrade Jetty Version 9.4.12

[ASF GitHub Bot (JIRA)]

[ 
https://issues.apache.org/jira/browse/MSITE-828?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16670483#comment-16670483
 ] 

ASF GitHub Bot commented on MSITE-828:
--

oflebbe commented on a change in pull request #3: [MSITE-828] Upgrade jetty to 
recent version. Update to java 1.8 (required for jetty)
URL: https://github.com/apache/maven-site-plugin/pull/3#discussion_r22981
 
 

 ##
 File path: pom.xml
 ##
 @@ -392,20 +394,34 @@ under the License.
 
 
 
-  org.mortbay.jetty
-  jetty
-  6.1.25
+  org.eclipse.jetty
+  jetty-server
+  9.4.11.v20180605
 
 Review comment:
   Introduced property and was wondering how I missed the most recent one.


This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


> Jdk 1.8 required / Upgrade Jetty Version 9.4.12
> ---
>
> Key: MSITE-828
> URL: https://issues.apache.org/jira/browse/MSITE-828
> Project: Maven Site Plugin
>  Issue Type: Task
>Reporter: Olivier Lamy (*$^¨%`£)
>Assignee: Olivier Lamy (*$^¨%`£)
>Priority: Major
>




--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

[jira] [Commented] (MSITE-828) Jdk 1.8 required / Upgrade Jetty Version 9.4.12

[ASF GitHub Bot (JIRA)]

[ 
https://issues.apache.org/jira/browse/MSITE-828?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16669674#comment-16669674
 ] 

ASF GitHub Bot commented on MSITE-828:
--

olamy commented on a change in pull request #3: [MSITE-828] Upgrade jetty to 
recent version. Update to java 1.8 (required for jetty)
URL: https://github.com/apache/maven-site-plugin/pull/3#discussion_r229574062
 
 

 ##
 File path: pom.xml
 ##
 @@ -392,20 +394,34 @@ under the License.
 
 
 
-  org.mortbay.jetty
-  jetty
-  6.1.25
+  org.eclipse.jetty
+  jetty-server
+  9.4.11.v20180605
 
 Review comment:
the last version is `9.4.12.v20180830` and I would prefer having this 
version in a property instead of few repeats.


This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


> Jdk 1.8 required / Upgrade Jetty Version 9.4.12
> ---
>
> Key: MSITE-828
> URL: https://issues.apache.org/jira/browse/MSITE-828
> Project: Maven Site Plugin
>  Issue Type: Task
>Reporter: Olivier Lamy (*$^¨%`£)
>Assignee: Olivier Lamy (*$^¨%`£)
>Priority: Major
>




--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

[jira] [Commented] (MSITE-828) Jdk 1.8 required / Upgrade Jetty Version 9.4.12

[ASF GitHub Bot (JIRA)]

[ 
https://issues.apache.org/jira/browse/MSITE-828?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16669667#comment-16669667
 ] 

ASF GitHub Bot commented on MSITE-828:
--

olamy commented on a change in pull request #3: [MSITE-828] Upgrade jetty to 
recent version. Update to java 1.8 (required for jetty)
URL: https://github.com/apache/maven-site-plugin/pull/3#discussion_r229574062
 
 

 ##
 File path: pom.xml
 ##
 @@ -392,20 +394,34 @@ under the License.
 
 
 
-  org.mortbay.jetty
-  jetty
-  6.1.25
+  org.eclipse.jetty
+  jetty-server
+  9.4.11.v20180605
 
 Review comment:
   the last version is `9.4.12.v20180830` and would prefer having this version 
in a property.


This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


> Jdk 1.8 required / Upgrade Jetty Version 9.4.12
> ---
>
> Key: MSITE-828
> URL: https://issues.apache.org/jira/browse/MSITE-828
> Project: Maven Site Plugin
>  Issue Type: Task
>Reporter: Olivier Lamy (*$^¨%`£)
>Assignee: Olivier Lamy (*$^¨%`£)
>Priority: Major
>




--
This message was sent by Atlassian JIRA
(v7.6.3#76005)