Re: [cross-project-issues-dev] MD5 hash not as expect for org.eclipse.jetty.jndi 10.0.15

Since I'm the one that built Eclipse Jetty 10.0.15, let's see what's going on ... First, the official release of 10.0.15 ... The official release does not live on a P2 repository anywhere on download.eclipse.org The official release exists as a maven (tycho) p2 artifact on maven central. The

Re: [cross-project-issues-dev] PlatformRel vs SimRel vs Orbit Abolishment frustration / Xtext leaving SimRel (again) ?!?

Regarding your JDK 17/18 support and your aQute issue. [INFO] --- ebr-maven-plugin:1.4.0-SNAPSHOT:bundle (default-bundle) @ org.antlr.runtime --- [INFO] Gathering dependencies [INFO] Configured Artifact: org.antlr:antlr-runtime:3.5.2:jar [INFO] Unpacking

Re: [cross-project-issues-dev] [orbit-dev] log4j vulnerability in Eclipse?

/6g0ls1cc9htn52hr0kkbo7dds5ts3rb5 - Joakim On Mon, Dec 13, 2021 at 2:44 PM Joakim Erdfelt wrote: > log4j2 version 2.16.0 just showed up on maven central a few moments ago. > > https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-api/2.16.0/ > https://repo1.maven.org/maven2/org/apache/l

Re: [cross-project-issues-dev] [orbit-dev] log4j vulnerability in Eclipse?

log4j2 version 2.16.0 just showed up on maven central a few moments ago. https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-api/2.16.0/ https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-core/2.16.0/ - Joakim On Mon, Dec 13, 2021 at 2:06 PM Matthias Sohn wrote: > I think

Re: [cross-project-issues-dev] log4j vulnerability in Eclipse?

Eclipse Jetty has no hard dependency on log4j2. It's an optional feature that can be used via slf4j-api. On Fri, Dec 10, 2021 at 1:11 PM Denis Roy wrote: > I guess I'm trying to determine if there are any versions of Eclipse, > Jetty, jGit, etc that are vulnerable. > > > For instance, we use

Re: [cross-project-issues-dev] Apache Maven 3.8.2 is now available on all Jenkins instances

Maven 3.8.3 got released a few days ago. The release notes at https://maven.apache.org/docs/3.8.3/release-notes.html Overview ... - Regression fixes from Maven 3.8.2 - Drop CDI API to avoid leakage into code - Speed improvements with

Re: [cross-project-issues-dev] [cbi-dev] Apache Maven 3.8.1 is now available on Jenkins instances

The change in maven to reject `http://` (non-tls secured http) was as a result of a CVE. https://nvd.nist.gov/vuln/detail/CVE-2021-26291 I think we should encourage proper use of `https://` (secured TLS http) from here on out within all Eclipse projects using maven. - Joakim On Mon, Jun 21,

Re: [cross-project-issues-dev] ACTION REQUIRED from RAP / REDDEER / WEBTOOLS - respin of Eclipse Platform RC2a and the status on removing slf4j 2.0.0 alpha

Eclipse Jetty 10.0.5 release (*not snapshot*) is now available on maven central. - Joakim On Fri, Jun 11, 2021 at 5:48 AM Sravan K Lakkimsetti < sravankum...@in.ibm.com> wrote: > Platform testing is also complete. Verified the help feature and no issues > found. > > > > Thanks > > Sravan > > >

Re: [cross-project-issues-dev] ACTION REQUIRED from RAP / REDDEER / WEBTOOLS - respin of Eclipse Platform RC2a and the status on removing slf4j 2.0.0 alpha

We (Eclipse Jetty) hope to have 10.0.5 out (in maven central) by this weekend. On Thu, Jun 10, 2021 at 3:01 PM Markus Knauer wrote: > Just to double-check: My understanding is that we are using Jetty 10.0.5- > *snapshot* for "early" testing in order to get some confidence that > everything will

Re: [cross-project-issues-dev] Missing requirement for org.slf4j in 2021-06 M2

The Eclipse Jetty 10+ usage of slf4j-api is minimal. It does not use the advanced feature set available in slf4j-api 2.x But it does use slf4j-api 2.x for JPMS environments (it's the first slf4j with proper jpms metadata). If the Platform wants to use slf4j-api 1.7.x with Eclipse Jetty 10.x it

[cross-project-issues-dev] What is the new (post portal.eclipse.org world) process for submitting a CQ?

The Eclipse Project Handbook still has references to the portal.eclipse.org as the starting point. https://www.eclipse.org/projects/handbook/#pmi-commands-cq What's the new way to start a CQ? Thanks, - Joakim ___ cross-project-issues-dev mailing list

Re: [cross-project-issues-dev] Bug tracker for Jsch

The official repo appears to be http://git.jcraft.com/jsch.git I found it referenced in the official zip file release: jsch-0.1.54.zip However, that git repo also has no test cases. - Joakim Erdfelt On Wed, Nov 15, 2017 at 4:43 PM, Matthias Sohn <matthias.s...@gmail.com> wrote: >

Re: [cross-project-issues-dev] Jetty version in Oxygen

cial release > >> announcement. > > > > Do you have any ETA? > > > > Dani > > > > > > > > From:Joakim Erdfelt <joakim.erdf...@gmail.com> > > To:Cross project issues <cross-project-issues-dev@eclipse.org>

Re: [cross-project-issues-dev] Jetty version in Oxygen

Jetty 9.4.6 is a staged/potential release, not available yet. It is undergoing testing, atm. Please wait for the jetty-announce thread for the official release announcement. On Fri, Jun 2, 2017 at 6:07 AM, Aleksandar Kurtakov wrote: > There is new staged release for Jetty

Re: [cross-project-issues-dev] [wtp-dev] Website links to wiki are not working with HTTP

This behavior of Chrome was announced. https://security.googleblog.com/2016/09/moving-towards-more-secure-web.html Also of note, on Jan 1, 2017, all SHA0 and SHA1 ciphers and certificates are now rejected by Chrome (as well as Firefox, Edge, amongst others). On Wed, Jan 11, 2017 at 8:10 AM,

Re: [cross-project-issues-dev] git.eclipse.org not reachable

The http port is dead. The https port is fine, and works here. Tested https://git.eclipse.org/c/jetty/ The ssh port is alive, and accepting connections, but is terribly slow. (like 10 minutes to connect slow) The git ssh:// connection is so slow that it times out. On Tue, Aug 16, 2016 at 5:31

Re: [cross-project-issues-dev] jetty versions - Another issue to feed on the topic of semantic versioning

What does Apache Aries have to do with this? There's no references to Apache anything in the Jetty WebSocket layers in code nor in the manifests. Where is this reference / dependency coming from? Certainly not Jetty. On Wed, Sep 16, 2015 at 7:39 AM, Doug Schaefer wrote: >

Re: [cross-project-issues-dev] jetty versions - Another issue to feed on the topic of semantic versioning

For the foreseeable future It will likely never be possible to mix Jetty websocket versions, the various specs (browser, main protocol, http/2 protocol, extensions, etc) are all changing rapidly STILL. On Wed, Sep 16, 2015 at 7:45 AM, Mickael Istria wrote: > On 09/16/2015

Re: [cross-project-issues-dev] jetty versions - Another issue to feed on the topic of semantic versioning

gt; On 16 Sep 2015, at 17:04, Mickael Istria wrote: > > On 09/16/2015 04:54 PM, Joakim Erdfelt wrote: >> >>> What does Apache Aries have to do with this? >>> There's no references to Apache anything in the Jetty WebSocket layers >>> in code nor in the manifests.

Re: [cross-project-issues-dev] jetty versions - Another issue to feed on the topic of semantic versioning

We monitor this list. However, the filed bug says "This class was API and was used by several of the other jetty bundles." Which is confusing, as SpinLock is internal, not API. And using mixed versions of Jetty (on the server side) is generally frowned upon (at least from the non-OSGi point of

Re: [cross-project-issues-dev] 103 Contributions pending on GitHub

The Jetty project enjoys the github repository and would not like to see PR requests disabled or the repository go away. This decisions being discussed here should be up to the individual projects, not wholesale for all of eclipse. On Wed, Dec 18, 2013 at 5:46 AM, Aleksandar Kurtakov

Re: [cross-project-issues-dev] Preferences (topic was touched in Eclipse smells kind of dead thread)

Preference import has another major issue. (which I had hoped back in the days of Eclipse 3.0 would have solved). Export / Import of preferences is an all or nothing proposition. If you, as a developer, have a core set of preferences you want to set, but are happy with the rest being at default,

Re: [cross-project-issues-dev] script that checks presence of file headers (copyright+legal)

Within the CBI and Maven, you can use the maven-license-plugin. https://code.google.com/p/maven-license-plugin/wiki/HowTo There is also the RAT (Release Audit Tool) / Creadur libraries at Apache that could be integrated as well. https://creadur.apache.org/ On Mon, Dec 10, 2012 at 9:42 AM,