Re: [VOTE] Release Apache Commons Compress 1.22 based on RC1

2022-10-28 Thread Gary D. Gregory
The tag in the repo is wrong: git clone https://gitbox.apache.org/repos/asf/commons-compress.git --branch commons-compress-1.22-RC1 commons-compress-1.22-RC1 Cloning into 'commons-compress-1.22-RC1'... fatal: Remote branch commons-compress-1.22-RC1 not found in upstream origin Gary On

Re: [VOTE] Release Apache Commons BCEL 6.6.1 based on RC1

2022-10-27 Thread Gary D. Gregory
Thanks Alex. I'll see what I can clean up this weekend before RC2 unless someone else can get to it. Gary On 2022/10/26 16:31:00 Alex Herbert wrote: > Validated signatures on the binary and src distributions. > > Built from src.zip using: > > maven install site -P jacoco -P japicmp > >

[VOTE][CANCEL] Release Apache Commons BCEL 6.6.1 based on RC1

2022-10-27 Thread Gary D. Gregory
g list and constant_pool in the > body. constant_pool is class field and I don’t think the intention of copy_ > is to reuse the existing ConstantPool. > > Mark > > > -Original Message----- > From: Gary D. Gregory [mailto:ggreg...@apache.org] > Sent: Tuesday, October 25, 2022 4:3

Re: [VOTE] Release Apache Commons BCEL 6.6.1 based on RC1

2022-10-26 Thread Gary D. Gregory
Ping ;-) On 2022/10/23 14:58:05 Gary Gregory wrote: > We have fixed one bug since Apache Commons BCEL 6.6.0 was released, so > I would like to release Apache Commons BCEL 6.6.1. This will help > SpotBugs migrate from 6.5.0. > > Apache Commons BCEL 6.6.1 RC1 is available for review here: >

Re: [VOTE] Release Apache Commons BCEL 6.6.1 based on RC1

2022-10-25 Thread Gary D. Gregory
Ping ;-) On 2022/10/23 14:58:05 Gary Gregory wrote: > We have fixed one bug since Apache Commons BCEL 6.6.0 was released, so > I would like to release Apache Commons BCEL 6.6.1. This will help > SpotBugs migrate from 6.5.0. > > Apache Commons BCEL 6.6.1 RC1 is available for review here: >

Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-23 Thread Gary D. Gregory
Hi All, Alex, more below: On 2022/10/22 21:23:13 Alex Herbert wrote: > On Sat, 22 Oct 2022 at 20:05, Gary D. Gregory wrote: > > > > Thank you for the new tests Alex! > > > > Here is one area that is easy to overlook: As Commons CSV has evolved, _not > > all set

Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-22 Thread Gary D. Gregory
ex Herbert wrote: > On Sat, 22 Oct 2022 at 13:56, Gary D. Gregory wrote: > > > > Thank you for your excellent investigation, Alex, and for finding and > > fixing the missing Test annotations. Overall, we have 98% coverage. > > :) > > > Taking stock, I think th

[CANCEL][VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-22 Thread Gary D. Gregory
This VOTE is canceled. I will roll an RC2 if we agree that git master is OK. Gary On 2022/10/22 12:56:40 "Gary D. Gregory" wrote: > Thank you for your excellent investigation, Alex, and for finding and fixing > the missing Test annotations. Overall, we have 98% coverage. >

Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-22 Thread Gary D. Gregory
> > fine > > > with closing my pr. > > > > > > regards, > > > Markus > > > > > > > > > From: Gary Gregory > > > Sent: Friday, October 21, 2022 15:17 > > > To: Commons Developers List > > > Subject: Re: [VOTE] Rel

Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-21 Thread Gary D. Gregory
On 2022/10/20 22:56:05 Alex Herbert wrote: > On Thu, 20 Oct 2022 at 23:43, Alex Herbert wrote: > > > > I did not have time to track through whether this behaviour changed > > after the initial implementation of the flag. I would think not as the > > original behaviour is from 1.0. This would map

Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-21 Thread Gary D. Gregory
; Would't it be simpler to deal with the serialization issue by bumping the > > serialVersionID? We can just say that you only serialized and deserialize > > for the same version. Also note the PR will throw an NPE in the builder > > when instead of using the validate() method. >

Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-20 Thread Gary D. Gregory
Hi All (below) On 2022/10/20 18:08:31 Alex Herbert wrote: > On Thu, 20 Oct 2022 at 17:05, sebb wrote: > > > > On Thu, 20 Oct 2022 at 15:43, Gary Gregory wrote: > > > > > > Would't it be simpler to deal with the serialization issue by bumping the > > > serialVersionID? We can just say that you

Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-19 Thread Gary D. Gregory
I've commented on the PR. TY. Gary On 2022/10/19 16:51:57 Gary Gregory wrote: > On Wed, Oct 19, 2022 at 10:01 AM Alex Herbert > wrote: > > > > On Wed, 19 Oct 2022 at 14:57, Gary D. Gregory wrote: > > > > > > My +1 > > > > > > Gary

Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-19 Thread Gary D. Gregory
Hi Markus, Anyone can vote, please see https://www.apache.org/foundation/voting.html Note that PMC member votes are binding, while others are advisory. Gary On 2022/10/17 10:00:13 sma...@outlook.de wrote: > Hello > > CSV-264 (Add DuplicateHeaderMode) introduces bugs that should be fixed

Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-19 Thread Gary D. Gregory
My +1 Gary On 2022/10/16 12:48:50 Gary Gregory wrote: > To: dev@commons.apache.org > We have fixed a few bugs and added some enhancements since Apache > Commons CSV 1.9.0 was released, so I would like to release Apache > Commons CSV 1.10.0. > > Apache Commons CSV 1.10.0 RC1 is available for

CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

2022-10-13 Thread Gary D. Gregory
Severity: important Description: Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of

Re: [VOTE] Release Apache Commons Daemon 1.3.2 based on RC1

2022-10-07 Thread Gary D. Gregory
+1 Tested Source Zip SHA 512 OK: $ shasum -a 512 --check commons-daemon-1.3.2-src.zip.sha512 commons-daemon-1.3.2-src.zip: OK ASC OK: gpg --verify commons-daemon-1.3.2-src.zip.asc gpg: assuming signed data in 'commons-daemon-1.3.2-src.zip' gpg: Signature made 05-Oct-22 10:03:56 AM Eastern

[VOTE][RESULT] Release Apache Commons Text 1.10.0 based on RC1

2022-09-29 Thread Gary D. Gregory
I should have added "RESULT" in the subject which I am doing now just for simpler search in the mailbox archive. Gary On 2022/09/28 19:32:50 Gary Gregory wrote: > This VOTE passes with the following +1s: > > - Bruno Kinoshita > - Alex Herbert > - Gary Gregory > > Gary > > > On Wed, Sep 28,

<    1   2