dev  

Messages by Thread

• Roller 6.1.7 PR status Dave
• [PR] Fix blogroll, category and ping target dialogs after an AJAX save [roller] via GitHub
  • Re: [PR] Fix blogroll, category and ping target dialogs, and AtomPub media collections [roller] via GitHub
  • Re: [PR] Fix blogroll, category and ping target dialogs, AtomPub media, the Planet feed title, and double image paste [roller] via GitHub
• [PR] Run CI and CodeQL on roller-6.1.x [roller] via GitHub
  • Re: [PR] Run CI and CodeQL on roller-6.1.x [roller] via GitHub
• [PR] ROL-2184: Preserve pasted entry images when publishing [roller] via GitHub
  • Re: [PR] ROL-2184: Preserve pasted entry images when publishing [roller] via GitHub
  • Re: [PR] ROL-2184: Preserve pasted entry images when publishing [roller] via GitHub
  • Re: [PR] ROL-2184: Preserve pasted entry images when publishing [roller] via GitHub
• [PR] Roller 6.1.x [roller] via GitHub
  • Re: [PR] Roller 6.1.x [roller] via GitHub
• [PR] Preserve pasted entry images when publishing [roller] via GitHub
  • Re: [PR] Preserve pasted entry images when publishing [roller] via GitHub
  • Re: [PR] ROL-2184: Preserve pasted entry images when publishing [roller] via GitHub
  • Re: [PR] ROL-2184: Preserve pasted entry images when publishing [roller] via GitHub
  • Re: [PR] ROL-2184: Preserve pasted entry images when publishing [roller] via GitHub
  • Re: [PR] ROL-2184: Preserve pasted entry images when publishing [roller] via GitHub
• [PR] Add security model and SECURITY.md [roller] via GitHub
  • Re: [PR] Add security model and SECURITY.md [roller] via GitHub
  • Re: [PR] Add security model and SECURITY.md [roller] via GitHub
  • Re: [PR] Add security model and SECURITY.md [roller] via GitHub
• [PR] Adopt Apache Commons Secure XML for XML parsing [roller] via GitHub
  • Re: [PR] Adopt Apache Commons Secure XML for XML parsing [roller] via GitHub
  • Re: [PR] Adopt Apache Commons Secure XML for XML parsing [roller] via GitHub
  • Re: [PR] Adopt Apache Commons Secure XML for XML parsing [roller] via GitHub
  • Re: [PR] Adopt Apache Commons Secure XML for XML parsing [roller] via GitHub
  • Re: [PR] Adopt Apache Commons Secure XML for XML parsing [roller] via GitHub
• [PR] Turn Planet off by default and require POST for its admin changes [roller] via GitHub
  • Re: [PR] Turn Planet off by default and require POST for its admin changes [roller] via GitHub
  • Re: [PR] Turn Planet off by default and require POST for its admin changes [roller] via GitHub
  • Re: [PR] Turn Planet off by default and require POST for its admin changes [roller] via GitHub
  • Re: [PR] Turn Planet off by default and require POST for its admin changes [roller] via GitHub
  • Re: [PR] Turn Planet off by default and require POST for its admin changes [roller] via GitHub
  • Re: [PR] Turn Planet off by default and require POST for its admin changes [roller] via GitHub
  • Re: [PR] Turn Planet off by default and require POST for its admin changes [roller] via GitHub
  • Re: [PR] Turn Planet off by default and require POST for its admin changes [roller] via GitHub
  • Re: [PR] Turn Planet off by default and require POST for its admin changes [roller] via GitHub
• [PR] Keep wrapped pojos out of the template surface [roller] via GitHub
  • Re: [PR] Keep wrapped pojos out of the template surface [roller] via GitHub
  • Re: [PR] Keep wrapped pojos out of the template surface [roller] via GitHub
  • Re: [PR] Keep wrapped pojos out of the template surface [roller] via GitHub
  • Re: [PR] Keep wrapped pojos out of the template surface [roller] via GitHub
  • Re: [PR] Keep wrapped pojos out of the template surface [roller] via GitHub
  • Re: [PR] Keep wrapped pojos out of the template surface [roller] via GitHub
  • Re: [PR] Keep wrapped pojos out of the template surface [roller] via GitHub
• [PR] Serve AtomPub through a Roller servlet [roller] via GitHub
  • Re: [PR] Serve AtomPub through a Roller servlet [roller] via GitHub
  • Re: [PR] Serve AtomPub through a Roller servlet [roller] via GitHub
  • Re: [PR] Serve AtomPub through a Roller servlet [roller] via GitHub
  • Re: [PR] Serve AtomPub through a Roller servlet [roller] via GitHub
  • Re: [PR] Serve AtomPub through a Roller servlet [roller] via GitHub
  • Re: [PR] Serve AtomPub through a Roller servlet [roller] via GitHub
  • Re: [PR] Serve AtomPub through a Roller servlet [roller] via GitHub
  • Re: [PR] Serve AtomPub through a Roller servlet [roller] via GitHub
  • Re: [PR] Serve AtomPub through a Roller servlet [roller] via GitHub
  • Re: [PR] Serve AtomPub through a Roller servlet [roller] via GitHub
• [ANNOUNCE] Apache Roller 6.1.6 fixes 18 security vulnerabilities Dave
• [PR] Update the gaurav theme's jQuery and Bootstrap, drop unused jQuery 2.1.1 [roller] via GitHub
  • Re: [PR] Update the gaurav theme's jQuery and Bootstrap, drop unused jQuery 2.1.1 [roller] via GitHub
• [PR] Fold release and disclosure lessons into the release and security skills [roller] via GitHub
  • Re: [PR] Fold release and disclosure lessons into the release and security skills [roller] via GitHub
• CVE-2026-82546: Apache Roller: Stored cross-site scripting through incoming Trackback links David M. Johnson
• CVE-2026-86507: Apache Roller: Stored XSS in comment moderation via comment author URL David M. Johnson
• CVE-2026-82387: Apache Roller: Stored cross-site scripting via uploaded media content type David M. Johnson
• CVE-2026-82348: Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups David M. Johnson
• CVE-2026-82376: Apache Roller: XML external entity processing in trackback response parser David M. Johnson
• CVE-2026-82375: Apache Roller: Server-side request forgery via entry trackback and enclosure URLs David M. Johnson
• CVE-2026-82386: Apache Roller: XML external entity processing in OPML bookmark import David M. Johnson
• CVE-2026-82385: Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files David M. Johnson
• CVE-2026-82378: Apache Roller: OAuth authorization endpoint trusts request-supplied identity David M. Johnson
• CVE-2026-82377: Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers David M. Johnson
• CVE-2026-82383: Apache Roller: Anonymous setup action allows frontpage configuration tampering David M. Johnson
• CVE-2026-82384: Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint David M. Johnson
• CVE-2026-82379: Apache Roller: WSSE digest authentication headers can be replayed David M. Johnson
• CVE-2026-82382: Apache Roller: Reflected cross-site scripting in the frontpage directory parameter David M. Johnson
• CVE-2026-82381: Apache Roller: Stored cross-site scripting in the authoring UI David M. Johnson
• CVE-2026-82380: Apache Roller: CSRF protection bypass via self-generated salt validation David M. Johnson
• [PR] Add the ASF license header to source files that were missing it [roller] via GitHub
  • Re: [PR] Add the ASF license header to source files that were missing it [roller] via GitHub
  • Re: [PR] Add the ASF license header to source files that were missing it [roller] via GitHub
  • Re: [PR] Add missing ASF license headers and check them with Apache RAT [roller] via GitHub
• [ANNOUNCE] Apache Roller 6.1.6 released Dave
• [PR] Bump org.freemarker:freemarker from 2.3.23 to 2.3.35 in /sources [roller-website] via GitHub
  • Re: [PR] Bump org.freemarker:freemarker from 2.3.23 to 2.3.35 in /sources [roller-website] via GitHub
• [PR] No single quotes in media file insert url on mediaFileAdd!save.rol [roller] via GitHub
  • Re: [PR] No single quotes in media file insert url on mediaFileAdd!save.rol [roller] via GitHub
  • Re: [PR] No single quotes in media file insert url on mediaFileAdd!save.rol [roller] via GitHub
  • Re: [PR] No single quotes in media file insert url on mediaFileAdd!save.rol [roller] via GitHub
  • Re: [PR] No single quotes in media file insert url on mediaFileAdd!save.rol [roller] via GitHub
  • [PR] No single quotes in media file insert url on mediaFileAdd!save.rol [roller] via GitHub
  • Re: [PR] No single quotes in media file insert url on mediaFileAdd!save.rol [roller] via GitHub
  • Re: [PR] No single quotes in media file insert url on mediaFileAdd!save.rol [roller] via GitHub
• [VOTE] Release Apache Roller 6.1.6 (RC4) Dave
  • Re: [VOTE] Release Apache Roller 6.1.6 (RC4) Michael Bien
  • Re: [VOTE] Release Apache Roller 6.1.6 (RC4) Dave
  • Re: [VOTE] Release Apache Roller 6.1.6 (RC4) Matt Raible
  • Re: [VOTE] Release Apache Roller 6.1.6 (RC4) Greg Huber
  • Re: [VOTE] Release Apache Roller 6.1.6 (RC4) Dave
  • 6.1.7 release to struts v6 Greg Huber
  • Re: 6.1.7 release to struts v6 Greg Huber
  • roller on struts v7 Greg Huber
  • [RESULT][VOTE] Release Apache Roller 6.1.6 (RC4) Dave
• [PR] Bump org.apache.struts:struts2-core from 2.5.29 to 6.8.0 in /app [roller] via GitHub
  • Re: [PR] Bump org.apache.struts:struts2-core from 2.5.29 to 6.8.0 in /app [roller] via GitHub
  • Re: [PR] Bump org.apache.struts:struts2-core from 2.5.29 to 6.8.0 in /app [roller] via GitHub
• [PR] Format LDAP comment form values consistently [roller] via GitHub
  • Re: [PR] Format LDAP comment form values consistently [roller] via GitHub
  • Re: [PR] Format LDAP comment form values consistently [roller] via GitHub
  • Re: [PR] Format LDAP comment form values consistently [roller] via GitHub
  • Re: [PR] Format LDAP comment form values consistently [roller] via GitHub
• [PR] Normalize links in HTML subset formatting [roller] via GitHub
  • Re: [PR] Normalize links in HTML subset formatting [roller] via GitHub
  • Re: [PR] Normalize links in HTML subset formatting [roller] via GitHub
  • Re: [PR] Normalize links in HTML subset formatting [roller] via GitHub
  • Re: [PR] Normalize links in HTML subset formatting [roller] via GitHub
  • Re: [PR] Normalize links in HTML subset formatting [roller] via GitHub
• [PR] Secure initial Roller setup with one-time operator token [roller] via GitHub
  • Re: [PR] Secure initial Roller setup with one-time operator token [roller] via GitHub
  • Re: [PR] Secure initial Roller setup with one-time operator token [roller] via GitHub
  • Re: [PR] Secure initial Roller setup with one-time operator token [roller] via GitHub
  • Re: [PR] Secure initial Roller setup with one-time operator token [roller] via GitHub
  • Re: [PR] Secure initial Roller setup with one-time operator token [roller] via GitHub
  • Re: [PR] Secure initial Roller setup with one-time operator token [roller] via GitHub
  • Re: [PR] Secure initial Roller setup with one-time operator token [roller] via GitHub
• [PR] Make sure bootstrap tables.less .table-striped > tbody > tr:nth-of-type(2n+1) is overridden [roller] via GitHub
  • Re: [PR] Make sure bootstrap tables.less .table-striped > tbody > tr:nth-of-type(2n+1) is overridden [roller] via GitHub
• [PR] Add a roller-security developer skill for report triage and coordination [roller] via GitHub
  • Re: [PR] Add a roller-security developer skill for report triage and coordination [roller] via GitHub
• [PR] Add a roller-release developer skill documenting the release procedure [roller] via GitHub
  • Re: [PR] Add a roller-release developer skill documenting the release procedure [roller] via GitHub
• [VOTE] Release Apache Roller 6.1.6 RC3 Dave
  • Re: [VOTE] Release Apache Roller 6.1.6 RC3 Dave
  • Re: [VOTE] Release Apache Roller 6.1.6 RC3 Matt Raible
• [PR] Fix jQuery UI 404 on authoring pages (drop webjar +1 suffix from head.jsp URL) [roller] via GitHub
  • Re: [PR] Fix jQuery UI 404 on authoring pages (drop webjar +1 suffix from head.jsp URL) [roller] via GitHub
• [PR] Track schema upgrades with a flag instead of a hardcoded version check [roller] via GitHub
  • Re: [PR] Track schema upgrades with a flag instead of a hardcoded version check [roller] via GitHub
• [PR] Fix blank Font Awesome icons in preset themes (CSP font-src) and document H2 VALUE workaround [roller] via GitHub
  • Re: [PR] Fix blank Font Awesome icons in preset themes (CSP font-src) and document H2 VALUE workaround [roller] via GitHub
• Note on Roller compatibility with the latest H2 database (H2 2.5.250) Richard via dev
  • Re: Note on Roller compatibility with the latest H2 database (H2 2.5.250) Dave
  • Re: Note on Roller compatibility with the latest H2 database (H2 2.5.250) Richard via dev
• [PR] Use double-quoted href attributes on the comment management page [roller] via GitHub
  • Re: [PR] Use double-quoted href attributes on the comment management page [roller] via GitHub
• [VOTE] Release Apache Roller 6.1.6 RC2 Dave
  • Re: [VOTE] Release Apache Roller 6.1.6 RC2 Matt Raible
  • Re: [VOTE] Release Apache Roller 6.1.6 RC2 Dave
  • Re: [VOTE] Release Apache Roller 6.1.6 RC2 Dave
  • [CANCEL][VOTE] Release Apache Roller 6.1.6 RC2 Dave
• [PR] Improve installer form initialization and preview navigation [roller] via GitHub
  • Re: [PR] Improve installer form initialization and preview navigation [roller] via GitHub
  • Re: [PR] Improve installer form initialization and preview navigation [roller] via GitHub
  • Re: [PR] Improve installer form initialization and preview navigation [roller] via GitHub
  • Re: [PR] Improve installer form initialization and preview navigation [roller] via GitHub
  • Re: [PR] Improve installer form initialization and preview navigation [roller] via GitHub
  • Re: [PR] Improve installer form initialization and preview navigation [roller] via GitHub
• [VOTE] Release Apache Roller 6.1.6 RC1 Dave
  • Re: [VOTE] Release Apache Roller 6.1.6 RC1 Dave
  • testing 6.1.6 RC1 Greg Huber
  • Re: testing 6.1.6 RC1 Dave
  • [CANCEL][VOTE] Release Apache Roller 6.1.6 RC1 Dave
• [PR] Update dependencies across project and add JDK 25 to test matrix [roller] via GitHub
  • Re: [PR] Update dependencies across project and add JDK 25 to test matrix [roller] via GitHub
  • Re: [PR] Update dependencies across project and add JDK 25 to test matrix [roller] via GitHub
• [PR] Add release notes and stop shipping third-party jars in the source release [roller] via GitHub
  • Re: [PR] Add release notes and stop shipping third-party jars in the source release [roller] via GitHub
• [PR] Fix release signing script argument handling and checksums [roller] via GitHub
  • Re: [PR] Fix release signing script argument handling and checksums [roller] via GitHub
• [PR] Retire incoming Trackback support and normalize comment links [roller] via GitHub
  • Re: [PR] Retire incoming Trackback support and normalize comment links [roller] via GitHub
  • Re: [PR] Retire incoming Trackback support and normalize comment links [roller] via GitHub
  • Re: [PR] Retire incoming Trackback support and normalize comment links [roller] via GitHub
  • Re: [PR] Retire incoming Trackback support and normalize comment links [roller] via GitHub
  • Re: [PR] Retire incoming Trackback support and normalize comment links [roller] via GitHub
  • Re: [PR] Retire incoming Trackback support and normalize comment links [roller] via GitHub
  • Re: [PR] Retire incoming Trackback support and normalize comment links [roller] via GitHub
  • [PR] Retire incoming Trackback support and normalize comment links [roller] via GitHub
  • Re: [PR] Retire incoming Trackback support and normalize comment links [roller] via GitHub
• [PR] Store enclosure metadata without fetching remote URLs [roller] via GitHub
  • Re: [PR] Store enclosure metadata without fetching remote URLs [roller] via GitHub
  • Re: [PR] Store enclosure metadata without fetching remote URLs [roller] via GitHub
  • Re: [PR] Store enclosure metadata without fetching remote URLs [roller] via GitHub
  • Re: [PR] Store enclosure metadata without fetching remote URLs [roller] via GitHub
  • Re: [PR] Store enclosure metadata without fetching remote URLs [roller] via GitHub
• [PR] Move authoring UI inline JS handlers to data attributes [roller] via GitHub
  • Re: [PR] Move authoring UI inline JS handlers to data attributes [roller] via GitHub
  • Re: [PR] Move authoring UI inline JS handlers to data attributes [roller] via GitHub
  • Re: [PR] Move authoring UI inline JS handlers to data attributes [roller] via GitHub
  • Re: [PR] Move authoring UI inline JS handlers to data attributes [roller] via GitHub
• [PR] Derive media content types from file content, not the request [roller] via GitHub
  • Re: [PR] Derive media content types from file content, not the request [roller] via GitHub
  • Re: [PR] Derive media content types from file content, not the request [roller] via GitHub
  • Re: [PR] Derive media content types from file content, not the request [roller] via GitHub
  • Re: [PR] Derive media content types from file content, not the request [roller] via GitHub
  • Re: [PR] Derive media content types from file content, not the request [roller] via GitHub
  • Re: [PR] Derive media content types from file content, not the request [roller] via GitHub
• [PR] Move frontpage selection into the administrator setup workflow [roller] via GitHub
  • Re: [PR] Move frontpage selection into the administrator setup workflow [roller] via GitHub
  • Re: [PR] Move frontpage selection into the administrator setup workflow [roller] via GitHub

• Earlier messages