dev  

Messages by Date

• 2026/09/29 [PR] Keep wrapped pojos out of the template surface [roller] via GitHub
• 2026/09/29 [PR] Serve AtomPub through a Roller servlet [roller] via GitHub
• 2026/09/28 [PR] No single quotes in media file insert url on mediaFileAdd!save.rol [roller] via GitHub
• 2026/09/27 Re: [PR] No single quotes in media file insert url on mediaFileAdd!save.rol [roller] via GitHub
• 2026/09/27 Re: [PR] Update the gaurav theme's jQuery and Bootstrap, drop unused jQuery 2.1.1 [roller] via GitHub
• 2026/09/27 [ANNOUNCE] Apache Roller 6.1.6 fixes 18 security vulnerabilities Dave
• 2026/09/27 Re: [PR] Add missing ASF license headers and check them with Apache RAT [roller] via GitHub
• 2026/09/27 Re: [PR] No single quotes in media file insert url on mediaFileAdd!save.rol [roller] via GitHub
• 2026/09/27 Re: [PR] Use double-quoted attributes in media file links inserted into new entries [roller] via GitHub
• 2026/09/27 Re: [PR] Use double-quoted attributes in media file links inserted into new entries [roller] via GitHub
• 2026/09/27 Re: [PR] Fold release and disclosure lessons into the release and security skills [roller] via GitHub
• 2026/09/27 roller on struts v7 Greg Huber
• 2026/09/27 6.1.7 release to struts v6 Greg Huber
• 2026/09/26 Re: [VOTE] Release Apache Roller 6.1.6 (RC4) Dave
• 2026/09/26 [PR] Update the gaurav theme's jQuery and Bootstrap, drop unused jQuery 2.1.1 [roller] via GitHub
• 2026/09/26 Re: [PR] Add the ASF license header to source files that were missing it [roller] via GitHub
• 2026/09/25 Re: [PR] Fix incorrect PostgreSQL port in Dockerfile [roller] via GitHub
• 2026/09/25 [PR] Fold release and disclosure lessons into the release and security skills [roller] via GitHub
• 2026/09/25 CVE-2026-82546: Apache Roller: Stored cross-site scripting through incoming Trackback links David M. Johnson
• 2026/09/25 CVE-2026-86507: Apache Roller: Stored XSS in comment moderation via comment author URL David M. Johnson
• 2026/09/25 CVE-2026-82387: Apache Roller: Stored cross-site scripting via uploaded media content type David M. Johnson
• 2026/09/25 CVE-2026-82348: Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups David M. Johnson
• 2026/09/25 CVE-2026-82376: Apache Roller: XML external entity processing in trackback response parser David M. Johnson
• 2026/09/25 CVE-2026-82375: Apache Roller: Server-side request forgery via entry trackback and enclosure URLs David M. Johnson
• 2026/09/25 CVE-2026-82386: Apache Roller: XML external entity processing in OPML bookmark import David M. Johnson
• 2026/09/25 CVE-2026-82385: Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files David M. Johnson
• 2026/09/25 CVE-2026-82378: Apache Roller: OAuth authorization endpoint trusts request-supplied identity David M. Johnson
• 2026/09/25 CVE-2026-82377: Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers David M. Johnson
• 2026/09/25 CVE-2026-82383: Apache Roller: Anonymous setup action allows frontpage configuration tampering David M. Johnson
• 2026/09/25 CVE-2026-82384: Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint David M. Johnson
• 2026/09/25 CVE-2026-82379: Apache Roller: WSSE digest authentication headers can be replayed David M. Johnson
• 2026/09/25 CVE-2026-82382: Apache Roller: Reflected cross-site scripting in the frontpage directory parameter David M. Johnson
• 2026/09/25 CVE-2026-82381: Apache Roller: Stored cross-site scripting in the authoring UI David M. Johnson
• 2026/09/25 CVE-2026-82380: Apache Roller: CSRF protection bypass via self-generated salt validation David M. Johnson
• 2026/09/25 Re: [PR] Add the ASF license header to source files that were missing it [roller] via GitHub
• 2026/09/25 Re: [PR] ROL-2183: Migrate from javax to Jakarta EE 11 [roller] via GitHub
• 2026/09/25 Re: [PR] Use double-quoted attributes in media file links inserted into new entries [roller] via GitHub
• 2026/09/25 Re: [PR] ROL-2183: Migrate from javax to Jakarta EE 11 [roller] via GitHub
• 2026/09/25 [PR] Add the ASF license header to source files that were missing it [roller] via GitHub
• 2026/09/25 Re: [PR] Include jquery instead of getting it from ajax.googleapis.com [roller-website] via GitHub
• 2026/09/25 Re: [PR] [INFRA] Set up default rulesets for default and release branches [roller-website] via GitHub
• 2026/09/25 Re: [PR] Bump org.freemarker:freemarker from 2.3.23 to 2.3.35 in /sources [roller-website] via GitHub
• 2026/09/25 Re: [VOTE] Release Apache Roller 6.1.6 (RC4) Greg Huber
• 2026/09/24 [ANNOUNCE] Apache Roller 6.1.6 released Dave
• 2026/09/24 [RESULT][VOTE] Release Apache Roller 6.1.6 (RC4) Dave
• 2026/09/24 [PR] Bump org.freemarker:freemarker from 2.3.23 to 2.3.35 in /sources [roller-website] via GitHub
• 2026/09/24 Re: [VOTE] Release Apache Roller 6.1.6 (RC4) Matt Raible
• 2026/09/24 Re: [VOTE] Release Apache Roller 6.1.6 (RC4) Dave
• 2026/09/22 Re: [PR] No single quotes in media file insert url on mediaFileAdd!save.rol [roller] via GitHub
• 2026/09/19 Re: [PR] No single quotes in media file insert url on mediaFileAdd!save.rol [roller] via GitHub
• 2026/09/19 [PR] No single quotes in media file insert url on mediaFileAdd!save.rol [roller] via GitHub
• 2026/09/17 Re: [VOTE] Release Apache Roller 6.1.6 (RC4) Michael Bien
• 2026/09/17 [VOTE] Release Apache Roller 6.1.6 (RC4) Dave
• 2026/09/17 Re: [PR] Bump org.apache.struts:struts2-core from 2.5.29 to 6.8.0 in /app [roller] via GitHub
• 2026/09/17 Re: [PR] Bump org.apache.struts:struts2-core from 2.5.29 to 6.8.0 in /app [roller] via GitHub
• 2026/09/17 Re: [PR] Make sure bootstrap tables.less .table-striped > tbody > tr:nth-of-type(2n+1) is overridden [roller] via GitHub
• 2026/09/17 [PR] Bump org.apache.struts:struts2-core from 2.5.29 to 6.8.0 in /app [roller] via GitHub
• 2026/09/17 Re: [PR] Secure initial Roller setup with one-time operator token [roller] via GitHub
• 2026/09/17 Re: [PR] Secure initial Roller setup with one-time operator token [roller] via GitHub
• 2026/09/17 Re: [PR] Secure initial Roller setup with one-time operator token [roller] via GitHub
• 2026/09/17 Re: [PR] Secure initial Roller setup with one-time operator token [roller] via GitHub
• 2026/09/17 Re: [PR] Normalize links in HTML subset formatting [roller] via GitHub
• 2026/09/17 Re: [PR] Normalize links in HTML subset formatting [roller] via GitHub
• 2026/09/17 Re: [PR] Normalize links in HTML subset formatting [roller] via GitHub
• 2026/09/17 Re: [PR] Normalize links in HTML subset formatting [roller] via GitHub
• 2026/09/17 Re: [PR] Normalize links in HTML subset formatting [roller] via GitHub
• 2026/09/17 Re: [PR] Format LDAP comment form values consistently [roller] via GitHub
• 2026/09/17 Re: [PR] Format LDAP comment form values consistently [roller] via GitHub
• 2026/09/17 Re: [PR] Format LDAP comment form values consistently [roller] via GitHub
• 2026/09/17 Re: [PR] Format LDAP comment form values consistently [roller] via GitHub
• 2026/09/15 Re: [VOTE] Release Apache Roller 6.1.6 RC3 Matt Raible
• 2026/09/15 Re: [VOTE] Release Apache Roller 6.1.6 RC3 Dave
• 2026/09/15 Re: [PR] Secure initial Roller setup with one-time operator token [roller] via GitHub
• 2026/09/14 [PR] Format LDAP comment form values consistently [roller] via GitHub
• 2026/09/14 [PR] Normalize links in HTML subset formatting [roller] via GitHub
• 2026/09/14 Re: [PR] Secure initial Roller setup with one-time operator token [roller] via GitHub
• 2026/09/14 Re: [PR] Secure initial Roller setup with one-time operator token [roller] via GitHub
• 2026/09/13 [PR] Secure initial Roller setup with one-time operator token [roller] via GitHub
• 2026/09/13 [PR] Make sure bootstrap tables.less .table-striped > tbody > tr:nth-of-type(2n+1) is overridden [roller] via GitHub
• 2026/09/11 Re: [PR] Add a roller-release developer skill documenting the release procedure [roller] via GitHub
• 2026/09/11 Re: [PR] Add a roller-security developer skill for report triage and coordination [roller] via GitHub
• 2026/09/11 [PR] Add a roller-security developer skill for report triage and coordination [roller] via GitHub
• 2026/09/11 [PR] Add a roller-release developer skill documenting the release procedure [roller] via GitHub
• 2026/09/10 [VOTE] Release Apache Roller 6.1.6 RC3 Dave
• 2026/09/10 [CANCEL][VOTE] Release Apache Roller 6.1.6 RC2 Dave
• 2026/09/10 Re: [PR] Fix blank Font Awesome icons in preset themes (CSP font-src) and document H2 VALUE workaround [roller] via GitHub
• 2026/09/10 Re: [PR] Track schema upgrades with a flag instead of a hardcoded version check [roller] via GitHub
• 2026/09/10 Re: [PR] Fix jQuery UI 404 on authoring pages (drop webjar +1 suffix from head.jsp URL) [roller] via GitHub
• 2026/09/09 Re: [VOTE] Release Apache Roller 6.1.6 RC2 Dave
• 2026/09/09 [PR] Fix jQuery UI 404 on authoring pages (drop webjar +1 suffix from head.jsp URL) [roller] via GitHub
• 2026/09/09 Re: [VOTE] Release Apache Roller 6.1.6 RC2 Dave
• 2026/09/09 Re: [VOTE] Release Apache Roller 6.1.6 RC2 Matt Raible
• 2026/09/08 Re: [PR] Replace the Selenium suite with Playwright browser tests run across all auth methods [roller] via GitHub
• 2026/09/08 Re: Note on Roller compatibility with the latest H2 database (H2 2.5.250) Richard via dev
• 2026/09/08 Re: Note on Roller compatibility with the latest H2 database (H2 2.5.250) Dave
• 2026/09/08 Re: [PR] Improve installer form initialization and preview navigation [roller] via GitHub
• 2026/09/08 [PR] Track schema upgrades with a flag instead of a hardcoded version check [roller] via GitHub
• 2026/09/08 [PR] Fix blank Font Awesome icons in preset themes (CSP font-src) and document H2 VALUE workaround [roller] via GitHub
• 2026/09/08 Re: [PR] Improve installer form initialization and preview navigation [roller] via GitHub
• 2026/09/08 Re: [PR] Improve installer form initialization and preview navigation [roller] via GitHub
• 2026/09/07 Note on Roller compatibility with the latest H2 database (H2 2.5.250) Richard via dev
• 2026/09/07 [PR] Use double-quoted href attributes on the comment management page [roller] via GitHub
• 2026/09/07 Re: [PR] Improve installer form initialization and preview navigation [roller] via GitHub
• 2026/09/07 [VOTE] Release Apache Roller 6.1.6 RC2 Dave
• 2026/09/07 [CANCEL][VOTE] Release Apache Roller 6.1.6 RC1 Dave
• 2026/09/07 Re: [PR] Improve installer form initialization and preview navigation [roller] via GitHub
• 2026/09/07 Re: [PR] Improve installer form initialization and preview navigation [roller] via GitHub
• 2026/09/07 Re: testing 6.1.6 RC1 Dave
• 2026/09/07 [PR] Improve installer form initialization and preview navigation [roller] via GitHub
• 2026/09/07 Re: [PR] Use double-quoted href attributes on the comment management page [roller] via GitHub
• 2026/09/07 testing 6.1.6 RC1 Greg Huber
• 2026/09/06 Re: [PR] Bump spring-web from 5.3.20 to 6.0.0 in /app [roller] via GitHub
• 2026/09/06 Re: [PR] Bump spring-web from 5.3.20 to 6.0.0 in /app [roller] via GitHub
• 2026/09/06 Re: [PR] Bump spring-web from 5.3.20 to 6.0.0 in /app [roller] via GitHub
• 2026/09/06 Re: [PR] Bump struts2-core from 2.5.29 to 2.5.31 in /app [roller] via GitHub
• 2026/09/06 Re: [PR] Bump struts2-core from 2.5.29 to 2.5.31 in /app [roller] via GitHub
• 2026/09/06 Re: [PR] Bump struts2-core from 2.5.29 to 2.5.31 in /app [roller] via GitHub
• 2026/09/06 Re: [PR] Bump spring-security-config from 5.8.3 to 5.8.5 in /app [roller] via GitHub
• 2026/09/06 Re: [PR] Bump spring-security-config from 5.8.3 to 5.8.5 in /app [roller] via GitHub
• 2026/09/06 Re: [PR] Bump spring-security-config from 5.8.3 to 5.8.5 in /app [roller] via GitHub
• 2026/09/06 Re: [VOTE] Release Apache Roller 6.1.6 RC1 Dave
• 2026/09/06 Re: [PR] Update dependencies across project and add JDK 25 to test matrix [roller] via GitHub
• 2026/09/06 [VOTE] Release Apache Roller 6.1.6 RC1 Dave
• 2026/09/05 Re: [PR] build and sonar added [roller] via GitHub
• 2026/09/05 Re: [PR] build and sonar added [roller] via GitHub
• 2026/09/05 Re: [PR] Replace the Selenium suite with Playwright browser tests run across all auth methods [roller] via GitHub
• 2026/09/05 Re: [PR] Update dependencies across project and add JDK 25 to test matrix [roller] via GitHub
• 2026/09/05 [PR] Update dependencies across project and add JDK 25 to test matrix [roller] via GitHub
• 2026/09/05 Re: [PR] Retire incoming Trackback support and normalize comment links [roller] via GitHub
• 2026/09/05 Re: [PR] Add release notes and stop shipping third-party jars in the source release [roller] via GitHub
• 2026/09/05 [PR] Add release notes and stop shipping third-party jars in the source release [roller] via GitHub
• 2026/09/05 [PR] Retire incoming Trackback support and normalize comment links [roller] via GitHub
• 2026/09/05 Re: [PR] Store enclosure metadata without fetching remote URLs [roller] via GitHub
• 2026/09/05 Re: [PR] Check weblog permission in XML-RPC Blogger/MetaWeblog handlers [roller] via GitHub
• 2026/09/05 Re: [PR] Use the current Roller session during OAuth authorization [roller] via GitHub
• 2026/09/05 Re: [PR] Derive media content types from file content, not the request [roller] via GitHub
• 2026/09/05 Re: [PR] Scope authoring resource lookups to the action weblog [roller] via GitHub
• 2026/09/05 Re: [PR] Move authoring UI inline JS handlers to data attributes [roller] via GitHub
• 2026/09/05 Re: [PR] Move frontpage selection into the administrator setup workflow [roller] via GitHub
• 2026/09/05 Re: [PR] Retire the WSSE AtomPub authentication mode [roller] via GitHub
• 2026/09/05 Re: [PR] Fix release signing script argument handling and checksums [roller] via GitHub
• 2026/09/05 Re: [PR] Normalize frontpage directory parameters before rendering the bundled theme [roller] via GitHub
• 2026/09/05 Re: [PR] Disable vendor extension types on the XML-RPC servlet [roller] via GitHub
• 2026/09/05 Re: [PR] Resolve weblog template resources within the active theme [roller] via GitHub
• 2026/09/05 [PR] Fix release signing script argument handling and checksums [roller] via GitHub
• 2026/09/05 Re: [PR] Separate submitted and response salts in UI filters [roller] via GitHub
• 2026/09/05 Re: [PR] Retire incoming Trackback support and normalize comment links [roller] via GitHub
• 2026/09/05 Re: [PR] Use a shared JDOM builder for bookmark and configuration parsing [roller] via GitHub
• 2026/09/05 Re: [PR] Remove legacy outbound trackback action [roller] via GitHub
• 2026/09/05 Re: [PR] Use a shared JDOM builder for bookmark and configuration parsing [roller] via GitHub
• 2026/09/05 Re: [PR] Resolve weblog template resources within the active theme [roller] via GitHub
• 2026/09/05 Re: [PR] Separate submitted and response salts in UI filters [roller] via GitHub
• 2026/09/05 Re: [PR] Check weblog permission in XML-RPC Blogger/MetaWeblog handlers [roller] via GitHub
• 2026/09/05 Re: [PR] Use the current Roller session during OAuth authorization [roller] via GitHub
• 2026/09/05 Re: [PR] Derive media content types from file content, not the request [roller] via GitHub
• 2026/09/05 Re: [PR] Derive media content types from file content, not the request [roller] via GitHub
• 2026/09/05 Re: [PR] Replace ROME Propono AtomPub server with self-contained StAX implementation [roller] via GitHub
• 2026/09/05 Re: [PR] Use double-quoted attributes in media file links inserted into new entries [roller] via GitHub
• 2026/09/02 Re: [PR] Retire incoming Trackback support and normalize comment links [roller] via GitHub
• 2026/09/02 Re: [PR] Retire incoming Trackback support and normalize comment links [roller] via GitHub
• 2026/09/02 Re: [PR] Retire incoming Trackback support and normalize comment links [roller] via GitHub
• 2026/09/01 Re: [PR] Use the current Roller session during OAuth authorization [roller] via GitHub
• 2026/09/01 Re: [PR] Retire incoming Trackback support and normalize comment links [roller] via GitHub
• 2026/09/01 Re: [PR] Use a shared JDOM builder for bookmark and configuration parsing [roller] via GitHub
• 2026/09/01 Re: [PR] Disable vendor extension types on the XML-RPC servlet [roller] via GitHub
• 2026/09/01 Re: [PR] Move frontpage selection into the administrator setup workflow [roller] via GitHub
• 2026/09/01 Re: [PR] Store enclosure metadata without fetching remote URLs [roller] via GitHub
• 2026/09/01 Re: [PR] Check weblog permission in XML-RPC Blogger/MetaWeblog handlers [roller] via GitHub
• 2026/09/01 Re: [PR] Derive media content types from file content, not the request [roller] via GitHub
• 2026/09/01 Re: [PR] Resolve weblog template resources within the active theme [roller] via GitHub
• 2026/09/01 Re: [PR] Move authoring UI inline JS handlers to data attributes [roller] via GitHub
• 2026/09/01 Re: [PR] Scope authoring resource lookups to the action weblog [roller] via GitHub
• 2026/08/31 Re: [PR] Store enclosure metadata without fetching remote URLs [roller] via GitHub
• 2026/08/31 Re: [PR] Normalize frontpage directory parameters before rendering the bundled theme [roller] via GitHub
• 2026/08/31 Re: [PR] Use the current Roller session during OAuth authorization [roller] via GitHub
• 2026/08/31 Re: [PR] Normalize frontpage directory parameters before rendering the bundled theme [roller] via GitHub
• 2026/08/31 Re: [PR] Separate submitted and response salts in UI filters [roller] via GitHub
• 2026/08/31 Re: [PR] Separate submitted and response salts in UI filters [roller] via GitHub
• 2026/08/31 Re: [PR] Retire the WSSE AtomPub authentication mode [roller] via GitHub
• 2026/08/31 Re: [PR] Use the current Roller session during OAuth authorization [roller] via GitHub
• 2026/08/30 Re: [PR] Derive media content types from file content, not the request [roller] via GitHub
• 2026/08/30 Re: [PR] Resolve weblog template resources within the active theme [roller] via GitHub
• 2026/08/30 Re: [PR] Disable vendor extension types on the XML-RPC servlet [roller] via GitHub
• 2026/08/30 Re: [PR] Disable vendor extension types on the XML-RPC servlet [roller] via GitHub
• 2026/08/30 Re: [PR] Retire incoming Trackback support and normalize comment links [roller] via GitHub
• 2026/08/30 Re: [PR] Derive media content types from file content, not the request [roller] via GitHub
• 2026/08/30 Re: [PR] Store enclosure metadata without fetching remote URLs [roller] via GitHub
• 2026/08/30 Re: [PR] Normalize frontpage directory parameters before rendering the bundled theme [roller] via GitHub
• 2026/08/30 Re: [PR] Move frontpage selection into the administrator setup workflow [roller] via GitHub
• 2026/08/30 Re: [PR] Move authoring UI inline JS handlers to data attributes [roller] via GitHub
• 2026/08/30 Re: [PR] Separate submitted and response salts in UI filters [roller] via GitHub
• 2026/08/30 Re: [PR] Retire incoming Trackback support and normalize comment links [roller] via GitHub
• 2026/08/30 Re: [PR] Store enclosure metadata without fetching remote URLs [roller] via GitHub
• 2026/08/30 Re: [PR] Resolve weblog template resources within the active theme [roller] via GitHub
• 2026/08/30 Re: [PR] Use a shared JDOM builder for bookmark and configuration parsing [roller] via GitHub
• 2026/08/30 Re: [PR] Disable vendor extension types on the XML-RPC servlet [roller] via GitHub
• 2026/08/30 Re: [PR] Move frontpage selection into the administrator setup workflow [roller] via GitHub
• 2026/08/30 Re: [PR] Normalize frontpage directory parameters before rendering the bundled theme [roller] via GitHub
• 2026/08/30 Re: [PR] Separate submitted and response salts in UI filters [roller] via GitHub
• 2026/08/30 Re: [PR] Move authoring UI inline JS handlers to data attributes [roller] via GitHub

• Earlier messages