slachiewicz opened a new pull request, #715: URL: https://github.com/apache/maven-doxia-sitetools/pull/715
velocity-tools-generic 3.1, the last release (March 2021), pulls in commons-beanutils 1.9.4 (CVE-2025-48734), commons-digester3, commons-collections 3.2.2 and json-simple. Only its `ToolManager` and configuration classes need BeanUtils and Digester; the tool classes do not. The renderer now builds the tool context itself from the same tool classes, so all four libraries leave the report-plugin classpath. An enforcer rule keeps them out. Templates and skins see the same context keys and output. `META-INF/maven/site-tools.xml` keeps working for custom tools, such as the Reflow skin's: it is read with the JDK parser with external entities off, and properties reach tools through `configure(Map)` and plain setters. The differences are listed on the renderer's site page: - The `display`, `math` and `sorter` methods that take a property name need commons-beanutils added to the site plugin's dependencies. None of the skins or sites surveyed use them. - `restrictTo` is ignored. It never took effect under `ToolManager` here, because no request path was set. - Values of type `field` are kept as strings. This also deprecates `alternator`, `class`, `field`, `link` and `loop` for removal in 3.0. A scan of Fluido, the default skin, Reflow, the Maven site and GitHub `src/site` templates found no use of `class`, `field`, `link` or `alternator`, and one project using `loop`. Not yet run against this branch: the maven-site-plugin ITs and a Reflow site build. Verified: `mvn verify` (Maven 3.9.16, JDK 21) → all modules pass, 30 renderer tests including the unchanged tool-manager expected output. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
