[GitHub] struts issue #166: WW-4851 Upgrade to Log4j2 2.9.0

2017-09-07 Thread lukaszlenart
Github user lukaszlenart commented on the issue: https://github.com/apache/struts/pull/166 👍 LGTM --- - To unsubscribe, e-mail: dev-unsubscr...@struts.apache.org For additional commands, e-mail: dev-h...@struts.a

GitBox

2017-09-07 Thread Lukasz Lenart
Hi all, I'm going to request moving all our repos to GitBox - this will allow push commits directly to GitHub, also we should be able to merge PRs using GH instead of fetching them locally and pushing to Apache. Gitbox adds a bi-directional mirroring with GitHub. Some info https://gitbox.apache.o

Core & plugins

2017-09-07 Thread Lukasz Lenart
Hi, After latest burnings around plugins I wonder if it makes sense to separate them from the Core and release them when required. It would be the same approach as for Maven plugins, each one with a dedicated version. The problem I see is how to handle dependencies by users - right now they have

[GitHub] struts pull request #166: WW-4851 Upgrade to Log4j2 2.9.0

2017-09-07 Thread asfgit
Github user asfgit closed the pull request at: https://github.com/apache/struts/pull/166 --- - To unsubscribe, e-mail: dev-unsubscr...@struts.apache.org For additional commands, e-mail: dev-h...@struts.apache.org

Re: Core & plugins

2017-09-07 Thread Christoph Nenning
> Hi, > > After latest burnings around plugins I wonder if it makes sense to > separate them from the Core and release them when required. It would > be the same approach as for Maven plugins, each one with a dedicated > version. > > The problem I see is how to handle dependencies by users - righ

Re: Core & plugins

2017-09-07 Thread Stefaan Dutry
> Hi, > > After latest burnings around plugins I wonder if it makes sense to > separate them from the Core and release them when required. It would > be the same approach as for Maven plugins, each one with a dedicated > version. > > The problem I see is how to handle dependencies by users - right

[ANN] Apache Struts 2.3.34 General Availability with Security Fixes Release

2017-09-07 Thread Lukasz Lenart
The Apache Struts group is pleased to announce that Struts 2.3.34 is available as a “General Availability” release. The GA designation is our highest quality grade. This release addresses these potential security vulnerabilities: - S2-050 A regular expression Denial of Service when using URLValida

Re: [ANN] Apache Struts 2.3.34 General Availability with Security Fixes Release

2017-09-07 Thread Lukasz Lenart
2017-09-07 10:36 GMT+02:00 Bas van Schaik : > Hi Łukasz, > > Thanks for the notification. The upgrade advice on s2-053.html instructs > users to upgrade to Struts 2.5.12 or 2.3.34 (including links to both > versions). I think you probably intended to write 2.5.13 there? Nope, it's a different issu

Re: GitBox

2017-09-07 Thread Yasser Zamani
Thank you very much for your works! I love improvement changes a lot! On 9/7/2017 12:01 PM, Lukasz Lenart wrote: > Hi all, > > I'm going to request moving all our repos to GitBox - this will allow > push commits directly to GitHub, also we should be able to merge PRs > using GH instead of fetching

Re: [ANN] Apache Struts 2.3.34 General Availability with Security Fixes Release

2017-09-07 Thread Yasser Zamani
I'm curious if it's better and INFRA is able to not list "Not A Problem" and "Not A Bug" issues in ANN and version notes. I'm not sure if it's a good idea. On 9/7/2017 12:54 PM, Lukasz Lenart wrote: > More details in version notes > http://struts.apache.org/docs/version-notes-2334.html

Re: [ANN] Apache Struts 2.3.34 General Availability with Security Fixes Release

2017-09-07 Thread Lukasz Lenart
2017-09-07 11:09 GMT+02:00 Yasser Zamani : > I'm curious if it's better and INFRA is able to not list "Not A Problem" > and "Not A Bug" issues in ANN and version notes. I'm not sure if it's a > good idea. It's exactly what JIRA produces https://issues.apache.org/jira/secure/ReleaseNote.jspa?versio

Re: [ANN] Apache Struts 2.3.34 General Availability with Security Fixes Release

2017-09-07 Thread Bas van Schaik
Hi Łukasz, Thanks for the notification. The upgrade advice on s2-053.html instructs users to upgrade to Struts 2.5.*12* or 2.3.34 (including links to both versions). I think you probably intended to write 2.5.*13* there? Cheers, Bas On 07/09/17 09:24, Lukasz Lenart wrote: The Apache Str

Re: GitBox

2017-09-07 Thread Stefaan Dutry
I don't have any objections for it. Maybe warn people that when they activate the 2-factor authentication (which is required for this setup), they'll need to generate an access token and use that instead of their password to push to github. (Took me a minute to figure out after doing the setup) R