commits

(juneau) branch release-manager updated: TODO-406: Load Excel/PDF export libs from IRS-matching cdnjs tags so the ribbon buttons work.

Fri, 21 Aug 2026 12:12:19 GMT

2026/08/21 -- jamesbognar

(juneau) branch dependabot/github_actions/actions/checkout-7.0.1 deleted (was bbb12539fa)

Fri, 21 Aug 2026 09:34:02 GMT

2026/08/21 -- ggregory

(juneau) branch master updated (c97325505b -> 25dfec12cb)

Fri, 21 Aug 2026 09:33:51 GMT

2026/08/21 -- ggregory

(juneau) 01/01: Merge pull request #386 from apache/dependabot/github_actions/actions/checkout-7.0.1

Fri, 21 Aug 2026 09:33:50 GMT

2026/08/21 -- ggregory

(juneau) branch dependabot/github_actions/github/codeql-action/analyze-4.37.6 deleted (was 992c3f3862)

Fri, 21 Aug 2026 04:42:43 GMT

2026/08/21 -- github-bot

(juneau) branch dependabot/maven/org.openrewrite-rewrite-java-8.90.0 created (now 9724f6e34a)

Fri, 21 Aug 2026 04:32:27 GMT

2026/08/21 -- github-bot

(juneau) branch dependabot/github_actions/github/codeql-action/analyze-4.37.7 created (now bcb97c0355)

Fri, 21 Aug 2026 04:25:45 GMT

2026/08/21 -- github-bot

(juneau) branch dependabot/github_actions/actions/setup-java-5.7.0 created (now a6d74a1768)

Fri, 21 Aug 2026 04:25:38 GMT

2026/08/21 -- github-bot

(juneau) branch dependabot/github_actions/actions/checkout-7.0.1 created (now bbb12539fa)

Fri, 21 Aug 2026 04:24:28 GMT

2026/08/21 -- github-bot

(juneau) branch dependabot/github_actions/github/codeql-action/init-4.37.6 deleted (was 45f62b1cb1)

Fri, 21 Aug 2026 04:23:59 GMT

2026/08/21 -- github-bot

(juneau) branch dependabot/github_actions/github/codeql-action/init-4.37.7 created (now b492ac251e)

Fri, 21 Aug 2026 04:23:47 GMT

2026/08/21 -- github-bot

(juneau) branch dependabot/maven/org.apache.tomcat.embed-tomcat-embed-core-11.0.25 created (now 1f2fbb5ddd)

Fri, 21 Aug 2026 04:23:22 GMT

2026/08/21 -- github-bot

(juneau) branch dependabot/maven/com.nimbusds-oauth2-oidc-sdk-11.38.2 created (now 48a262a814)

Fri, 21 Aug 2026 04:23:16 GMT

2026/08/21 -- github-bot

(juneau) branch dependabot/maven/com.squareup.okhttp3-okhttp-jvm-5.5.0 created (now 445f021b80)

Fri, 21 Aug 2026 04:22:58 GMT

2026/08/21 -- github-bot

(juneau) branch dependabot/maven/org.apache.httpcomponents.client5-httpclient5-5.6.4 created (now bd417424fc)

Fri, 21 Aug 2026 04:22:52 GMT

2026/08/21 -- github-bot

(juneau) 02/02: Unify view toolbar chrome: grouped ribbons, findViewWrapper, paging checkmark

Thu, 20 Aug 2026 21:45:44 GMT

2026/08/20 -- jamesbognar

(juneau) branch master updated (378def68d7 -> c97325505b)

Thu, 20 Aug 2026 21:45:41 GMT

2026/08/20 -- jamesbognar

(juneau) branch master updated: Suppress Eclipse resource-analysis false positives on SavedViewsMixin serving-test mock Closeables.

Thu, 20 Aug 2026 20:40:18 GMT

2026/08/20 -- jamesbognar

(juneau) branch master updated: Add typed FormDef inputs, per-registry async timeout, and markdown expand fields

Thu, 20 Aug 2026 18:45:36 GMT

2026/08/20 -- jamesbognar

(juneau) 01/02: TODO-445a: Add juneau-rest-server-widgets module with ActionBar, ActionRef, and SafeAction

Thu, 20 Aug 2026 15:36:42 GMT

2026/08/20 -- jamesbognar

(juneau) branch master updated (4ba9524e6c -> 742f803d69)

Thu, 20 Aug 2026 15:36:39 GMT

2026/08/20 -- jamesbognar

(juneau) branch release-manager updated: TODO-444: Dogfood column configurator assets and ColumnConfig on Release/Admin pages

Thu, 20 Aug 2026 15:36:28 GMT

2026/08/20 -- jamesbognar

(juneau) 01/02: TODO-432: Add composition-time var(--jc-name) Theme references, resolved to literals at build()

Wed, 19 Aug 2026 21:47:24 GMT

2026/08/19 -- jamesbognar

(juneau) branch release-manager updated: TODO-435: Confirm F1's cross-origin credential overwrite on both routes and pin its remedies

Wed, 19 Aug 2026 21:46:31 GMT

2026/08/19 -- jamesbognar

(juneau) branch master updated (e145337f99 -> 4ba9524e6c)

Wed, 19 Aug 2026 21:46:25 GMT

2026/08/19 -- jamesbognar

(juneau) 02/02: Ignore JMH-generated benchmark sources under juneau-integration-tests

Wed, 19 Aug 2026 21:46:14 GMT

2026/08/19 -- jamesbognar

(juneau) branch release-manager updated: Add Apache license headers to Playwright e2e TypeScript files (RAT compliance)

Wed, 19 Aug 2026 21:05:44 GMT

2026/08/19 -- jamesbognar

(juneau) 02/02: Reactor-wide Eclipse resource-warning cleanup

Wed, 19 Aug 2026 20:49:16 GMT

2026/08/19 -- jamesbognar

(juneau) branch master updated (b7b4b615b2 -> e145337f99)

Wed, 19 Aug 2026 20:48:50 GMT

2026/08/19 -- jamesbognar

(juneau) branch docs updated: Document Markdown view rendering; rename juneau-secret-keychain to juneau-secret-macos-keychain

Wed, 19 Aug 2026 17:13:07 GMT

2026/08/19 -- jamesbognar

(juneau) branch release-manager updated: Use Shorts.cp() for defensive list copy in MilestoneService

Wed, 19 Aug 2026 17:09:03 GMT

2026/08/19 -- jamesbognar

(juneau) branch master updated: Shorts collection aliases, ChecksumUtils/ClasspathAssetCache extraction, Sonar+Eclipse cleanup

Wed, 19 Aug 2026 17:08:57 GMT

2026/08/19 -- jamesbognar

(juneau) branch release-manager updated: SonarCloud cleanup + minor REST/UI updates

Wed, 19 Aug 2026 14:27:20 GMT

2026/08/19 -- jamesbognar

(juneau) 02/02: Bump github/codeql-action init+analyze to 4.37.6

Tue, 18 Aug 2026 19:58:03 GMT

2026/08/18 -- jamesbognar

(juneau) branch master updated (c18d8cc2e6 -> 116238d32f)

Tue, 18 Aug 2026 19:58:03 GMT

2026/08/18 -- jamesbognar

(juneau) 01/02: Fix arity-1 Cache WEAK-mode self-reference leak and harden CacheN WEAK tests

Tue, 18 Aug 2026 19:58:03 GMT

2026/08/18 -- jamesbognar

(juneau) branch dependabot/maven/juneau-integration-tests/org.apache.httpcomponents.client5-httpclient5-5.6.3 deleted (was 93fcaffdab)

Tue, 18 Aug 2026 19:02:46 GMT

2026/08/18 -- github-bot

(juneau) 01/01: Merge pull request #379 from apache/dependabot/maven/juneau-integration-tests/org.apache.httpcomponents.client5-httpclient5-5.6.3

Tue, 18 Aug 2026 19:02:39 GMT

2026/08/18 -- jamesbognar

(juneau) branch master updated (44a47f78a1 -> c18d8cc2e6)

Tue, 18 Aug 2026 19:02:39 GMT

2026/08/18 -- jamesbognar

(juneau) branch dependabot/maven/com.nimbusds-nimbus-jose-jwt-10.9.1 deleted (was 06155e9a77)

Tue, 18 Aug 2026 19:02:31 GMT

2026/08/18 -- github-bot

(juneau) 01/01: Merge pull request #378 from apache/dependabot/maven/com.nimbusds-nimbus-jose-jwt-10.9.1

Tue, 18 Aug 2026 19:02:28 GMT

2026/08/18 -- jamesbognar

(juneau) branch master updated (2556492e48 -> 44a47f78a1)

Tue, 18 Aug 2026 19:02:24 GMT

2026/08/18 -- jamesbognar

(juneau) branch dependabot/maven/juneau-rest/juneau-rest-client-apache-httpclient-50/org.apache.httpcomponents.client5-httpclient5-5.6.3 deleted (was af98a08e8f)

Tue, 18 Aug 2026 19:02:21 GMT

2026/08/18 -- github-bot

(juneau) 01/01: Merge pull request #373 from apache/dependabot/maven/juneau-rest/juneau-rest-client-apache-httpclient-50/org.apache.httpcomponents.client5-httpclient5-5.6.3

Tue, 18 Aug 2026 19:02:15 GMT

2026/08/18 -- jamesbognar

(juneau) branch master updated (1436d8b0ea -> 2556492e48)

Tue, 18 Aug 2026 19:02:11 GMT

2026/08/18 -- jamesbognar

(juneau) branch dependabot/maven/org.eclipse.jgit-org.eclipse.jgit-7.7.1.202607240634-r deleted (was 30aaa4b502)

Tue, 18 Aug 2026 18:56:10 GMT

2026/08/18 -- jamesbognar

(juneau) branch master updated (b94fa75270 -> 1436d8b0ea)

Tue, 18 Aug 2026 18:56:07 GMT

2026/08/18 -- jamesbognar

(juneau) 01/01: Merge pull request #377 from apache/dependabot/maven/org.eclipse.jgit-org.eclipse.jgit-7.7.1.202607240634-r

Tue, 18 Aug 2026 18:56:07 GMT

2026/08/18 -- jamesbognar

(juneau) branch dependabot/maven/org.apache.felix-maven-bundle-plugin-6.1.0 deleted (was dd7184a2f0)

Tue, 18 Aug 2026 18:55:40 GMT

2026/08/18 -- github-bot

(juneau) 01/01: Merge pull request #376 from apache/dependabot/maven/micrometer.version-1.17.0

Tue, 18 Aug 2026 18:55:40 GMT

2026/08/18 -- jamesbognar

(juneau) 01/01: Merge pull request #375 from apache/dependabot/maven/org.apache.felix-maven-bundle-plugin-6.1.0

Tue, 18 Aug 2026 18:55:37 GMT

2026/08/18 -- jamesbognar

(juneau) branch master updated (41a0691d54 -> b94fa75270)

Tue, 18 Aug 2026 18:55:37 GMT

2026/08/18 -- jamesbognar

(juneau) 01/01: Merge pull request #374 from apache/dependabot/maven/org.apache.logging.log4j-log4j-core-2.26.1

Tue, 18 Aug 2026 18:55:34 GMT

2026/08/18 -- jamesbognar

(juneau) branch master updated (0b3e4582cb -> 613be21736)

Tue, 18 Aug 2026 18:55:34 GMT

2026/08/18 -- jamesbognar

(juneau) branch dependabot/maven/micrometer.version-1.17.0 deleted (was 2aba49c711)

Tue, 18 Aug 2026 18:55:33 GMT

2026/08/18 -- jamesbognar

(juneau) branch master updated (613be21736 -> 41a0691d54)

Tue, 18 Aug 2026 18:55:09 GMT

2026/08/18 -- jamesbognar

(juneau) branch dependabot/maven/org.apache.logging.log4j-log4j-core-2.26.1 deleted (was eac50a01c3)

Tue, 18 Aug 2026 18:54:55 GMT

2026/08/18 -- github-bot

(juneau) branch dependabot/maven/juneau-integration-tests/org.apache.httpcomponents.core5-httpcore5-h2-5.4.3 deleted (was f788f098b2)

Tue, 18 Aug 2026 18:54:32 GMT

2026/08/18 -- github-bot

(juneau) branch master updated (b029b17dfb -> 0b3e4582cb)

Tue, 18 Aug 2026 18:54:27 GMT

2026/08/18 -- jamesbognar

(juneau) 01/01: Merge pull request #372 from apache/dependabot/maven/juneau-integration-tests/org.apache.httpcomponents.core5-httpcore5-h2-5.4.3

Tue, 18 Aug 2026 18:54:23 GMT

2026/08/18 -- jamesbognar

(juneau) branch master updated: Converge TODO-tracker scripts to be repo-agnostic across juneau/release-manager/support-console

Tue, 18 Aug 2026 18:47:39 GMT

2026/08/18 -- jamesbognar

(juneau) branch release-manager updated: Add TODO-tracker scaffolding for the Release Manager

Tue, 18 Aug 2026 18:47:27 GMT

2026/08/18 -- jamesbognar

(juneau) 04/05: TODO-419/434: Wire the loopback write boundary and a CSRF synchronizer token into Release Manager

Tue, 18 Aug 2026 18:32:22 GMT

2026/08/18 -- jamesbognar

(juneau) branch master updated (9cc8a6881e -> e1c1394eaa)

Tue, 18 Aug 2026 18:31:41 GMT

2026/08/18 -- jamesbognar

(juneau) 03/05: Adopt juneau's mount-duality fix and red-tag theme token in Release Manager's console chrome

Tue, 18 Aug 2026 18:31:41 GMT

2026/08/18 -- jamesbognar

(juneau) 01/05: Adopt console-ui chrome/theme, rich views toolkit, and add Playwright suite

Tue, 18 Aug 2026 18:31:41 GMT

2026/08/18 -- jamesbognar

(juneau) 02/05: Harden GitHub/GPG credential validators; fix the untested-credential status pill

Tue, 18 Aug 2026 18:31:41 GMT

2026/08/18 -- jamesbognar

(juneau) 08/08: TODO-419: Add a loopback write boundary (CSRF/DNS-rebinding defense) for loopback-bound REST apps

Tue, 18 Aug 2026 18:31:41 GMT

2026/08/18 -- jamesbognar

(juneau) 07/08: TODO-408/414: Add a themeable red tag/stage triad; make Theme.getTokens() iteration order deterministic

Tue, 18 Aug 2026 18:31:38 GMT

2026/08/18 -- jamesbognar

(juneau) branch release-manager updated (8a3ebd846e -> edd032e1d3)

Tue, 18 Aug 2026 18:31:38 GMT

2026/08/18 -- jamesbognar

(juneau) 06/08: FINISHED-411/412/413: Resolve ConsoleChromeMixin's chrome.css/logo/page-bg endpoints under both mount styles

Tue, 18 Aug 2026 18:31:38 GMT

2026/08/18 -- jamesbognar

(juneau) 03/08: Clean up SonarQube/SonarLint findings in juneau-commons and the views-toolkit builders

Tue, 18 Aug 2026 18:31:38 GMT

2026/08/18 -- jamesbognar

(juneau) 05/05: Close subscription leaks in RunStateBroadcaster/SseLogServlet tests

Tue, 18 Aug 2026 18:31:38 GMT

2026/08/18 -- jamesbognar

(juneau) 05/08: TODO-429: Add an opt-in Playwright browser-execution harness for the views-toolkit client assets

Tue, 18 Aug 2026 18:31:38 GMT

2026/08/18 -- jamesbognar

(juneau) 04/08: TODO-429/431: Fix sub-tab panel visibility and eager DataTable init in juneau-pages.js; adopt escapeForScript

Tue, 18 Aug 2026 18:31:38 GMT

2026/08/18 -- jamesbognar

(juneau) 02/08: Add themeable logo/page-background assets and table theming to console chrome

Tue, 18 Aug 2026 18:31:38 GMT

2026/08/18 -- jamesbognar

(juneau) branch docs updated: READY-404: Correct remote-proxy classic/next-gen parity claims in the 10.0.0 release notes

Mon, 17 Aug 2026 14:42:30 GMT

2026/08/17 -- jamesbognar

(juneau) branch master updated: Add ordinary-resource real-container 404 regression test and correct remote-annotation parity javadoc

Mon, 17 Aug 2026 14:34:11 GMT

2026/08/17 -- jamesbognar

(juneau) branch master updated: Clean up SonarQube/SonarLint findings in commons, console-ui FreeMarker, and datatables modules

Mon, 17 Aug 2026 12:15:59 GMT

2026/08/17 -- jamesbognar

(juneau) branch docs updated: Document REST correlation IDs, RichLogger logging context, and admin console chrome

Mon, 17 Aug 2026 11:15:56 GMT

2026/08/17 -- jamesbognar

(juneau) branch docs updated: READY-389/390/392/396: Release notes + docs for the parser-depth and client SSRF hardening batch

Mon, 17 Aug 2026 01:23:40 GMT

2026/08/17 -- jamesbognar

(juneau) 02/03: READY-396: Correct @Url/baseUrl parity docs and add classic-engine SSRF parity tests

Mon, 17 Aug 2026 01:23:18 GMT

2026/08/17 -- jamesbognar

(juneau) branch master updated (ae4cc786c7 -> 4654fee99b)

Mon, 17 Aug 2026 01:23:18 GMT

2026/08/17 -- jamesbognar

(juneau) 01/03: READY-389/390: Shared parse-depth budget + narrowed OOM catch in ParserSession

Mon, 17 Aug 2026 01:23:18 GMT

2026/08/17 -- jamesbognar

(juneau) branch docs updated: READY-381/383/385/394: Release notes for the auth/lifecycle hardening batch

Sun, 16 Aug 2026 22:51:22 GMT

2026/08/16 -- jamesbognar

(juneau) 06/06: Fix flaky MCP tools/call schema-validation timeout under load: decouple validation compute budget from the structural-traversal wall-clock deadline

Sun, 16 Aug 2026 22:50:37 GMT

2026/08/16 -- jamesbognar

(juneau) 05/06: Fix Eclipse/SonarLint warnings: CachingHttpServletResponse resource suppression, javadoc refs, unused import/field, serialVersionUID, dead debugBodyCap

Sun, 16 Aug 2026 22:50:29 GMT

2026/08/16 -- jamesbognar

(juneau) 01/06: READY-385: Bound remote SAML metadata fetch size (1 MiB cap)

Sun, 16 Aug 2026 22:50:29 GMT

2026/08/16 -- jamesbognar

(juneau) 02/06: READY-383: Don't union roles across distinct principals in AuthFilterChain

Sun, 16 Aug 2026 22:50:26 GMT

2026/08/16 -- jamesbognar

(juneau) 04/06: READY-394: Make ReadinessState lifecycle-owned instead of a JVM-global singleton

Sun, 16 Aug 2026 22:50:26 GMT

2026/08/16 -- jamesbognar

(juneau) 03/06: READY-381: Bind OAuth introspection results to the expected audience/resource

Sun, 16 Aug 2026 22:50:25 GMT

2026/08/16 -- jamesbognar

(juneau) branch master updated (0219941939 -> ae4cc786c7)

Sun, 16 Aug 2026 22:50:25 GMT

2026/08/16 -- jamesbognar

(juneau) branch docs updated: READY-395/384: Document actuator off-by-default policy and MCP DCR secure-only registration

Sun, 16 Aug 2026 19:34:21 GMT

2026/08/16 -- jamesbognar

(juneau) 04/08: READY-363: Fix RestContext annotationWork init-ordering NPE in framework-bean memoizers

Sun, 16 Aug 2026 19:33:59 GMT

2026/08/16 -- jamesbognar

(juneau) 01/08: READY-393: Reject CR/LF and control chars in multipart part name/filename/content-type

Sun, 16 Aug 2026 19:33:59 GMT

2026/08/16 -- jamesbognar

(juneau) 03/08: READY-379: Bind SAML assertions to the request ACS recipient (bearer subject-confirmation)

Sun, 16 Aug 2026 19:33:59 GMT

2026/08/16 -- jamesbognar

(juneau) 05/08: READY-388/391: Bound Protobuf LEN fields by maxLength and reject overlong varints

Sun, 16 Aug 2026 19:33:59 GMT

2026/08/16 -- jamesbognar

(juneau) 07/08: READY-382: Enforce HTTPS-or-loopback on the OidcDiscoveryClient issuer

Sun, 16 Aug 2026 19:33:59 GMT

2026/08/16 -- jamesbognar

(juneau) 02/08: READY-387: Enforce declared document-length bounds in the BSON parser

Sun, 16 Aug 2026 19:33:59 GMT

2026/08/16 -- jamesbognar

(juneau) 08/08: READY-384: Remove the MCP DCR requireSecure(false) plaintext escape hatch

Sun, 16 Aug 2026 19:33:59 GMT

2026/08/16 -- jamesbognar