Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-19 Thread Gary D. Gregory
I've commented on the PR. TY. Gary On 2022/10/19 16:51:57 Gary Gregory wrote: > On Wed, Oct 19, 2022 at 10:01 AM Alex Herbert > wrote: > > > > On Wed, 19 Oct 2022 at 14:57, Gary D. Gregory wrote: > > > > > > My +1 > > > > > > Gary > > > > Gary, > > > > PR #276 highlights a behavioural compatibi

Re: Publish statement on Commons Text CVE

2022-10-19 Thread Bruno Kinoshita
Not a problem, and thank **you** for the many releases and for working on CVE, site updates, commons reports, PR reviews :) Fixed! The Apache Commons Configuration Security page is now live: > https://commons.apache.org/proper/commons-configuration/security.html > It's working fine for me too! C

Re: Publish statement on Commons Text CVE

2022-10-19 Thread Gary Gregory
Fixed! The Apache Commons Configuration Security page is now live: https://commons.apache.org/proper/commons-configuration/security.html Gary On Wed, Oct 19, 2022 at 4:45 PM Gary Gregory wrote: > > Thank you for the brilliant detective work Bruno! > > Gary > > On Wed, Oct 19, 2022, 16:16 Bruno K

[numbers] user guide

2022-10-19 Thread Alex Herbert
I have added an initial user guide to Numbers. To build locally: Full: mvn package site site:stage -Pcommons-numbers-examples # [ ... wait ...] open target/staging/userguide/index.html Quick: mvn site -DgenerateReports=false -N open target/site/userguide/index.html The code examples are veri

Re: Publish statement on Commons Text CVE

2022-10-19 Thread Gary Gregory
Thank you for the brilliant detective work Bruno! Gary On Wed, Oct 19, 2022, 16:16 Bruno Kinoshita wrote: > I had a look at the browser network tab, and saw an HTTP 302 location > redirect from Varnish. These redirects normally need to be configured in > Varnish with some sort of rule. > > I we

Re: Publish statement on Commons Text CVE

2022-10-19 Thread Bruno Kinoshita
I had a look at the browser network tab, and saw an HTTP 302 location redirect from Varnish. These redirects normally need to be configured in Varnish with some sort of rule. I went back to your email, grabbed the SVN URL, stepped up a few directories and saw an .htaccess at a parent level, that h

Re: Publish statement on Commons Text CVE

2022-10-19 Thread Gary Gregory
Well, I published the Configuration site to the usual svn: https://svn.apache.org/repos/infra/websites/production/commons/content/proper/commons-configuration/ which should be end up at: https://commons.apache.org/proper/commons-configuration/index.html but for me clicking on the "Security" (in

Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-19 Thread Gary Gregory
On Wed, Oct 19, 2022 at 10:01 AM Alex Herbert wrote: > > On Wed, 19 Oct 2022 at 14:57, Gary D. Gregory wrote: > > > > My +1 > > > > Gary > > Gary, > > PR #276 highlights a behavioural compatibility error in the 1.10.0 RC1. > > AllowDuplicates enum may be set to the incorrect value when setting >

Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-19 Thread Gary Gregory
On Wed, Oct 19, 2022 at 9:52 AM wrote: > > > You have added test data for CSVFormat for 1.7 and 1.8 and these do > not work (commented out). I take it this means serialization has been > broken since the CSVFormat.delimiter was changed from char to String > in 1.9.0. > > That's correct, Alex. I ad

Re: Publish statement on Commons Text CVE

2022-10-19 Thread Gary Gregory
TY and merged. I'll publish later today. Gary On Wed, Oct 19, 2022 at 11:13 AM Arnout Engelen wrote: > > On Wed, Oct 19, 2022 at 12:23 PM Gary Gregory wrote: >> >> Would you be available to update the Commons Configuration page >> https://github.com/apache/commons-configuration/blob/master/src/

Re: Publish statement on Commons Text CVE

2022-10-19 Thread Arnout Engelen
On Wed, Oct 19, 2022 at 12:23 PM Gary Gregory wrote: > Would you be available to update the Commons Configuration page > > https://github.com/apache/commons-configuration/blob/master/src/site/xdoc/security.xml > in the same way you did for Commons Text? The CVE is basically the > same: https://nv

Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-19 Thread Gary D. Gregory
Hi Markus, Anyone can vote, please see https://www.apache.org/foundation/voting.html Note that PMC member votes are binding, while others are advisory. Gary On 2022/10/17 10:00:13 sma...@outlook.de wrote: > Hello > > CSV-264 (Add DuplicateHeaderMode) introduces bugs that should be fixed before

Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-19 Thread Alex Herbert
On Wed, 19 Oct 2022 at 14:57, Gary D. Gregory wrote: > > My +1 > > Gary Gary, PR #276 highlights a behavioural compatibility error in the 1.10.0 RC1. AllowDuplicates enum may be set to the incorrect value when setting the allow duplicates boolean. Have you reviewed this? I believe it is valid.

Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-19 Thread Alex Herbert
On Wed, 19 Oct 2022 at 14:52, wrote: > > > You have added test data for CSVFormat for 1.7 and 1.8 and these do > not work (commented out). I take it this means serialization has been > broken since the CSVFormat.delimiter was changed from char to String > in 1.9.0. > > That's correct, Alex. I adde

Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-19 Thread Gary D. Gregory
My +1 Gary On 2022/10/16 12:48:50 Gary Gregory wrote: > To: dev@commons.apache.org > We have fixed a few bugs and added some enhancements since Apache > Commons CSV 1.9.0 was released, so I would like to release Apache > Commons CSV 1.10.0. > > Apache Commons CSV 1.10.0 RC1 is available for revi

Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-19 Thread sman81
> You have added test data for CSVFormat for 1.7 and 1.8 and these do not work (commented out). I take it this means serialization has been broken since the CSVFormat.delimiter was changed from char to String in 1.9.0. That's correct, Alex. I added the comments for documentation. Should we decide

Re: Publish statement on Commons Text CVE

2022-10-19 Thread Gary Gregory
Hi Arnout, Would you be available to update the Commons Configuration page https://github.com/apache/commons-configuration/blob/master/src/site/xdoc/security.xml in the same way you did for Commons Text? The CVE is basically the same: https://nvd.nist.gov/vuln/detail/CVE-2022-33980 Gary On Tue,

Correctly configuring Apache Commons components for oss-fuzz

2022-10-19 Thread Mark Thomas
Hi, You are receiving this email as you are currently configured as the recipients for oss-fuzz reports for Apache Commons JXPath. As per the discussion on the Apache Commons dev list[1], please make the following configuration changes to the oss-fuzz integrations with immediate effect: -

Re: [jxpath] reported CVE and path forward

2022-10-19 Thread Mark Thomas
On 15/10/2022 17:12, Mark Thomas wrote: On 11/10/2022 16:25, Mike Drob wrote: Thanks for this outline, Mark. Some questions in line. Mike On Tue, Oct 11, 2022 at 6:13 AM Mark Thomas wrote: Roman - don't do anything yet. Commons folk, I suggest the following which is based on how we have os