Re: Proposal: Experimental VEX File for Apache Commons Projects

2025-07-27 Thread Gary Gregory
On Sat, Jul 26, 2025, 17:38 Piotr P. Karwasz wrote: > Hi Gary, > > On 26.07.2025 14:35, Gary Gregory wrote: > > Inventing a custom schema seems like a bad idea to me when formats like > > OpenVEX have a well-defined schema. If we need to use Markdown as an > > intermediary step, then maybe. YAML

Re: Proposal: Experimental VEX File for Apache Commons Projects

2025-07-26 Thread Piotr P. Karwasz
Hi Gary, On 26.07.2025 14:35, Gary Gregory wrote: > Inventing a custom schema seems like a bad idea to me when formats like > OpenVEX have a well-defined schema. If we need to use Markdown as an > intermediary step, then maybe. YAML is gross IMO due to its use of > significant whitespace, causing

Re: Proposal: Experimental VEX File for Apache Commons Projects

2025-07-26 Thread Gary Gregory
On Thu, Jul 24, 2025 at 3:17 AM Piotr P. Karwasz wrote: > Hi Gary, > > On 23.07.2025 13:18, Gary Gregory wrote: > > So, for Commons Compress for example, like this: > > > > { > > "@context": "https://openvex.dev/ns/v0.2.0";, > > "id": "https://apache.org/vex/statement-commons-compress-001";,

Re: Proposal: Experimental VEX File for Apache Commons Projects

2025-07-24 Thread Piotr P. Karwasz
Hi Gary, On 23.07.2025 13:18, Gary Gregory wrote: > So, for Commons Compress for example, like this: > > { > "@context": "https://openvex.dev/ns/v0.2.0";, > "id": "https://apache.org/vex/statement-commons-compress-001";, > "author": "apache.org", > "role": "Document Creator", > "timesta

Re: Proposal: Experimental VEX File for Apache Commons Projects

2025-07-23 Thread Gary Gregory
So, for Commons Compress for example, like this: { "@context": "https://openvex.dev/ns/v0.2.0";, "id": "https://apache.org/vex/statement-commons-compress-001";, "author": "apache.org", "role": "Document Creator", "timestamp": "2025-07-23T11:11:00Z", "version": 1, "statements": [

Proposal: Experimental VEX File for Apache Commons Projects

2025-07-20 Thread Piotr P. Karwasz
Hi all, As you know, we released CVE-2025-48924 for Commons Lang a few days ago. Due to the widespread use of the library, the CVE has already triggered some user responses: for example, in [1], users reported being forced to upgrade Commons Lang and remove deprecated method usage due to inter