You are viewing a plain text version of this content. The canonical link for it is here.
- [PR] Updates to dev/test/production mode detection (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/01 10:13:44 UTC, 2 replies.
- Re: [PR] Extract some of the validation for TP configuration into a shared helper (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/01 11:03:28 UTC, 0 replies.
- Re: [I] Trusted Publishing Cross-Field Validation Bypassed Via Web Form (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/01 11:03:30 UTC, 0 replies.
- Re: [I] Missing `--` Separator and Unsafe Argument Order in `sbomqs` Execution (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/01 11:04:20 UTC, 0 replies.
- Re: [PR] Possible LDAP implementation for review (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/01 13:30:50 UTC, 0 replies.
- Re: [PR] Periodic recheck of LDAP status (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/01 13:32:21 UTC, 0 replies.
- [PR] Merging 952 and 992 (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/01 15:24:45 UTC, 1 replies.
- Re: [PR] #776 - implement 50k character limit for vote comment and support passing form errors through a cache in the form module instead of via flash in the session (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/01 16:33:25 UTC, 0 replies.
- Re: [I] Global Session Validation Hook Checks Age But Not Account Status (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/01 17:17:25 UTC, 0 replies.
- Re: [I] Form Fields Bypass Safe Type Validation (Multiple Instances) (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/01 17:17:45 UTC, 0 replies.
- [I] Form Hidden Field Validated Against Wrong Source (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/01 17:51:34 UTC, 1 replies.
- [I] API Distribution Models Missing Platform/Owner-Namespace Validation (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/01 17:51:36 UTC, 1 replies.
- [I] Upload Session Not Validated Against Project/Version Context (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/01 17:51:47 UTC, 2 replies.
- [I] No File Size Limit on Web Upload Staging Endpoint (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/01 17:51:58 UTC, 2 replies.
- [I] Project Creation Race Condition Between Existence Check and Insert (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/01 17:52:00 UTC, 1 replies.
- [I] Form Validation Error Messages Rendered as Unescaped HTML (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/01 17:52:11 UTC, 2 replies.
- [I] API Blueprint Lacks Explicit CORS Preflight Enforcement for Session-Authenticated Endpoints (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/01 17:52:13 UTC, 2 replies.
- [I] No Evidence of postMessage Origin Validation in Application (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/01 17:52:15 UTC, 2 replies.
- [I] No Application-Level HTTPS Enforcement for API Endpoints (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/01 17:52:18 UTC, 3 replies.
- [I] Upload Staging Token Lacks Session Management Properties (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/01 17:52:30 UTC, 2 replies.
- [I] No Cleanup or Aggregate Limit for Upload Staging Directories (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/01 17:52:42 UTC, 2 replies.
- [I] Disallowed File Detection Occurs After Storage, Not At Upload Time (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/01 17:52:44 UTC, 0 replies.
- [I] In-Memory Hash Function Could Process Unbounded Data (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/01 17:52:44 UTC, 2 replies.
- [I] Pre-Extraction Safety Checks Do Not Verify Total Uncompressed Size (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/01 17:52:46 UTC, 1 replies.
- [I] SSH Authentication Pathway Lacks Rate Limiting (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/01 17:53:05 UTC, 2 replies.
- [I] SSH Authentication Surface Not Covered in Authentication Security Documentation (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/01 17:53:08 UTC, 2 replies.
- [I] Documentation Does Not Address Adaptive Response Mechanisms (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/01 17:53:09 UTC, 2 replies.
- [I] ldap.is_active() Returns True When LDAP Is Unconfigured (Fail-Open) (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/01 17:53:19 UTC, 2 replies.
- [I] Admin Blueprint post Decorator Bypasses LDAP Active Account Check (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/01 17:53:22 UTC, 1 replies.
- [I] No Session Termination After SSH Key Changes (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/01 17:53:23 UTC, 4 replies.
- [I] Web-Issued JWTs Cannot Be Revoked and Survive PAT Deletion (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/01 17:53:25 UTC, 2 replies.
- [I] JWT API Authentication Success Not Logged (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/01 17:53:26 UTC, 2 replies.
- Re: [I] Finish-Phase Operations Executable During Any Release Phase (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/01 19:37:43 UTC, 1 replies.
- Re: [I] Missing Phase Validation in Vote Start Flow (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/01 19:38:23 UTC, 1 replies.
- Re: [I] Update Pygments when a fix for CVE-2026-4539 is available (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/01 19:51:11 UTC, 1 replies.
- [I] Consider moving the PubSub code to ASFQuart (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/02 16:06:11 UTC, 1 replies.
- [PR] Safe paths implementation (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/02 16:49:32 UTC, 3 replies.
- Re: [I] Admin Environment Variable Endpoint Exposes All Secrets Without Redaction (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/02 18:10:01 UTC, 1 replies.
- Re: [I] SSH Authentication Completely Bypasses LDAP Account Status Checks (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/02 18:33:06 UTC, 1 replies.
- [GH] Safe paths implementation (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/02 19:46:04 UTC, 1 replies.
- Re: [I] Key-Committee Association Bypasses Storage Layer Authorization (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/02 19:56:03 UTC, 1 replies.
- Re: [I] No Global Anti-Caching Middleware (Architectural Gap) (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/03 13:36:24 UTC, 2 replies.
- Re: [I] SVN Operations Disable TLS Certificate Verification (Supply Chain Risk) (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/03 13:49:32 UTC, 1 replies.
- Re: [I] API Models Lack Cross-Field Contextual Validation (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/03 14:10:39 UTC, 2 replies.
- Re: [I] Committee Key Bulk Deletion Bypasses Storage Layer and Audit (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/03 14:48:24 UTC, 1 replies.
- Re: [I] SBOM score_tool Uses previous_release_version in Path Without Validation (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/03 14:48:54 UTC, 1 replies.
- Re: [I] SBOM Task Functions Use File Paths Without Containment Validation (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/03 15:03:55 UTC, 0 replies.
- Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/03 15:08:12 UTC, 2 replies.
- [I] TLS: Add explicit cipher suite configuration for defense-in-depth (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/03 16:14:29 UTC, 6 replies.
- [I] Discuss how we handle private mailing list votes in the security model (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/03 16:36:08 UTC, 4 replies.
- [I] GPG detection (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/03 16:44:19 UTC, 0 replies.
- [I] Discuss: Session contents (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/03 16:52:21 UTC, 2 replies.
- Re: [I] OpenPGP Key Management Entirely Lacks Audit Logging (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/03 18:34:11 UTC, 1 replies.
- [I] Web-Based JWT Issuance Not Audit-Logged (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:39:36 UTC, 1 replies.
- [I] Admin Pages Using template.blank() May Lack Logout Button (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:39:38 UTC, 2 replies.
- [I] Admin Pages Using web.ElementResponse() May Lack Logout Button (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:39:41 UTC, 4 replies.
- [I] Inconsistent Defense-in-Depth in Distribution Endpoints (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:39:41 UTC, 3 replies.
- [I] GET Blueprint Lacks Centralized Project-Level Authorization (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:39:42 UTC, 4 replies.
- [I] Admin Route Uses Insufficient Authorization Context for Storage Layer (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:39:44 UTC, 1 replies.
- [I] Storage Layer Bypassed for Revision Tag Modification (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:39:47 UTC, 2 replies.
- [I] Resource-Committee Validation Control Not Applied Across Storage Writers (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:39:48 UTC, 2 replies.
- [I] Vote Duration Not Validated Against Release Policy Minimum (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:39:49 UTC, 2 replies.
- [I] API Models Accept Client-Submitted Identity Alongside JWT (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:39:50 UTC, 1 replies.
- [I] Public API Endpoints Expose Internal Implementation Fields (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:39:52 UTC, 2 replies.
- [I] Dynamic Field Assignment Without Explicit Allowlist in Policy Updates (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:39:54 UTC, 2 replies.
- [I] Unvalidated Identity Parameter in Email and Vote Operations (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:39:56 UTC, 2 replies.
- [I] Missing Authorization Documentation for Distribution/SSH/Keys/Policy/Project Operations (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:39:57 UTC, 0 replies.
- [I] ATR JWTs Lack Explicit Token Type Identification (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:39:58 UTC, 4 replies.
- [I] OAuth Client Does Not Request Explicit Scopes (Principle of Least Privilege) (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:40:02 UTC, 0 replies.
- [I] Authorization Code Not URL-Encoded in Token Exchange Request (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:40:02 UTC, 2 replies.
- [I] Unauthenticated /api/tasks/list Endpoint Exposes Internal Error Details (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:40:03 UTC, 2 replies.
- [I] HTTP TRACE Method Not Disabled at Apache Reverse Proxy (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:40:05 UTC, 4 replies.
- [I] Internal Documentation Publicly Exposed (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:40:07 UTC, 2 replies.
- [I] Swagger UI and OpenAPI Specification Publicly Accessible (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:40:09 UTC, 1 replies.
- [I] Session Cache Persists Sensitive Data Indefinitely Without TTL (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:40:10 UTC, 2 replies.
- [I] WorkflowSSHKey Entries Not Purged After Expiration (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:40:11 UTC, 1 replies.
- [I] Full Email Content Logged at INFO Level (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:40:23 UTC, 6 replies.
- [I] Session Cookie Contains PII and Authorization Data in Readable (Signed-But-Not-Encrypted) Format (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:40:35 UTC, 2 replies.
- [I] OSV Vulnerability Scanning Has No HTTP Timeout (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:40:36 UTC, 1 replies.
- [I] Unbounded Response Sizes on Multiple List Endpoints (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:40:39 UTC, 0 replies.
- [I] Thread Message Fetching Without Timeout or Concurrency Limit (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:40:39 UTC, 1 replies.
- [I] ZIP Download Streaming Without Size or Time Guards (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:40:41 UTC, 1 replies.
- [I] Unbounded Distribution Status Check Loop (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:40:42 UTC, 1 replies.
- [I] No Documented Risk-Based Remediation Timeframes for Vulnerable Components (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:40:45 UTC, 0 replies.
- [I] No Update Timeframe or Monitoring for Dockerfile-Installed External Tools (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:40:47 UTC, 0 replies.
- [I] No Documented Update Timeframe for npm/Frontend Dependencies (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:40:47 UTC, 0 replies.
- [I] Binary Tool Downloaded Without Integrity Verification (CycloneDX CLI) (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:40:48 UTC, 1 replies.
- [I] Syft Installed via Unverified Remote Script Execution (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:40:50 UTC, 0 replies.
- [I] OSV API Unbounded Pagination and Detail Fetching (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:40:53 UTC, 0 replies.
- [I] No Formal SBOM for ATR's Own Third-Party Dependencies (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:40:53 UTC, 1 replies.
- [I] SSH Server Lacks Connection and Idle Timeouts (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:40:56 UTC, 2 replies.
- [I] SBOM Conformance External HTTP Requests Without Explicit Timeout (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:40:56 UTC, 1 replies.
- [I] Unbounded PGP Key Block Processing in Bulk Operations (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:08 UTC, 1 replies.
- [I] ZipResponse Does Not Enforce Content-Disposition: attachment (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:09 UTC, 1 replies.
- [I] ShellResponse Serves Executable Content Without Content-Disposition: attachment (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:10 UTC, 1 replies.
- [I] Unverifiable Session Cookie Write in atr.util (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:11 UTC, 5 replies.
- [I] Text Response Classes Rely on Implicit Charset from Werkzeug (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:14 UTC, 1 replies.
- [I] HSTS Not Applied at Application Level (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:16 UTC, 1 replies.
- [I] KEYS File Web Upload Lacks Extension Validation (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:17 UTC, 1 replies.
- [I] Defense-in-Depth — Missing AllowOverride None in Apache Downloads Directory (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:18 UTC, 1 replies.
- [I] No "Revoke All Tokens for ALL Users" Global Capability (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:20 UTC, 2 replies.
- [I] No Comprehensive Endpoint-to-Authorization Mapping (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:24 UTC, 1 replies.
- [I] PAT Validation Exceptions Return HTTP 500 Instead of 401 (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:24 UTC, 3 replies.
- [I] Unverified JWT Subject Claim Used for Logging Before Signature Verification (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:26 UTC, 3 replies.
- [I] Asymmetric Authorization Enforcement Between Read and Write Paths (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:27 UTC, 1 replies.
- [I] PAT Creation Not Audit-Logged (Inconsistency) (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:27 UTC, 5 replies.
- [I] Documentation-Code TTL Discrepancy (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:30 UTC, 1 replies.
- [I] JWT Audience Values Contain 'test' Identifier (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:31 UTC, 3 replies.
- [I] JWT TTL Documentation Discrepancy (30 Minutes Actual vs 90 Minutes Documented) (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:32 UTC, 5 replies.
- [I] Session Cookies Signed But Not Encrypted — Documentation Claims Encryption (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:34 UTC, 1 replies.
- [I] Server Does Not Enforce Cipher Suite Preference Order (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:37 UTC, 4 replies.
- [I] Admin Debug Test Route /admin/raise-error Available in Production (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:38 UTC, 1 replies.
- [I] Database Connection URL Logged at Startup (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:38 UTC, 1 replies.
- [I] No Explicit Directory Listing Prevention on Docroot (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:40 UTC, 4 replies.
- [I] JWT Claims Including User Identity Logged at DEBUG Level (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:42 UTC, 1 replies.
- [I] User Identity Data Sent to External GitHub API (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:45 UTC, 1 replies.
- [I] Expired Personal Access Tokens Not Automatically Purged (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:45 UTC, 3 replies.
- [I] Debug print() Bypasses Structured Logging (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:46 UTC, 4 replies.
- [I] Client-Side JWT Display TypeScript Not Available for Complete Audit (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:48 UTC, 4 replies.
- [I] General Library Update Timeframe Is Enforced but Undocumented as Policy (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 18:41:52 UTC, 2 replies.
- Re: [I] Release Vote Logic Validation Always Passes Due to Catch-All Pattern (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/03 18:52:27 UTC, 1 replies.
- Re: [I] Vote Resolution Phase Transitions Lack Optimistic Locking (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/03 19:31:14 UTC, 3 replies.
- [I] Vote Casting POST Endpoint Relies on Indirect Phase Check (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 19:48:48 UTC, 2 replies.
- [I] Documentation Missing Cross-Entity Business Logic Validation Rules (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 19:48:51 UTC, 2 replies.
- [I] Inconsistent CSRF Enforcement Pattern on Admin POST Endpoints (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 19:48:56 UTC, 2 replies.
- [I] innerHTML Read Used Where textContent Is Appropriate (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 19:48:58 UTC, 1 replies.
- [I] Neither Vhost Sanitizes X-Forwarded-Host (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 19:49:00 UTC, 2 replies.
- [I] No WebSocket Origin Validation Framework Exists (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 19:49:02 UTC, 6 replies.
- [I] JWT TTL Documentation Inconsistency (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 19:49:04 UTC, 1 replies.
- [I] Documentation Does Not Describe Failed Authentication Monitoring and Alerting (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 19:49:06 UTC, 2 replies.
- [I] SSH Authentication Success Not Logged (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 19:49:13 UTC, 2 replies.
- [I] API Models Lack Enum Validation for Phase Parameter (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 19:49:15 UTC, 2 replies.
- [I] Vote Tabulation Authorization Check Commented Out (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 19:49:17 UTC, 2 replies.
- [I] `nbf` Claim Not Enforced as Required in ATR JWT Verification (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 19:49:21 UTC, 2 replies.
- [I] Web-Issued JWTs Lack PAT Binding and Cannot Be Individually Revoked (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 19:49:27 UTC, 2 replies.
- [I] JWT DOM Auto-Clear Lacks Page Lifecycle Event Handlers (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 19:49:31 UTC, 2 replies.
- [I] Missing .dockerignore for Build Context Optimization (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 19:49:33 UTC, 2 replies.
- [I] API Error Responses Leak Internal Error Details (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 19:49:35 UTC, 1 replies.
- [I] Principal Authorization Cache Lacks Purge for Inactive Users (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 19:49:38 UTC, 1 replies.
- [I] Pre-Release (Release Candidate) Dependency Used in Production (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 19:49:52 UTC, 0 replies.
- [I] Project Deletion Missing Additional Authorization Checks (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 19:50:19 UTC, 2 replies.
- Re: [I] Require two approvals for important actions (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/05 19:39:56 UTC, 0 replies.
- [I] Document vhost configuration (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/05 22:20:15 UTC, 2 replies.
- [I] Make server startup more efficient (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/06 13:54:29 UTC, 3 replies.
- Re: [I] Use read only permissions for attestation data once written (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/06 14:44:06 UTC, 1 replies.
- Re: [I] Automatically delete unfinished releases (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/06 15:25:44 UTC, 2 replies.
- Re: [I] Admin User Impersonation Has No Audit Trail (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/06 16:19:04 UTC, 2 replies.
- [PR] Bump astral-sh/setup-uv from 6.4.3 to 8.0.0 (tooling-releases-client) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/04/06 16:21:26 UTC, 1 replies.
- Re: [PR] Bump astral-sh/setup-uv from 6.4.3 to 7.6.0 (tooling-releases-client) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/04/06 16:21:29 UTC, 1 replies.
- Re: [PR] Bump pygments from 2.19.2 to 2.20.0 (tooling-releases-client) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/04/06 16:29:43 UTC, 1 replies.
- Re: [PR] Bump actions/cache from 5.0.3 to 5.0.4 (tooling-releases-client) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/06 16:31:51 UTC, 0 replies.
- Re: [PR] Bump actions/upload-artifact from 6.0.0 to 7.0.0 (tooling-releases-client) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/06 16:32:03 UTC, 0 replies.
- [PR] Bump astral-sh/setup-uv from 7.6.0 to 8.0.0 (tooling-actions) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/04/06 17:39:12 UTC, 2 replies.
- Re: [PR] Bump actions/cache from 4.2.0 to 5.0.4 (tooling-actions) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/06 18:21:25 UTC, 0 replies.
- [PR] Bump astral-sh/setup-uv from 7.6.0 to 8.0.0 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/04/06 18:43:28 UTC, 1 replies.
- Re: [I] Upload Staging Endpoint Ignores Authentication Context (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/06 19:45:34 UTC, 1 replies.
- Re: [PR] Bump actions/cache from 5.0.3 to 5.0.4 (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/06 23:43:14 UTC, 0 replies.
- Re: [I] Optional Safe-Type URL Parameters Bypass Validation (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/07 14:15:45 UTC, 0 replies.
- Re: [I] API JWT Creation Endpoint Missing Cache-Control Header (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/07 16:38:31 UTC, 2 replies.
- Re: [I] ALLOW_TESTS Flag Enables Complete Authentication Bypass in Production Worker (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/07 16:44:51 UTC, 1 replies.
- [PR] Bump urllib3 from 2.5.0 to 2.6.3 (tooling-docs) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/04/07 17:29:32 UTC, 2 replies.
- [PR] Bump filelock from 3.20.0 to 3.20.3 (tooling-docs) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/04/07 17:29:36 UTC, 3 replies.
- [PR] Bump virtualenv from 20.35.4 to 20.36.1 (tooling-docs) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/04/07 17:31:13 UTC, 2 replies.
- [PR] Bump requests from 2.32.5 to 2.33.0 (tooling-docs) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/04/07 17:34:03 UTC, 2 replies.
- [PR] Bump pygments from 2.18.0 to 2.20.0 (tooling-docs) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/04/07 17:39:13 UTC, 2 replies.
- [I] Make build-bootstrap error (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/07 18:15:45 UTC, 2 replies.
- Re: [I] Update pre-commit lint to use uv and act on push (tooling-docs) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/07 18:29:56 UTC, 0 replies.
- Re: [I] We could add a `Dependabot` config for `actions` updates (tooling-docs) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/07 18:30:28 UTC, 0 replies.
- Re: [I] Provide clear instructions for running pre-check locally (tooling-docs) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/07 18:31:06 UTC, 0 replies.
- [PR] Adding mermaid support (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/07 18:52:37 UTC, 2 replies.
- Re: [PR] Adding docs for cascading (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/07 18:54:02 UTC, 2 replies.
- Re: [I] Support Mermaid charts in the documentation pages (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/07 19:26:41 UTC, 0 replies.
- [PR] Bump mermaid from 11.4.1 to 11.10.0 in /bootstrap/source (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/04/07 19:29:46 UTC, 2 replies.
- [PR] Bump lodash-es and mermaid in /bootstrap/source (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/04/07 20:04:19 UTC, 3 replies.
- [I] Set a 14 day cooldown for npm packages in Dependabot (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/07 20:07:58 UTC, 3 replies.
- Re: [I] pre-commit: add `markdown-link-check` to check for dead links in Markdown files (tooling-docs) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/07 21:18:03 UTC, 0 replies.
- Re: [PR] Invalidate SSH keys (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/07 23:19:51 UTC, 6 replies.
- [PR] Fix build-bootstrap by resolving ICU dependency for dart-sass (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/07 23:57:34 UTC, 2 replies.
- [PR] Auth audit log and user preferences (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/08 13:34:44 UTC, 1 replies.
- [I] Resolve security issues with Mermaid (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/08 13:45:38 UTC, 0 replies.
- Re: [I] Resolve security issues with Mermaid dependencies (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/08 14:47:39 UTC, 5 replies.
- Re: [I] Study replacing repository.apache.org (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/08 16:56:13 UTC, 0 replies.
- Re: [I] Research whether structured ASFQuart permissions can be used more widely in ATR (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/08 16:59:32 UTC, 0 replies.
- Re: [I] No Validation of Uploaded OpenPGP Key Cryptographic Strength (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/08 17:00:39 UTC, 1 replies.
- Re: [I] Allow error check results to be turned into a TODO list (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/08 17:15:34 UTC, 1 replies.
- Re: [I] Preserve the history of configuration options that affect attestations (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/08 17:16:18 UTC, 1 replies.
- Re: [I] Document database cascades (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/08 18:59:10 UTC, 0 replies.
- Re: [I] Projects VM track (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/08 19:08:19 UTC, 1 replies.
- Re: [I] Discuss upstreaming of certain components (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/08 19:15:27 UTC, 0 replies.
- Re: [I] Archive Extraction Does Not Inspect or Sanitize SVG Files (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/08 19:51:12 UTC, 2 replies.
- Re: [I] No SVG Sanitization Library or Function Exists in Codebase (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/08 19:52:40 UTC, 2 replies.
- Re: [I] Make the user interface clearer in the finish phase (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/08 20:11:47 UTC, 3 replies.
- [PR] Bump cryptography from 46.0.6 to 46.0.7 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/04/08 21:09:13 UTC, 3 replies.
- [GH] Invalidate SSH keys (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/09 08:15:41 UTC, 1 replies.
- Re: [I] IDOR in Check Ignore Operations via Numeric ID (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/09 08:59:40 UTC, 1 replies.
- Re: [I] Git Clone Operations Without Network Timeout (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/09 09:34:54 UTC, 5 replies.
- [PR] #1003 - add rate limiting to SSH connections (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/09 10:55:07 UTC, 1 replies.
- Re: [I] Archive Extraction Size Tracking Reset by Metadata Files (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/09 15:21:08 UTC, 0 replies.
- Re: [I] Unsandboxed render_string_sync API Allows Arbitrary Jinja2 Template Compilation (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/09 15:50:28 UTC, 2 replies.
- [PR] Use the debug print format that is used throughout osv.pysv (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/09 16:11:43 UTC, 0 replies.
- Re: [PR] Use the debug print format that is used throughout osv.py (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/09 16:19:00 UTC, 3 replies.
- Re: [I] Unbounded Directory Traversal and File Hashing in Signature Provenance Endpoint (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/09 16:27:15 UTC, 2 replies.
- [I] Add logging framework to SBOM CLI (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/09 16:35:12 UTC, 0 replies.
- Re: [I] Vote Policy Form Bypasses Minimum Hours Range Check (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/09 16:38:59 UTC, 2 replies.
- [GH] #1003 - add rate limiting to SSH connections (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/09 18:29:12 UTC, 0 replies.
- [PR] Store session data in the server (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/09 19:43:28 UTC, 1 replies.
- [I] API to list PMCs approved for CI staging (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/09 19:44:09 UTC, 2 replies.
- [GH] Store session data in the server (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/10 08:31:15 UTC, 4 replies.
- Re: [I] Setup svn credentials to commit to dist/release (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/10 13:52:49 UTC, 1 replies.
- Re: [I] Implement server-side session store to enable session revocation (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/10 14:12:46 UTC, 1 replies.
- Re: [I] SSH Host Key Generated with RSA 2048-bit (~112 bits of security) (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/10 14:29:13 UTC, 0 replies.
- Re: [I] SSH Interface Lacks Rate Limiting for Write Operations (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/10 14:41:48 UTC, 0 replies.
- Re: [I] Distribution Operations Have No Audit Logging (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/10 14:41:54 UTC, 0 replies.
- Re: [I] No Session Termination After PAT Deletion or Creation (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/10 15:49:57 UTC, 3 replies.
- Re: [I] No Automatic Credential Revocation on Account Disable (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/10 16:00:42 UTC, 0 replies.
- [I] Remove the ability to generate test JWT tokens (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/10 16:27:02 UTC, 3 replies.
- Re: [I] SSH server lacks brute force protection (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/10 16:33:40 UTC, 0 replies.
- Re: [I] Admin Token Revocation Does Not Terminate User Web Sessions (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/10 16:43:50 UTC, 2 replies.
- Re: [I] rsync Subprocess Execution Without Timeout (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/10 17:19:24 UTC, 1 replies.
- [I] MFA OAuth logins fail for developers without LDAP credentials (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/10 18:40:41 UTC, 3 replies.
- [I] Add SWHID identifiers for release verification (tooling-trusted-releases) - posted by "ppkarwasz (via GitHub)" <gi...@apache.org> on 2026/04/11 22:35:16 UTC, 18 replies.
- Re: [I] Thread ID Parameter Lacks Format Validation Before Server-Side Request (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/13 10:18:38 UTC, 0 replies.
- [I] Document when second round podling votes can be held on `general@` (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/13 14:44:06 UTC, 6 replies.
- [I] Tabulate votes from the IPMC in the second podling vote round only (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/13 14:57:49 UTC, 2 replies.
- [I] Hard link files in the incubator directory for podling releases (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/13 15:12:54 UTC, 2 replies.
- [I] Send form validation errors through the database, not through flash cookies (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/13 15:17:53 UTC, 2 replies.
- [I] Do not allow first round podling votes to be sent to private lists (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/13 15:24:11 UTC, 2 replies.
- [I] Votes cast on ATR by IPMC members may fail in the second podling round (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/13 15:31:06 UTC, 2 replies.
- [I] Fix bugs in the vote page for second round podling votes (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/13 15:55:09 UTC, 2 replies.
- [I] Add a podling disclaimer to podling release announcements (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/13 15:59:13 UTC, 2 replies.
- Re: [I] HTTP Redirects Followed Without Target Domain Validation (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/14 04:13:41 UTC, 0 replies.
- [PR] Adding ssh specifics to docs (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/14 04:23:20 UTC, 1 replies.
- Re: [I] Missing Project-Level Access Control on Multiple GET Endpoints (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/14 04:31:53 UTC, 1 replies.
- Re: [I] IDOR on check_id in Check Result Data Endpoint (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/14 04:32:14 UTC, 1 replies.
- Re: [I] OAuth Authentication Does Not Terminate Prior Session Token (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/14 04:34:01 UTC, 1 replies.
- [PR] Adding mermaid back in (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/14 05:16:52 UTC, 3 replies.
- Re: [I] Investigate remote promotion of artifacts on third party platforms (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/14 05:28:11 UTC, 0 replies.
- [PR] Adding endpoint to list projects using CI staging (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/14 07:12:48 UTC, 2 replies.
- [PR] #1158 - move error handling to database (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/14 09:43:36 UTC, 1 replies.
- [PR] Allow character limits on forms, move form error handling to database, add 50k limit to vote form (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/14 09:56:28 UTC, 0 replies.
- Re: [PR] Allow character limits on forms, move form error handling to database, add 50k limit to vote form, add workflowsshkey expiry purge (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/14 15:46:55 UTC, 0 replies.
- Re: [I] Add user configuration for navigation pinning and colour blindness mode (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/14 15:49:27 UTC, 0 replies.
- [GH] Adding endpoint to list projects using CI staging (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/14 16:21:32 UTC, 0 replies.
- Re: [I] Vote content fields lack length and content validation (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/14 16:37:20 UTC, 0 replies.
- Re: [I] Apply path ignores to implicitly classified source archives (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/14 16:56:42 UTC, 1 replies.
- Cannot prepare candidate draft - posted by Craig Russell <ap...@gmail.com> on 2026/04/14 17:44:09 UTC, 2 replies.
- [PR] Do not log the email message body (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/14 19:11:54 UTC, 1 replies.
- [I] Add explicit authentication level decorators for API endpoint functions (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/14 19:28:59 UTC, 6 replies.
- Re: [I] Review Maven ATR plugin and make recommendations (tooling-trusted-releases) - posted by "hboutemy (via GitHub)" <gi...@apache.org> on 2026/04/14 19:38:34 UTC, 12 replies.
- [PR] Only show exception detail in dev environments (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/14 20:06:39 UTC, 3 replies.
- [PR] Update hypercorn[uvloop] requirement from ~=0.17 to ~=0.18 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/04/14 20:29:36 UTC, 1 replies.
- [PR] Update cyclonedx-python-lib[json-validation] requirement from >=11.0.0 to >=11.7.0 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/04/14 20:29:51 UTC, 4 replies.
- [PR] Update quart-schema[pydantic] requirement from ~=0.21 to ~=0.23 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/04/14 20:30:01 UTC, 1 replies.
- [PR] Use textContent and not innerHTML (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/14 20:54:32 UTC, 0 replies.
- Re: [I] User Input Used Directly as RegExp Without Escaping in Project Directory Filter (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/14 21:35:31 UTC, 1 replies.
- Re: [I] Bugs in vote counting algorithm (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/14 21:50:04 UTC, 7 replies.
- Re: [I] LDAP state in dev/debug/test modes and users (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/14 21:51:30 UTC, 0 replies.
- [I] LICENSE validation fails with https instead of http (tooling-trusted-releases) - posted by "clr-apache (via GitHub)" <gi...@apache.org> on 2026/04/15 00:45:12 UTC, 3 replies.
- Re: [I] Missing URL Protocol Validation for Third-Party Distribution URLs Rendered in HTML (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/15 09:23:26 UTC, 0 replies.
- Re: [I] LDAP Filter Injection in Account Lookup Function (Multiple Files) (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/15 11:07:09 UTC, 0 replies.
- Re: [PR] Update quart-schema[pydantic] requirement from <1.0.0,>=0.21 to >=0.23.0,<1.0.0 (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/15 14:21:58 UTC, 2 replies.
- Re: [PR] Update hypercorn[uvloop] requirement from <1.0.0,>=0.17 to >=0.18.0,<1.0.0 (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/15 14:22:29 UTC, 2 replies.
- Re: [I] Ensure that at least one archive is classified as source in path checks (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/15 16:21:57 UTC, 2 replies.
- Re: [PR] Project filter use textContent and not innerHTML plus cheap redos protection (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/15 16:22:06 UTC, 1 replies.
- Re: [I] Invalidate all SSH keys when user account is disabled (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/15 17:14:53 UTC, 0 replies.
- Re: [I] Require passing vote and time period before allowing vote completion (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/15 19:29:48 UTC, 1 replies.
- [PR] #977 and #1022 - rework extraction and quarantine logic to rely on exarch (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/16 09:22:54 UTC, 0 replies.
- [GH] #997 and #1022 - rework extraction and quarantine logic to rely on exarch (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/16 13:03:35 UTC, 1 replies.
- [I] Cover more types of archive in quarantine code (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/16 13:20:12 UTC, 3 replies.
- [PR] Update audience values in jwtoken.py (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/16 14:51:00 UTC, 1 replies.
- [I] Record votes in the database (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/16 15:46:41 UTC, 6 replies.
- Re: [PR] #997 and #1022 - rework extraction and quarantine logic to rely on exarch (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/16 15:48:39 UTC, 0 replies.
- Re: [I] Tar Archive Extraction Uses Explicitly Insecure Default Filter (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/16 16:12:42 UTC, 0 replies.
- Re: [I] Allow more flexible naming for npm artifacts (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/16 19:37:41 UTC, 1 replies.
- Re: [I] Discuss integrations with ECMA standards (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/16 22:14:03 UTC, 1 replies.
- Re: [I] Starting server with env var for expected secret crashes server (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/16 23:00:37 UTC, 6 replies.
- [PR] #1177 - allow zip format archives (jar, war, apk, vsix, whl, nar, nbm) to be quarantine checked (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/17 13:07:40 UTC, 5 replies.
- Re: [I] Add filetype warning checks (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/17 13:08:53 UTC, 4 replies.
- Re: [I] Document what moving files in the compose phase does (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/17 13:10:44 UTC, 2 replies.
- Re: [I] Improve error reporting when /resolve/tabulated data is unavailable (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/17 14:58:10 UTC, 1 replies.
- Re: [I] Add SHA512 generation to attestations (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/17 15:10:25 UTC, 2 replies.
- [I] Migrate from gnupg to rpgp-py (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/17 16:23:29 UTC, 1 replies.
- [PR] Fix env var for expected secret crashes server (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/17 17:53:44 UTC, 2 replies.
- [I] Disallow phase transitions from any but the latest revision (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/20 14:47:00 UTC, 1 replies.
- Re: [I] Migrate from pgpy to rpgp-py (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/20 16:12:33 UTC, 7 replies.
- [I] Confusing error message when trying to upload an existing file (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/20 18:02:43 UTC, 4 replies.
- Re: [I] Expand SBOM support (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/20 18:08:00 UTC, 2 replies.
- [I] Warn when an uploaded OpenPGP key does not have the ASF UID of the user (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/20 18:15:58 UTC, 0 replies.
- [PR] Bump actions/cache from 5.0.4 to 5.0.5 (tooling-releases-client) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/04/20 18:49:05 UTC, 1 replies.
- [PR] Bump actions/upload-artifact from 7.0.0 to 7.0.1 (tooling-releases-client) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/04/20 18:49:13 UTC, 1 replies.
- Re: [I] Retry failed email deliveries (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/20 18:56:40 UTC, 0 replies.
- [I] Work on the client before alpha3 (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/20 19:34:35 UTC, 0 replies.
- [PR] Bump actions/cache from 5.0.4 to 5.0.5 (tooling-actions) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/04/20 20:00:56 UTC, 0 replies.
- [PR] Project delete / archival (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/21 08:17:44 UTC, 0 replies.
- Re: [I] Ensure that a project can only be deleted or archived under certain conditions, and that the state is clear (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/04/21 13:32:52 UTC, 0 replies.
- Re: [I] Add a new class of check outcome that cannot be ignored (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/21 16:43:07 UTC, 0 replies.
- Re: [I] Require the release manager to confirm that they are ignoring non-blocking errors (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/21 19:25:16 UTC, 3 replies.
- [I] Make compose and vote check result tables consistent (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/21 19:37:53 UTC, 0 replies.
- [PR] Bump actions/cache from 5.0.4 to 5.0.5 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/04/21 20:26:48 UTC, 1 replies.
- [I] Add explicit authentication level decorators for GET and POST functions (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/21 21:20:31 UTC, 4 replies.
- Re: [I] Anonymous emails come back from lists.a.o (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/22 14:37:18 UTC, 2 replies.
- Re: [I] Allow private vote threads to be tallied (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/22 14:37:40 UTC, 2 replies.
- [GH] Project delete / archival (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/22 15:24:57 UTC, 6 replies.
- Re: [I] Tie ATR server into the rsync path of svn dist artifacts (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/22 16:14:26 UTC, 0 replies.
- Re: [I] Finish option to automatically archive prior release (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/22 16:14:26 UTC, 1 replies.
- Re: [I] Subscribe to pubsub for LDAP and use it to inform authorisation decisions (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/22 16:46:31 UTC, 0 replies.
- Re: [I] Data browser must include paging (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/22 17:49:12 UTC, 0 replies.
- [I] Request feedback from users more clearly (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/22 17:52:16 UTC, 0 replies.
- [I] MFA from localhost is failing after authentication (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/22 19:39:37 UTC, 2 replies.
- [I] During beta track (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/22 19:58:43 UTC, 0 replies.
- Re: [I] Prevent the reuse of detached session objects in database commit contexts (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/23 02:31:00 UTC, 1 replies.
- [I] Test critical finding carve-out with privateRepo (tooling-agents) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/23 07:43:47 UTC, 0 replies.
- [I] Test email delivery on ASF infrastructure (tooling-agents) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/23 07:44:15 UTC, 0 replies.
- [I] Build test suite with fixtures (tooling-agents) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/23 07:48:49 UTC, 1 replies.
- [I] Pull open issues into pipeline (tooling-agents) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/23 07:49:46 UTC, 0 replies.
- [I] Keep last audit and compare new audit (tooling-agents) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/23 07:55:34 UTC, 0 replies.
- [I] Auto-file issues (tooling-agents) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/23 07:59:12 UTC, 0 replies.
- [I] Auto PR generator (tooling-agents) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/23 08:04:30 UTC, 0 replies.
- [I] Assess scrutineer (tooling-agents) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/23 08:25:51 UTC, 0 replies.
- [I] Assess brief (tooling-agents) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/23 08:27:01 UTC, 0 replies.
- [I] Audit projects (tooling-agents) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/23 08:30:26 UTC, 0 replies.
- [I] Steve run issue (tooling-agents) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/23 09:13:14 UTC, 2 replies.
- [I] Add specs in addition to ASVS (tooling-agents) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/23 09:54:00 UTC, 0 replies.
- Re: [I] Add size limits to SSH/rsync file uploads (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/23 16:20:22 UTC, 3 replies.
- Re: [I] API Policy Update Bypasses Form-Level Business Validation (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/23 16:27:20 UTC, 1 replies.
- [I] Request timeout when uploading multiple files (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/24 16:09:51 UTC, 1 replies.
- [I] After a failed upload, the upload form is only available through a refresh (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/24 16:12:02 UTC, 1 replies.
- [I] A sources JAR was not detected as source by the classifier (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/24 16:15:50 UTC, 2 replies.
- [I] Make email address selection in OpenPGP key generation clearer (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/24 16:17:22 UTC, 1 replies.
- [I] Allow uploading an OpenPGP key as a file (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/24 16:18:50 UTC, 1 replies.
- [I] Explain the consequences of OpenPGP committee association (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/24 16:20:04 UTC, 1 replies.
- [I] SHA-512 generation failed despite a valid signature (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/24 16:21:30 UTC, 0 replies.
- [I] The output of the standard sha512 tool is rejected by checks (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/24 16:23:11 UTC, 1 replies.
- [I] The project settings page should be more prominent and better integrated (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/24 16:24:48 UTC, 1 replies.
- [I] Change the navigation element on phase pages (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/24 16:26:17 UTC, 0 replies.
- [I] Whole release check results are omitted in the vote table (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/24 16:27:45 UTC, 4 replies.
- [I] Allow release managers to be notified by email when a vote ends (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/24 16:29:08 UTC, 0 replies.
- [I] Add a vote mode where binding votes must be cast through ATR (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/27 19:44:25 UTC, 0 replies.
- [PR] Bump astral-sh/setup-uv from 8.0.0 to 8.1.0 (tooling-releases-client) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/04/27 20:17:01 UTC, 1 replies.
- [PR] Bump astral-sh/setup-uv from 8.0.0 to 8.1.0 (tooling-actions) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/04/27 21:38:21 UTC, 0 replies.
- [I] Fix bugs associated with the manual voting mode (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/28 13:51:48 UTC, 0 replies.
- [PR] Api auth decorators 1169 (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/28 14:35:20 UTC, 2 replies.
- [I] Add a vote mode for security releases (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/28 14:35:59 UTC, 0 replies.
- [GH] Api auth decorators 1169 (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/28 15:44:48 UTC, 2 replies.
- [PR] Bump astral-sh/setup-uv from 8.0.0 to 8.1.0 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/04/28 20:28:02 UTC, 1 replies.
- [I] Add committee metadata along with admin updates (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/29 00:47:06 UTC, 0 replies.
- [I] Investigate scrutineer (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/29 17:27:35 UTC, 0 replies.
- [I] Refactor prompts (tooling-agents) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/30 06:57:04 UTC, 4 replies.
- [I] Compression of inputs (tooling-agents) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/30 07:00:53 UTC, 1 replies.
- [I] Handle missing committee logos with appropriate fallback (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/04/30 17:22:33 UTC, 0 replies.
- [VOTE] Release Tooling 0.4 - posted by sb...@apache.org on 2026/04/30 18:33:27 UTC, 5 replies.