You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@directory.apache.org by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2024/12/26 16:00:43 UTC
[PR] Bump org.apache.mina:mina-core from 2.2.3 to 2.2.4 [directory-ldap-api]
dependabot[bot] opened a new pull request, #170:
URL: https://github.com/apache/directory-ldap-api/pull/170
Bumps [org.apache.mina:mina-core](https://github.com/apache/mina) from 2.2.3 to 2.2.4.
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/apache/mina/commit/4134a125d8830c67c21b97c28f2bf706801bdd13"><code>4134a12</code></a> [maven-release-plugin] prepare release 2.2.4</li>
<li><a href="https://github.com/apache/mina/commit/ccc85e38a1b1b494444246b6cd9d98419dee8912"><code>ccc85e3</code></a> Fixing another link issue</li>
<li><a href="https://github.com/apache/mina/commit/bfb75f2490953fa4753da57ef742fdeb5e0ef3ea"><code>bfb75f2</code></a> Rollbacked to source plugin 3.2.1</li>
<li><a href="https://github.com/apache/mina/commit/625a52405acabe624a2bf9e68f8743ec46474b37"><code>625a524</code></a> Trying to get maven source plugin to the latest version</li>
<li><a href="https://github.com/apache/mina/commit/252130da0fd76d9c2399b75a9f1a13efa313f133"><code>252130d</code></a> Solved some link issues</li>
<li><a href="https://github.com/apache/mina/commit/859e7aaa6f039032c3063daa92e86d94eac11cc5"><code>859e7aa</code></a> Fixed a bad <a href="https://github.com/link"><code>@link</code></a></li>
<li><a href="https://github.com/apache/mina/commit/f58344115703a883074941f54fccd92aeeb4382e"><code>f583441</code></a> Fixed some compilation issues</li>
<li><a href="https://github.com/apache/mina/commit/b1dc83a3a8ceef10cff1daa957320ac043fc03d8"><code>b1dc83a</code></a> Fixed some javadoc issues</li>
<li><a href="https://github.com/apache/mina/commit/06a51073ebddd1a969ba50ea41e8bb262c065169"><code>06a5107</code></a> Rollbacked maven source plugin to 3.2.1, because since 3.3.0 the build fails</li>
<li><a href="https://github.com/apache/mina/commit/97918866b79f35bcf00a5e7090e02c15ab82b1db"><code>9791886</code></a> Added some missing spaces</li>
<li>Additional commits viewable in <a href="https://github.com/apache/mina/compare/2.2.3...2.2.4">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/directory-ldap-api/network/alerts).
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [PR] Bump org.apache.mina:mina-core from 2.2.3 to 2.2.4 [directory-ldap-api]
Posted by "prashil-g (via GitHub)" <gi...@apache.org>.
prashil-g commented on PR #170:
URL: https://github.com/apache/directory-ldap-api/pull/170#issuecomment-2576767249
@coheigea when can we get new version for directory-ldap-api with this fix.
Apache MINA Deserialization RCE Vulnerability is 10/10 and we would like to upgrade to newer directory-ldap-api with the fix
CVE Advisory link - https://github.com/advisories/GHSA-76h9-2vwh-w278
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [PR] Bump org.apache.mina:mina-core from 2.2.3 to 2.2.4 [directory-ldap-api]
Posted by "jmini (via GitHub)" <gi...@apache.org>.
jmini commented on PR #170:
URL: https://github.com/apache/directory-ldap-api/pull/170#issuecomment-2652744325
I saw a tag [`2.1.8`](https://github.com/apache/directory-ldap-api/releases/tag/2.1.8) was created, but I do not see the jars in maven central.
I am doing something wrong?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [PR] Bump org.apache.mina:mina-core from 2.2.3 to 2.2.4 [directory-ldap-api]
Posted by "elecharny (via GitHub)" <gi...@apache.org>.
elecharny commented on PR #170:
URL: https://github.com/apache/directory-ldap-api/pull/170#issuecomment-2719428278
No ETA. Fixing MINA is a hard piece of work...
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [PR] Bump org.apache.mina:mina-core from 2.2.3 to 2.2.4 [directory-ldap-api]
Posted by "jmini (via GitHub)" <gi...@apache.org>.
jmini commented on PR #170:
URL: https://github.com/apache/directory-ldap-api/pull/170#issuecomment-2720494297
Ok, thank you for the update.
I looked closer at the commits:
The tag `2.1.8` which used to be on commit https://github.com/apache/directory-ldap-api/commit/91d49b438a1c35eb8b74d559eb1609245dfa5c66 was removed.
In addition a "Rollbacking the 2.1.8 release" commit https://github.com/apache/directory-ldap-api/commit/f9b04c40f8b975ce71b1eec20ad32bdee3f394ce was pushed to the main branch.
So I guess that the vote wasn't OK and that we still have to wait to have a release of `org.apache.directory.api:api-all` that is free from any CVE.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [PR] Bump org.apache.mina:mina-core from 2.2.3 to 2.2.4 [directory-ldap-api]
Posted by "coheigea (via GitHub)" <gi...@apache.org>.
coheigea merged PR #170:
URL: https://github.com/apache/directory-ldap-api/pull/170
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [PR] Bump org.apache.mina:mina-core from 2.2.3 to 2.2.4 [directory-ldap-api]
Posted by "coheigea (via GitHub)" <gi...@apache.org>.
coheigea commented on PR #170:
URL: https://github.com/apache/directory-ldap-api/pull/170#issuecomment-2652769470
@jmini The vote hasn't closed yet
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [PR] Bump org.apache.mina:mina-core from 2.2.3 to 2.2.4 [directory-ldap-api]
Posted by "elecharny (via GitHub)" <gi...@apache.org>.
elecharny commented on PR #170:
URL: https://github.com/apache/directory-ldap-api/pull/170#issuecomment-2576942060
@prashil-g The LDAP API release is on its way.
Side note: Apache LDAP API is *totally* immune against the MINA CVE. We don't use the part that allows a RCE. You are safe with the current version.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [PR] Bump org.apache.mina:mina-core from 2.2.3 to 2.2.4 [directory-ldap-api]
Posted by "prashil-g (via GitHub)" <gi...@apache.org>.
prashil-g commented on PR #170:
URL: https://github.com/apache/directory-ldap-api/pull/170#issuecomment-2576989799
@elecharny thanks a lot for the info
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [PR] Bump org.apache.mina:mina-core from 2.2.3 to 2.2.4 [directory-ldap-api]
Posted by "jmini (via GitHub)" <gi...@apache.org>.
jmini commented on PR #170:
URL: https://github.com/apache/directory-ldap-api/pull/170#issuecomment-2655875913
No problem...
I am not at all in the Apache Foundation processes, so by following the GitHub project it is hard to follow what is going on.
Thank you very much for the update here.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [PR] Bump org.apache.mina:mina-core from 2.2.3 to 2.2.4 [directory-ldap-api]
Posted by "jmini (via GitHub)" <gi...@apache.org>.
jmini commented on PR #170:
URL: https://github.com/apache/directory-ldap-api/pull/170#issuecomment-2713227852
@elecharny, @coheigea: Any ETA for this vote concerning the publication of `org.apache.directory.api:api-all:2.1.8` on maven central?
Is there some dashboard or mailing-list archive where I can follow progress?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org