You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@shiro.apache.org by "jbampton (via GitHub)" <gi...@apache.org> on 2026/01/07 16:43:17 UTC
[PR] [CI] Dependabot: add a cooldown period for new releases [shiro]
jbampton opened a new pull request, #2444:
URL: https://github.com/apache/shiro/pull/2444
Enforces security best practices by requiring a minimum age for new dependency releases before they are automatically updated by Dependabot.
This practice, known as a "cooldown period," helps mitigate supply chain attacks by allowing time for frequently published malicious packages to be identified.
refs https://github.com/apache/cloudstack/pull/12384
<!--
For Security Vulnerabilities, please email: security@shiro.apache.org
For more details on how to report a vulnerability see: https://www.apache.org/security/
-->
Following this checklist to help us incorporate your contribution quickly and easily:
- [ ] Make sure there is a [GitHub issue](https://github.com/apache/shiro/issues) filed
for the change (usually before you start working on it). Trivial changes like typos do not
require a GitHub issue. Your pull request should address just this issue, without pulling in other changes.
- [ ] Format the pull request title like `[#XXX] - Fixes bug in SessionManager`,
where you replace `#XXX` with the appropriate GitHub issue. Best practice
is to use the GitHub issue title in the pull request title and in the first line of the commit message.
- [ ] Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
- [ ] add `fixes #XXX` if merging the PR should close a related issue.
- [ ] Run `mvn verify` to make sure basic checks pass. A more thorough check will be performed on your pull request automatically.
- [ ] Committers: Make sure a milestone is set on the PR
- [ ] Committers: Use "Squash and Merge" to combine all commits into one when merging a PR when appropriate.
Trivial changes like typos do not require a GitHub issue (javadoc, comments...).
In this case, just format the pull request title like `[DOC] - Add javadoc in SessionManager`.
If this is your first contribution, you have to read the [Contribution Guidelines](https://github.com/apache/shiro/blob/master/CONTRIBUTING.md)
If your pull request is about ~20 lines of code you don't need to sign an [Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf)
if you are unsure please ask on the developers list.
To make clear that you license your contribution under the [Apache License Version 2.0, January 2004](http://www.apache.org/licenses/LICENSE-2.0)
you have to acknowledge this by using the following check-box.
- [ ] I hereby declare this contribution to be licenced under the [Apache License Version 2.0, January 2004](http://www.apache.org/licenses/LICENSE-2.0)
- [ ] In any other case, please file an [Apache Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@shiro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CI] Dependabot: add a cooldown period for new releases [shiro]
Posted by "lprimak (via GitHub)" <gi...@apache.org>.
lprimak closed pull request #2444: [CI] Dependabot: add a cooldown period for new releases
URL: https://github.com/apache/shiro/pull/2444
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@shiro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CI] Dependabot: add a cooldown period for new releases [shiro]
Posted by "boris-petrov (via GitHub)" <gi...@apache.org>.
boris-petrov commented on PR #2444:
URL: https://github.com/apache/shiro/pull/2444#issuecomment-3723877988
I agree that this is not strictly needed as in the NPM ecosystem. In addition to what @lprimak mentioned as reasons, note that most exploits are done via NPM's pre-build scripts which is not a thing in the Java world - so such supply-chain attacks are much more difficult.
That's what I believe at least. Will be interested to hear opinions of others too.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@shiro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CI] Dependabot: add a cooldown period for new releases [shiro]
Posted by "lprimak (via GitHub)" <gi...@apache.org>.
lprimak commented on PR #2444:
URL: https://github.com/apache/shiro/pull/2444#issuecomment-3740640202
Loos like we have a consensus that cool-down period is not necessary for Apache Shiro
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@shiro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CI] Dependabot: add a cooldown period for new releases [shiro]
Posted by "lprimak (via GitHub)" <gi...@apache.org>.
lprimak commented on PR #2444:
URL: https://github.com/apache/shiro/pull/2444#issuecomment-3721278836
I am not sure that Maven Central is susceptible to these kinds of attacks.
Maven Central scans for malware and has stricter criteria for publishing (domain ownership verification).
What do others think?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@shiro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org