You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@jspwiki.apache.org by Alex O'Ree <al...@apache.org> on 2026/03/21 18:57:19 UTC
[VOTE] Release JSPWiki version 2.12.4
This is a release vote for Apache JSPWiki, version 2.12.4. The vote will be
open for at least 72 hours from now.
It fixes the following issues:
https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310732&version=2.12.4
You can see a curated changelog at
https://jspwiki-wiki.apache.org/Wiki.jsp?page=NewIn2.12.4
Note that we are voting upon the source (tag), binaries are provided for
convenience.
Everybody is encouraged to vote.
Source and binary files:
https://dist.apache.org/repos/dist/dev/jspwiki/2.12.4-RC1
Nexus staging repo:
https://repository.apache.org/content/repositories/orgapachejspwiki-1036
The tag to be voted upon:
https://github.com/apache/jspwiki/tree/2.12.4-RC1
JSPWiki's KEYS file containing PGP keys we use to sign the release:
https://www.apache.org/dist/jspwiki/KEYS
== Reproducible Builds ==
JSPWiki should follow Reproducible Builds (https://reproducible-builds.org/).
In order to verify
artifacts' build reproducibility, please use
mvn verify artifact:compare -Dreference.repo=
https://repository.apache.org/content/repositories/staging/
*** Please download, test and vote:
[ ] +1 Approve the release
[ ] 0 Don't mind
[ ] -1 Disapprove the release (please provide specific comments)
Re: [VOTE] Release JSPWiki version 2.12.4
Posted by Alex O'Ree <al...@apache.org>.
I can't comment on this at this time.
I do see what you mean about the loop though. I suppose we can retract the
build, address it then do another RC.
On Thu, Mar 26, 2026 at 8:06 AM Ulf Dittmer <ul...@googlemail.com>
wrote:
> I'm not sure if
>
> https://github.com/apache/jspwiki/commit/a56dd0d191b77e9b82ea14c47033960d39ea3c50
> is working as intended, but it seems to break code.
>
> In the following code excerpt, the last if block is independent of the
> loop, and thus should not be part of it. But more importantly, it disallows
> access to any property starting with "jspwiki". I bet that lots of people
> named some of their properties "jspwiki.something.something". If accessing
> those no longer works, I think there might be quite a bit of breakage.
>
> That is likely not what people would expect from a dot-dot release; I sure
> didn't :-)
>
> Ulf
>
> for( final String value : THE_BIG_NO_NO_LIST ) {
> if( name.equals( value ) ) {
> return ""; // FIXME: Should this be something different?
> }
> if ("jspwiki.frontpage".equals(name)) continue;
> if ("jspwiki.runfilters".equals(name) ) continue;
>
> if ( name.startsWith( "jspwiki" ) ) {
> LOG.warn("variable manager is denying access to '" + name +
> "'");
> return "";
> }
> }
>
Re: [VOTE] Release JSPWiki version 2.12.4
Posted by Ulf Dittmer <ul...@googlemail.com>.
I'm not sure if
https://github.com/apache/jspwiki/commit/a56dd0d191b77e9b82ea14c47033960d39ea3c50
is working as intended, but it seems to break code.
In the following code excerpt, the last if block is independent of the
loop, and thus should not be part of it. But more importantly, it disallows
access to any property starting with "jspwiki". I bet that lots of people
named some of their properties "jspwiki.something.something". If accessing
those no longer works, I think there might be quite a bit of breakage.
That is likely not what people would expect from a dot-dot release; I sure
didn't :-)
Ulf
for( final String value : THE_BIG_NO_NO_LIST ) {
if( name.equals( value ) ) {
return ""; // FIXME: Should this be something different?
}
if ("jspwiki.frontpage".equals(name)) continue;
if ("jspwiki.runfilters".equals(name) ) continue;
if ( name.startsWith( "jspwiki" ) ) {
LOG.warn("variable manager is denying access to '" + name +
"'");
return "";
}
}
Re: [VOTE] Release JSPWiki version 2.12.4
Posted by Arturo Bernal <ab...@apache.org>.
+1 Approve the release
Arturo
On Mon, Mar 23, 2026 at 10:37 PM Juan Pablo Santos Rodríguez <
juanpablo.santos@gmail.com> wrote:
> Hi,
>
> sorry for the delay with this one
>
> +1: compiles & runs ok, integration testing ok, and the usual
> workaround the application also seems fine
>
>
> best regards,
> juan pablo
>
> On Mon, Mar 23, 2026 at 12:19 PM Ulf Dittmer <ul...@googlemail.com>
> wrote:
> >
> > On Sun, Mar 22, 2026 at 3:27 PM Alex O'Ree <al...@apache.org> wrote:
> >
> > >
> > > Note: since all of the jira issues are security related, you'll have to
> > > login to get any results
> > >
> >
> > Even when logged in, I can't see those tickets - I guess you have to be a
> > committer to the project.
> >
> >
> >
> https://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12356749&styleName=Text&projectId=12310732&Create=Create
> >
> >
> > That just brings up an empty edit box for the release notes. But I found
> > https://github.com/apache/jspwiki/compare/master...master-2x-2.12.4,
> which
> > I guess is the closest thing to a changelog that exists before a release.
>
Re: [VOTE] Release JSPWiki version 2.12.4
Posted by Juan Pablo Santos Rodríguez <ju...@gmail.com>.
Hi,
sorry for the delay with this one
+1: compiles & runs ok, integration testing ok, and the usual
workaround the application also seems fine
best regards,
juan pablo
On Mon, Mar 23, 2026 at 12:19 PM Ulf Dittmer <ul...@googlemail.com> wrote:
>
> On Sun, Mar 22, 2026 at 3:27 PM Alex O'Ree <al...@apache.org> wrote:
>
> >
> > Note: since all of the jira issues are security related, you'll have to
> > login to get any results
> >
>
> Even when logged in, I can't see those tickets - I guess you have to be a
> committer to the project.
>
>
> https://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12356749&styleName=Text&projectId=12310732&Create=Create
>
>
> That just brings up an empty edit box for the release notes. But I found
> https://github.com/apache/jspwiki/compare/master...master-2x-2.12.4, which
> I guess is the closest thing to a changelog that exists before a release.
Re: [VOTE] Release JSPWiki version 2.12.4
Posted by Ulf Dittmer <ul...@googlemail.com>.
On Sun, Mar 22, 2026 at 3:27 PM Alex O'Ree <al...@apache.org> wrote:
>
> Note: since all of the jira issues are security related, you'll have to
> login to get any results
>
Even when logged in, I can't see those tickets - I guess you have to be a
committer to the project.
https://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12356749&styleName=Text&projectId=12310732&Create=Create
That just brings up an empty edit box for the release notes. But I found
https://github.com/apache/jspwiki/compare/master...master-2x-2.12.4, which
I guess is the closest thing to a changelog that exists before a release.
Re: [VOTE] Release JSPWiki version 2.12.4
Posted by Alex O'Ree <al...@apache.org>.
Apologies, i just followed the release procedure.
Note: since all of the jira issues are security related, you'll have to
login to get any results
Give this one a shot
https://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12356749&styleName=Text&projectId=12310732&Create=Create
And i made the change summary on the other link
On Sun, Mar 22, 2026 at 9:02 AM Ulf Dittmer <ul...@googlemail.com>
wrote:
>
> https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310732&version=2.12.4
>
> https://jspwiki-wiki.apache.org/Wiki.jsp?page=NewIn2.12.4
>
> Both these links are dead.
>
Re: [VOTE] Release JSPWiki version 2.12.4
Posted by Ulf Dittmer <ul...@googlemail.com>.
https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310732&version=2.12.4
https://jspwiki-wiki.apache.org/Wiki.jsp?page=NewIn2.12.4
Both these links are dead.