You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@commons.apache.org by TvT <tv...@nepatec.de> on 2020/06/04 10:01:35 UTC
[Validator] Project dead?
The last update of the apache commons validator is from 2017.
Since then lots of bugs/issues have been reported. Some are critical and
introduce vulnerable 3rd party dependencies e.g. VALIDATOR-458.
There are over 20 unfixed Bugs reported against the latest version (1.6).
There are overall 64 issues of which 18 are fixed in a non-existing version
2.0.
So my questions are:
Will there be a new version release 1.6.1 or 1.7?
What about version 2.0?
Is the project dead? (There have been talks about this in the past:
https://markmail.org/message/36hcl3hq73ncjb4m )
It would be highly appreciated if somebody could share some light on this...
Thanks!
Re: [Validator] Project dead?
Posted by Melloware <me...@gmail.com>.
And to add to that BeanUtils2 removed Commons Collection as a dependency
entirely so whenever BeanUtils2 is released it can then be added to
Validator as well.
On 6/4/2020 2:21 PM, sebb wrote:
> On Thu, 4 Jun 2020 at 17:19, TvT <tv...@nepatec.de> wrote:
>> yeah but more like a zombie ;-)
>>
>> But my mentioned issue 458 is a duplicate of
>> https://issues.apache.org/jira/projects/VALIDATOR/issues/VALIDATOR-437
>> and already solved in 1.7....
>> So the question remains when can we expect 1.7....
> AFAICT, that particular issue can be solved without needing a new release.
> It should be enough to adjust your pom.
>
> Also, unless you are actually using the parts of Validator that need
> beanutils, you should be able to remove the beanutils jar entirely.
>
> However it obviously would be good to get a new release out.
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: [Validator] Project dead?
Posted by sebb <se...@gmail.com>.
On Thu, 4 Jun 2020 at 17:19, TvT <tv...@nepatec.de> wrote:
>
> yeah but more like a zombie ;-)
>
> But my mentioned issue 458 is a duplicate of
> https://issues.apache.org/jira/projects/VALIDATOR/issues/VALIDATOR-437
> and already solved in 1.7....
> So the question remains when can we expect 1.7....
AFAICT, that particular issue can be solved without needing a new release.
It should be enough to adjust your pom.
Also, unless you are actually using the parts of Validator that need
beanutils, you should be able to remove the beanutils jar entirely.
However it obviously would be good to get a new release out.
> Am Do., 4. Juni 2020 um 12:45 Uhr schrieb Gary Gregory <
> garydgregory@gmail.com>:
>
> > The last commit was 18 days ago, so not dead ;-)
> > https://github.com/apache/commons-validator?files=1
> >
> > Gary
> >
> > On Thu, Jun 4, 2020, 06:01 TvT <tv...@nepatec.de> wrote:
> >
> > > The last update of the apache commons validator is from 2017.
> > > Since then lots of bugs/issues have been reported. Some are critical and
> > > introduce vulnerable 3rd party dependencies e.g. VALIDATOR-458.
> > > There are over 20 unfixed Bugs reported against the latest version (1.6).
> > > There are overall 64 issues of which 18 are fixed in a non-existing
> > version
> > > 2.0.
> > > So my questions are:
> > >
> > > Will there be a new version release 1.6.1 or 1.7?
> > > What about version 2.0?
> > > Is the project dead? (There have been talks about this in the past:
> > > https://markmail.org/message/36hcl3hq73ncjb4m )
> > >
> > > It would be highly appreciated if somebody could share some light on
> > > this...
> > > Thanks!
> > >
> >
>
>
> --
> Beste Grüße/Kind regards
> Tobias van Treeck
> ___________________________________________________________________________________________________
> Tobias van Treeck (MSc)
> nepatec GmbH . Seelhorststraße 44 . 30175 Hannover
> <https://maps.google.com/?q=Seelhorststra%C3%9Fe+44+.+30175+Hannover&entry=gmail&source=g>
> Fon: +49.511.935.946.51 . Fax: +49.511.935.946.57 . Mail:
> tobias.vantreeck@nepatec.de Internet: www.nepatec.de
> nepatec GmbH . Amtsgericht Hannover
> HRB 200954 . Geschäftsführer: Burkhard Gerlts . Claudius Grieser . Thorsten
> Geier
> Hinweis: https://www.nepatec.de/about/
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: [Validator] Project dead?
Posted by Gary Gregory <ga...@gmail.com>.
There is no schedule for a release, I am a volunteer here as are others. We
work on various components as what must appear as random from the outside
looking in.
I am the release manager from time to time, others pitch in as well. If you
remind the list once in a while, I or someone else will hopefully come
around to doing a release.
Thank you for being patient.
Gary
On Thu, Jun 4, 2020 at 12:19 PM TvT <tv...@nepatec.de> wrote:
> yeah but more like a zombie ;-)
>
> But my mentioned issue 458 is a duplicate of
> https://issues.apache.org/jira/projects/VALIDATOR/issues/VALIDATOR-437
> and already solved in 1.7....
> So the question remains when can we expect 1.7....
>
> Am Do., 4. Juni 2020 um 12:45 Uhr schrieb Gary Gregory <
> garydgregory@gmail.com>:
>
> > The last commit was 18 days ago, so not dead ;-)
> > https://github.com/apache/commons-validator?files=1
> >
> > Gary
> >
> > On Thu, Jun 4, 2020, 06:01 TvT <tv...@nepatec.de> wrote:
> >
> > > The last update of the apache commons validator is from 2017.
> > > Since then lots of bugs/issues have been reported. Some are critical
> and
> > > introduce vulnerable 3rd party dependencies e.g. VALIDATOR-458.
> > > There are over 20 unfixed Bugs reported against the latest version
> (1.6).
> > > There are overall 64 issues of which 18 are fixed in a non-existing
> > version
> > > 2.0.
> > > So my questions are:
> > >
> > > Will there be a new version release 1.6.1 or 1.7?
> > > What about version 2.0?
> > > Is the project dead? (There have been talks about this in the past:
> > > https://markmail.org/message/36hcl3hq73ncjb4m )
> > >
> > > It would be highly appreciated if somebody could share some light on
> > > this...
> > > Thanks!
> > >
> >
>
>
> --
> Beste Grüße/Kind regards
> Tobias van Treeck
>
> ___________________________________________________________________________________________________
> Tobias van Treeck (MSc)
> nepatec GmbH . Seelhorststraße 44 . 30175 Hannover
> <
> https://maps.google.com/?q=Seelhorststra%C3%9Fe+44+.+30175+Hannover&entry=gmail&source=g
> >
> Fon: +49.511.935.946.51 . Fax: +49.511.935.946.57 . Mail:
> tobias.vantreeck@nepatec.de Internet: www.nepatec.de
> nepatec GmbH . Amtsgericht Hannover
> HRB 200954 . Geschäftsführer: Burkhard Gerlts . Claudius Grieser . Thorsten
> Geier
> Hinweis: https://www.nepatec.de/about/
>
Re: [Validator] Project dead?
Posted by TvT <tv...@nepatec.de>.
yeah but more like a zombie ;-)
But my mentioned issue 458 is a duplicate of
https://issues.apache.org/jira/projects/VALIDATOR/issues/VALIDATOR-437
and already solved in 1.7....
So the question remains when can we expect 1.7....
Am Do., 4. Juni 2020 um 12:45 Uhr schrieb Gary Gregory <
garydgregory@gmail.com>:
> The last commit was 18 days ago, so not dead ;-)
> https://github.com/apache/commons-validator?files=1
>
> Gary
>
> On Thu, Jun 4, 2020, 06:01 TvT <tv...@nepatec.de> wrote:
>
> > The last update of the apache commons validator is from 2017.
> > Since then lots of bugs/issues have been reported. Some are critical and
> > introduce vulnerable 3rd party dependencies e.g. VALIDATOR-458.
> > There are over 20 unfixed Bugs reported against the latest version (1.6).
> > There are overall 64 issues of which 18 are fixed in a non-existing
> version
> > 2.0.
> > So my questions are:
> >
> > Will there be a new version release 1.6.1 or 1.7?
> > What about version 2.0?
> > Is the project dead? (There have been talks about this in the past:
> > https://markmail.org/message/36hcl3hq73ncjb4m )
> >
> > It would be highly appreciated if somebody could share some light on
> > this...
> > Thanks!
> >
>
--
Beste Grüße/Kind regards
Tobias van Treeck
___________________________________________________________________________________________________
Tobias van Treeck (MSc)
nepatec GmbH . Seelhorststraße 44 . 30175 Hannover
<https://maps.google.com/?q=Seelhorststra%C3%9Fe+44+.+30175+Hannover&entry=gmail&source=g>
Fon: +49.511.935.946.51 . Fax: +49.511.935.946.57 . Mail:
tobias.vantreeck@nepatec.de Internet: www.nepatec.de
nepatec GmbH . Amtsgericht Hannover
HRB 200954 . Geschäftsführer: Burkhard Gerlts . Claudius Grieser . Thorsten
Geier
Hinweis: https://www.nepatec.de/about/
Re: [Validator] Project dead?
Posted by Gary Gregory <ga...@gmail.com>.
The last commit was 18 days ago, so not dead ;-)
https://github.com/apache/commons-validator?files=1
Gary
On Thu, Jun 4, 2020, 06:01 TvT <tv...@nepatec.de> wrote:
> The last update of the apache commons validator is from 2017.
> Since then lots of bugs/issues have been reported. Some are critical and
> introduce vulnerable 3rd party dependencies e.g. VALIDATOR-458.
> There are over 20 unfixed Bugs reported against the latest version (1.6).
> There are overall 64 issues of which 18 are fixed in a non-existing version
> 2.0.
> So my questions are:
>
> Will there be a new version release 1.6.1 or 1.7?
> What about version 2.0?
> Is the project dead? (There have been talks about this in the past:
> https://markmail.org/message/36hcl3hq73ncjb4m )
>
> It would be highly appreciated if somebody could share some light on
> this...
> Thanks!
>