[jira] [Work logged] (ROL-2183) Migrate from javax to jakarta namespace (Jakarta EE 9+)

["ASF GitHub Bot (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/ROL-2183?focusedWorklogId=1045543&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1045543 ]

ASF GitHub Bot logged work on ROL-2183:
---------------------------------------

                Author: ASF GitHub Bot
            Created on: 03/Oct/26 21:06
            Start Date: 03/Oct/26 21:06
    Worklog Time Spent: 10m 
      Work Description: snoopdave commented on PR #154:
URL: https://github.com/apache/roller/pull/154#issuecomment-5973478728

   🐞Claude Issue: **PR-Review: General Issues**
   
   The following issues were found but cannot be attached to a specific line in the diff:
   
   - **Blocking: why checks fail.** CodeQL reports 4 new high alerts. The XSS one is covered inline. The other three are `java/path-injection` at `MediaCollection.java:122`, `:141` and `:185`. That code is unchanged, but the forked servlet now exposes the request source to CodeQL. The `Slug` header becomes the `File.createTempFile` prefix. The JDK strips directory parts from the prefix (I checked `"../../evil"` on JDK 17), so this is not exploitable. Still, the prefix has no reason to carry request data: use `File.createTempFile("roller-atom-", ".tmp")`, which removes all three alerts without dismissals.
   - **Blocking:** The PR conflicts with `master` (`mergeStateStatus: DIRTY`) and needs another merge.
   - **Blocking:** `CHANGES.md` is not updated. This PR removes OAuth 1.0a for AtomPub, the consumer key UI and OpenID 2.0 login. It also raises the baseline to Java 17 and Tomcat 11 / Servlet 6.1. Each of these needs an upgrade note linked to [ROL-2183](https://issues.apache.org/jira/browse/ROL-2183).
   - **Scope note:** At 226 files, this review covered CI, `security.xml`, and the AtomPub fork. The Struts 7, `@StrutsParameter` and JPA namespace changes were not reviewed line by line.




Issue Time Tracking
-------------------

    Worklog Id:     (was: 1045543)
    Time Spent: 1h 40m  (was: 1.5h)

> Migrate from javax to jakarta namespace (Jakarta EE 9+)
> -------------------------------------------------------
>
>                 Key: ROL-2183
>                 URL: https://issues.apache.org/jira/browse/ROL-2183
>             Project: Apache Roller
>          Issue Type: Improvement
>            Reporter: Matt Raible
>            Assignee: Matt Raible
>            Priority: Major
>          Time Spent: 1h 40m
>  Remaining Estimate: 0h
>
> Roller currently uses Java EE 8 APIs with the {{javax.\*}} namespace (Servlet API 4.0.1, JavaMail, JSP, JAXB, javax.activation). The JPA layer has been partially migrated to {{jakarta.persistence}}, but the rest of the codebase remains on {{javax.\*}}.
> This issue tracks the full migration to the {{jakarta.\*}} namespace to support Jakarta EE 9+ and modern servlet containers like Tomcat 10+.
> *Scope of changes:*
> * \~305 {{javax.\*}} imports across the codebase (servlet, JSP, mail, activation, XML bind)
> * \~31 {{jakarta.persistence}} imports already in place (JPA managers)
> * Servlet API dependency: {{javax.servlet:javax.servlet-api:4.0.1}} -> {{jakarta.servlet:jakarta.servlet-api:5.0+}}
> * JavaMail: {{javax.mail}} -> {{jakarta.mail}}
> * JSP: {{javax.servlet.jsp}} -> {{jakarta.servlet.jsp}}
> * JAXB: {{javax.xml.bind}} -> {{jakarta.xml.bind}}
> * {{javax.activation}} -> {{jakarta.activation}}
> * Update {{web.xml}} and any deployment descriptors
> * Update third-party dependencies to Jakarta-compatible versions



--
This message was sent by Atlassian Jira
(v8.20.10#820010)