You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@roller.apache.org by Dave <sn...@gmail.com> on 2026/09/06 11:43:26 UTC
[VOTE] Release Apache Roller 6.1.6 RC1
Dear Apache Roller Community,
I am pleased to call for a vote on the release of Apache Roller 6.1.6-RC1.
This is a maintenance release that retires three obsolete features, hardens
media and enclosure handling, and fixes the source distribution so that it
builds. The release candidate files can be found at:
https://dist.apache.org/repos/dist/dev/roller/roller-6.1/v6.1.6
* apache-roller-6.1.6-rc1-source.tar.gz
* apache-roller-6.1.6-rc1-source.zip
* apache-roller-6.1.6-rc1-binary.tar.gz
* apache-roller-6.1.6-rc1-binary.zip
Each has a .asc signature and .sha512 and .sha256 checksums alongside it.
This release is signed with a new key, 8FEC6F9CBA59703C, so please re-import
KEYS before verifying: https://downloads.apache.org/roller/KEYS
Please review the release candidate and cast your vote:
[ ] +1 Release this package as Apache Roller 6.1.6
[ ] 0 No opinion
[ ] -1 Do not release this package because...
The vote will be open for at least 72 hours.
## Key Changes in Apache Roller 6.1.6
### Retired Features - Please Read Before Upgrading
* Incoming Trackback support removed; the endpoint is gone and unmapped
* Outbound Trackback removed from the entry editor
* WSSE AtomPub authentication retired; authentication.method now takes
basic or oauth, and an installation set to wsse will fail closed on
startup rather than falling back
### Media and Enclosures
* Media file content types derived from file content, not the upload request
* Enclosure metadata stored as submitted, without fetching the remote URL
### Authoring and Rendering
* Authoring resource lookups scoped to the weblog being edited
* Weblog template resources resolved within the active theme
* Front page selection moved into the administrator setup workflow
* Authoring UI event handlers moved to data attributes
### Web Services
* XML-RPC handlers check weblog permission per method
* Vendor extension types disabled on the XML-RPC servlet
* OAuth authorization bound to the current session and made one-shot
### Build and Packaging
* Source distribution now includes db-utils, which was missing from earlier
source releases and prevented them from building
* Third-party jars no longer shipped in the source distribution
* CHANGES.md added, and sign-release.sh takes the version as an argument
Thank you for your time and contributions to the Apache Roller project.
Best regards,
Dave Johnson
Re: testing 6.1.6 RC1
Posted by Dave <sn...@gmail.com>.
Thanks for the testing, Greg! Looks like some legit problems.
I'm working on a fix for these issues here:
https://github.com/apache/roller/pull/182
Dave
On Mon, Sep 7, 2026 at 9:50 AM Greg Huber <gr...@gmail.com> wrote:
> Basically looks OK. .....Although with some findings, possibly due to
> http/https enforcement irregularities?
>
> ####
>
> The upgrade database script failed with a 500 Security validation just
> after clicking the upgrade button.
>
> Re-running the upgrade again, it passed with a page saying these were
> the tables upgraded, but the list of tables was empty.
> Clicking the start button seemed to work OK.
>
> Think the original start page was https://www.devbox.co.uk/roller/ which
> it then does a redirect to the upgrade page. Needs checking the
> redirect also enforces https.
>
> Here are is the upgrade bit in log file.
>
> WARN 2026-09-07 12:00:50 [ajp-nio-127.0.0.1-8009-exec-8]
> StrutsLocalizedTextProvider - Trying to find text with null key!
> WARN 2026-09-07 12:00:52 [ajp-nio-127.0.0.1-8009-exec-9]
> StrutsLocalizedTextProvider - Trying to find text with null key!
> INFO 2026-09-07 12:00:52 [ajp-nio-127.0.0.1-8009-exec-7] SaltCache -
> {size=5000, id=cache.salt, timeout=3600, enabled=true}
> WARN 2026-09-07 12:00:52 [ajp-nio-127.0.0.1-8009-exec-2]
> StrutsLocalizedTextProvider - Trying to find text with null key!
> WARN 2026-09-07 12:06:05 [ajp-nio-127.0.0.1-8009-exec-6]
> StrutsLocalizedTextProvider - Trying to find text with null key!
> WARN 2026-09-07 12:06:05 [ajp-nio-127.0.0.1-8009-exec-10]
> StrutsLocalizedTextProvider - Trying to find text with null key!
> WARN 2026-09-07 12:06:08 [ajp-nio-127.0.0.1-8009-exec-4]
> StrutsLocalizedTextProvider - Trying to find text with null key!
> INFO 2026-09-07 12:06:09 [ajp-nio-127.0.0.1-8009-exec-3]
> DatabaseInstaller - Database version = 610
> INFO 2026-09-07 12:06:09 [ajp-nio-127.0.0.1-8009-exec-3]
> DatabaseInstaller - Desired version = 616
> INFO 2026-09-07 12:06:09 [ajp-nio-127.0.0.1-8009-exec-3]
> DatabaseInstaller - Database is old, beginning upgrade to version 616
> WARN 2026-09-07 12:06:09 [ajp-nio-127.0.0.1-8009-exec-3]
> StrutsLocalizedTextProvider - Trying to find text with null key!
> WARN 2026-09-07 12:06:09 [ajp-nio-127.0.0.1-8009-exec-6]
> StrutsLocalizedTextProvider - Trying to find text with null key!
> WARN 2026-09-07 12:06:10 [ajp-nio-127.0.0.1-8009-exec-6]
> SecurityMemberAccess - Declaring class of member type [public final
> native java.lang.Class java.lang.Object.getClass()] is excluded!
> INFO 2026-09-07 12:07:43 [ajp-nio-127.0.0.1-8009-exec-5] Install -
> ENTERING
> INFO 2026-09-07 12:07:44 [ajp-nio-127.0.0.1-8009-exec-5]
> WebloggerFactory - Bootstrapping Roller Weblogger business tier
>
> ##
>
> The edit entry preview button seems not to work as it just shows a login
> page. It opens a new tab not being on https. The https link shows the
> preview page correctly.
>
>
> http://www.devbox.co.uk/roller/roller-ui/authoring/preview/mainpage/?previewEntry=test
>
> https://www.devbox.co.uk/roller/roller-ui/authoring/preview/mainpage/?previewEntry=test
>
> The getPreviewURL() returns an absolute url,
>
> .java
> public String getPreviewURL() {
> return WebloggerFactory
> .getWeblogger()
> .getUrlStrategy()
> .getPreviewURLStrategy(null)
> .getWeblogEntryURL(getActionWeblog(), null,
> getEntry().getAnchor(), true);
> }
> .jsp
> function fullPreviewMode() {
> window.open('<s:property value="previewURL" />',
> 'roller-preview');
> }
> Needs checking to ensure the new tab matches the previous http/https
> entryEdit.rol page.
>
> ####
>
> Will look some more.
>
> Cheers
>
>
> On 06/09/2026 12:43, Dave wrote:
> > Dear Apache Roller Community,
> >
> > I am pleased to call for a vote on the release of Apache Roller
> 6.1.6-RC1.
> > This is a maintenance release that retires three obsolete features,
> hardens
> > media and enclosure handling, and fixes the source distribution so that
> it
> > builds. The release candidate files can be found at:
> >
> > https://dist.apache.org/repos/dist/dev/roller/roller-6.1/v6.1.6
> >
> > * apache-roller-6.1.6-rc1-source.tar.gz
> > * apache-roller-6.1.6-rc1-source.zip
> > * apache-roller-6.1.6-rc1-binary.tar.gz
> > * apache-roller-6.1.6-rc1-binary.zip
> >
> > Each has a .asc signature and .sha512 and .sha256 checksums alongside it.
> > This release is signed with a new key, 8FEC6F9CBA59703C, so please
> re-import
> > KEYS before verifying: https://downloads.apache.org/roller/KEYS
> >
> > Please review the release candidate and cast your vote:
> >
> > [ ] +1 Release this package as Apache Roller 6.1.6
> > [ ] 0 No opinion
> > [ ] -1 Do not release this package because...
> >
> > The vote will be open for at least 72 hours.
> >
> > ## Key Changes in Apache Roller 6.1.6
> >
> > ### Retired Features - Please Read Before Upgrading
> > * Incoming Trackback support removed; the endpoint is gone and unmapped
> > * Outbound Trackback removed from the entry editor
> > * WSSE AtomPub authentication retired; authentication.method now takes
> > basic or oauth, and an installation set to wsse will fail closed on
> > startup rather than falling back
> >
> > ### Media and Enclosures
> > * Media file content types derived from file content, not the upload
> request
> > * Enclosure metadata stored as submitted, without fetching the remote URL
> >
> > ### Authoring and Rendering
> > * Authoring resource lookups scoped to the weblog being edited
> > * Weblog template resources resolved within the active theme
> > * Front page selection moved into the administrator setup workflow
> > * Authoring UI event handlers moved to data attributes
> >
> > ### Web Services
> > * XML-RPC handlers check weblog permission per method
> > * Vendor extension types disabled on the XML-RPC servlet
> > * OAuth authorization bound to the current session and made one-shot
> >
> > ### Build and Packaging
> > * Source distribution now includes db-utils, which was missing from
> earlier
> > source releases and prevented them from building
> > * Third-party jars no longer shipped in the source distribution
> > * CHANGES.md added, and sign-release.sh takes the version as an argument
> >
> > Thank you for your time and contributions to the Apache Roller project.
> >
> > Best regards,
> > Dave Johnson
> >
>
testing 6.1.6 RC1
Posted by Greg Huber <gr...@gmail.com>.
Basically looks OK. .....Although with some findings, possibly due to
http/https enforcement irregularities?
####
The upgrade database script failed with a 500 Security validation just
after clicking the upgrade button.
Re-running the upgrade again, it passed with a page saying these were
the tables upgraded, but the list of tables was empty.
Clicking the start button seemed to work OK.
Think the original start page was https://www.devbox.co.uk/roller/ which
it then does a redirect to the upgrade page. Needs checking the
redirect also enforces https.
Here are is the upgrade bit in log file.
WARN 2026-09-07 12:00:50 [ajp-nio-127.0.0.1-8009-exec-8]
StrutsLocalizedTextProvider - Trying to find text with null key!
WARN 2026-09-07 12:00:52 [ajp-nio-127.0.0.1-8009-exec-9]
StrutsLocalizedTextProvider - Trying to find text with null key!
INFO 2026-09-07 12:00:52 [ajp-nio-127.0.0.1-8009-exec-7] SaltCache -
{size=5000, id=cache.salt, timeout=3600, enabled=true}
WARN 2026-09-07 12:00:52 [ajp-nio-127.0.0.1-8009-exec-2]
StrutsLocalizedTextProvider - Trying to find text with null key!
WARN 2026-09-07 12:06:05 [ajp-nio-127.0.0.1-8009-exec-6]
StrutsLocalizedTextProvider - Trying to find text with null key!
WARN 2026-09-07 12:06:05 [ajp-nio-127.0.0.1-8009-exec-10]
StrutsLocalizedTextProvider - Trying to find text with null key!
WARN 2026-09-07 12:06:08 [ajp-nio-127.0.0.1-8009-exec-4]
StrutsLocalizedTextProvider - Trying to find text with null key!
INFO 2026-09-07 12:06:09 [ajp-nio-127.0.0.1-8009-exec-3]
DatabaseInstaller - Database version = 610
INFO 2026-09-07 12:06:09 [ajp-nio-127.0.0.1-8009-exec-3]
DatabaseInstaller - Desired version = 616
INFO 2026-09-07 12:06:09 [ajp-nio-127.0.0.1-8009-exec-3]
DatabaseInstaller - Database is old, beginning upgrade to version 616
WARN 2026-09-07 12:06:09 [ajp-nio-127.0.0.1-8009-exec-3]
StrutsLocalizedTextProvider - Trying to find text with null key!
WARN 2026-09-07 12:06:09 [ajp-nio-127.0.0.1-8009-exec-6]
StrutsLocalizedTextProvider - Trying to find text with null key!
WARN 2026-09-07 12:06:10 [ajp-nio-127.0.0.1-8009-exec-6]
SecurityMemberAccess - Declaring class of member type [public final
native java.lang.Class java.lang.Object.getClass()] is excluded!
INFO 2026-09-07 12:07:43 [ajp-nio-127.0.0.1-8009-exec-5] Install - ENTERING
INFO 2026-09-07 12:07:44 [ajp-nio-127.0.0.1-8009-exec-5]
WebloggerFactory - Bootstrapping Roller Weblogger business tier
##
The edit entry preview button seems not to work as it just shows a login
page. It opens a new tab not being on https. The https link shows the
preview page correctly.
http://www.devbox.co.uk/roller/roller-ui/authoring/preview/mainpage/?previewEntry=test
https://www.devbox.co.uk/roller/roller-ui/authoring/preview/mainpage/?previewEntry=test
The getPreviewURL() returns an absolute url,
.java
public String getPreviewURL() {
return WebloggerFactory
.getWeblogger()
.getUrlStrategy()
.getPreviewURLStrategy(null)
.getWeblogEntryURL(getActionWeblog(), null,
getEntry().getAnchor(), true);
}
.jsp
function fullPreviewMode() {
window.open('<s:property value="previewURL" />', 'roller-preview');
}
Needs checking to ensure the new tab matches the previous http/https
entryEdit.rol page.
####
Will look some more.
Cheers
On 06/09/2026 12:43, Dave wrote:
> Dear Apache Roller Community,
>
> I am pleased to call for a vote on the release of Apache Roller 6.1.6-RC1.
> This is a maintenance release that retires three obsolete features, hardens
> media and enclosure handling, and fixes the source distribution so that it
> builds. The release candidate files can be found at:
>
> https://dist.apache.org/repos/dist/dev/roller/roller-6.1/v6.1.6
>
> * apache-roller-6.1.6-rc1-source.tar.gz
> * apache-roller-6.1.6-rc1-source.zip
> * apache-roller-6.1.6-rc1-binary.tar.gz
> * apache-roller-6.1.6-rc1-binary.zip
>
> Each has a .asc signature and .sha512 and .sha256 checksums alongside it.
> This release is signed with a new key, 8FEC6F9CBA59703C, so please re-import
> KEYS before verifying: https://downloads.apache.org/roller/KEYS
>
> Please review the release candidate and cast your vote:
>
> [ ] +1 Release this package as Apache Roller 6.1.6
> [ ] 0 No opinion
> [ ] -1 Do not release this package because...
>
> The vote will be open for at least 72 hours.
>
> ## Key Changes in Apache Roller 6.1.6
>
> ### Retired Features - Please Read Before Upgrading
> * Incoming Trackback support removed; the endpoint is gone and unmapped
> * Outbound Trackback removed from the entry editor
> * WSSE AtomPub authentication retired; authentication.method now takes
> basic or oauth, and an installation set to wsse will fail closed on
> startup rather than falling back
>
> ### Media and Enclosures
> * Media file content types derived from file content, not the upload request
> * Enclosure metadata stored as submitted, without fetching the remote URL
>
> ### Authoring and Rendering
> * Authoring resource lookups scoped to the weblog being edited
> * Weblog template resources resolved within the active theme
> * Front page selection moved into the administrator setup workflow
> * Authoring UI event handlers moved to data attributes
>
> ### Web Services
> * XML-RPC handlers check weblog permission per method
> * Vendor extension types disabled on the XML-RPC servlet
> * OAuth authorization bound to the current session and made one-shot
>
> ### Build and Packaging
> * Source distribution now includes db-utils, which was missing from earlier
> source releases and prevented them from building
> * Third-party jars no longer shipped in the source distribution
> * CHANGES.md added, and sign-release.sh takes the version as an argument
>
> Thank you for your time and contributions to the Apache Roller project.
>
> Best regards,
> Dave Johnson
>
[CANCEL][VOTE] Release Apache Roller 6.1.6 RC1
Posted by Dave <sn...@gmail.com>.
Cancelling the RC1 vote. RC2 supersedes it — it adds the dependency updates
and JDK 25 test matrix from #180 and a small authoring-template consistency
change — and is up for vote in a separate message.
Thanks to everyone who looked at RC1.
Dave
Re: [VOTE] Release Apache Roller 6.1.6 RC1
Posted by Dave <sn...@gmail.com>.
There will definitely be an RC2 so we can pull in this PR
https://github.com/apache/roller/pull/180, but I'll hold off on that to see
if there's any feedback on RC1.
Dave
On Sun, Sep 6, 2026 at 7:43 AM Dave <sn...@gmail.com> wrote:
> Dear Apache Roller Community,
>
> I am pleased to call for a vote on the release of Apache Roller 6.1.6-RC1.
> This is a maintenance release that retires three obsolete features, hardens
> media and enclosure handling, and fixes the source distribution so that it
> builds. The release candidate files can be found at:
>
> https://dist.apache.org/repos/dist/dev/roller/roller-6.1/v6.1.6
>
> * apache-roller-6.1.6-rc1-source.tar.gz
> * apache-roller-6.1.6-rc1-source.zip
> * apache-roller-6.1.6-rc1-binary.tar.gz
> * apache-roller-6.1.6-rc1-binary.zip
>
> Each has a .asc signature and .sha512 and .sha256 checksums alongside it.
> This release is signed with a new key, 8FEC6F9CBA59703C, so please
> re-import
> KEYS before verifying: https://downloads.apache.org/roller/KEYS
>
> Please review the release candidate and cast your vote:
>
> [ ] +1 Release this package as Apache Roller 6.1.6
> [ ] 0 No opinion
> [ ] -1 Do not release this package because...
>
> The vote will be open for at least 72 hours.
>
> ## Key Changes in Apache Roller 6.1.6
>
> ### Retired Features - Please Read Before Upgrading
> * Incoming Trackback support removed; the endpoint is gone and unmapped
> * Outbound Trackback removed from the entry editor
> * WSSE AtomPub authentication retired; authentication.method now takes
> basic or oauth, and an installation set to wsse will fail closed on
> startup rather than falling back
>
> ### Media and Enclosures
> * Media file content types derived from file content, not the upload
> request
> * Enclosure metadata stored as submitted, without fetching the remote URL
>
> ### Authoring and Rendering
> * Authoring resource lookups scoped to the weblog being edited
> * Weblog template resources resolved within the active theme
> * Front page selection moved into the administrator setup workflow
> * Authoring UI event handlers moved to data attributes
>
> ### Web Services
> * XML-RPC handlers check weblog permission per method
> * Vendor extension types disabled on the XML-RPC servlet
> * OAuth authorization bound to the current session and made one-shot
>
> ### Build and Packaging
> * Source distribution now includes db-utils, which was missing from earlier
> source releases and prevented them from building
> * Third-party jars no longer shipped in the source distribution
> * CHANGES.md added, and sign-release.sh takes the version as an argument
>
> Thank you for your time and contributions to the Apache Roller project.
>
> Best regards,
> Dave Johnson
>