Elliotte Rusty Harold

icon indicating a website link https://www.elharo.com/blog/

icon location New York icon location Elliotte Rusty Harold lives in a secret mountaintop laboratory on a large island off the East Coast of the United States. He's an active member of SFWA and BSFW

Results 445 comments of Elliotte Rusty Harold

Upgrade json-path to 2.9.0 due CVE-2023-1370

Why/where do we use json-smart? It looks unmaintained and risky. Can we just remove/replace it?

Upgrade json-path to 2.9.0 due CVE-2023-1370

Looks like we should be able to remove this dependency completely. Less dependencies --> less security bugs

Fix timestamp preservation when extracting cached files

Can you resolve conflicts and repush?

Fix #375: Capture plugin properties at validation time to eliminate timing mismatch

Absolutely nothing should be merged on a failing build. A failing build blocks everything.

[MDEP-948] building site with Maven 4 throws NPE saying "this.configuration" is null

clsoing since it doesn't seem to be an issue in the dependency plugin

Maven allows random namespaces on project

We do want to restrict namespaces when parsing 4.0.0 files to only the specifically allowed namespaces and no namespace at all. But we should not allow arbitrary strings.

[MNG-8537] Keep Maven Namespace the same

I've been pushing this for a long time, and the longer we wait the harder it gets to do. I'm not sure it can be done in 5.0

[MNG-8537] Keep Maven Namespace the same

Nothing should be deployed with the 4.0 namespace as it hasn't been released yet. If something is, I can live with that breakage. Of course, once 4.0 is released, it...

[MNG-8537] Keep Maven Namespace the same

FYI, a quick check of my inbox shows I've been raising red flags on this since at least 2019.

[MNG-8537] Maven 4 namespace should not change

Digging into the code, I now notice that we're keying off of the namespace to select the model version, which means in the future we won't be able to change...