Re: latest spring vulnerability and roller

Hello again,

dev builds are now also uploaded automatically after PR integration.

index for master builds:
https://github.com/apache/roller/actions/workflows/main.yml?query=branch%3Amaster

example of the most recent build (would be the first link of the index 
above):
https://github.com/apache/roller/actions/runs/2080694025
(see bottom of the page for artifacts)

best regards,
michael


On 02.04.22 01:50, Michael Bien wrote:
> Hello Roller users,
>
> you probably heard of "spring shell"* by now.
>
> if you don't want to wait for a roller update release, building roller 
> yourself is really easy.
>
> follow first two steps described here:
>
> https://github.com/apache/roller#quick-start-running-via-maven
>
>
> The master branch already contains the spring dependency updates which 
> include the fixes for the (known) vulnerabilities.
>
> We updated a lot of code over the last ~two years, this allows making 
> those dependency updates quickly without having to change anything 
> code wise - the apache release process still takes time though - 
> building roller yourself takes 5-10 minutes.
>
> best regards,
>
> michael
>
>
> * https://security.snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-2436751
>
> ** https://github.com/apache/roller/pull/115
>
>