)]}'
{
  "commit": "94c935d1406bc0875daebd36994595efa2f48ae0",
  "tree": "c84e51d324869143ab817dc8bdbb09ea805dd5a8",
  "parents": [
    "583e78e68341f50735d27a23c58b197a04737535"
  ],
  "author": {
    "name": "Robert Lazarski",
    "email": "robertlazarski@gmail.com",
    "time": "Fri Sep 04 11:23:55 2026 -1000"
  },
  "committer": {
    "name": "Robert Lazarski",
    "email": "robertlazarski@gmail.com",
    "time": "Fri Sep 04 11:23:55 2026 -1000"
  },
  "message": "Bound the MTOM, SwA and SOAP bodies too\n\nThe ceilings added for the form builders left the other stream-reading builders\nunbounded, which bounds nothing: the caller picks the builder by choosing the\nContent-Type, so sending multipart/related avoided them entirely. Bound the\nwhole multipart body in MIMEBuilder, before the parts are buffered to heap or\ndisk, and a plain SOAP or POX body in SOAPBuilder. Its MIME path takes its root\npart from the now-bounded multipart body and needs no ceiling of its own. Item\n10 of the threat model scoped itself to the form builders, which is what let\nthis stand; it now says every stream-reading builder.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "76475cfb4fdfb9ed23e813c84c58bba93807a5fd",
      "old_mode": 33188,
      "old_path": "SECURITY.md",
      "new_id": "1feeae5d1b45e4236367d504c27bda4e8f81ece5",
      "new_mode": 33188,
      "new_path": "SECURITY.md"
    },
    {
      "type": "modify",
      "old_id": "454bda3cc01aaba8eb7c4056301349fe295dfaa6",
      "old_mode": 33188,
      "old_path": "modules/kernel/src/org/apache/axis2/builder/MIMEBuilder.java",
      "new_id": "0e1f61e81130d8fe6aa349c19b3cf045d3136044",
      "new_mode": 33188,
      "new_path": "modules/kernel/src/org/apache/axis2/builder/MIMEBuilder.java"
    },
    {
      "type": "modify",
      "old_id": "28b48682a3d1901bb4093386696be56d3f2ae84f",
      "old_mode": 33188,
      "old_path": "modules/kernel/src/org/apache/axis2/builder/RequestSizeLimits.java",
      "new_id": "ce9461b37d4b2b159784ec8d6f35c8ee5b5a93f5",
      "new_mode": 33188,
      "new_path": "modules/kernel/src/org/apache/axis2/builder/RequestSizeLimits.java"
    },
    {
      "type": "modify",
      "old_id": "7c4167f99293543be25ea5ee772293e327a9f8eb",
      "old_mode": 33188,
      "old_path": "modules/kernel/src/org/apache/axis2/builder/SOAPBuilder.java",
      "new_id": "c16c43032b3339a5711e87c399ccb663d78d1c50",
      "new_mode": 33188,
      "new_path": "modules/kernel/src/org/apache/axis2/builder/SOAPBuilder.java"
    },
    {
      "type": "modify",
      "old_id": "20be3881926218a32a4198565eda1ecf1802a4a1",
      "old_mode": 33188,
      "old_path": "modules/kernel/test/org/apache/axis2/builder/RequestSizeLimitsTest.java",
      "new_id": "6ce056919a9ffc962bb536533ba901c27cf6c88b",
      "new_mode": 33188,
      "new_path": "modules/kernel/test/org/apache/axis2/builder/RequestSizeLimitsTest.java"
    },
    {
      "type": "modify",
      "old_id": "03703de9a0090f8d36ee6d35757a0a5d3f8a6896",
      "old_mode": 33188,
      "old_path": "src/site/markdown/release-notes/2.0.2.md",
      "new_id": "84f2e6751aa518819ae9a714b41ee098d75414f4",
      "new_mode": 33188,
      "new_path": "src/site/markdown/release-notes/2.0.2.md"
    }
  ]
}