)]}' { "log": [ { "commit": "d353c6180ac2a05f19d2957e53089d27beaaf017", "tree": "337b6e996fe54e6da845b097c7b7019cb33a860f", "parents": [ "905e4cf03dfd801fde708aa5a49e360875063f20" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Thu Oct 22 23:20:01 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Thu Oct 22 23:31:42 2026 +0530" }, "message": "Improved: Allow Dependabot major-version updates for Gradle dependencies on trunk (OFBIZ-13716)\n\nRemoved the semver-major ignore from the trunk gradle entry of the Dependabot configuration, so that major versions are proposed and triaged one by one, as agreed on dev@. Added explicit ignores for the asciidoctor plugins, whose 5.x release renamed the convert plugin, and for activiti-juel-jakarta 9.x, which needs Java 25. The release24.09 entry keeps ignoring major versions.\n" }, { "commit": "905e4cf03dfd801fde708aa5a49e360875063f20", "tree": "6645b41fccf5db982e6e6cf8230ba3b09f75e3b8", "parents": [ "38e2bc6d21c02dcb44df8298e6105e1748c0154b" ], "author": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Thu Oct 22 11:10:56 2026 +0200" }, "committer": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Thu Oct 22 18:47:18 2026 +0200" }, "message": "Refactor Gradle build steps to separate Javadoc preparation, and perform data loading and integration tests\n" }, { "commit": "38e2bc6d21c02dcb44df8298e6105e1748c0154b", "tree": "32ab4f250dfe934898311a47abdbf6cff2ed3494", "parents": [ "1177219b576f2e67a5f6886516fc5aff36016075" ], "author": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Thu Oct 22 10:53:05 2026 +0200" }, "committer": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Thu Oct 22 18:47:18 2026 +0200" }, "message": "Build the Docker images only when they can be pushed and are needed\n\nThe Docker workflow builds three images, compiling OFBiz each time, on\nan ubuntu-latest runner, a limited resource shared by all the ASF\nprojects:\n\n- run the job only when the DO_DOCKER_PUSH variable is \u0027true\u0027: forks\n built the images without being able to push them. To run the\n workflow with act, pass --var DO_DOCKER_PUSH\u003dtrue; the images are\n still not pushed under act\n- cancel the running or queued build of a branch when a new commit is\n pushed to it, since only the images of the latest push replace the\n -snapshot images; tag builds are never cancelled\n- don\u0027t trigger the build for changes that cannot affect the images\n (Markdown files, Windows scripts, IDE/devcontainer setup, other\n workflows). The docs are copied into the images, so they still\n trigger it. Paths filters are not evaluated for tag pushes, so\n tags always build the images\n\nDocument the new condition and the cancellation in README-CI-CD.md.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n" }, { "commit": "1177219b576f2e67a5f6886516fc5aff36016075", "tree": "aaf3c6ed3231b2f97560f46a1812ac697c97b7a7", "parents": [ "aa8624c262d340f79ba4bd7460933d4c3c86d56b" ], "author": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Thu Oct 22 10:53:05 2026 +0200" }, "committer": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Thu Oct 22 18:47:18 2026 +0200" }, "message": "Run the CodeQL analysis only when it is useful\n\nThe ubuntu-latest runners are a limited resource shared by all the ASF\nprojects, so avoid using them when the analysis cannot be affected:\n\n- trigger the workflow only for changes that can affect the analyzed\n sources, with the same paths filter as the Java CI workflow:\n changes to documentation, Windows scripts, legal/info files,\n Docker/IDE/devcontainer setup and other workflows no longer start\n an analysis; the weekly scheduled analysis runs anyway\n- cancel the analysis of a pull request that is still running or\n queued when a new commit is pushed to it; analyses of pushes to\n trunk and release* branches are never cancelled, and each of them\n gets its own concurrency group\n- skip the analysis of Dependabot pull requests, which only change\n dependency versions; the push of their merge is analyzed as any\n other push\n\nDocument the new triggers in README-CI-CD.md.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n" }, { "commit": "aa8624c262d340f79ba4bd7460933d4c3c86d56b", "tree": "ae3047f72d6d308b9c09ce081e6028ebc177a72c", "parents": [ "eb01ea135a897b07a3a83340248ee3a3ce0b318e" ], "author": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Thu Oct 22 10:53:05 2026 +0200" }, "committer": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Thu Oct 22 18:47:18 2026 +0200" }, "message": "Group Dependabot updates and check for them weekly\n\nEach Dependabot pull request runs the CI workflows on ubuntu-latest\nrunners, a limited resource shared by all the ASF projects: when it is\nopened, again each time it is rebased after another pull request is\nmerged, and once more when it is merged. With daily checks and one pull\nrequest per dependency, this added up to many builds for routine\nupdates.\n\nCheck for updates weekly instead of daily, and group the minor and\npatch updates of each gradle, npm and github-actions entry in a single\npull request. Major updates, which need a closer review, still get\ntheir own pull request. The codeql-action group stays first, so it\nstill collects the init and analyze actions, major updates included.\nThe docker entries have a single base image and need no group.\n\nDocument the schedule and the grouping in README-CI-CD.md.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n" }, { "commit": "eb01ea135a897b07a3a83340248ee3a3ce0b318e", "tree": "8cfb155d32086129c365aa56c631b3a87c587b6c", "parents": [ "9f5cb346e1e67e49228c78c1100adf86fb6e8ce7" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 21 19:23:55 2026 +0000" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Thu Oct 22 15:59:28 2026 +0530" }, "message": "Bump com.fasterxml.jackson.core:jackson-databind from 2.22.3 to 2.22.4\n\nBumps [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson-databind) from 2.22.3 to 2.22.4.\n- [Commits](https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.22.3...jackson-databind-2.22.4)\n\n---\nupdated-dependencies:\n- dependency-name: com.fasterxml.jackson.core:jackson-databind\n dependency-version: 2.22.4\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "9f5cb346e1e67e49228c78c1100adf86fb6e8ce7", "tree": "7f64ef4326b2ee0df4a4f76d62940f26897791e7", "parents": [ "7099f47083c8a26b0e6e5e9cd5ca80b81766a854" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Oct 20 17:57:37 2026 +0000" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Thu Oct 22 15:59:09 2026 +0530" }, "message": "Bump org.simplejavamail:utils-mail-dkim from 3.3.0 to 3.3.1\n\nBumps [org.simplejavamail:utils-mail-dkim](https://github.com/simple-java-mail/java-utils-mail-dkim) from 3.3.0 to 3.3.1.\n- [Release notes](https://github.com/simple-java-mail/java-utils-mail-dkim/releases)\n- [Changelog](https://github.com/simple-java-mail/java-utils-mail-dkim/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/simple-java-mail/java-utils-mail-dkim/compare/3.3.0...3.3.1)\n\n---\nupdated-dependencies:\n- dependency-name: org.simplejavamail:utils-mail-dkim\n dependency-version: 3.3.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "7099f47083c8a26b0e6e5e9cd5ca80b81766a854", "tree": "8bbdba3144053176bd59a454e0aef32fbbf9aa31", "parents": [ "9de0431956c684a4f182b0cfca8b615c2da3cad8" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 21 17:18:30 2026 +0530" }, "committer": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Thu Oct 22 07:20:12 2026 +0200" }, "message": "Fixed: Shopping list permission services check the wrong permission action (OFBIZ-13702)\n\n- checkShoppingListSecurity and checkShoppingListItemSecurity built the PARTYMGR permission from a permissionAction parameter that permissionInterface does not define, so only PARTYMGR_ADMIN passed. They now use mainAction, and fill the error message from resourceDescription and mainAction instead of leaving the placeholders empty.\n- calculateShoppingListDeepTotalPrice called checkShoppingListItemSecurity without an action. It now checks with the VIEW action, as the original minilang did.\n" }, { "commit": "9de0431956c684a4f182b0cfca8b615c2da3cad8", "tree": "f45e5815fe076955f7d969981859a84d545cc204", "parents": [ "696e14e5b1e289cd5d80026341dc85ba2af3948d" ], "author": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Wed Oct 21 14:37:41 2026 +0200" }, "committer": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Thu Oct 22 07:17:41 2026 +0200" }, "message": "Allow the Scorecard analysis to be run by hand\n\nNow that the analysis only runs on the weekly schedule, add the\nworkflow_dispatch trigger so it can be re-run on demand, for example\nto check that an alert is resolved without waiting for the next\nscheduled run.\n\nThanks to Mridul Pathak for the review.\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "696e14e5b1e289cd5d80026341dc85ba2af3948d", "tree": "853ef0908c0c06837fc11d1e1f08c28d1fa2f7bd", "parents": [ "af414fda287eff031f0b8a8e1f3c6b7b67ad36f8" ], "author": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Wed Oct 21 14:36:38 2026 +0200" }, "committer": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Thu Oct 22 07:17:41 2026 +0200" }, "message": "Give each push build of the Java CI workflow its own concurrency group\n\nA concurrency group holds at most one running and one pending run: when\na newer run joins the group, the pending one is cancelled even if\ncancel-in-progress is false. Grouping trunk and release* pushes by\ngithub.ref could therefore leave some commits without a build. Use\ngithub.run_id for pushes instead, while pull requests are still grouped\nby number and still have their older runs cancelled.\n\nThanks to Mridul Pathak for the review.\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "af414fda287eff031f0b8a8e1f3c6b7b67ad36f8", "tree": "150e5f06f87cda37c12f902c0ae96ffc9ef6d980", "parents": [ "1cae5ea3bb3afe299ee266a122866c33b1589dda" ], "author": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Tue Oct 20 19:44:30 2026 +0200" }, "committer": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Thu Oct 22 07:17:41 2026 +0200" }, "message": "Run lightweight workflows on ubuntu-slim runners\n\nThe dependency\nreview jobs only run small scripts or JavaScript actions that call the\nGitHub API. Run them on the single-CPU ubuntu-slim runners to spare the\nubuntu-latest runners, which are a limited resource shared by all the\nASF projects.\n\nCo-Authored-By: Claude Opus 5.5\n" }, { "commit": "1cae5ea3bb3afe299ee266a122866c33b1589dda", "tree": "918ae39369721017af7a21f291573049ef9bbf82", "parents": [ "3734acdb57e9a2ade75006eac0206de9ecd1a762" ], "author": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Tue Oct 20 19:42:55 2026 +0200" }, "committer": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Thu Oct 22 07:17:41 2026 +0200" }, "message": "Run the Scorecard analysis weekly instead of on every push\n\nThe Scorecard analysis requires an ubuntu-latest runner (the scorecard\naction runs in a Docker container) and these runners are a limited\nresource shared by all the ASF projects. Running it for every commit\npushed to trunk is not useful: the score mostly depends on repository\nsettings and practices that rarely change from one commit to the next.\n\nRemove the push trigger and rely on the weekly schedule and on the\nbranch_protection_rule trigger to keep the results and the badge\nup to date.\n\nCo-Authored-By: Claude Opus 5.5\n" }, { "commit": "3734acdb57e9a2ade75006eac0206de9ecd1a762", "tree": "08d7a07055cf03a271f43c68206bdac5142e8cf1", "parents": [ "b6c861cc51e5636fa16d78793d1f5fe3ad6073d6" ], "author": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Tue Oct 20 19:33:59 2026 +0200" }, "committer": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Thu Oct 22 07:17:41 2026 +0200" }, "message": "Run the Java CI workflow only when it is useful\n\nThe ubuntu-latest runners are a limited resource shared by all the ASF\nprojects, so avoid using them when the build cannot be affected:\n\n- trigger the workflow only for changes that can affect\n \"gradlew check javadoc\": changes to documentation (*.md, *.adoc,\n docs/), Windows scripts, legal/info files, Docker/IDE/devcontainer\n setup and other workflows no longer start a build\n- cancel the build of a pull request that is still running or queued\n when a new commit is pushed to it; builds of pushes to trunk and\n release* branches are never cancelled\n- drop the \"prep\" job, which used a runner only to compute the JDK\n matrix: the matrix is now computed directly with an expression\n (JDK 17 for release* branches, JDK 17 and 21 otherwise)\n\nCo-Authored-By: Claude Opus 5.5\n" }, { "commit": "b6c861cc51e5636fa16d78793d1f5fe3ad6073d6", "tree": "bfdcb7c2020c7e4c84d8304d12f331065e3307ed", "parents": [ "fac9b4c8bf2c0fc8acae6ebd75eeb8d8be4dd9fc" ], "author": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Tue Oct 20 19:30:29 2026 +0200" }, "committer": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Thu Oct 22 07:17:41 2026 +0200" }, "message": "Change some of the GitHub Actions runners from ubuntu-latest to ubuntu-slim for improved efficiency\n" }, { "commit": "fac9b4c8bf2c0fc8acae6ebd75eeb8d8be4dd9fc", "tree": "77a419fa752e6f7128321cdae0378154f19bdfed", "parents": [ "cc687ca4b5804c55eb1fd676d95f019396467947" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 21 14:33:34 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 21 22:28:04 2026 +0530" }, "message": "Improved: Group the security fixes and security hardening in the release notes (OFBIZ-13696)\n\nPull requests labeled cve are listed under Security fixes and the other pull requests labeled security under Security hardening, ahead of the type categories since a pull request is listed in the first category whose labels match. The labels are set by hand, cve only once the CVE is announced, after which the release notes can be generated again.\n" }, { "commit": "cc687ca4b5804c55eb1fd676d95f019396467947", "tree": "999f728c4622c852ea30cd0d19f19506e7a2094b", "parents": [ "53a378b57da12b4b2a2aacc7c5cf9ed42fcf1724" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 21 11:03:10 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 21 17:10:39 2026 +0530" }, "message": "Fixed: Check ownership of the order, payment method and shipping address used by shopping lists (OFBIZ-13701)\n\n- makeShoppingListFromOrder now requires the ORDERMGR_VIEW permission or the PLACING_CUSTOMER role on the order, and otherwise returns the same error as for an unknown order.\n- createShoppingList and updateShoppingList now reject a payment method or shipping address that does not belong to the party of the shopping list, and the auto-reorder job skips lists that fail the same check.\n" }, { "commit": "53a378b57da12b4b2a2aacc7c5cf9ed42fcf1724", "tree": "dffd85110cec016309d07b01015c08d82643079f", "parents": [ "8b9358c16702c1bd35f2dabc10c25228ef482dee" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 21 05:21:28 2026 +0000" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 21 11:33:51 2026 +0530" }, "message": "Bump gradle-wrapper from 8.14.5 to 8.14.6\n\nBumps [gradle-wrapper](https://github.com/gradle/gradle) from 8.14.5 to 8.14.6.\n- [Release notes](https://github.com/gradle/gradle/releases)\n- [Commits](https://github.com/gradle/gradle/compare/v8.14.5...v8.14.6)\n\n---\nupdated-dependencies:\n- dependency-name: gradle-wrapper\n dependency-version: 8.14.6\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "8b9358c16702c1bd35f2dabc10c25228ef482dee", "tree": "33b339ddb46de41a054e029101aa5443f823cab6", "parents": [ "35f1a662a461a7f0075b6df520df52022ea5a40a" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Tue Oct 20 14:36:42 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 21 10:20:28 2026 +0530" }, "message": "Fixed: Check that the dataResourceId belongs to the contentId in SimpleContentViewHandler\n\nWhen both contentId and dataResourceId are passed, SimpleContentViewHandler now verifies that the DataResource is the one referenced by the Content before streaming it, since the view permission check is done on the contentId.\n" }, { "commit": "35f1a662a461a7f0075b6df520df52022ea5a40a", "tree": "7c602c3ed863ac35681fc1684389df7499c04af6", "parents": [ "4afb1bc107bd0669e9defe51cad56b41cbd62e33" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Tue Oct 20 13:52:46 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 21 10:17:32 2026 +0530" }, "message": "Fixed: Check the owner of the shopping list in checkShoppingListSecurity\n\ncheckShoppingListSecurity only compared the partyId passed to the service with the logged-in user, and did not look at who owns the shopping list being updated or removed. It now loads the list when a shoppingListId is passed and requires the logged-in user to be its owner or to have the PARTYMGR permission, as checkShoppingListItemSecurity already does for list items.\n" }, { "commit": "4afb1bc107bd0669e9defe51cad56b41cbd62e33", "tree": "bea57dc555807e6bb615ec6e13d6e2b04b21950c", "parents": [ "34a042341bff44df0474f5228919db8e398c78c5" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Tue Oct 20 13:36:19 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 21 09:12:19 2026 +0530" }, "message": "Fixed: init-gradle-wrapper installs a wrapper jar that does not match the published checksum (OFBIZ-13699)\n" }, { "commit": "34a042341bff44df0474f5228919db8e398c78c5", "tree": "7b56bc9a8e13edc29e0d49541e01405dab841755", "parents": [ "bccb166adeca4e2a6f1e5a06d388c1c4bf302eda" ], "author": { "name": "Anahita Goljahani", "email": "anahita.goljahani@gmail.com", "time": "Tue Oct 20 12:40:03 2026 +0200" }, "committer": { "name": "Anahita Goljahani", "email": "anahita.goljahani@gmail.com", "time": "Tue Oct 20 22:21:09 2026 +0200" }, "message": "Remove Jainrain matches from spotbugs exclude.xml\n\nThese rules are unnecessary because the Jainrain integration has been removed from the ecommerce plugin.\n" }, { "commit": "bccb166adeca4e2a6f1e5a06d388c1c4bf302eda", "tree": "713388e192399250b681d087badb36208742fb47", "parents": [ "5d8d7924f8851d3eae0cf93c068676182e965822" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Mon Oct 19 21:35:55 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Tue Oct 20 11:10:54 2026 +0530" }, "message": "Improved: Prevent the datasources from being reopened during shutdown (OFBIZ-13686)\n\nA thread still running after the datasources are closed can no longer reopen the embedded H2 database and leave it unclosed.\n\n- DBCPConnectionFactory.getConnection() fails once closeAll() has run, instead of creating a new pool.\n- JobPoller.stop() waits up to 5 seconds for the interrupted jobs to end and return their connections before the datasources get closed.\n- DOCKER.adoc warns that H2 is not closed when docker stop kills the container before OFBiz has finished shutting down, and how to give it more time.\n\nThanks: Jacopo Cappellato (jacopoc) for the review and suggestion\n" }, { "commit": "5d8d7924f8851d3eae0cf93c068676182e965822", "tree": "9612f9ffe6c99660a67e96c9589bdb51a25eb2b5", "parents": [ "7dd53e8af5a929a64cac0599f6a57e68f3e81f09" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Thu Oct 15 19:19:46 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Tue Oct 20 11:10:54 2026 +0530" }, "message": "Fixed: Close the embedded H2 database cleanly on shutdown (OFBIZ-13686)\n\nOFBiz never closed its datasources, so with DB_CLOSE_ON_EXIT\u003dFALSE every exit was an unclean close for the embedded H2 database, after which H2 can silently lose committed data on the next open.\n\n- DBCPConnectionFactory.closeAll() now closes the connection pools instead of only clearing its cache, so that H2 closes the database once its last connection is closed.\n- The new datasource-container of the entity component, loaded for every loader, shuts down the transaction factory, and so closes the pools, when it is stopped; being declared before the other containers, it is stopped after them.\n- ContainerLoader adds each container to the loaded containers as soon as it is initialized, as described in the Container javadoc, and keeps stopping the other containers when one throws a RuntimeException.\n- Start stops the loaded containers when OFBiz fails to start, since the shutdown hook is disabled for the load-data and test runs.\n" }, { "commit": "7dd53e8af5a929a64cac0599f6a57e68f3e81f09", "tree": "b08c956eea89e9a02a41d455037c1773be726bb9", "parents": [ "7d3c10865f81bb947ffb29271b8f5371e3ccb688" ], "author": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Mon Oct 19 19:03:25 2026 +0200" }, "committer": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Mon Oct 19 21:20:14 2026 +0200" }, "message": "Fix blank Redoc page after the upgrade to Redoc 3\n\nRedoc 3 is distributed as an ES module and no longer defines a global\nRedoc object, so loading redoc.standalone.js with a classic script tag\nfailed and the page stayed empty. Load it as a module and call the\nexported init function instead.\n\nAlso disable the usage telemetry that Redoc 3 sends to Redocly by\ndefault.\n\nCo-Authored-By: Claude Opus 5.5\n" }, { "commit": "7d3c10865f81bb947ffb29271b8f5371e3ccb688", "tree": "1bd8fc6abb3b79e619513f7f38f0c02de760cd2e", "parents": [ "f1faa87638176720302ec5ab8a63644ceeaa670d" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 19 15:08:56 2026 +0000" }, "committer": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Mon Oct 19 20:02:14 2026 +0200" }, "message": "Bump swagger-ui-dist from 5.33.2 to 5.33.3 in /framework/rest-api\n\nBumps [swagger-ui-dist](https://github.com/swagger-api/swagger-ui) from 5.33.2 to 5.33.3.\n- [Release notes](https://github.com/swagger-api/swagger-ui/releases)\n- [Commits](https://github.com/swagger-api/swagger-ui/compare/v5.33.2...v5.33.3)\n\n---\nupdated-dependencies:\n- dependency-name: swagger-ui-dist\n dependency-version: 5.33.3\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "f1faa87638176720302ec5ab8a63644ceeaa670d", "tree": "007f557bf07e467ca2a35cfd1f3f381810a3bbdf", "parents": [ "6294153cb7abb7d238832bc1d219c2e9c4fcc57e" ], "author": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Mon Oct 19 10:55:36 2026 +0200" }, "committer": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Mon Oct 19 15:18:36 2026 +0200" }, "message": "Upgrade Redoc to 3.0.1 and remove the npm overrides\n\nThe overrides pinned js-yaml, minimatch, brace-expansion and fast-xml-parser, which Redoc 2.5.4 pulled in through @redocly/openapi-core and openapi-sampler. Redoc 3.0.1 depends on\nneither, so none of these packages is installed any more and the\noverrides have no effect. npm audit reports no vulnerabilities without\nthem.\n\nCo-Authored-By: Claude Opus 5.5\n" }, { "commit": "6294153cb7abb7d238832bc1d219c2e9c4fcc57e", "tree": "c9877a76bc3d7fa882edd8c88e1b8bfb176fb6bf", "parents": [ "46d7803791a1036457fe6a08a09ce4e36ccd9180" ], "author": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Mon Oct 19 10:37:34 2026 +0200" }, "committer": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Mon Oct 19 15:18:36 2026 +0200" }, "message": "Fix Redoc failing to load the OpenAPI specification\n\nSince the REST API was split into independent API groups, the OpenAPI\nspecification is served at /rest/\u003capi-group-path\u003e/openapi.json, but\nredoc.html still requested /rest/openapi.json, which now returns 404.\n\nRedoc now picks the API group from the page URL, as Swagger UI already\ndoes: /docs/redoc.html shows the default \"api\" group and\n/docs/\u003capi-group-path\u003e/redoc.html shows the named group. The Redoc\nscript is loaded from an absolute path so that it is also found under\n/docs/\u003capi-group-path\u003e/, and OFBizOpenApiUiFilter now forwards those\nURLs to redoc.html. The docs README lists the per-group URLs for both\nviewers.\n\nCo-Authored-By: Claude Opus 5.5\n" }, { "commit": "46d7803791a1036457fe6a08a09ce4e36ccd9180", "tree": "7e79593f66e43c4b5f633ee164585dc532a34063", "parents": [ "5343967656d71f767142fd69e7e978bfacf22708" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 22:39:10 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 23:19:58 2026 +0530" }, "message": "Fixed: Check every URL parameter value for markup in ControlFilter\n\nControlFilter rejected a request whose parameter value contained \"\u003c\", but the result for each parameter replaced the previous one, so only the last parameter checked counted. Any such parameter now rejects the request. Only the parameters passed in the URL (query string and path) are checked, so form bodies that legitimately contain markup, such as HTML content, are accepted.\n" }, { "commit": "5343967656d71f767142fd69e7e978bfacf22708", "tree": "aa23373b7777d6f76afb0ae370ff4d8731c34c2c", "parents": [ "ddccb6d363ec70259b3e584690a4722054d20bd7" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 22:39:10 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 23:19:58 2026 +0530" }, "message": "Improved: Remove the parsing of query strings encoded in the request path\n\nNow that sort links no longer put their query string in the request path, UtilHttp.getParameterMap no longer parses a query string out of an encoded request path, and ControlFilter no longer checks such a query string against deniedWebShellTokens. The allowedTokens property and the query string mode of SecuredUpload.isValidText, which were only used by that check, are removed.\n" }, { "commit": "ddccb6d363ec70259b3e584690a4722054d20bd7", "tree": "09b82658351d8a000a03950bb11c389270867c50", "parents": [ "d1665ff2f0103436033382c0f4fbab4acfef0bf8" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 22:39:10 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 23:19:58 2026 +0530" }, "message": "Fixed: Build the sort links of list forms with an encoded query string\n\nThe sort links of list forms URL-encoded their whole query string and appended it to the request path, and FindGeneric turned that encoding off with the escapeUrlEncode context flag because it broke its sort links, so its sort links carried the request parameters unencoded. The sort link is now built like the pagination links, with a regular query string whose parameter names and values are URL-encoded. The escapeUrlEncode flag and UtilCodec.encodeUrl(String, Map) are removed.\n" }, { "commit": "d1665ff2f0103436033382c0f4fbab4acfef0bf8", "tree": "bf1baed0b085f1150cbe36e3b91bc9c43d8b5ad6", "parents": [ "0003431731cb060d7bbea42cd5e91935ae503507" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 23:05:16 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 23:16:22 2026 +0530" }, "message": "Fixed: CodeQL workflow fails while printing debug logs\n\nSince github/codeql-action 4.39.0 the post step of the init action reads each CodeQL debug log into a single string before printing it. On release24.09 the Java execute-queries log is larger than the maximum string size Node.js allows, so every CodeQL run now fails with \"Cannot create a string longer than 0x1fffffe8 characters\", even though the analysis and the SARIF upload complete successfully. Debug mode was left on from earlier troubleshooting of the workflow and is not needed for regular runs, so this removes it. This also stops uploading the database bundle and logs as an artifact on every push.\n" }, { "commit": "0003431731cb060d7bbea42cd5e91935ae503507", "tree": "5e0766be69206899bee7a3538c7b768a08fa25ef", "parents": [ "c2516b55845b47432f89c20a4bcd07611b64218e" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 19:07:44 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 22:22:11 2026 +0530" }, "message": "Fixed: Encode the source URL of menu, tree and form images\n\nThe image source URL of menu and tree image widgets, and of form hyperlink, display and submit image locations, was written into the src attribute without encoding. It is now encoded with the context simple encoder once the final URL has been built, like screen image widgets already are.\n" }, { "commit": "c2516b55845b47432f89c20a4bcd07611b64218e", "tree": "f3ba5cc623df7cd4f0a9eb78160e3bf8299f986c", "parents": [ "a1602c5560175561121990d7533b128028f7066e" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 18:42:19 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 19:48:50 2026 +0530" }, "message": "Fixed: Require the ORDERMGR_UPDATE permission in the updateTrackingNumber service\n\nThe updateTrackingNumber service changed the tracking number of an order ship group without checking any permission, unlike sibling order-update services such as updateOrderHeader. It now requires an authenticated user with the ORDERMGR_UPDATE permission.\n" }, { "commit": "a1602c5560175561121990d7533b128028f7066e", "tree": "91d03a65850ba614a2f1617f302e9070afb3ade6", "parents": [ "70788dcee7fc5cc1800c2200bfd286655a56aae8" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 18:37:22 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 19:42:17 2026 +0530" }, "message": "Fixed: Enforces order-update authorization in updateShipGroupShipInfo and addItemToApprovedOrder\n\n- Requires the standard order-update authorization in updateShipGroupShipInfo before the order is loaded into a cart for update, matching the pattern already used by updateApprovedOrderItems.\n- Requires the same authorization in addItemToApprovedOrder (service appendOrderItem) before an item is appended to an existing order.\n" }, { "commit": "70788dcee7fc5cc1800c2200bfd286655a56aae8", "tree": "a6b0c7f88621fd404f9c04bd706b1be38a6ea3f6", "parents": [ "1a1d9c1132107dc416f37657b555f4a6d7b30a51" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 18:09:02 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 19:40:42 2026 +0530" }, "message": "Fixed: Encode the source URL of screen image widgets\n\nThe src attribute of the screen image widget was rendered without encoding, unlike its alt attribute. The final URL is now encoded with the context encoder after it has been built, so that intra-app and content URLs are still resolved from the unencoded value.\n" }, { "commit": "1a1d9c1132107dc416f37657b555f4a6d7b30a51", "tree": "c6843dc0bdcf368c80998598aec364b7f3e216bc", "parents": [ "503f6297ba61cb3f80a50019301480d74510ab32" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 14 18:59:09 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 18:46:09 2026 +0530" }, "message": "Fixed: Add permission checks to WebAnalyticsConfig services\n\nThe create, update and delete WebAnalyticsConfig services had no permission-service, so any user able to reach the Content application could manage web analytics configurations. They now require the matching CONTENTMGR permission through contentManagerPermission, consistent with the WebSite services.\n" }, { "commit": "503f6297ba61cb3f80a50019301480d74510ab32", "tree": "a929ccb4d5d14febc9379c8872f5097da68f816f", "parents": [ "314eaf8a68b0b4d39e602e5aeab518d28d80a8e6" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Oct 18 05:50:43 2026 +0000" }, "committer": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Sun Oct 18 10:56:57 2026 +0200" }, "message": "Bump actions/setup-java from 6.0.1 to 6.1.0\n\nBumps [actions/setup-java](https://github.com/actions/setup-java) from 6.0.1 to 6.1.0.\n- [Release notes](https://github.com/actions/setup-java/releases)\n- [Commits](https://github.com/actions/setup-java/compare/de7274f081f381c8f8158605e0321c36c376e2e6...b843ebf9b913146b38da2eaa7aeddf76074ae1ad)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-java\n dependency-version: 6.1.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "314eaf8a68b0b4d39e602e5aeab518d28d80a8e6", "tree": "9ff51a634e8f4d4b84f0c1b80b7e8a2802eb5d2d", "parents": [ "bb78d45e27f0d4de51115255dc5842034c2b6669" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Oct 18 05:51:44 2026 +0000" }, "committer": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Sun Oct 18 10:55:37 2026 +0200" }, "message": "Bump github/codeql-action/upload-sarif from 4.38.3 to 4.39.0\n\nBumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.38.3 to 4.39.0.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee)\n\n---\nupdated-dependencies:\n- dependency-name: github/codeql-action/upload-sarif\n dependency-version: 4.39.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "bb78d45e27f0d4de51115255dc5842034c2b6669", "tree": "61437eafe014b3c55c5b82c022bf52517a9d608e", "parents": [ "8286d1d3dd0f28de07b3e7c97be4c1a141db0381" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Oct 18 05:50:26 2026 +0000" }, "committer": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Sun Oct 18 10:54:34 2026 +0200" }, "message": "Bump the codeql-action group with 2 updates\n\nBumps the codeql-action group with 2 updates: [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).\n\n\nUpdates `github/codeql-action/init` from 4.38.3 to 4.39.0\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee)\n\nUpdates `github/codeql-action/analyze` from 4.38.3 to 4.39.0\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee)\n\n---\nupdated-dependencies:\n- dependency-name: github/codeql-action/init\n dependency-version: 4.39.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: codeql-action\n- dependency-name: github/codeql-action/analyze\n dependency-version: 4.39.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: codeql-action\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "8286d1d3dd0f28de07b3e7c97be4c1a141db0381", "tree": "810d3848d951fc78894e901eaaeeff52c8e20bfc", "parents": [ "374fdbae251cea5028d586ad8c34d13dbb580612" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 11:05:33 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 11:17:43 2026 +0530" }, "message": "Improved: Set the release_branch label of pull requests automatically (OFBIZ-13696)\n\n- Dependabot adds the release_branch label to its pull requests to release24.09, besides the dependencies and ecosystem labels it adds by default.\n- The PR Labels workflow, renamed from PR Type Label since it now sets more than the type label, adds the release_branch label to the other pull requests to a release branch, removes it if a pull request is retargeted to trunk, and adds it when run manually to the pull requests already merged.\n- Document both in .github/README-CI-CD.md, including the labels to give the Dependabot entries of a new release branch.\n" }, { "commit": "374fdbae251cea5028d586ad8c34d13dbb580612", "tree": "d91b28b883d95d1ca6f91d13d308547fd484174b", "parents": [ "4e30277efddb1e3493d112ba2ed73195afa7a0ea" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 11:00:00 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 11:13:25 2026 +0530" }, "message": "Improved: Reject uploaded PDF files with hidden attachments or active actions (OFBIZ-13693)\n\n- SecuredUpload.isValidPdfFile only looked for embedded files in the catalog\u0027s embedded files names tree, so a file attached through a file attachment annotation, or through any other file specification with an embedded file, was accepted. The check now walks every PDF object, like the JavaScript check, and rejects any embedded file except the single ZUGFeRD invoice of the names tree.\n- The same walk rejects Launch, ImportData, GoToR, GoToE, Movie, Sound, Rendition and RichMediaExecute actions, RichMedia, Movie, Sound and Screen annotations, links that are not http, https or mailto, and form submissions that are not http or https.\n- With the default allowZUGFeRDnotSecure\u003dfalse, a PDF with a single valid ZUGFeRD invoice was always rejected, because the XML check compared document.toString() with \"[#document: null]\", which is what every parsed DOM document returns. It now rejects only when no XML document can be read.\n" }, { "commit": "4e30277efddb1e3493d112ba2ed73195afa7a0ea", "tree": "7c69af7980e70b7a5f400900672e3c566a7f2e22", "parents": [ "44102f133df37b3a230c6f1db52152bd2bf9cb5d" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 02:36:49 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 02:46:21 2026 +0530" }, "message": "Improved: Label pull requests titled \"Bump ...\" as dependencies so that the release notes leave them out (OFBIZ-13696)\n\nDependency updates made by hand instead of by Dependabot now get the dependencies label from the PR Type Label workflow, so that the release notes GitHub generates leave them out like the Dependabot pull requests.\n" }, { "commit": "44102f133df37b3a230c6f1db52152bd2bf9cb5d", "tree": "3987910fa72f5b0ec4db49618bf7cbf96061f225", "parents": [ "f61726762aff2c2a79c97eef50d039c2e4dd8b77" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 01:09:21 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 01:52:25 2026 +0530" }, "message": "Implemented: Generate release notes with GitHub and label pull requests by type from their title prefix (OFBIZ-13696)\n\n- Add .github/release.yml, which groups the generated release notes into Bug fixes, Improvements, New features, Documentation and Other changes, and leaves out Dependabot pull requests and those labeled dependencies.\n- Add the PR Type Label workflow, which sets the bug, enhancement, feature or documentation label of a pull request from its title prefix (Fixed, Improved, Implemented, Documented), including backport titles, and swaps the label when the title changes. It only uses actions/github-script and never checks out the pull request. A manual run labels the pull requests merged since a given date.\n- Document both files in .github/README-CI-CD.md.\n" }, { "commit": "f61726762aff2c2a79c97eef50d039c2e4dd8b77", "tree": "f2222de8adc898f6dd46d8fed349264148dcc39d", "parents": [ "6473bad3725e7d93c01c0d6d398530f4c80d5569" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 00:10:48 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Sun Oct 18 00:29:52 2026 +0530" }, "message": "Fixed: cleanAll deletes the version-controlled package-lock.json files (OFBIZ-13695)\n\ncleanAll and rest-api\u0027s cleanDocAssets depended on cleanNpmInstall, the Gradle clean\u003cTaskName\u003e rule for npmInstall, which deletes every output of the task, including package-lock.json. Running cleanAll therefore removed the committed lockfiles and npm re-resolved all dependencies from scratch, which currently breaks npmInstall on release24.09 (npm 10.8.2 fails with \"Cannot read properties of null (reading \u0027edgesOut\u0027)\"). cleanNpm is now a Delete task that removes only node_modules, and it replaces cleanNpmInstall in both places.\n" }, { "commit": "6473bad3725e7d93c01c0d6d398530f4c80d5569", "tree": "4433fe11f8932fccf9d7a95bf49fcb331b51d46c", "parents": [ "4d701c9c69cc34c0fc2344164c5605458ad0c8ff" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 16 19:06:21 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 16 21:40:33 2026 +0530" }, "message": "Fixed: Survey PDF services throw a NullPointerException when contentId matches no Content (OFBIZ-13692)\n\nPdfSurveyServices.getInputByteBuffer now returns no input when the contentId matches no Content, or a Content without a DataResource, so the survey PDF services return the \"No PDF was given.\" error instead of failing with a NullPointerException or an unexpected exception.\n" }, { "commit": "4d701c9c69cc34c0fc2344164c5605458ad0c8ff", "tree": "144902aede73748f5635c9950eeb29c3808bab3a", "parents": [ "1ff6ac5ceb5e277e1de3611970f895550f51eadf" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Oct 16 13:35:37 2026 +0000" }, "committer": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Fri Oct 16 17:39:22 2026 +0200" }, "message": "Bump com.auth0:java-jwt from 4.6.1 to 4.6.2\n\nBumps [com.auth0:java-jwt](https://github.com/auth0/java-jwt) from 4.6.1 to 4.6.2.\n- [Release notes](https://github.com/auth0/java-jwt/releases)\n- [Changelog](https://github.com/auth0/java-jwt/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/auth0/java-jwt/compare/4.6.1...4.6.2)\n\n---\nupdated-dependencies:\n- dependency-name: com.auth0:java-jwt\n dependency-version: 4.6.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "1ff6ac5ceb5e277e1de3611970f895550f51eadf", "tree": "9dc60ea986c155d2a9d9c405958da655145024c7", "parents": [ "4ccdb3e917b64245a527b1c01d8f9de613c6c714" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Oct 16 13:35:22 2026 +0000" }, "committer": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Fri Oct 16 17:36:35 2026 +0200" }, "message": "Bump com.github.ben-manes.caffeine:caffeine from 3.3.0 to 3.3.1\n\nBumps [com.github.ben-manes.caffeine:caffeine](https://github.com/ben-manes/caffeine) from 3.3.0 to 3.3.1.\n- [Release notes](https://github.com/ben-manes/caffeine/releases)\n- [Commits](https://github.com/ben-manes/caffeine/compare/v3.3.0...v3.3.1)\n\n---\nupdated-dependencies:\n- dependency-name: com.github.ben-manes.caffeine:caffeine\n dependency-version: 3.3.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "4ccdb3e917b64245a527b1c01d8f9de613c6c714", "tree": "3fda19725cbc8c0ab16c384fd43ae9877d4304c9", "parents": [ "2c8fc6dc61ab989a10d4c11299a4f58f2b6203cd" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 16 18:42:30 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 16 19:03:38 2026 +0530" }, "message": "Improved: The macro renderers cannot compile a string as a template anymore (OFBIZ-13682)\n\nAll the macro calls of the widget renderers are now made with data, so the code that compiled text as a template is not used anymore and is removed, which makes sure that a value can never be parsed as template code again. FtlWriter only compiles the constant text that calls a macro, and a test checks that no other class builds macro text or compiles a template, and that FtlWriter compiles that one constant only.\n\n- FtlWriter.processFtlString, MacroFormRenderer.executeMacro, MacroFormRenderer.encode with its escaping for a FreeMarker string literal, MacroCommonRenderer.escapeFtlString and the unused MacroFormRenderer.appendContentUrl are removed, as well as a macro call as text that RenderableFtlFormElementsBuilder built and never used.\n- RenderableFtlString is renamed RenderableFtlVerbatim, because FtlWriter writes it as it is and does not process it as a template.\n" }, { "commit": "2c8fc6dc61ab989a10d4c11299a4f58f2b6203cd", "tree": "8513cfae20456e285e231122cbee0078e8759dc3", "parents": [ "cc6d9d5d05c02f1b7e530121b76e22def767e0da" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 16 17:21:50 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 16 18:16:54 2026 +0530" }, "message": "Fixed: The tests of the text find and range find fields reference the static mock of UtilProperties (OFBIZ-13681)\n\nThe three tests opened the static mock of UtilProperties in a try-with-resources statement without referencing it in the body, which made the Java compiler warn about an auto-closeable resource that is never referenced. The tests now create the mock in the statement and stub the labels through it.\n" }, { "commit": "cc6d9d5d05c02f1b7e530121b76e22def767e0da", "tree": "b4b153fc11735a7ac06382722dd5507608f735e9", "parents": [ "4b0e5aad8f990b29d5a71471db515f3c5d027771" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 16 17:02:48 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 16 18:16:54 2026 +0530" }, "message": "Improved: MacroFormRenderer builds the find, lookup, pagination, file, password, image and banner macro calls with RenderableFtlFormElementsBuilder (OFBIZ-13681)\n\nMacroFormRenderer built the macro calls of the text find, range find, lookup, file, password and image fields, of the pagination and of the banner as text and compiled them. RenderableFtlFormElementsBuilder now creates these macro calls, so that FtlWriter passes their values as data: the target parameters of the lookup field are a list instead of a hash literal of quoted strings. The macro signatures and the output are unchanged, except that values containing a quote, a backslash or an interpolation, which used to fail to render or to be evaluated, are now rendered as they are, and a missing value is rendered as an empty string instead of the text \"null\". The alternate text and the title of the image of a hyperlink field are not escaped for a FreeMarker string literal anymore, which they still were after OFBIZ-13680 and made a quote show with a backslash.\n" }, { "commit": "4b0e5aad8f990b29d5a71471db515f3c5d027771", "tree": "25e1ddd7f2924ab4bff40c5fb7bfb0371db8ae5e", "parents": [ "c12644866ee6bd9036bd4367ddf222219de856de" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 16 16:51:37 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 16 17:17:33 2026 +0530" }, "message": "Fixed: Survey PDF services read any server file named in the pdfFileNameIn parameter (OFBIZ-13690)\n\n- Removed the pdfFileNameIn parameter from the survey PDF services, the BuildSurveyResponseFromPdf form and its label, so a PDF can only be given as an inputByteBuffer or a contentId.\n- Removed the unused pdfFileNameOut handling in setAcroFieldsFromSurveyResponse.\n- buildSurveyFromPdf and buildSurveyResponseFromPdf now require a logged-in user with the content manager CREATE permission.\n" }, { "commit": "c12644866ee6bd9036bd4367ddf222219de856de", "tree": "0539db594002539c9cb080310088b9d9aebd3f0b", "parents": [ "c1f4c2b39d0b27f4424032ef101bd53dbc2f0562" ], "author": { "name": "Rehan Khan", "email": "rehan.khan@hotwaxsystems.com", "time": "Fri Oct 09 18:30:34 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 16 16:41:32 2026 +0530" }, "message": "Fixed: Preserve Webtools theme when editing entities (OFBIZ-12072)\n" }, { "commit": "c1f4c2b39d0b27f4424032ef101bd53dbc2f0562", "tree": "aee02ec0072e4ea61d620f2ed420d8cadcb1b528", "parents": [ "ab38bcdd65e6f830f89a4c0974a109e98ff817ca" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 16 13:25:45 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 16 16:30:22 2026 +0530" }, "message": "Fixed: PDF survey services fail to store answers and throw a NullPointerException when no PDF is given (OFBIZ-13688)\n\n- buildSurveyResponseFromPdf created SurveyResponseAnswer without surveyMultiRespColId, which is part of the primary key, so building a survey response from a PDF failed on the first answer and rolled back. It now sets it to _NA_ like the regular survey service, and updates the existing answers when it runs again for the same survey response.\n- When no PDF was given, buildSurveyFromPdf, buildSurveyResponseFromPdf, getAcroFieldsFromPdf and setAcroFields threw a NullPointerException. They now return an error with the new ContentPDFInputMissing label.\n" }, { "commit": "ab38bcdd65e6f830f89a4c0974a109e98ff817ca", "tree": "5f1a7cfba4ea29126385adb064ad3720b27b5356", "parents": [ "5611b685dcf7c1221f04935fab835f8f5a5397c9" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 16 13:31:35 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 16 16:29:34 2026 +0530" }, "message": "Improved: MacroFormRenderer builds the form structure and hyperlink macro calls with RenderableFtlFormElementsBuilder (OFBIZ-13680)\n\nMacroFormRenderer built the macro calls of the form structure (form, list and row wrappers, header, cell and field row macros, boundary comments) and of the hyperlinks as text and compiled them. RenderableFtlFormElementsBuilder now creates these macro calls, so that FtlWriter passes their values as data, and the hand-built copy of the hyperlink code in MacroFormRenderer is replaced by the one that the builder already had, which now gives the same output. The macro signatures and the output are unchanged, except that values containing a quote, a backslash or an interpolation, which used to fail to render or to be evaluated, are now rendered as they are, and a missing value is rendered as an empty string instead of the text \"null\". The code that the builder shares with the renderer is fixed in these ways:\n\n- the parameters of a layered modal link are passed as the JSON string that the macro expects, with the presentation layer, instead of as a map, and the text of the link is passed as well.\n- the form of a hidden form link in a multi form is written after the closing of the multi form, which never happened for the sub hyperlinks of the display entity and text fields.\n- FtlWriter writes a RenderableFtlString as it is instead of compiling it as a template, so that an interpolation in the description of a hidden form link is not evaluated.\n- the description of a hidden form link with a quote does not show a backslash before the quote anymore.\n" }, { "commit": "5611b685dcf7c1221f04935fab835f8f5a5397c9", "tree": "6d057d30368ad64da85a41e526134faa0de2a22b", "parents": [ "35d68ab0e80984dfbe9d90d967449c23e4aebb2c" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 16 13:09:29 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 16 13:32:05 2026 +0530" }, "message": "Fixed: Allow the content upload directory in the default LOCAL_FILE allow-list (OFBIZ-13689)\n\nUploads stored as LOCAL_FILE data resources are written under ${ofbiz.home}/runtime/uploads/ (content.upload.path.prefix), but the default content.data.local.file.allowed.paths only allowed ${ofbiz.home}/runtime/tmp/, so SecurityUtil.checkLocalFileAllowList rejected every such upload with \"Access to file denied: path is not within an allowed directory\" and the transaction rolled back, and LOCAL_FILE resources uploaded earlier could no longer be rendered. Add the upload directory to the default list, with a comment that it must match content.upload.path.prefix; the canonical-path checks are unchanged.\n" }, { "commit": "35d68ab0e80984dfbe9d90d967449c23e4aebb2c", "tree": "b203eb32f72fcaaede14e96e45bd83cc62960f07", "parents": [ "5de1b918f147f47158958fa0c9f41efd1ff8a4d4" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 16 11:13:13 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 16 12:44:19 2026 +0530" }, "message": "Improved: MacroFormRenderer builds the check, radio, submit, reset, hidden and field title macro calls with RenderableFtlFormElementsBuilder (OFBIZ-13679)\n\nMacroFormRenderer built the macro calls of the check, radio, submit, reset and hidden fields, of the field titles and of the sort field as text and compiled them. RenderableFtlFormElementsBuilder now creates these macro calls, so that FtlWriter passes their values as data: the options of the check and radio fields are lists of maps instead of hash literals, and the quotes that the form fields escaped for a FreeMarker string literal are no longer escaped. The macro signatures and the output are unchanged, except that values containing a quote, a backslash or an interpolation, which used to fail to render or to be evaluated, are now rendered as they are, and a missing value is rendered as an empty string instead of the text \"null\".\n" }, { "commit": "5de1b918f147f47158958fa0c9f41efd1ff8a4d4", "tree": "085564fc97aae1514e21efa762cdf9108785423f", "parents": [ "9c0d307576fdce4d67ce0a2d9aec7434d48c2217" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Thu Oct 15 17:17:19 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 16 12:22:55 2026 +0530" }, "message": "Improved: Replace OpenPDF with Apache PDFBox and drop the OpenPDF dependency (OFBIZ-13684)\n\nOpenPDF 1.4.2 (com.lowagie) was only kept for PdfSurveyServices and SecuredUpload, while PDFBox 3 is already used for uploads and by Mustang. OFBiz now uses a single PDF library.\n\n- SecuredUpload: the PDF probe and the JavaScript check now use PDFBox. The JavaScript check looks at every object of the document, those reachable from the trailer and those listed in the cross-reference table, instead of only the document-level JavaScript names tree, so JavaScript in OpenAction, Next chains, and document, page, annotation and form field actions is now rejected too.\n- New allowPdfFormFieldScripts property in security.properties, false by default, to still accept PDF forms whose fields have keystroke, format, validate or calculate scripts.\n- PdfSurveyServices: survey AcroForm handling ported to the PDFBox form field API, through a new package-private PdfFormHelper, with the same inputs and outputs. The question label now comes from the field\u0027s tooltip wherever it is set.\n- buildPdfFromSurveyResponse now returns a PDF with one \"question: answer\" line per answer. It never opened its OpenPDF document, so it failed whenever the response had answers.\n- Removed openpdf from libs.versions.toml and dependencies.gradle.\n" }, { "commit": "9c0d307576fdce4d67ce0a2d9aec7434d48c2217", "tree": "81fd7cc7bff4b68be9114be5ee5551f9492ebd9e", "parents": [ "52cd10d0f0637c7a1e013cd2ece219ee625547b3" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Thu Oct 15 19:19:19 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 16 12:14:35 2026 +0530" }, "message": "Fixed: URL.getFile() used as a filesystem path breaks OFBiz when the install directory contains a space (OFBIZ-13687)\n\nURL.getFile() and URL.getPath() keep percent-encoded characters such as %20, so using their result as a file name points to a path that does not exist when the OFBiz home directory contains a space. Added UtilURL.toFile(URL), which converts through URL.toURI() to decode the path, and used it at the affected call sites:\n\n- ApacheFopWorker: fop.xconf and the font base directory were not found, leaving the FopFactory null and making every PDF render fail\n- ScriptUtil.executeScript: read the script through URL.openStream() instead of a FileInputStream on the encoded path\n- MiniLangUtil.writeMiniLangDocument, CommonEvents.openSourceFile, ScaleImage and ImageManagementServices: resolve the file through UtilURL.toFile\n- UtilURL.getOfbizHomeRelativeLocation: compare the decoded URI path with ofbiz.home\n" }, { "commit": "52cd10d0f0637c7a1e013cd2ece219ee625547b3", "tree": "d883a1ae4f81d0ec077a3f6e089a6df356f8a199", "parents": [ "c5ac496917681845c3c6cbc70a2cd2180b04ef1b" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 16 10:02:14 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 16 11:38:02 2026 +0530" }, "message": "Improved: MacroTreeRenderer passes the macro parameters as data and writes to the given writer (OFBIZ-13678)\n\nMacroTreeRenderer built the text of every macro call by hand and compiled it in one environment bound to the writer of its constructor, so it ignored the writer it was given. It now passes the parameters to FtlWriter as data and renders into the writer of each call, which also puts the image of a link inside the link instead of before it, and the replacement of the pipe for OFBIZ-9191 is applied to the link url only instead of to the whole macro text. The macro signatures and the output are unchanged, except that values containing a quote, a backslash or an interpolation, which used to fail to render or to be evaluated, are now rendered as they are, and a missing value is rendered as an empty string instead of the text \"null\".\n" }, { "commit": "c5ac496917681845c3c6cbc70a2cd2180b04ef1b", "tree": "3827f16a20a07156595123a7da5addd0375c7b56", "parents": [ "fb6b2939cd7afbbc15ab83d92de9a0d9e2409f6c" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 16 00:08:18 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 16 08:48:54 2026 +0530" }, "message": "Improved: MacroScreenRenderer passes the macro parameters as data (OFBIZ-13677)\n\nMacroScreenRenderer built the text of each macro call, from a parameter map in most places and by hand in renderLink, the portal page methods and the column container, and compiled it with its own environments. It now passes the parameters to FtlWriter as data, with the parameterList of renderLink as a list of name and value maps, and FtlWriter gets a constructor for macro libraries that do not use the theme variables, since the screen renderer has no visual theme. The macro signatures and the output are unchanged, except that values containing a quote, a backslash or an interpolation, which used to fail to render or to be evaluated, are now rendered as they are, and a missing value is rendered as an empty string instead of the text \"null\".\n" }, { "commit": "fb6b2939cd7afbbc15ab83d92de9a0d9e2409f6c", "tree": "b2d04f5be7bb09f46ab3c08e622151fa808a7a28", "parents": [ "7bd72c46b5cca50996c4eeefb86c88f1aa884a76" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Thu Oct 15 20:41:34 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 16 08:46:38 2026 +0530" }, "message": "Improved: MacroMenuRenderer passes the macro parameters as data (OFBIZ-13676)\n\nMacroMenuRenderer built the text of each macro call from a parameter map and compiled it, and kept its own environments and template compilation. It now passes the parameters to FtlWriter as data, with the parameterList of renderLink as a list of name and value maps instead of a hash literal built as text. The macro signatures and the output are unchanged, except that the parameter names and values of hidden-form and layered-modal links are no longer interpreted as FreeMarker, which used to fail to render, or evaluate, a link whose parameter name or value contained a quote, a backslash or an interpolation.\n" }, { "commit": "7bd72c46b5cca50996c4eeefb86c88f1aa884a76", "tree": "04c39d8e2fe276f796bdac94507bf21587913232", "parents": [ "9fe2a2649214560921db3c8b5ab8c5a3fa29a550" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 15 14:27:40 2026 +0000" }, "committer": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Thu Oct 15 19:13:08 2026 +0200" }, "message": "Bump swagger-ui-dist from 5.33.1 to 5.33.2 in /framework/rest-api\n\nBumps [swagger-ui-dist](https://github.com/swagger-api/swagger-ui) from 5.33.1 to 5.33.2.\n- [Release notes](https://github.com/swagger-api/swagger-ui/releases)\n- [Commits](https://github.com/swagger-api/swagger-ui/compare/v5.33.1...v5.33.2)\n\n---\nupdated-dependencies:\n- dependency-name: swagger-ui-dist\n dependency-version: 5.33.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "9fe2a2649214560921db3c8b5ab8c5a3fa29a550", "tree": "bdaaa4b78eaa4b3f7f02ca393e34fbed667510f9", "parents": [ "c0513fb2f8bf5f627bb438607f525e32f1553fbc" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 15 14:26:39 2026 +0000" }, "committer": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Thu Oct 15 19:11:53 2026 +0200" }, "message": "Bump dompurify in /themes/common-theme/webapp/common-theme/js\n\nBumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.16 to 3.4.17.\n- [Release notes](https://github.com/cure53/DOMPurify/releases)\n- [Commits](https://github.com/cure53/DOMPurify/compare/3.4.16...3.4.17)\n\n---\nupdated-dependencies:\n- dependency-name: dompurify\n dependency-version: 3.4.17\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "c0513fb2f8bf5f627bb438607f525e32f1553fbc", "tree": "d6a5ef466ca9c5df60950b78482c95eaa8e5006b", "parents": [ "5b1856083d2f61ede3d7fd2cf14ca5d4cbf8d3eb" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 14 00:10:16 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Thu Oct 15 20:06:39 2026 +0530" }, "message": "Improved: FtlWriter calls every macro through one constant template (OFBIZ-13675)\n\nFtlWriter built the call to a macro as text, \u003c@name?with_args($args$name)/\u003e, and compiled a new template for every call, so the compiled text still depended on the macro name. It now sets the macro name and the parameters as variables of the environment and includes a single constant template that calls the macro held by that variable, only if the variable is a macro. The template is compiled once and shared, and the new processMacroCall method is the entry point for the macro calls of the renderers. The macro libraries and their output are unchanged.\n" }, { "commit": "5b1856083d2f61ede3d7fd2cf14ca5d4cbf8d3eb", "tree": "f902b9be494228e09c9d994e71396b08257293cb", "parents": [ "4aab182e8c323ac1bce179dcd10fb1489385d42c" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Thu Oct 15 14:52:58 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Thu Oct 15 17:18:32 2026 +0530" }, "message": "Improved: Use a single Apache Shiro version and drop shiro-core (OFBIZ-13685)\n\nThe build declared shiro-core 1.13.0 next to shiro-crypto-cipher 2.2.1 with separate version refs, so Dependabot bumped them independently and the runtime mixed 1.x and 2.x Shiro modules. shiro-core 1.13.0 is a fat jar that duplicated some 2.x classes, so which copy loaded depended on classpath order.\n\n- Replace shiro-core and shiro-crypto-cipher with shiro-crypto-cipher, shiro-crypto-core and shiro-lang on one shared version ref (3.0.1), the only Shiro modules OFBiz uses.\n- Compute the EntityCrypto key-name hash explicitly as Base64(SHA-512(key name)). This is what Shiro 1.x\u0027s DefaultHashService produced by default; Shiro 2.x and later default to a salted argon2 hash, which would no longer match the stored EntityKeyStore key names.\n" }, { "commit": "4aab182e8c323ac1bce179dcd10fb1489385d42c", "tree": "4bf2f0e0f0ebab596a28ec3298d458b4e34302ed", "parents": [ "b8b72d556e829d4a0818f8a4fed57e0750efcacb" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 14 15:08:01 2026 +0000" }, "committer": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Thu Oct 15 06:48:06 2026 +0200" }, "message": "Bump ossf/scorecard-action from 2.4.4 to 2.5.0\n\nBumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.4 to 2.5.0.\n- [Release notes](https://github.com/ossf/scorecard-action/releases)\n- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)\n- [Commits](https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e)\n\n---\nupdated-dependencies:\n- dependency-name: ossf/scorecard-action\n dependency-version: 2.5.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "b8b72d556e829d4a0818f8a4fed57e0750efcacb", "tree": "2c60f90d42011883a8b45466bfd14f5351f3143e", "parents": [ "1953858e36f9ab52c30371050d2c97fd899b2374" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 14 14:46:26 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 14 19:28:47 2026 +0530" }, "message": "Improved: Group Dependabot updates for codeql-action init and analyze\n" }, { "commit": "1953858e36f9ab52c30371050d2c97fd899b2374", "tree": "f4fbcaa0fd3f23215cc2a795ec8b22974af38278", "parents": [ "a68331a4b1c24b2a3c452fa01821139e6f762d4d" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 14 14:22:35 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 14 19:26:56 2026 +0530" }, "message": "Improved: Pin Scorecard upload-sarif to a codeql-action release instead of a main-branch commit\n\nThe upload-sarif step was pinned to a commit on codeql-action\u0027s main branch with a stale \"v2.16.2\" comment. For a SHA pin that isn\u0027t a release tag commit, Dependabot follows the head of the branch containing it, so it opened a PR for almost every main commit (32 since mid-July, against 13 v4 releases). Pinning to the v4.38.3 release commit makes Dependabot move from release to release and keep the version comment current, in step with the init/analyze actions in codeql-analysis.yml.\n" }, { "commit": "a68331a4b1c24b2a3c452fa01821139e6f762d4d", "tree": "70fd56bfbf91a15103c924236b56522f50fed7fa", "parents": [ "3a5cc5c242cc32b8273ee1128347dc1df83caa92" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 14 06:37:59 2026 +0000" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 14 16:53:28 2026 +0530" }, "message": "Bump tika from 3.3.2 to 3.3.3\n\nBumps `tika` from 3.3.2 to 3.3.3.\n\nUpdates `org.apache.tika:tika-core` from 3.3.2 to 3.3.3\n- [Changelog](https://github.com/apache/tika/blob/main/CHANGES.txt)\n- [Commits](https://github.com/apache/tika/commits)\n\nUpdates `org.apache.tika:tika-parsers` from 3.3.2 to 3.3.3\n- [Changelog](https://github.com/apache/tika/blob/main/CHANGES.txt)\n- [Commits](https://github.com/apache/tika/commits)\n\nUpdates `org.apache.tika:tika-parser-pdf-module` from 3.3.2 to 3.3.3\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.tika:tika-core\n dependency-version: 3.3.3\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.tika:tika-parser-pdf-module\n dependency-version: 3.3.3\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.tika:tika-parsers\n dependency-version: 3.3.3\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "3a5cc5c242cc32b8273ee1128347dc1df83caa92", "tree": "8fc14adbebb9f8649569d4f44b1173e2d6559c93", "parents": [ "0f18dff732d94dfabb044e6e77ae3fa812388fe4" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 14 11:35:46 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 14 14:24:18 2026 +0530" }, "message": "Improved: Bump github/codeql-action/init and analyze from 4.38.2 to 4.38.3\n" }, { "commit": "0f18dff732d94dfabb044e6e77ae3fa812388fe4", "tree": "9aea098e8f1fde2adc927c552bd4d8945a7d9c12", "parents": [ "aef4085c892e5419954cf6b2fb9e0d25dacf93dd" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Oct 13 19:55:09 2026 +0000" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 14 11:52:16 2026 +0530" }, "message": "Bump github/codeql-action/upload-sarif\n\nBumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 5aa5056e2d064690968faa15e019d7d823ef6d7b to eb94de7c5cfc51dc10fff26d52210eb23a589b0e.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/5aa5056e2d064690968faa15e019d7d823ef6d7b...eb94de7c5cfc51dc10fff26d52210eb23a589b0e)\n\n---\nupdated-dependencies:\n- dependency-name: github/codeql-action/upload-sarif\n dependency-version: eb94de7c5cfc51dc10fff26d52210eb23a589b0e\n dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "aef4085c892e5419954cf6b2fb9e0d25dacf93dd", "tree": "7d90ee6573871a0d6337ce4c56ff70eb9e2304be", "parents": [ "4da78d24655c82379c6a1a407a92d80d617bb016" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 14 10:20:22 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 14 11:29:15 2026 +0530" }, "message": "Fixed: Missing permission checks on FinAccount GL-reconciliation services (OFBIZ-13683)\n\nSeveral GL-reconciliation services (reconcileFinAccountTrans, assignGlRecToFinAccTrans, removeFinAccountTransFromReconciliation, cancelBankReconciliation) had neither auth nor a permission-service, so any authenticated session could assign, remove, or cancel bank-reconciliation associations on arbitrary FinAccountTrans records directly. This adds the existing acctgFinAcctPermissionCheck permission-service to each of these service definitions, matching the convention already used for sibling FinAccount services in this file.\n" }, { "commit": "4da78d24655c82379c6a1a407a92d80d617bb016", "tree": "7f3e057a52e7b0a2adddfa8ec58b7b2057330cdd", "parents": [ "7bb3486b109f51462e1c4171e57fd920ea003de2" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Oct 13 19:49:53 2026 +0000" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 14 11:22:31 2026 +0530" }, "message": "Bump actions/upload-artifact from 7.0.1 to 7.0.2\n\nBumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 7.0.1 to 7.0.2.\n- [Release notes](https://github.com/actions/upload-artifact/releases)\n- [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9)\n\n---\nupdated-dependencies:\n- dependency-name: actions/upload-artifact\n dependency-version: 7.0.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "7bb3486b109f51462e1c4171e57fd920ea003de2", "tree": "15daa8791a752a7f4192cc51a315e2570f78d8aa", "parents": [ "66d9f60790300725b32384f770d72a83fd698ad9" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Oct 13 19:49:43 2026 +0000" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 14 11:22:12 2026 +0530" }, "message": "Bump org.apache.cxf:cxf-rt-frontend-jaxrs from 4.2.3 to 4.2.4\n\nBumps org.apache.cxf:cxf-rt-frontend-jaxrs from 4.2.3 to 4.2.4.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.cxf:cxf-rt-frontend-jaxrs\n dependency-version: 4.2.4\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "66d9f60790300725b32384f770d72a83fd698ad9", "tree": "c3005378e70efafec9bcbdaecfec2955073aa252", "parents": [ "bda0073f5aa24153febeb953f496d15f54eb6346" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Oct 13 19:49:10 2026 +0000" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 14 11:22:06 2026 +0530" }, "message": "Bump tomcat from 10.1.60 to 10.1.61\n\nBumps `tomcat` from 10.1.60 to 10.1.61.\n\nUpdates `org.apache.tomcat:tomcat-catalina-ha` from 10.1.60 to 10.1.61\n\nUpdates `org.apache.tomcat:tomcat-jasper` from 10.1.60 to 10.1.61\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.tomcat:tomcat-catalina-ha\n dependency-version: 10.1.61\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.tomcat:tomcat-jasper\n dependency-version: 10.1.61\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "bda0073f5aa24153febeb953f496d15f54eb6346", "tree": "d081d1e797a0b809c8e3ccb9fa8af093db162cd3", "parents": [ "5f6705bc66b25e79c4f2396fe90a38f7e649d9b9" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Oct 13 19:48:48 2026 +0000" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 14 11:21:55 2026 +0530" }, "message": "Bump com.twelvemonkeys.imageio:imageio-tiff from 3.15.2 to 3.15.3\n\nBumps com.twelvemonkeys.imageio:imageio-tiff from 3.15.2 to 3.15.3.\n\n---\nupdated-dependencies:\n- dependency-name: com.twelvemonkeys.imageio:imageio-tiff\n dependency-version: 3.15.3\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "5f6705bc66b25e79c4f2396fe90a38f7e649d9b9", "tree": "1be0f545180f1abd972e011c29bc3837c61aa6b8", "parents": [ "66803eca23b595c5334e750e4356e08986962f3a" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Tue Oct 13 15:28:50 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 14 11:11:07 2026 +0530" }, "message": "Improved: Scope password-reset JWTs to their purpose, confined to the password-change flow\n\n- SecurityUtil now generates and validates JWTs with a purpose claim (login vs password_reset), mirroring the existing refresh/access token distinction in JWTManager\n- The password-reset email token is issued with the password_reset purpose instead of a general login-scoped token\n- A session established from a password-reset-purpose token is confined by checkLogin() to the passwordChange, updatePassword, and logout requests, and is promoted to a normal session only once the password has actually been changed\n- Declared passwordResetOnly (OUT) on the userLogin service and login.token (IN) on the updatePassword service; both attributes were silently dropped by the service engine because they were not declared, which also means the existing admin-bypass-current-password token check in updatePassword was non-functional before this change\n" }, { "commit": "66803eca23b595c5334e750e4356e08986962f3a", "tree": "5d1352ed2fb3edaedb589f217d335857d5e741ab", "parents": [ "cd3736207f80b26ef364c5ecd13f3113848e0aa5" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Tue Oct 13 17:06:48 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Wed Oct 14 10:07:13 2026 +0530" }, "message": "Improved: GL-posting and order-completion invoicing commit-ECAs lack run-as-user\u003d\"system\" (OFBIZ-13673)\n\n- Add run-as-user\u003d\"system\" to the createPayment/setPaymentStatus commit-ECAs in secas_ledger.xml (PMNT_RECEIVED and PMNT_SENT), so the GL posting no longer depends on the accounting permission of whatever caller happened to trigger the payment status change\n- Add run-as-user\u003d\"system\" to the createInvoiceFromOrder ECA in secas.xml\n- Align createInvoiceFromOrder\u0027s \"partially billed\" branch with its sibling createInvoiceForOrderAllItems, which already substitutes the system userLogin before invoicing\n" }, { "commit": "cd3736207f80b26ef364c5ecd13f3113848e0aa5", "tree": "2d4d0b62e92e12a3a77f8c42a6954ef81b967959", "parents": [ "bd05804356c0b5107e7c546bdf743d6e33df0437" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Tue Oct 13 12:24:10 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Tue Oct 13 15:45:56 2026 +0530" }, "message": "Fixed: updateContactList does not enforce marketing UPDATE permission (OFBIZ-13672)\n\ncreateContactList and removeContactList both require a marketingPermissionService permission check, but updateContactList does not, letting any authenticated user modify an arbitrary ContactList record.\n" }, { "commit": "bd05804356c0b5107e7c546bdf743d6e33df0437", "tree": "c7efe409e4a455085cd125415f14c1082d05a0a3", "parents": [ "69e3ead75379181e7c80b741b13389b467d4b279" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Mon Oct 12 16:52:49 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Tue Oct 13 15:33:13 2026 +0530" }, "message": "Fixed: Payment method create services accept a caller-supplied paymentMethodId without verifying it belongs to the authorized party (OFBIZ-13671)\n\n- createCreditCard, createGiftCard, createEftAccount, and createCheckAccount now reject a supplied paymentMethodId that already belongs to a different party.\n- Added the shared checkPaymentMethodOwnership helper and the AccountingPaymentMethodIdBelongsToAnotherParty error label.\n" }, { "commit": "69e3ead75379181e7c80b741b13389b467d4b279", "tree": "d046dca465d57bda50dec9bd9f05db2655563957", "parents": [ "3b5423b760753cf7bf49c471e93bffe8c985c258" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Tue Oct 13 12:37:31 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Tue Oct 13 13:35:26 2026 +0530" }, "message": "Improved: Validate the FTP connection target hostname in sendContentToFtp before connecting\n\nAdds UtilURL.checkHostResourceAllowed(String), a bare-hostname counterpart to the\nexisting checkUrlResourceAllowed(URL) check, and applies it in\nFtpServices.sendContentToFtp before the outbound FTP connection is established.\nRejects loopback, link-local, private, and other reserved targets, bringing the FTP\ndelivery path in line with the validation already enforced on the URL_RESOURCE read\npath.\n" }, { "commit": "3b5423b760753cf7bf49c471e93bffe8c985c258", "tree": "45f4eedafe75d7eedb1b1bca3373a5db13d517c2", "parents": [ "f3207bdff6dc99f1205601a7ad910bdc6dad98e7" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Mon Oct 12 17:16:11 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Tue Oct 13 13:29:26 2026 +0530" }, "message": "Elevate createAccountAndCredit\u0027s internal FinAccount writes to the system user\n\ncreateAccountAndCredit (shared by createServiceCredit and createFinAccountAndCredit) was the one caller in this change not elevated to the system user, so a caller without accounting permission now gets rejected by createFinAccount/createFinAccountRole/createFinAccountTrans.\n" }, { "commit": "f3207bdff6dc99f1205601a7ad910bdc6dad98e7", "tree": "1346d388a40f22e2ffc942abc1b52a6a2f085f9e", "parents": [ "98e498f9a24dbf4e961761f279f0cdc4c210b40c" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Mon Oct 12 15:18:41 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Tue Oct 13 13:29:26 2026 +0530" }, "message": "Add permission checks to FinAccount create/update/delete services\n\nSeveral Financial Account services (createFinAccount, updateFinAccount,\ndeleteFinAccount, createFinAccountTrans, createFinAccountRole,\ncreateFinAccountAuth, setFinAccountTransStatus, depositWithdrawPayments)\nhad neither auth nor a permission-service, so any authenticated session\ncould call them directly. Wire the existing (previously UI-only)\nacctgFinAcctPermissionCheck permission-service into each of these\nservice definitions, matching the convention already used for sibling\nservices in this file (updateFinAccountRole, deleteFinAccountRole).\n\nSeveral internal callers invoke these services as a trusted side effect\nof an already-validated operation (gift certificate purchase/reload/\nredemption, financial-account payment authorization/capture, auto-\nreplenish, and return/store-credit processing), using the initiating\ncustomer\u0027s or CSR\u0027s own userLogin. Elevate those specific calls to the\nsystem user, mirroring the existing pattern in\nGiftCertificateServices#createGiftCertificate, so the new permission\nchecks don\u0027t block legitimate checkout and return flows:\n\n- FinAccountPaymentServices: financial-account auth/capture/withdraw/\n deposit/replenish\n- GiftCertificateServices: gift certificate creation, reload, redemption,\n and authorization\n- OrderReturnServices: store-credit creation on return processing\n- FinAccountProductServices: financial-account purchase fulfillment\n" }, { "commit": "98e498f9a24dbf4e961761f279f0cdc4c210b40c", "tree": "5614a9b274faf9636654ced952f4248af3e1a4fb", "parents": [ "db50cbc908e9671f30a2e5f21729dc0ff25b6106" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Tue Oct 13 11:43:50 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Tue Oct 13 12:38:31 2026 +0530" }, "message": "Fixed: createReturnItem() does not verify OrderItem ownership before attaching it to a ReturnHeader\n\ncreateReturnItem() authorizes the request against the supplied ReturnHeader (ORDERMGR_CREATE or ReturnHeader.fromPartyId \u003d\u003d userLogin.partyId), but then resolves the OrderItem from caller-supplied orderId/orderItemSeqId without checking that it belongs to an order associated with ReturnHeader.fromPartyId. This let a non-privileged caller attach an OrderItem from an unrelated order to a ReturnHeader they control. For callers without ORDERMGR_CREATE, this now requires an OrderRole linking ReturnHeader.fromPartyId to the resolved OrderItem\u0027s order before accepting it.\n" }, { "commit": "db50cbc908e9671f30a2e5f21729dc0ff25b6106", "tree": "e49b7adc0d6fa47dcc18a0182f058374679ca127", "parents": [ "97f74160ccfc768226c959bb0485a6ed62fba17d" ], "author": { "name": "Pranay Pandey", "email": "pandeypranay@users.noreply.github.com", "time": "Tue Oct 13 11:09:55 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 13 11:09:55 2026 +0530" }, "message": "Improved: Auto-generated indicator (Y/N) fields silently default to \"Y\" and overwrite a NULL value on unrelated form saves (OFBIZ-13503) (#2239)\n\nAuto-generated create/update forms rendered indicator (Y/N) fields as a\ndrop-down with only \"Y\" and \"N\" options. For a nullable column holding\nNULL, the browser preselected \"Y\", so saving any unrelated field on the\nform silently persisted \"Y\" (e.g. ProductStore.allocateInventory).\nOFBIZ-12001 addressed this for allocateInventory only; this change\napplies to every auto-generated indicator field.\n\nChanges:\n- ModelFormFieldBuilder: indicator drop-downs on non-find forms now get\na blank option when the entity field is nullable. Not-null fields keep\nonly Y/N. Find forms already had the blank option and are unchanged.\n- GenericEntity.set(): an empty string set on an indicator field is now\nstored as null, so selecting the blank option persists NULL rather than\nan empty string.\n\nSide effects:\n- Setting \"\" on a NOT NULL indicator field through GenericEntity.set()\nnow results in null and the store fails, instead of saving an empty\nvalue. Auto-generated forms never submit a blank for such fields; only\nhand-written forms or services passing \"\" would be affected." }, { "commit": "97f74160ccfc768226c959bb0485a6ed62fba17d", "tree": "1d9a53e6a55fe582b02c4d74260b38132f4bc58e", "parents": [ "c667dcfae6972aa090c37909934a3ea222e8b73a" ], "author": { "name": "Anahita Goljahani", "email": "anahita.goljahani@gmail.com", "time": "Mon Oct 12 13:01:06 2026 +0200" }, "committer": { "name": "Anahita Goljahani", "email": "anahita.goljahani@gmail.com", "time": "Mon Oct 12 15:42:54 2026 +0200" }, "message": "Correct Italian translations for various order-related labels in OrderUiLabels.xml\n" }, { "commit": "c667dcfae6972aa090c37909934a3ea222e8b73a", "tree": "7d5fa933ada21680f65bcd7d48be8d6c2b3baf4b", "parents": [ "564669800ac49dac22800632f776e03c79ba19f3" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 09 14:36:52 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Mon Oct 12 15:51:47 2026 +0530" }, "message": "Fixed: Enforces order-update authorization in updateOrderPaymentPreference\n\n- Resolves the parent orderId from the loaded OrderPaymentPreference\n (never from caller-supplied context) and requires the standard\n order-update authorization before changing its status, matching\n the pattern already used by sibling order-mutation methods.\n- Guards against a missing OrderPaymentPreference lookup.\n- Prevents a newly-cloned OrderPaymentPreference from being attached\n to a different order via a caller-supplied orderId.\n" }, { "commit": "564669800ac49dac22800632f776e03c79ba19f3", "tree": "93e95213620ca53b2741381562e870e22327cdbd", "parents": [ "e95e9201164577fc128f56d63aeb3251b366477f" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Thu Oct 08 13:00:18 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Mon Oct 12 15:42:52 2026 +0530" }, "message": "Improved: Validate the InventoryItem and the issued quantity in the issueInventoryItemToShipment service\n\n- Reject an InventoryItem whose product differs from the product of the ShipmentItem.\n- Compute the quantity already issued to the shipment item from its ItemIssuance records instead of taking it from the totalIssuedQty parameter, and remove that parameter from the service and the AddItemsFromInventory form.\n- Return a clear error when the InventoryItem or the ShipmentItem does not exist, or when the ShipmentItem is not associated with a return item.\n" }, { "commit": "e95e9201164577fc128f56d63aeb3251b366477f", "tree": "c8be94a11bb6ee3509bf580b6cbf50e05ce37186", "parents": [ "45506b377c855e455942b238dbd55e33fce79d4f" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 09 19:34:34 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Mon Oct 12 15:21:18 2026 +0530" }, "message": "Fixed: Anonymous ecommerce checkout accepts an arbitrary partyId and lets it be used to overwrite another party\u0027s name and attach caller-supplied contact and payment data to that party (OFBIZ-13669)\n\n- setAnonUserLogin and createUpdateBillingAddressAndPaymentMethod now reject a request-supplied partyId that does not match the party already associated with the caller\u0027s own shopping cart, instead of trusting it unconditionally.\n- Added the OrderPartyIdDoesNotMatchCartParty error label for the rejection message.\n" }, { "commit": "45506b377c855e455942b238dbd55e33fce79d4f", "tree": "2d9055093d88a11e8793eb46224a2a2524ef16b0", "parents": [ "3b63151e7d9a501a538dff54a71595f9eb348b39" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Oct 09 14:12:05 2026 +0000" }, "committer": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Fri Oct 09 17:50:21 2026 +0200" }, "message": "Bump github/codeql-action/upload-sarif\n\nBumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from e0b52dbdc5c3376dd8cb78e956fd23fa07ca2c5b to 5aa5056e2d064690968faa15e019d7d823ef6d7b.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/e0b52dbdc5c3376dd8cb78e956fd23fa07ca2c5b...5aa5056e2d064690968faa15e019d7d823ef6d7b)\n\n---\nupdated-dependencies:\n- dependency-name: github/codeql-action/upload-sarif\n dependency-version: 5aa5056e2d064690968faa15e019d7d823ef6d7b\n dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "3b63151e7d9a501a538dff54a71595f9eb348b39", "tree": "3562ce2c54fb3cc53bab018aeaeb32db535e2628", "parents": [ "7ab39ee2cd99aaa61f84be5682ff62749133db4a" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 09 13:18:09 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 09 14:47:05 2026 +0530" }, "message": "Fixed: Promo conditions PPIP_ORST_YEAR and PPIP_ORST_LAST_YEAR read the order sub-total from the wrong map (OFBIZ-13667)\n\nproductOrderYear and productOrderLastYear keep the answer of getOrderedSummaryInformation in serviceResult but read the sub-total from their own result map, so the sub-total was always null and the condition never reflected the order history. Read totalSubRemainingAmount from serviceResult, and use serviceResult when checking for an error and when logging the error message (also in productOrderHist), since productOrderYear tested its own result for an error.\n" }, { "commit": "7ab39ee2cd99aaa61f84be5682ff62749133db4a", "tree": "dbd0412c9f527ddbf7ba4411c05d95d0f496746c", "parents": [ "708850634832064c87604352a9a61226b56186be" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 09 12:25:54 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 09 13:06:01 2026 +0530" }, "message": "Fixed: getOrderedSummaryInformation ignores explicit fromDate and thruDate (OFBIZ-13664)\n\nThe service declares fromDate and thruDate as IN attributes and the mini-lang used them to restrict the orders, letting monthsToInclude override them. The Groovy conversion initialised both to null and only set them from monthsToInclude, so callers passing only dates received the totals of all orders. Seed fromDate and thruDate from the parameters again, and keep monthsToInclude overriding them.\n" }, { "commit": "708850634832064c87604352a9a61226b56186be", "tree": "8d33f66c863cb872d6917b6c08d1699922227c40", "parents": [ "528199b34c520f1f431dd7fc024ac4386feb9e77" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 09 11:56:39 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 09 12:49:09 2026 +0530" }, "message": "Fixed: Regressions in ShoppingListServicesScript.groovy introduced by the mini-lang conversion (OFBIZ-13662)\n\nThe Groovy conversion of ShoppingListServices.xml changed the behaviour of two services. Restore the mini-lang behaviour:\n\n- addSuggestionsToShoppingList: for a variant product, link the complements of the virtual product (productId of the variant ProductAssoc) instead of re-linking the complements of the variant itself\n- createShoppingListItem: treat a missing quantity as zero when adding to an existing shopping list item\n" }, { "commit": "528199b34c520f1f431dd7fc024ac4386feb9e77", "tree": "47775a3055438a0f4e4acd3126d4f28f270e91e7", "parents": [ "4a10a9fea96c9d143e13c06d04ed09e016592829" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Thu Oct 08 18:14:12 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 09 11:57:10 2026 +0530" }, "message": "Fixed: Regressions in QuoteServicesScript.groovy introduced by the mini-lang conversion (OFBIZ-13660)\n\nThe Groovy conversion of QuoteServices.xml changed the behaviour of several services. Restore the mini-lang behaviour:\n\n- copyQuote: copy each quote item with the copyQuoteItem service so that the item level adjustments are copied too\n- createQuoteAndQuoteItemForRequest: build the quote from the request fields the mini-lang used instead of spreading the whole CustRequest, which leaked its CRQ_ status into the quote, let the submitted quote item fields take precedence over the request item, and skip a quote role that createQuote already created\n- createQuoteItem and autoUpdateQuotePrice: treat a price of zero as a value instead of as missing\n" }, { "commit": "4a10a9fea96c9d143e13c06d04ed09e016592829", "tree": "44ebd8a3a0a2caffba935ba0501a9f7b9527c5bd", "parents": [ "a37c9c7148ca258ead3311d037bfe5ad09d07b05" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Thu Oct 08 18:59:41 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Fri Oct 09 11:49:57 2026 +0530" }, "message": "Fixed: Regressions in ShipmentServices.groovy introduced by the mini-lang conversion (OFBIZ-13661)\n\nThe Groovy conversion of ShipmentServices.xml changed the behaviour of several services. Restore the mini-lang behaviour:\n\n- quickShipEntireOrder: accept the setPackedOnly String in the sub-method instead of a Boolean (a String such as Y raised a MissingMethodException), and collect the shipments, messages and ship group facilities of all facilities instead of keeping the last ones, returning shipmentIds as well\n- removeOrderShipmentFromShipment: subtract the removed OrderShipment quantity from the ShipmentItem quantity, not the other way round\n- setShipmentSettingsFromPrimaryOrder: use the ShipmentRouteSegment field names estimatedStartDate and estimatedArrivalDate, keep the destination contact mech and telecom number when the ship group has none, keep an explicit estimatedShipCost of zero, and do not fail when no FacilityContactMech is found for a purchase shipment\n- issueSerializedInvToShipmentPackageAndSetTracking: look up the route segment 00001\n- checkAndUpdateWorkEffort: only change the dates and facility of the shipment WorkEfforts when the corresponding value is passed\n" }, { "commit": "a37c9c7148ca258ead3311d037bfe5ad09d07b05", "tree": "1cf8be398eb89fb4679fe2fa38723d3298beb615", "parents": [ "2cc834f9e6a2bc32365b6bb68f2320d62f86a619" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 08 14:07:07 2026 +0000" }, "committer": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Thu Oct 08 17:41:23 2026 +0200" }, "message": "Bump github/codeql-action/upload-sarif\n\nBumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 63d3d632fc7cbd91c8089c7fea5322f1bc73d7d8 to e0b52dbdc5c3376dd8cb78e956fd23fa07ca2c5b.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/63d3d632fc7cbd91c8089c7fea5322f1bc73d7d8...e0b52dbdc5c3376dd8cb78e956fd23fa07ca2c5b)\n\n---\nupdated-dependencies:\n- dependency-name: github/codeql-action/upload-sarif\n dependency-version: e0b52dbdc5c3376dd8cb78e956fd23fa07ca2c5b\n dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "2cc834f9e6a2bc32365b6bb68f2320d62f86a619", "tree": "9724851c5fa8db0d118edad81db4359d6a745b01", "parents": [ "e955a1466e9e9d2fc28dc26f1f502fc3dd907941" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Thu Oct 08 17:19:37 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Thu Oct 08 19:17:38 2026 +0530" }, "message": "Fixed: Regressions in CategoryServicesScript.groovy introduced by the mini-lang conversion (OFBIZ-13659)\n\nThe Groovy conversion of CategoryServices.xml changed the behaviour of several services. Restore the mini-lang behaviour:\n\n- copyCategoryProductMembers: set productCategoryId of the copied members from productCategoryIdTo (the assignment was reversed, so nothing was copied and productCategoryIdTo was overwritten), and apply validDate when filtering members and rollups\n- copyCategoryEntities: apply validDate when filtering the entities to copy\n- createProductInCategory: iterate productFeatureIdByType with Map.Entry (the Map-typed loop variable threw a GroovyCastException), create the default price and average cost also when they are zero, and look the product up by the created productId when marking it virtual\n- createProductCategoryLink: keep the fields supplied by the caller (linkSeqId, fromDate and the non-PK fields) and only generate linkSeqId when none is given\n- addProductCategoryToCategories: check the permission against parameters.categories instead of the literal string\n- checkCategoryPermissionWithViewPurchaseAllow: use the existing CommonCallingMethodPermissionError label with named arguments for both permissions\n" }, { "commit": "e955a1466e9e9d2fc28dc26f1f502fc3dd907941", "tree": "a266b1a620c1e87b165483c10710064b0203649d", "parents": [ "f4a6d19a0f5ecb04facfccd04b015c1f29f5cc32" ], "author": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Thu Oct 08 15:43:11 2026 +0530" }, "committer": { "name": "Mridul Pathak", "email": "mridul.72@gmail.com", "time": "Thu Oct 08 19:14:55 2026 +0530" }, "message": "Fixed: Regressions in OrderServicesScript.groovy introduced by the mini-lang conversion (OFBIZ-13663)\n\nThe Groovy conversion of OrderServices.xml (OFBIZ-9984) changed the behaviour of several services. Restore the mini-lang behaviour:\n\n- createOrderHeader: set the non-PK fields outside the with{} closure, which resolved \"parameters\" on the GenericValue and threw\n- setUnitPriceAsLastPrice: convert the String itemPriceMap values to BigDecimal instead of casting, and compare the order currency price or unit cost as BigDecimals with the original if/else structure\n- recreateOrderAdjustments: stop the loop variable from shadowing the orderItemSeqId assigned in the with{} closure, and take the promo item id from the per-order sub-sequence\n- checkOrderIsOnBackOrder: use \"greater than\" for quantityNotAvailable, as the mini-lang did\n- getOrderItemShipGroupEstimatedShipDate: look the ship group up by orderId and shipGroupSeqId and null-guard the results\n- createUpdateShippingAddress and createUpdateBillingAddress: look up the existing PostalAddress by the address context\u0027s contactMechId, and in the \"use shipping address for billing\" branch expire the old billing purposes and delete the contact mech only when keepAddressBook is N\n- createUpdateCreditCard: filter the payment methods by date and keep the supplied paymentMethodId when none is found\n- productAvailabilityByFacility: only filter by ownerPartyId when one is given\n- createOrderPaymentApplication: order the order item billings by invoiceId\n" }, { "commit": "f4a6d19a0f5ecb04facfccd04b015c1f29f5cc32", "tree": "88b62696bebd50470c4010aff2bc370f84ca6ff4", "parents": [ "df3aa3c824fb43e560625d8a9d3a38ace7187c7a" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 07 13:36:05 2026 +0000" }, "committer": { "name": "Jacopo Cappellato", "email": "jacopo.cappellato@gmail.com", "time": "Thu Oct 08 10:02:10 2026 +0200" }, "message": "Bump github/codeql-action/upload-sarif\n\nBumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 1767808e1164b88b6d037184ffb3ed13697e8966 to 63d3d632fc7cbd91c8089c7fea5322f1bc73d7d8.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/1767808e1164b88b6d037184ffb3ed13697e8966...63d3d632fc7cbd91c8089c7fea5322f1bc73d7d8)\n\n---\nupdated-dependencies:\n- dependency-name: github/codeql-action/upload-sarif\n dependency-version: 63d3d632fc7cbd91c8089c7fea5322f1bc73d7d8\n dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "df3aa3c824fb43e560625d8a9d3a38ace7187c7a", "tree": "2a713052ab84df5ee07e30bea3d13e8e342c0625", "parents": [ "9866d9d4ed299b4b8b4bf4371fce2d10f0bd0c0b" ], "author": { "name": "Lukas-Finster", "email": "lukas.finster@ecomify.de", "time": "Thu Oct 08 08:41:27 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 08 08:41:27 2026 +0200" }, "message": "Fixed: Hardens security by adding missing permission check in OrderServices (#2217)" } ], "next": "9866d9d4ed299b4b8b4bf4371fce2d10f0bd0c0b" }