)]}' { "log": [ { "commit": "cba0f9bcb5d0902b3bfa3e596b047ad3ff3a00ef", "tree": "ea553e6ed6d33d4c9f29e998d7e637ee74e95417", "parents": [ "a65e4906bad2a994c8787df78869fe3f5eed2f62", "2995aeb0ea195ce083cf342934f029edbc81551d" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Tue Oct 27 17:36:17 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 27 17:36:17 2026 +0100" }, "message": "Merge pull request #125 from apache/cve-updates-2026-10-27\n\nCVE updates from 2026-10-22 through 2026-10-26" }, { "commit": "2995aeb0ea195ce083cf342934f029edbc81551d", "tree": "ea553e6ed6d33d4c9f29e998d7e637ee74e95417", "parents": [ "a65e4906bad2a994c8787df78869fe3f5eed2f62" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Tue Oct 27 15:39:22 2026 +0100" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Tue Oct 27 15:39:22 2026 +0100" }, "message": "CVE updates from 2026-10-22 through 2026-10-26\n\nRegenerate the project pages with the latest public CVE data from\ncveprocess.apache.org. No metadata changes.\n\nAssisted-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "a65e4906bad2a994c8787df78869fe3f5eed2f62", "tree": "3c394a1f26ec321febff2b72bc30d21312812bdb", "parents": [ "ede11d2abf8d91176bde5ca522314fa5850d4340", "0347a9e0e5bc167cf0e8f7be27a343357dec3fc6" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Fri Oct 23 10:25:41 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 23 10:25:41 2026 +0200" }, "message": "Merge pull request #124 from apache/feat/tsfile-security-model\n\nfeat: add Apache TsFile security model links" }, { "commit": "0347a9e0e5bc167cf0e8f7be27a343357dec3fc6", "tree": "3c394a1f26ec321febff2b72bc30d21312812bdb", "parents": [ "ede11d2abf8d91176bde5ca522314fa5850d4340" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Thu Oct 22 17:35:44 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Thu Oct 22 17:35:44 2026 +0200" }, "message": "feat: add Apache TsFile security model links\n" }, { "commit": "ede11d2abf8d91176bde5ca522314fa5850d4340", "tree": "d3e939391bb386a624b0eeeb5d2382050f248984", "parents": [ "5cdb8b37990c9c8d32abac91389778127ad28e92" ], "author": { "name": "Piotr P. Karwasz", "email": "pkarwasz-github@apache.org", "time": "Thu Oct 22 08:43:16 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 08:43:16 2026 +0200" }, "message": "CVE updates from 2026-10-16 through 2026-10-21 (#123)\n\nRegenerate the project pages with the latest public CVE data from\ncveprocess.apache.org. No metadata changes." }, { "commit": "5cdb8b37990c9c8d32abac91389778127ad28e92", "tree": "e591dd017b9658d7febc052fe9b03263b45e8dfa", "parents": [ "df982864f0b84304b26b6adde46ff0c61bc760e8", "3ea9ba060259da1d36163daa581da0ba16ab61b3" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Tue Oct 20 21:37:42 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 21:37:42 2026 +0100" }, "message": "Merge pull request #122 from damccorm/patch-1\n\nUpdate credits to include Maulik Mehta" }, { "commit": "3ea9ba060259da1d36163daa581da0ba16ab61b3", "tree": "e591dd017b9658d7febc052fe9b03263b45e8dfa", "parents": [ "df982864f0b84304b26b6adde46ff0c61bc760e8" ], "author": { "name": "Danny McCormick", "email": "dannymccormick@google.com", "time": "Tue Oct 20 16:16:30 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 16:16:30 2026 -0400" }, "message": "Update credits to include Maulik Mehta" }, { "commit": "df982864f0b84304b26b6adde46ff0c61bc760e8", "tree": "0daccc2e89eb4839b7560e11cd4347d946b787c1", "parents": [ "d707e83db708ce8aa8bfb5b363df6b12cef366c0", "8166353d655fc1be721afb8ec91e2941e43cbe70" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Mon Oct 19 16:03:31 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 16:03:31 2026 +0100" }, "message": "Merge pull request #121 from damccorm/patch-1\n\nUpdate credits for issue reporter and mention Beam, not vendor" }, { "commit": "8166353d655fc1be721afb8ec91e2941e43cbe70", "tree": "0daccc2e89eb4839b7560e11cd4347d946b787c1", "parents": [ "d707e83db708ce8aa8bfb5b363df6b12cef366c0" ], "author": { "name": "Danny McCormick", "email": "dannymccormick@google.com", "time": "Mon Oct 19 10:54:35 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 10:54:35 2026 -0400" }, "message": "Update credits for issue reporter and mention Beam, not vendor" }, { "commit": "d707e83db708ce8aa8bfb5b363df6b12cef366c0", "tree": "2f3d9a6ff0133e29efe4cc2a4319446269b3ee28", "parents": [ "ccd10a1a8255817da80d0deb4a26bd23f760f207", "f8c8a3c898ee9b4794cd3bdcb42898b8cba18eab" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Mon Oct 19 15:12:41 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 15:12:41 2026 +0100" }, "message": "Merge pull request #120 from raboof/beam-grafana-credit\n\ncredit for Grafana permissions report" }, { "commit": "f8c8a3c898ee9b4794cd3bdcb42898b8cba18eab", "tree": "2f3d9a6ff0133e29efe4cc2a4319446269b3ee28", "parents": [ "1f07b4148698acf77c2c892dddbb26a267510695" ], "author": { "name": "Arnout Engelen", "email": "arnout@engelen.eu", "time": "Mon Oct 19 15:12:29 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 15:12:29 2026 +0100" }, "message": "Add credit for Davi Johns as well\n\nCo-authored-by: Danny McCormick \u003cdannymccormick@google.com\u003e" }, { "commit": "1f07b4148698acf77c2c892dddbb26a267510695", "tree": "1fb22a1a60ac3a483af24d7ddf85335114471c78", "parents": [ "ccd10a1a8255817da80d0deb4a26bd23f760f207" ], "author": { "name": "Arnout Engelen", "email": "arnout@bzzt.net", "time": "Mon Oct 19 14:49:05 2026 +0100" }, "committer": { "name": "Arnout Engelen", "email": "arnout@bzzt.net", "time": "Mon Oct 19 14:49:05 2026 +0100" }, "message": "credit for Grafana permissions report\n" }, { "commit": "ccd10a1a8255817da80d0deb4a26bd23f760f207", "tree": "c2dea0117bcdb79c9abfe1ea775f25f0affb338d", "parents": [ "5aa0da504637ee8acd09017741a7ba59b33e0af6", "e8113658abee6127827f739314893b0e97adca02" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Fri Oct 16 05:03:24 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 16 05:03:24 2026 +0100" }, "message": "Merge pull request #119 from potiuk/airflow-cve-updates-2026-10-16\n\nAdd Airflow advisories CVE-2026-92228, CVE-2026-94134, CVE-2026-94135 and CVE-2026-96806" }, { "commit": "e8113658abee6127827f739314893b0e97adca02", "tree": "c2dea0117bcdb79c9abfe1ea775f25f0affb338d", "parents": [ "5aa0da504637ee8acd09017741a7ba59b33e0af6" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Fri Oct 16 04:52:07 2026 +0100" }, "committer": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Fri Oct 16 04:52:07 2026 +0100" }, "message": "Add Airflow advisories CVE-2026-92228, CVE-2026-94134, CVE-2026-94135 and CVE-2026-96806\n\nRegenerate the Apache Airflow page with scripts/project-page.py from\nfresh cveprocess data. The four advisories were announced on\n2026-10-15; no other Airflow entry changes.\n\nGenerated-by: Claude Opus 5\n" }, { "commit": "5aa0da504637ee8acd09017741a7ba59b33e0af6", "tree": "cd1f4d256e48349c634ea789c257516670cef227", "parents": [ "581d7b2ee16b785da93a65058535d2a78a452629", "e615af65e828152490c4b0d2701e0d27aaba53b4" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Tue Oct 06 12:33:00 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 12:33:00 2026 +0200" }, "message": "Merge pull request #117 from apache/cve-updates-2026-10-06\n\nRestore Traffic Server 8.x affected ranges" }, { "commit": "e615af65e828152490c4b0d2701e0d27aaba53b4", "tree": "cd1f4d256e48349c634ea789c257516670cef227", "parents": [ "581d7b2ee16b785da93a65058535d2a78a452629" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Tue Oct 06 12:28:04 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Tue Oct 06 12:28:04 2026 +0200" }, "message": "Restore Traffic Server 8.x affected ranges\n\nRegenerate the site from fresh data. The only change is to 31 Apache\nTraffic Server advisories: commit 14b9fde3 was generated from a stale\nCVE cache and reverted their 8.x affected range from \"through 8.1.11\"\n(as published and as fixed in #111) back to \"through 8.1.9\".\n\nAssisted-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "581d7b2ee16b785da93a65058535d2a78a452629", "tree": "4ea45b77bed02a9f490a3c0dadc64bb6163fe72c", "parents": [ "3b9566eb3b5f4f520cb7f4f108743d2f1f7fb7ed", "9b3c6f7eed0270502128bfd046798966b52f3b5e" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Tue Oct 06 12:11:42 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 12:11:42 2026 +0200" }, "message": "Merge pull request #116 from apache/sort-cve-json-keys\n\nRe-serialize CVE json files with sorted keys" }, { "commit": "9b3c6f7eed0270502128bfd046798966b52f3b5e", "tree": "4ea45b77bed02a9f490a3c0dadc64bb6163fe72c", "parents": [ "3b9566eb3b5f4f520cb7f4f108743d2f1f7fb7ed" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Tue Oct 06 12:03:29 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Tue Oct 06 12:03:29 2026 +0200" }, "message": "Re-serialize CVE json files with sorted keys\n\nFollow-up to #113: apply `sort_keys\u003dTrue` to the existing generated\n`*.cve.json` files without refetching data, so that the next regeneration\nonly shows actual data changes.\n\nThe files were loaded and re-dumped with the same `json.dump` options as\n`scripts/project-page.py`. The parsed content is unchanged, and the derived\n`*.osv.json` files are byte-identical when regenerated from the sorted input.\n\nAssisted-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "3b9566eb3b5f4f520cb7f4f108743d2f1f7fb7ed", "tree": "674b3b757cbbdf4146a38253c40552acb78ed351", "parents": [ "3485d7be77a8ba30ef247a6b352451d51f1fd95e" ], "author": { "name": "Basant_Jamwal", "email": "basantrajput570@gmail.com", "time": "Tue Oct 06 15:28:56 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 11:58:56 2026 +0200" }, "message": "Sort keys in generated CVE json for deterministic output (#113)" }, { "commit": "3485d7be77a8ba30ef247a6b352451d51f1fd95e", "tree": "4b3b403991f9f24915fcea4069f9bebe083731c9", "parents": [ "f4e6ff7a7ef4cd336d5d84a760d9d74009203150", "14b9fde3f5d83d3764617013dbc0e48631d8fd27" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Tue Oct 06 11:31:56 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 11:31:56 2026 +0200" }, "message": "Merge pull request #115 from raboof/update\n\nvarious updates" }, { "commit": "14b9fde3f5d83d3764617013dbc0e48631d8fd27", "tree": "4b3b403991f9f24915fcea4069f9bebe083731c9", "parents": [ "f4e6ff7a7ef4cd336d5d84a760d9d74009203150" ], "author": { "name": "Arnout Engelen", "email": "arnout@bzzt.net", "time": "Tue Oct 06 10:47:11 2026 +0200" }, "committer": { "name": "Arnout Engelen", "email": "arnout@bzzt.net", "time": "Tue Oct 06 10:47:11 2026 +0200" }, "message": "various updates\n\nUpdates, mainly the \u0027to\u0027 that was added to the template\nand updates to CVEs that hadn\u0027t made it to the site yet.\n" }, { "commit": "f4e6ff7a7ef4cd336d5d84a760d9d74009203150", "tree": "ee5fb265fd419543f940977172c1927a2c7aaf48", "parents": [ "0883741ed9b7eec770decab837323eeb8caec8f2", "254663326e2b9cba104863063d7a12f5ce1532be" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Tue Oct 06 10:10:42 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 10:10:42 2026 +0200" }, "message": "Merge pull request #114 from raboof/roller-model\n\nLink to roller security model" }, { "commit": "254663326e2b9cba104863063d7a12f5ce1532be", "tree": "ee5fb265fd419543f940977172c1927a2c7aaf48", "parents": [ "0883741ed9b7eec770decab837323eeb8caec8f2" ], "author": { "name": "Arnout Engelen", "email": "arnout@bzzt.net", "time": "Tue Oct 06 09:05:22 2026 +0200" }, "committer": { "name": "Arnout Engelen", "email": "arnout@bzzt.net", "time": "Tue Oct 06 09:05:22 2026 +0200" }, "message": "Link to roller security model\n" }, { "commit": "0883741ed9b7eec770decab837323eeb8caec8f2", "tree": "9d9ef46a2d55b7174b63e24546f13deacb88e845", "parents": [ "21af4ff58d1332b1377fb91ad7610a9b01943216" ], "author": { "name": "Piotr P. Karwasz", "email": "pkarwasz-github@apache.org", "time": "Fri Oct 02 23:42:29 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 02 23:42:29 2026 +0200" }, "message": "CVE updates from 2026-10-01 through 2026-10-02 (#111)\n\nRegenerate the project pages with the latest public CVE data from\ncveprocess.apache.org. No metadata changes.\n\nRecords whose index timestamp was newer than the locally cached copy were\nrefetched before regenerating, so edits to already published records\n(affected ranges, credits, references, descriptions) land on the pages\ninstead of only bumping their \"last updated\" line.\n\nAssisted-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e" }, { "commit": "21af4ff58d1332b1377fb91ad7610a9b01943216", "tree": "b414d4828ee1560d94080c4106e8a343b931eba0", "parents": [ "0b8b72266bba8d2d33feb7c6b9c1037e78f0d926", "63a1c8825ae5e10a722fc8fbdeb7c1f1f902b1c6" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Fri Oct 02 16:09:21 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 02 16:09:21 2026 +0200" }, "message": "Merge pull request #112 from elecharny/patch-1\n\nUpdate project-page.py" }, { "commit": "63a1c8825ae5e10a722fc8fbdeb7c1f1f902b1c6", "tree": "b414d4828ee1560d94080c4106e8a343b931eba0", "parents": [ "0b8b72266bba8d2d33feb7c6b9c1037e78f0d926" ], "author": { "name": "Emmanuel Lécharny", "email": "2922517+elecharny@users.noreply.github.com", "time": "Fri Oct 02 16:07:32 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 02 16:07:32 2026 +0200" }, "message": "Update project-page.py\n\nAdded a missing \u0027to\u0027 in the project main page" }, { "commit": "0b8b72266bba8d2d33feb7c6b9c1037e78f0d926", "tree": "da7e62378c73c7921189882e402bbe5b8c6c6b56", "parents": [ "862b0aee4307f31fc117b241aad9b825dc501ba2" ], "author": { "name": "Piotr P. Karwasz", "email": "pkarwasz-github@apache.org", "time": "Fri Oct 02 10:03:49 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 02 10:03:49 2026 +0200" }, "message": "CVE updates from 2026-09-29 through 2026-10-01 (#110)\n\nRegenerate the project pages with the latest public CVE data from\ncveprocess.apache.org. No metadata changes.\n\nAssisted-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e" }, { "commit": "862b0aee4307f31fc117b241aad9b825dc501ba2", "tree": "0f2e91d275086deeb63c0a84526bb55352c937f3", "parents": [ "6b7c5b7e1f34b62ca2be52a89061af852089a3b3", "c00c54eb507c7061d1aaaba3f5b70c80e933ce84" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Tue Sep 29 22:51:34 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 29 22:51:34 2026 +0200" }, "message": "Merge pull request #109 from apache/cve-updates-2026-09-29\n\nCVE updates from 2026-09-23 through 2026-09-29" }, { "commit": "6b7c5b7e1f34b62ca2be52a89061af852089a3b3", "tree": "c2d1b956a8679314f1b6ac59caf810608000c0a7", "parents": [ "f38f0f2905d9b4e5f35ddddaaa10efaf66de2f7b" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Tue Sep 29 17:37:39 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 29 17:37:39 2026 +0200" }, "message": "fix: typo Program -\u003e Project Management Committee (#104)" }, { "commit": "f38f0f2905d9b4e5f35ddddaaa10efaf66de2f7b", "tree": "5f346ee0952bd43c8215e0bdf136fb6298e16d73", "parents": [ "52f6fd5f2e181411cccde6bada332ce97f9de6ca", "584894db10667374073f2272dd1f459a4e602639" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Tue Sep 29 16:40:20 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 29 16:40:20 2026 +0200" }, "message": "Merge pull request #108 from raboof/netbeans-contributing\n\nrecord netbeans contributing link" }, { "commit": "c00c54eb507c7061d1aaaba3f5b70c80e933ce84", "tree": "dee17dc61e4f981133b0d1cd0ba1c75b81e729c8", "parents": [ "52f6fd5f2e181411cccde6bada332ce97f9de6ca" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Tue Sep 29 16:23:08 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Tue Sep 29 16:23:08 2026 +0200" }, "message": "CVE updates from 2026-09-23 through 2026-09-29\n\nRegenerate the project pages with the latest public CVE data from\ncveprocess.apache.org. No metadata changes.\n\nAssisted-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "584894db10667374073f2272dd1f459a4e602639", "tree": "5f346ee0952bd43c8215e0bdf136fb6298e16d73", "parents": [ "52f6fd5f2e181411cccde6bada332ce97f9de6ca" ], "author": { "name": "Arnout Engelen", "email": "arnout@bzzt.net", "time": "Mon Sep 28 11:07:51 2026 +0200" }, "committer": { "name": "Arnout Engelen", "email": "arnout@bzzt.net", "time": "Mon Sep 28 11:07:51 2026 +0200" }, "message": "record netbeans contributing link\n" }, { "commit": "52f6fd5f2e181411cccde6bada332ce97f9de6ca", "tree": "abe5e41e3025180a33a9d78403c744f5ea35d5fd", "parents": [ "d47b5de59879586e5b6387209be6e6960068f37b", "3907a54f8cc8252f46096199e0b0e0187cf52d40" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Wed Sep 23 10:56:24 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 23 10:56:24 2026 +0200" }, "message": "Merge pull request #106 from apache/systemds-security-model\n\nRegister the Apache SystemDS security model" }, { "commit": "3907a54f8cc8252f46096199e0b0e0187cf52d40", "tree": "abe5e41e3025180a33a9d78403c744f5ea35d5fd", "parents": [ "05447057478ee8ca9fe6c31fc20208afeadfb702" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Wed Sep 23 10:53:12 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Wed Sep 23 10:53:12 2026 +0200" }, "message": "Regenerate pages with the Apache SystemDS security model\n\nAssisted-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "05447057478ee8ca9fe6c31fc20208afeadfb702", "tree": "d8a9655ae7fafbb88c2424f5fe4ced4d741b7878", "parents": [ "67139eede1c06a414d13117627b2b26741ce67b1" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Wed Sep 23 10:53:12 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Wed Sep 23 10:53:12 2026 +0200" }, "message": "Register the Apache SystemDS security model\n\nApache SystemDS has published a security model on its project site, with\nthe source document kept in the repository\u0027s docs/site/security.md.\n\nAssisted-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "d47b5de59879586e5b6387209be6e6960068f37b", "tree": "a608df17aa1ed0ac5e2624af5dafd839a2a74753", "parents": [ "95b7b403e3c4b9ee3a00c29caed6bf6aaf707b1c", "67139eede1c06a414d13117627b2b26741ce67b1" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Wed Sep 23 10:28:00 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 23 10:28:00 2026 +0200" }, "message": "Merge pull request #105 from apache/cve-updates-2026-09-23\n\nCVE updates from 2026-09-19 through 2026-09-23" }, { "commit": "67139eede1c06a414d13117627b2b26741ce67b1", "tree": "a608df17aa1ed0ac5e2624af5dafd839a2a74753", "parents": [ "95b7b403e3c4b9ee3a00c29caed6bf6aaf707b1c" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Wed Sep 23 10:26:37 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Wed Sep 23 10:26:37 2026 +0200" }, "message": "CVE updates from 2026-09-19 through 2026-09-23\n\nRegenerate the project pages with the latest public CVE data from\ncveprocess.apache.org. No metadata changes.\n\nAssisted-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "95b7b403e3c4b9ee3a00c29caed6bf6aaf707b1c", "tree": "e493080cdd782cffb9ef11443ef549d71d690c4a", "parents": [ "58febdf1ecddcc9943c2ec49641f00fcbe625bad" ], "author": { "name": "Piotr P. Karwasz", "email": "pkarwasz-github@apache.org", "time": "Fri Sep 18 13:46:24 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 18 13:46:24 2026 +0200" }, "message": "CVE updates from 2026-09-17 through 2026-09-18 (#103)\n\nRegenerate the project pages with the latest public CVE data from\ncveprocess.apache.org. No metadata changes.\n\nAssisted-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e" }, { "commit": "58febdf1ecddcc9943c2ec49641f00fcbe625bad", "tree": "46f434e805b3305d85bbd98ab0666ce9b2856202", "parents": [ "a6bcdad678859bf0bf19967d2f59201b24ad0ff4", "371a5af0bdbfea355c0a424fcaea130c4797350a" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Fri Sep 18 12:01:57 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 18 12:01:57 2026 +0200" }, "message": "Merge pull request #102 from raboof/yunikorn-security-lits\n\nannounce yunicorn security list" }, { "commit": "371a5af0bdbfea355c0a424fcaea130c4797350a", "tree": "46f434e805b3305d85bbd98ab0666ce9b2856202", "parents": [ "a6bcdad678859bf0bf19967d2f59201b24ad0ff4" ], "author": { "name": "Arnout Engelen", "email": "arnout@bzzt.net", "time": "Fri Sep 18 10:31:38 2026 +0200" }, "committer": { "name": "Arnout Engelen", "email": "arnout@bzzt.net", "time": "Fri Sep 18 10:33:14 2026 +0200" }, "message": "announce yunicorn security list\n" }, { "commit": "a6bcdad678859bf0bf19967d2f59201b24ad0ff4", "tree": "b6e406279617b922aff18781fb8c5ce2581f8b0a", "parents": [ "e20e56fc62127f8d44c180e42188c96c6c77e3c0", "e73189641f0fe0df78f42ee6933eaf31459c1d7a" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Fri Sep 18 10:29:07 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 18 10:29:07 2026 +0200" }, "message": "Merge pull request #101 from apache/cve-updates-2026-09-16\n\nCVE updates from 2026-09-11 through 2026-09-16" }, { "commit": "e73189641f0fe0df78f42ee6933eaf31459c1d7a", "tree": "b6e406279617b922aff18781fb8c5ce2581f8b0a", "parents": [ "e20e56fc62127f8d44c180e42188c96c6c77e3c0" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Wed Sep 16 22:39:12 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Wed Sep 16 22:39:12 2026 +0200" }, "message": "CVE updates from 2026-09-11 through 2026-09-16\n\nRegenerate the project pages with the latest public CVE data from\ncveprocess.apache.org. No metadata changes.\n\nAssisted-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "e20e56fc62127f8d44c180e42188c96c6c77e3c0", "tree": "8e68f2722102273bbe1564eb0541237988eabcb3", "parents": [ "0a4e5f390eb69ddcd4ccbb574c858cbe06d643b6", "deaa86dd79575fbed07108d7a54fed3099691f32" ], "author": { "name": "Piotr P. Karwasz", "email": "jarek@potiuk.com", "time": "Sat Sep 12 13:29:55 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 12 13:29:55 2026 +0200" }, "message": "Merge pull request #99 from apache/threat-model-coordinates\n\nRegister the Allura, Ignite 2 and Kvrocks Controller security models\n" }, { "commit": "deaa86dd79575fbed07108d7a54fed3099691f32", "tree": "8e68f2722102273bbe1564eb0541237988eabcb3", "parents": [ "dad8adaba9c8c0a726bd371dfc955d05c2d9a445" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Sep 11 18:17:17 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Sep 11 18:17:17 2026 +0200" }, "message": "Regenerate pages with the security models found by the Claude Security scans\n\nAssisted-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "dad8adaba9c8c0a726bd371dfc955d05c2d9a445", "tree": "0540ede7fb3f80ff86a830179b303a8f9d154322", "parents": [ "71cc6f8b0c3cc1fa208275dcecef5cdb3550f18e" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Sep 11 18:06:45 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Sep 11 18:17:17 2026 +0200" }, "message": "Register the project security models found by the Claude Security scans\n\nA fleet of Claude Security scans covering 231 Apache repositories recorded,\nfor each repository, the security model the scan was driven from. Most of\nthose models were already registered here; these are the ones that were not,\neach verified to be public on the repository\u0027s default branch:\n\n* Apache Camel: camel-k, camel-kafka-connector, camel-kamelets, camel-karaf\n and camel-quarkus each publish a security model of their own alongside the\n Camel manual\u0027s.\n* Apache Iceberg: the C++, Go, Python, Rust and Terraform implementations each\n carry their own SECURITY-THREAT-MODEL.md.\n* Apache Directory: SCIMple, Fortress Web and Fortress Rest publish their own\n models; the remaining Directory repositories share the Directory Server one\n already registered.\n* Apache Mynewt: the PMC had no model registered at all. mynewt-core carries\n the Mynewt model, with NimBLE and mcumgr publishing their own.\n* Apache OpenDAL: oli and reqsign.\n* Apache CXF: Fediz.\n\nAirflow and HBase already pointed at their rendered security model pages but\nhad no machine-readable source; the scans identified the documents behind\nthose pages, so both now carry one.\n\nAssisted-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "71cc6f8b0c3cc1fa208275dcecef5cdb3550f18e", "tree": "dc676209b4bb44d7a095901c2bb867617d02e761", "parents": [ "96b3f8ae0b9611803e97311de3493e2b9762df8a" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Sep 11 17:47:21 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Sep 11 17:47:21 2026 +0200" }, "message": "Regenerate pages with the Allura, Ignite 2 and Kvrocks Controller models\n\nAssisted-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "96b3f8ae0b9611803e97311de3493e2b9762df8a", "tree": "810fbb15802f48e4231bd361c7ba0e44db7900b7", "parents": [ "76902f1037cc117d43e41e0fd36c0ae37f3d68ba" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Sep 11 17:38:05 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Sep 11 17:38:05 2026 +0200" }, "message": "Register the Allura, Ignite 2 and Kvrocks Controller security models\n\nThree threat-model coordinates were wrong or missing:\n\n* Allura publishes a vulnerability-scope statement in SECURITY.md on the\n default branch of apache/allura, but no model was registered.\n* The only model registered for the Ignite PMC was the Ignite 3 one, even\n though Ignite 2.x is a separate product with its own published security\n model. The PMC entry now carries the Ignite 2.x model and Ignite 3 is\n listed as a project of its own.\n* apache/kvrocks/THREAT_MODEL.md covers the server only and defers the\n cluster control plane to apache/kvrocks-controller, which publishes its\n own model. The controller is now registered as a project of the PMC.\n\nAssisted-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "76902f1037cc117d43e41e0fd36c0ae37f3d68ba", "tree": "50333fe6549c75afdc92720fd1e3aa19d8fcb21a", "parents": [ "0a4e5f390eb69ddcd4ccbb574c858cbe06d643b6" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Sep 11 17:33:38 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Sep 11 17:33:38 2026 +0200" }, "message": "CVE updates from 2026-09-03 through 2026-09-10\n\nRegenerate the project pages with the latest public CVE data from\ncveprocess.apache.org. No metadata changes.\n\nAssisted-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "0a4e5f390eb69ddcd4ccbb574c858cbe06d643b6", "tree": "82c339b1cf1435f8755c80e7129dc8d5ae307254", "parents": [ "6a1133de2fd771a98a5988be24da2fca938b65f1", "6ae9106f5460cefd3587daecb3551dd977c50065" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Thu Sep 03 16:03:51 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 03 16:03:51 2026 +0200" }, "message": "Merge pull request #95 from apache/hbase-phoenix-security-contacts\n\nUse the new HBase and Phoenix security lists as contacts" }, { "commit": "6ae9106f5460cefd3587daecb3551dd977c50065", "tree": "82c339b1cf1435f8755c80e7129dc8d5ae307254", "parents": [ "f1adca711add982fc74d09b8a9d2104501b4d4da" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Thu Sep 03 14:31:52 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Thu Sep 03 14:31:52 2026 +0200" }, "message": "Regenerate pages with the HBase and Phoenix security contacts\n\nAssisted-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "f1adca711add982fc74d09b8a9d2104501b4d4da", "tree": "0b43ddbcd40cd338b0331918f6b00b28cdb44997", "parents": [ "88d9fc3eb50739f0abf353a353dfb20bc284722a" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Thu Sep 03 14:31:52 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Thu Sep 03 14:31:52 2026 +0200" }, "message": "Use the new HBase and Phoenix security lists as contacts\n\nThe HBase and Phoenix PMCs now have dedicated security@hbase.apache.org\nand security@phoenix.apache.org lists.\n\nAssisted-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "6a1133de2fd771a98a5988be24da2fca938b65f1", "tree": "2f392979cdcb1765271a4c0265f2ada9eb608d4c", "parents": [ "1fb33b1b5d54390636ef6832de24c3ec011656df", "88d9fc3eb50739f0abf353a353dfb20bc284722a" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Thu Sep 03 14:31:47 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 03 14:31:47 2026 +0200" }, "message": "Merge pull request #94 from apache/cve-updates-2026-09-03\n\nCVE updates from 2026-08-25 through 2026-09-02" }, { "commit": "88d9fc3eb50739f0abf353a353dfb20bc284722a", "tree": "2f392979cdcb1765271a4c0265f2ada9eb608d4c", "parents": [ "1fb33b1b5d54390636ef6832de24c3ec011656df" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Thu Sep 03 14:29:48 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Thu Sep 03 14:29:48 2026 +0200" }, "message": "CVE updates from 2026-08-25 through 2026-09-02\n\nRegenerate the project pages with the latest public CVE data from\ncveprocess.apache.org. No metadata changes.\n\nAssisted-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "1fb33b1b5d54390636ef6832de24c3ec011656df", "tree": "9ac78e2f84d1a5ea539cc371746a5d2c98f9881d", "parents": [ "63ff9d5b8aeae00ca401e182703aabcbf9c073cd" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Wed Sep 02 13:43:37 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 13:43:37 2026 +0200" }, "message": "Spark: include a link to the security model source (#92)" }, { "commit": "63ff9d5b8aeae00ca401e182703aabcbf9c073cd", "tree": "66b8c0842dba0134ac621b551d63b7577b16f7cc", "parents": [ "a7ac53d17b6e7c25535aeb7e4a77cc209063a0b2", "6e53fff50e6b575c0f17f77f1673f8f51228ea33" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Mon Aug 31 13:22:17 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 13:22:17 2026 +0200" }, "message": "Merge pull request #93 from papegaaij/wicket-security-model\n\nAdd security model coordinates for Apache Wicket" }, { "commit": "6e53fff50e6b575c0f17f77f1673f8f51228ea33", "tree": "66b8c0842dba0134ac621b551d63b7577b16f7cc", "parents": [ "a7ac53d17b6e7c25535aeb7e4a77cc209063a0b2" ], "author": { "name": "Emond Papegaaij", "email": "papegaaij@apache.org", "time": "Mon Aug 31 12:51:46 2026 +0200" }, "committer": { "name": "Emond Papegaaij", "email": "papegaaij@apache.org", "time": "Mon Aug 31 12:51:46 2026 +0200" }, "message": "add wicket security model\n\nAssisted-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "a7ac53d17b6e7c25535aeb7e4a77cc209063a0b2", "tree": "d48d4c54839282616779826b9f3895acc92dae58", "parents": [ "acbf9e9c1dc38b01e4c7c9ab516b78db5acfcfb3", "b1435a5d81a7232d2a82d8758b7f619b76c7a51d" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Thu Aug 27 09:22:57 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 27 09:22:57 2026 +0200" }, "message": "Merge pull request #91 from raboof/phoenix-security-model\n\nadd phoenix security model" }, { "commit": "b1435a5d81a7232d2a82d8758b7f619b76c7a51d", "tree": "d48d4c54839282616779826b9f3895acc92dae58", "parents": [ "acbf9e9c1dc38b01e4c7c9ab516b78db5acfcfb3" ], "author": { "name": "Arnout Engelen", "email": "arnout@bzzt.net", "time": "Wed Aug 26 17:27:08 2026 +0200" }, "committer": { "name": "Arnout Engelen", "email": "arnout@bzzt.net", "time": "Wed Aug 26 17:27:08 2026 +0200" }, "message": "add phoenix security model\n" }, { "commit": "acbf9e9c1dc38b01e4c7c9ab516b78db5acfcfb3", "tree": "8e903df8773aad974decf6cc762f867835024f19", "parents": [ "3f73a69705bb82ce62255b18f4cb5e3c7d5d9cca" ], "author": { "name": "Piotr P. Karwasz", "email": "pkarwasz-github@apache.org", "time": "Wed Aug 26 12:16:52 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 26 12:16:52 2026 +0200" }, "message": "Add security model coordinates for Apache OpenNLP (#89)\n\n* Add security model coordinates for Apache OpenNLP\n\nThe OpenNLP security model is maintained in SECURITY.md in the\napache/opennlp repository; the project\u0027s website security page points to\nit as the authoritative version.\n\nAssisted-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n\n* Regenerate pages with OpenNLP security model link\n\nAssisted-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "3f73a69705bb82ce62255b18f4cb5e3c7d5d9cca", "tree": "6e4b06b92f582ad211ceadef37c0a5e0d61ec579", "parents": [ "1d43c53845442af1d7eb364fd4dddc9d3d412974" ], "author": { "name": "Piotr P. Karwasz", "email": "pkarwasz-github@apache.org", "time": "Wed Aug 26 12:16:51 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 26 12:16:51 2026 +0200" }, "message": "CVE updates from 2026-08-24 through 2026-08-25 (#88)\n\nAssisted-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "1d43c53845442af1d7eb364fd4dddc9d3d412974", "tree": "4226ddac3c9d5cbc312fae60d02248242622fe94", "parents": [ "3d944abac1761bbcae742bc02e8d006556c92b05" ], "author": { "name": "Arnout Engelen", "email": "arnout@bzzt.net", "time": "Tue Aug 25 15:31:37 2026 +0200" }, "committer": { "name": "Arnout Engelen", "email": "arnout@bzzt.net", "time": "Tue Aug 25 15:31:37 2026 +0200" }, "message": "Credit binarly research for finding two GH tokens\n" }, { "commit": "3d944abac1761bbcae742bc02e8d006556c92b05", "tree": "8d8434bec5185ce9b80f91dc9c1a264dd65ea9ad", "parents": [ "60118774f2963504bc674c4e2788d2f2197f4ca3", "f6a209f7cf0b04efad2da10f25c79619bc71ef32" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Mon Aug 24 13:48:59 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 24 13:48:59 2026 +0200" }, "message": "Merge pull request #87 from apache/podling-coordinates\n\nAdd security coordinates for Asyncband and Maka podlings\n" }, { "commit": "f6a209f7cf0b04efad2da10f25c79619bc71ef32", "tree": "8d8434bec5185ce9b80f91dc9c1a264dd65ea9ad", "parents": [ "1f2ff9b9419536e4f6abf2201c057231c2c4443b" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Mon Aug 24 13:21:30 2026 +0200" }, "committer": { "name": "Arnout Engelen", "email": "arnout@engelen.eu", "time": "Mon Aug 24 13:45:43 2026 +0200" }, "message": "Regenerate projects overview with Asyncband and Maka\n\nAssisted-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "1f2ff9b9419536e4f6abf2201c057231c2c4443b", "tree": "c7aaebfaac6bbfec9bad29ae97d4beb66a3c3440", "parents": [ "60118774f2963504bc674c4e2788d2f2197f4ca3" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Mon Aug 24 13:21:30 2026 +0200" }, "committer": { "name": "Arnout Engelen", "email": "arnout@engelen.eu", "time": "Mon Aug 24 13:45:43 2026 +0200" }, "message": "Add security coordinates for Asyncband and Maka podlings\n\nBoth entered incubation in 2026-08 and have no dedicated security list,\nadvisories or logo yet. Maka already publishes a security policy and a\ncontributing guide in its repository; Asyncband has neither, so all its\noptional fields are null.\n\nAssisted-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "60118774f2963504bc674c4e2788d2f2197f4ca3", "tree": "1d9f004258d7306296057440cd18ef64147b43de", "parents": [ "6e2340e20d0116edb1a8d475211eee5ba9a0d138", "6b41ef0bcced11d7576fc360d301d2adc817822a" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Mon Aug 24 13:45:40 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 24 13:45:40 2026 +0200" }, "message": "Merge pull request #85 from apache/sourcelume-coordinates\n\nAdd security coordinates for Apache Sourcelume\n" }, { "commit": "6b41ef0bcced11d7576fc360d301d2adc817822a", "tree": "1d9f004258d7306296057440cd18ef64147b43de", "parents": [ "4ef903b76869410d5ba8717d234ca2e7c594dc2e" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Mon Aug 24 12:54:31 2026 +0200" }, "committer": { "name": "Arnout Engelen", "email": "arnout@engelen.eu", "time": "Mon Aug 24 13:43:56 2026 +0200" }, "message": "Regenerate projects overview with Apache Sourcelume\n\nAssisted-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "4ef903b76869410d5ba8717d234ca2e7c594dc2e", "tree": "acb2d9749ff08bfc1facdd56632de03e439c850c", "parents": [ "6e2340e20d0116edb1a8d475211eee5ba9a0d138" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Mon Aug 24 12:54:31 2026 +0200" }, "committer": { "name": "Arnout Engelen", "email": "arnout@engelen.eu", "time": "Mon Aug 24 13:43:56 2026 +0200" }, "message": "Add security coordinates for Apache Sourcelume\n\nNew TLP (established 2026-08) with a dedicated security mailing list.\nNo website, logo, security model or advisories exist yet, so every\noptional field is null.\n\nAssisted-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "6e2340e20d0116edb1a8d475211eee5ba9a0d138", "tree": "9b76819971325a174c593fb5ffce12ddfb74fbc4", "parents": [ "2d64616086b7c754452dd68936410b8bd4604fc1", "650245005f865ac68948a7b6cbd149162109b01c" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Mon Aug 24 13:43:53 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 24 13:43:53 2026 +0200" }, "message": "Merge pull request #84 from apache/cve-updates-2026-08-24\n\nCVE updates from 2026-08-11 through 2026-08-24\n" }, { "commit": "650245005f865ac68948a7b6cbd149162109b01c", "tree": "9b76819971325a174c593fb5ffce12ddfb74fbc4", "parents": [ "2d64616086b7c754452dd68936410b8bd4604fc1" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Mon Aug 24 12:51:07 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Mon Aug 24 12:57:11 2026 +0200" }, "message": "CVE updates from 2026-08-11 through 2026-08-24\n\nRegenerate project pages with the latest public CVE data: 58 new\nadvisories, one retitled advisory (CVE-2025-59060) and a new page for\nApache Shindig (retired, but subject of a fresh advisory).\n\nAssisted-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "2d64616086b7c754452dd68936410b8bd4604fc1", "tree": "c0a92caa1c88a1eb7fba50c5b7ebebf7e9a941b0", "parents": [ "0a597864fea7e4ad1e5ad82e4dd6e82ec0b2bcd8", "08af9a60715a3bdd0d72d1adc17ef7e2f1ea9c53" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Mon Aug 10 19:40:40 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 10 19:40:40 2026 +0200" }, "message": "Merge pull request #83 from apache/add-syncope-threat-model\n\nAdd Syncope threat model" }, { "commit": "0a597864fea7e4ad1e5ad82e4dd6e82ec0b2bcd8", "tree": "fe258bb4e0addb4d2e4df29816dffdfb7a9c557d", "parents": [ "bce87b22eee208198ef00966d176158f83b8ed02", "4e2087bc257b3085ed369a887842728745c2bae4" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Mon Aug 10 19:39:54 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 10 19:39:54 2026 +0200" }, "message": "Merge pull request #82 from apache/cve-updates-2026-08-10\n\nCVE updates from 2026-08-03 through 2026-08-10" }, { "commit": "08af9a60715a3bdd0d72d1adc17ef7e2f1ea9c53", "tree": "c0a92caa1c88a1eb7fba50c5b7ebebf7e9a941b0", "parents": [ "4e2087bc257b3085ed369a887842728745c2bae4" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Mon Aug 10 19:11:34 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Mon Aug 10 19:11:34 2026 +0200" }, "message": "Add Syncope threat model\n\nApache Syncope has no dedicated security page yet, but the reference\nguide\u0027s \"REST Authorization Summary\" describes how its RESTful services\nare partitioned by the authentication and authorization they require:\nanonymous endpoints, endpoints gated by the shared anonymous key,\nself-service endpoints requiring authentication, and administrative\nendpoints requiring entitlements granted through roles.\n\nThat is the closest thing the project currently documents to a threat\nmodel, so link it until the PMC publishes something better.\n\nAssisted-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "4e2087bc257b3085ed369a887842728745c2bae4", "tree": "fe258bb4e0addb4d2e4df29816dffdfb7a9c557d", "parents": [ "81f992e1004d8c7b7505c45514e22d7552ed8f4b" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Mon Aug 10 19:07:49 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Mon Aug 10 19:07:49 2026 +0200" }, "message": "CVE updates from 2026-08-03 through 2026-08-10\n\nRegenerates the project pages with CVEs disclosed between 2026-08-03 and\n2026-08-10: 72 new advisories across 12 projects (CVE and OSV JSON files\nplus regenerated project pages).\n\nNew advisories: qpid (24), cxf (12), ranger (10), answer (6), apr (5),\nnifi (4), lucy (4), fory (3), jena (1), polaris (1), iotdb (1),\ntapestry (1). Lucy and Qpid get their first advisory pages.\n\nRanger CVE-2026-32227 has no OSV file: cve2osv.py does not yet support\nexplicitly \u0027unaffected\u0027 version ranges, as with the 45 advisories already\nin that situation.\n\nAssisted-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "81f992e1004d8c7b7505c45514e22d7552ed8f4b", "tree": "a2f4bef568b790f4879471e408c9ad34ee03949a", "parents": [ "c2490da2b20e8d49c969328c358486ef789a2a46" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Mon Aug 10 19:07:34 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Mon Aug 10 19:07:34 2026 +0200" }, "message": "Add coordinates for 24 podlings, mark BifroMQ and Seata incubating\n\nFills the gaps reported by the new missing-coordinates warning: amoro,\nauron, burr, caldera, casbin, cloudberry, fesod, fluss, geaflow, graphar,\nhamilton, iggy, kie, openserverless, ossie, otava, ozhera, pegasus,\nponymail, pouchdb, resilientdb, texera, toree and xtable. Most report to\nsecurity@apache.org and publish no security model yet; cloudberry, fluss,\nhamilton, iggy and texera have their own links.\n\nAlso renames BifroMQ and Seata to \"(Incubating)\", matching their current\nstatus.\n\nAssisted-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "c2490da2b20e8d49c969328c358486ef789a2a46", "tree": "bb2dde0a961aca126dff240c107c3be05d05e96a", "parents": [ "bce87b22eee208198ef00966d176158f83b8ed02" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Mon Aug 10 19:07:25 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Mon Aug 10 19:07:25 2026 +0200" }, "message": "Warn about projects missing security coordinates\n\nA project only appears on the overview page when project-coordinates.json\nhas an entry for it, so a newly created PMC or podling silently stays off\nthe site until someone notices. Print the list of committees without\ncoordinates at generation time, skipping retired committees and the three\nthat ship no software (attic, comdev, incubator).\n\nAssisted-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "bce87b22eee208198ef00966d176158f83b8ed02", "tree": "16682251db1fde1168dcd1058858cd4758982df3", "parents": [ "1fcf35ead9f283a5bb25762e52d7df8065b182ba" ], "author": { "name": "Piotr P. Karwasz", "email": "pkarwasz-github@apache.org", "time": "Mon Aug 03 13:24:40 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 03 13:24:40 2026 +0200" }, "message": "Add BifroMQ threat model (#81)\n\n* Add BifroMQ threat model\n\nAdds a reference to the Apache BifroMQ security model to\n`security.apache.org`, and with it the first BifroMQ entry in the\nprojects overview.\n\nAssisted-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n\n* Regenerate project pages\n\nPicks up the current CVE feed and project metadata:\n\n* Fluss has graduated, so it is no longer listed as \"(Incubating)\".\n* Refreshed \"last updated\" stamps on three Thrift advisories.\n* Drops CVE-2026-66713 from the Axis page. The record is still\n PUBLISHED at MITRE, but it is no longer present in\n https://cveprocess.apache.org/publicjson, which is what these pages\n are generated from.\n\nAssisted-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e" }, { "commit": "1fcf35ead9f283a5bb25762e52d7df8065b182ba", "tree": "b2c6d06d7ddb64e8774b1b02e2894b9fb63dcbd6", "parents": [ "baf3bc1af94f80bbfd2cce90e0ece9a6f54a998c" ], "author": { "name": "Piotr P. Karwasz", "email": "pkarwasz-github@apache.org", "time": "Mon Aug 03 12:40:17 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 03 12:40:17 2026 +0200" }, "message": "Delete head branches after a PR is merged (#80)\n\nMerged PR branches currently linger in the repository. Enable\n`github.pull_requests.del_branch_on_merge` so GitHub removes them\nautomatically.\n\nAssisted-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e" }, { "commit": "baf3bc1af94f80bbfd2cce90e0ece9a6f54a998c", "tree": "e67ceb043adf283effb42975773b929d90fd437f", "parents": [ "d300ee10da81b990ce01e32006c1ae5678771091" ], "author": { "name": "Piotr P. Karwasz", "email": "pkarwasz-github@apache.org", "time": "Mon Aug 03 12:31:19 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 03 12:31:19 2026 +0200" }, "message": "Send repository notifications to commits@security.apache.org (#79)\n\nThe `private@security.apache.org` list is for confidential traffic; the\nnew `commits@security.apache.org` list is the right target for\nrepository events on this public repo. Also adds the `jobs` scheme so\nbuild notifications land in the same place.\n\nAssisted-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e" }, { "commit": "d300ee10da81b990ce01e32006c1ae5678771091", "tree": "8d444921220b31b47e1fd80d109aabc430607ad5", "parents": [ "def829caa6d942b19cb171d584a7f9d6f4499f4e" ], "author": { "name": "Piotr P. Karwasz", "email": "pkarwasz-github@apache.org", "time": "Fri Jul 31 13:08:18 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 31 13:08:18 2026 +0200" }, "message": "CVE updates from 2026-07-30 through 2026-07-31 (#78)\n\n* CVE updates from 2026-07-30 through 2026-07-31\n\nRegenerates the project pages with CVEs disclosed on 2026-07-30 and\n2026-07-31: 16 new advisories across 6 projects (CVE and OSV JSON files\nplus regenerated project pages).\n\nAssisted-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n\n* cve2osv: tolerate references without tags\n\nCVE records may contain references that have no tags field. The\nconverter crashed with a KeyError on such records, so their OSV files\nwere never generated or updated. Treat a missing tags field as an empty\ntag list.\n\nAssisted-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n\n* Regenerate OSV files previously blocked by untagged references\n\nThe cve2osv fix allows 29 advisories to convert to OSV format for the\nfirst time (including JSPWiki CVE-2026-28811 and Zeppelin\nCVE-2026-44617 from this batch) and refreshes 6 stale OSV files whose\nCVE records had gained untagged references since their last successful\nconversion. Project pages gain the corresponding OSV json links.\n\nAssisted-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "def829caa6d942b19cb171d584a7f9d6f4499f4e", "tree": "6a0d8feddeeca5efb103c9018e519308acd369c2", "parents": [ "46dffe9efd924b13369fa2f5426705276b72be1f" ], "author": { "name": "Piotr P. Karwasz", "email": "pkarwasz-github@apache.org", "time": "Fri Jul 31 12:33:06 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 31 12:33:06 2026 +0200" }, "message": "Add Calcite threat model (#75)\n\nAdds a reference to Calcite threat model to `security.apache.org`." }, { "commit": "46dffe9efd924b13369fa2f5426705276b72be1f", "tree": "216412a53f41d4926351ef1719a2cf69adf9ba0d", "parents": [ "fb3ba8c2e23788bd9ddca1e51021b698c28d63c1" ], "author": { "name": "Piotr P. Karwasz", "email": "pkarwasz-github@apache.org", "time": "Wed Jul 29 20:24:47 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 29 20:24:47 2026 +0200" }, "message": "Clarify reporting instructions in report-code.md (#76)\n\nRestructure the introduction so that reporters can more easily find:\n\n- the three requirements for using the security contacts (a security\n vulnerability, undisclosed, in an ASF project), each with guidance\n for common mistakes such as forwarding scanner findings about\n already published CVEs,\n- the address to send the report to (per-project address listed on\n /projects, with security@apache.org as fallback),\n- the formal requirements of report emails, including the [SECURITY]\n subject prefix that matches the spam filter exclusion rule.\n\nThe text is reformatted using semantic line breaks.\n\nAssisted-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "fb3ba8c2e23788bd9ddca1e51021b698c28d63c1", "tree": "fb3c97a3cdcba06d76b98875249c072480a0b275", "parents": [ "63540028f9cee5b6a522752aafcc2be86fab6955" ], "author": { "name": "Piotr P. Karwasz", "email": "pkarwasz-github@apache.org", "time": "Wed Jul 29 20:22:53 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 29 20:22:53 2026 +0200" }, "message": "CVE updates from 2026-07-27 through 2026-07-29 (#77)\n\nAssisted-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "63540028f9cee5b6a522752aafcc2be86fab6955", "tree": "ee82ac60d845a969bb30913a5f1087eb62cf3f92", "parents": [ "a052793d80f921382ec3024871d79da653792ee6" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Mon Jul 27 08:49:36 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Mon Jul 27 08:49:36 2026 +0200" }, "message": "Fix disclosure order\n" }, { "commit": "a052793d80f921382ec3024871d79da653792ee6", "tree": "83bdf3f846e9fbd456fc6746935b136c4e525e11", "parents": [ "035c6539628628403bd3518d5e04b43f9ecc7007" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Mon Jul 27 07:57:48 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Mon Jul 27 07:57:48 2026 +0200" }, "message": "Threat model and CVE updates up to 2026-07-26\n" }, { "commit": "035c6539628628403bd3518d5e04b43f9ecc7007", "tree": "74a0b97d6633edfbce074eaa6ca919dbd2186346", "parents": [ "1ec2440bfd8f47ff50026ffcb22c3a5db913e2af" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Mon Jul 27 07:51:00 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jul 27 07:51:00 2026 +0200" }, "message": "Add and correct verified threat-model links in project-coordinates.json (#74)\n\n* Add and correct verified threat-model links in project-coordinates.json\n\nPopulate and correct security_model_link / security_model_source for 66\nPMCs whose threat models the ASF Security team has verified, and add\nCommons-style projects[] arrays for 9 multi-repo PMCs (axis, freemarker,\ngrails, jackrabbit, polaris, superset, teaclave, trafficserver, ws).\n\nEvery URL was deterministically verified to resolve: 72 GitHub files via\nthe contents API and 9 project-site pages. This fixes several stale\nentries that pointed at GitHub\u0027s /security/policy tab or non-existent\npaths (e.g. apisix pointed at a root THREAT_MODEL.md that does not exist;\nits model lives under docs/en/latest/). Adds advisory_link: null to the\ncamel entry to satisfy the schema.\n\nGenerated-by: Claude Opus 4.8 (1M context)\n\n* Use short branch form in raw.githubusercontent.com source URLs\n\nStrip the redundant refs/heads/ segment from all security_model_source\nlinks, as requested in PR #74 review. All 87 raw URLs in the file were\nverified to still resolve with HTTP 200.\n\nAssisted-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n\n* Restore rendered website link for the Camel security model\n\nPoint security_model_link back at camel.apache.org as requested in\nPR #74 review; the GitHub source stays in security_model_source.\nThe rendered page was verified to resolve with HTTP 200.\n\nAssisted-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n\n* Link the security/policy tab whenever the model is SECURITY.md\n\nWhen security_model_source is the repository\u0027s SECURITY.md on its\ndefault branch, point security_model_link at the GitHub security/policy\ntab, which renders the same file more cleanly. Converts 13 blob links\n(fineract, freemarker, impala, parquet-java, pdfbox, superset, tomee,\ntrafficserver and the axis, freemarker and trafficserver sub-projects);\nbaremaps, hadoop, httpd, paimon and pulsar already followed this\nconvention. Each source branch was checked to be the repository default\nand all 18 policy pages resolve with HTTP 200.\n\nAssisted-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n\n* Move WSS4J threat model into the ws projects list\n\nWSS4J is one of the projects under the Web Services PMC, so its threat\nmodel belongs in the projects array next to Axiom, XmlSchema and\nNeethi rather than at the PMC level, as noted in PR #74 review. The\nURLs are unchanged.\n\nAssisted-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n\n* Add the Apache Knox threat model\n\nKnox documents its threat model in THREAT_MODEL.md on the default\nbranch; the raw URL was verified to resolve with HTTP 200.\n\nAssisted-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Piotr P. Karwasz \u003cpiotr@github.copernik.eu\u003e" }, { "commit": "1ec2440bfd8f47ff50026ffcb22c3a5db913e2af", "tree": "bfe81f4e822b9dc0ba3c282cda828818b4a672d3", "parents": [ "688b49dd77e12d8bea3c3d690f69122f8f07c16a" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Tue Jul 21 13:14:12 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Tue Jul 21 13:14:12 2026 +0200" }, "message": "2026-07-21 CVE updates\n" }, { "commit": "688b49dd77e12d8bea3c3d690f69122f8f07c16a", "tree": "ea4a8d5d615e47a05e45c6180b9d69bf8f3d75a3", "parents": [ "be7765efeaa2f3d6a6239a6c0d056e9d8f5c6c6e", "db30e1acb377a668955529179bcf20e51285c2ec" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Sun Jul 19 01:01:58 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 19 01:01:58 2026 +0100" }, "message": "Merge pull request #62 from oscerd/camel-advisories-link\n\nAdd security advisories link for Apache Camel" }, { "commit": "db30e1acb377a668955529179bcf20e51285c2ec", "tree": "ea4a8d5d615e47a05e45c6180b9d69bf8f3d75a3", "parents": [ "987fb519f4a944bd4376b725c50aa09c2694f50e", "be7765efeaa2f3d6a6239a6c0d056e9d8f5c6c6e" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Sun Jul 19 01:01:49 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 19 01:01:49 2026 +0100" }, "message": "Merge branch \u0027main\u0027 into camel-advisories-link" }, { "commit": "be7765efeaa2f3d6a6239a6c0d056e9d8f5c6c6e", "tree": "e254796190daa893bc29351b01e62490348c1399", "parents": [ "c69c1dfc2219fd5140ab8d7fc0a2f224d58efb3b", "12373cb4cf2a7e41f54708820c4689d7b1aaf6a3" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Sun Jul 19 00:17:58 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Sun Jul 19 00:17:58 2026 +0200" }, "message": "Merge remote-tracking branch \u0027apache/cve-updates-2026-07-17\u0027\n" }, { "commit": "12373cb4cf2a7e41f54708820c4689d7b1aaf6a3", "tree": "e254796190daa893bc29351b01e62490348c1399", "parents": [ "cf40c2bf16ee9314cd57a40ad23b98cbc900528a", "a081bb94ba157bfe25ad0617fde9e9aa98960e95" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Sat Jul 18 21:28:11 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Jul 18 21:28:11 2026 +0100" }, "message": "Merge pull request #73 from apache/pmc-projects-schema\n\nSupport PMCs that ship multiple projects (Apache Commons example)" }, { "commit": "a081bb94ba157bfe25ad0617fde9e9aa98960e95", "tree": "e254796190daa893bc29351b01e62490348c1399", "parents": [ "a793683ee7e07e7279e654f5da1c9b7450f89c91" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Sat Jul 18 19:58:08 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Sat Jul 18 19:58:08 2026 +0200" }, "message": "Regenerate project pages for simplified mail subject\n\nAssisted-By: Claude Opus 4.8 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "a793683ee7e07e7279e654f5da1c9b7450f89c91", "tree": "261e7035ca5b2a6bb324d3976db1f1e43ca0fa8a", "parents": [ "c328b906968c9b912ee645d90d8c5d168b048699" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Sat Jul 18 19:58:07 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Sat Jul 18 19:58:07 2026 +0200" }, "message": "Simplify mailto subject to bare project name\n\nDrop the \u0027[FINDING]\u0027 tag and the redundant \u0027Apache \u0027 prefix from the\nprefilled mail subject, so reporting Apache Accumulo yields subject\n\u0027Accumulo\u0027 instead of \u0027[FINDING] Apache Accumulo\u0027. Reuse the existing\ndisplay_name() helper rather than a bespoke word-stripper.\n\nSuggested-by: Arnout Engelen\nAssisted-By: Claude Opus 4.8 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "c328b906968c9b912ee645d90d8c5d168b048699", "tree": "afd0e89f4839ce7c9e84b91da74babf7d6dfe3c3", "parents": [ "e2da45b6264ce744b25e229afcf345709c5a9bfe" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Jul 17 23:12:35 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Jul 17 23:12:35 2026 +0200" }, "message": "Regenerate project pages for Commons security models\n\nRebuild the overview and per-project pages so each security model is\nlisted under a \u0027Security model(s)\u0027 heading, including the Commons PMC\nand its per-project models.\n\nAssisted-By: Claude Opus 4.8 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "e2da45b6264ce744b25e229afcf345709c5a9bfe", "tree": "36b0b2e2bdc76d0b0490a4bf7a44a53ab19adc17", "parents": [ "88c8144cc3674654a9354c4011551333f7fe0f17" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Jul 17 23:05:34 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Jul 17 23:05:34 2026 +0200" }, "message": "Register Apache Commons multi-project security models\n\nUse Apache Commons as the first example of a PMC that ships several\nprojects. Point the Commons entry at its new umbrella threat model\n(commons.apache.org/threat_model.html, sourced from the cms-site SVN)\nrather than the older CVE-listing security page, and list the Commons\ncomponents that publish a threat model of their own:\n\n - Apache Commons Configuration\n - Apache Commons Imaging\n - Apache Commons XML\n\nThese are the proper Commons components whose security pages describe\ncomponent-specific security properties (what untrusted input is and is\nnot expected to be safe). Components that only list CVEs or defer to the\nglobal Commons security page are left out.\n\nAssisted-By: Claude Opus 4.8 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "88c8144cc3674654a9354c4011551333f7fe0f17", "tree": "c3ae4e2a9a5d369cf096749a32acef504edcc45c", "parents": [ "cf40c2bf16ee9314cd57a40ad23b98cbc900528a" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Jul 17 13:28:03 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Jul 17 22:51:52 2026 +0200" }, "message": "Support PMCs that ship multiple projects\n\nSome PMCs maintain more than one project, each with its own security\nmodel. Rename the schema\u0027s \"project\" def to \"pmc\" and introduce a new\n\"project\" def holding the three fields a named piece of software needs:\nname, security_model_link and security_model_source. A \"pmc\" extends\n\"project\" and gains an optional \"projects\" list for the individual\nprojects it ships.\n\nThe extension uses allOf, so the closure keyword had to change from\n\"additionalProperties\": false to \"unevaluatedProperties\": false:\nadditionalProperties only considers the properties declared next to it\nand would reject the keys a \"pmc\" adds on top of \"project\".\n\nproject-page.py now renders every security_model_link (the PMC\u0027s own\nplus one per project) as a list of links, each labelled\n\"\u003cname\u003e security model\".\n\nAssisted-By: Claude Opus 4.8 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "c69c1dfc2219fd5140ab8d7fc0a2f224d58efb3b", "tree": "421b182691d3d21ea7efd941d366fb9e2b0eac96", "parents": [ "c90027ce420fd48e050734728cf6e01bebd20d77", "cf40c2bf16ee9314cd57a40ad23b98cbc900528a" ], "author": { "name": "Arnout Engelen", "email": "engelen@apache.org", "time": "Fri Jul 17 21:15:08 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 17 21:15:08 2026 +0100" }, "message": "Merge pull request #72 from apache/cve-updates-2026-07-17\n\n2026-07-17 CVE updates" }, { "commit": "cf40c2bf16ee9314cd57a40ad23b98cbc900528a", "tree": "421b182691d3d21ea7efd941d366fb9e2b0eac96", "parents": [ "c90027ce420fd48e050734728cf6e01bebd20d77" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Jul 17 21:37:01 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Jul 17 21:37:01 2026 +0200" }, "message": "2026-07-17 CVE updates\n\nRegenerate project pages against a freshly fetched advisory index\n(cveprocess.apache.org/publicjson). Adds 17 new advisories across\naccumulo, airflow, ant, doris, fineract, gravitino, kylin, logging,\nopenmeetings and tomcat, refreshes enriched airflow CVE records, and\npublishes the security-page links for the threat models registered\nsince the last regeneration.\n\nAssisted-By: Claude Opus 4.8 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "c90027ce420fd48e050734728cf6e01bebd20d77", "tree": "724b1be04ef6f818eb1d7570172c34b349dc8328", "parents": [ "a9d9355f68d69e4024e15f020675b4e155ad26ec" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Jul 17 14:39:54 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Jul 17 14:39:54 2026 +0200" }, "message": "Register security models for avro, parquet, shenyu; fix cloudstack\n\nA search across coordinates, git repos, AGENTS.md chains, project\nwebsites and cwiki found three projects that publish a real threat\nmodel but had none registered, plus one entry pointing at the wrong\npage.\n\n* avro: website \"Security Model\" section (library scope: transport out\n of scope, side-channel leakage a non-goal, supply chain a caller\n duty).\n* parquet: SECURITY.md carries a \"Threat model\" section (untrusted\n files, caller-imposed resource limits, class loading not itself a\n vulnerability). Lives in parquet-java.\n* shenyu: SECURITY_MODEL.md, linked from SECURITY.md, states that all\n authenticated Admin users are fully trusted and that RBAC is not a\n hard security boundary.\n* cloudstack: was pointing at https://cloudstack.apache.org/security/,\n which has a \"Security Model\" heading and operator disclaimers but no\n trust boundary over principals. The actual model is the in-repo\n THREAT_MODEL.md, reached via AGENTS.md -\u003e SECURITY.md, and it does\n classify authenticated end users as untrusted.\n\nAll eight URLs verified to return 200. security_model_source uses the\nrefs/heads raw form, matching the majority convention in the file.\n\nAssisted-By: Claude Opus 4.8 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "a9d9355f68d69e4024e15f020675b4e155ad26ec", "tree": "17d3fbc21a2b23d02270092920890c9909d26a79", "parents": [ "e10e4681025bf9dc4cd4526154c316ba5fd405f4" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Jul 17 11:44:57 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Jul 17 11:45:17 2026 +0200" }, "message": "Update threat models\n\nThis commit updates threat model links for the benefit of tools that read `project-coordinates.json`.\n\nAn update to the website will be submitted via PR instead of a direct commit, so it can be reviewed.\n" }, { "commit": "e10e4681025bf9dc4cd4526154c316ba5fd405f4", "tree": "7cd6adca8d5bbceb8ae2156fc675eefa48e05a5e", "parents": [ "954fe39363273e34cdcead87424a63d04719152f" ], "author": { "name": "Arnout Engelen", "email": "arnout@bzzt.net", "time": "Wed Jul 15 12:24:33 2026 +0200" }, "committer": { "name": "Arnout Engelen", "email": "arnout@bzzt.net", "time": "Wed Jul 15 12:24:33 2026 +0200" }, "message": "data update\n" } ], "next": "987fb519f4a944bd4376b725c50aa09c2694f50e" }