geronimo-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Donald Woods <dwo...@apache.org>
Subject Re: Eliminating the svn repo
Date Wed, 24 Jun 2009 11:43:20 GMT
For DWR, we need 2.0.5 to fix known security vulnerabilities in earlier 
versions.


-Donald

David Jencks wrote:
> The svn repo is a terrible idea and violates the principle that all the 
> dependencies of anything in the maven central repo, must be in the maven 
> central repo.  I've been working to remove the need for stuff in there 
> with some success.
> 
> What's left is:
> 
> jtidy.  This appears to be a dependency only of the 
> testsuite-maven-plugin.  The project is not very active, although it is 
> built with maven 2.  Does anyone know what exactly it's used for?  Can 
> we get rid of it?  Otherwise I guess we'll have to see if we can get the 
> project to release something.
> 
> directwebremoting.  Our version (2.0.5)  appears to have been released 
> but not to a maven repo.  There's a 3.0.M1 released milestone.  I 
> suggest we try it and see if it works for us.  Does anyone know if the 
> 2.0.3 version would work?
> 
> dojo.  I don't know what's in our 0.4.3  dojo-ajax and 1.1.1 dojo-mini 
> jars but I see maven releases of dojo-war at 1.1.1, 1.2 and 1.3  Maybe 
> we can extract what we need from this.  Are we still using the 0.4.3 
> stuff? There's a 0.4.3 dojo-rhino jar..... maybe it's related.
> 
> thanks
> david jencks
> 

Mime
View raw message