Skip to content

security-fix - #80

Merged
jwaisner merged 3 commits into
mainfrom
security-fix
Aug 9, 2026
Merged

security-fix#80
jwaisner merged 3 commits into
mainfrom
security-fix

Conversation

@N6REJ

@N6REJ N6REJ commented Aug 6, 2026

Copy link
Copy Markdown
Collaborator

No description provided.

N6REJ added 2 commits August 6, 2026 18:53
…files, extension support, and dependency management"

This reverts commit a420c13.
…xtension support, and dependency management

SECURITY FIX
@N6REJ
N6REJ requested a review from jwaisner August 6, 2026 23:55
@N6REJ N6REJ added bug 🐛 For known bugs Security 🔐 Security issue labels Aug 6, 2026
@qodo-code-review

Copy link
Copy Markdown

PR Summary by Qodo

Fix bundle release version in build.properties

⚙️ Configuration changes 🕐 Less than 5 minutes

Grey Divider

AI Description

• Correct the bundle release value to match the intended release version.
• Ensure packaging metadata reflects the proper release identifier.
High-Level Assessment

Directly updating the bundle release metadata is the appropriate approach for this change; alternatives would add unnecessary process overhead for a one-line version correction.

Files changed (1) +1 / -1

Other (1) +1 / -1
build.propertiesUpdate bundle.release to correct release identifier +1/-1

Update bundle.release to correct release identifier

• Changes the bundle release value from 2026.8.6 to 2026.7.7 so build/package metadata reflects the intended release version.

build.properties

@qodo-code-review

qodo-code-review Bot commented Aug 6, 2026

Copy link
Copy Markdown

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

Grey Divider


Remediation recommended

1. Release version downgraded ✓ Resolved 🐞 Bug ≡ Correctness
Description
build.properties changes bundle.release from 2026.8.6 to the older date-like value 2026.7.7,
which becomes the Gradle project version and is embedded into release output paths and archive
filenames. This can mislabel newly built artifacts and can overwrite an existing ...-2026.7.7.7z
archive if one is already present because the packaging task deletes any same-named archive before
creating a new one.
Code

build.properties[2]

+bundle.release = 2026.7.7
Evidence
The downgraded bundle.release is used as the build/version identifier throughout the Gradle build,
including output directory computation and the release archive name. The packaging task deletes any
existing archive at the computed path, so an older bundle.release increases the likelihood of
colliding with and overwriting an existing artifact for that older release identifier. The README
explicitly describes bundle.release being updated to “today's date,” which conflicts with setting
it backwards.

build.properties[1-4]
build.gradle[20-28]
build.gradle[36-58]
build.gradle[1363-1371]
README.md[52-65]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`bundle.release` was changed to an older value (`2026.7.7`). This value is used as the Gradle project version and is embedded into output directories and archive filenames, which can mislabel artifacts and collide with prior build outputs.

### Issue Context
- `build.gradle` reads `bundle.release` and uses it for `project.version`, output directory naming, and archive filenames.
- The packaging task deletes any existing archive with the computed name before writing a new one, so collisions can cause overwrites.
- The README documents that the fetch/release flow updates `build.properties` with today's date.

### Fix Focus Areas
- build.properties[1-4]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


To customize comments, go to the Qodo configuration screen, or learn more in the docs.

Qodo Logo

Comment thread build.properties Outdated
@jwaisner
jwaisner merged commit 299e465 into main Aug 9, 2026
2 checks passed
@jwaisner
jwaisner deleted the security-fix branch August 9, 2026 05:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug 🐛 For known bugs Security 🔐 Security issue

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants