Repository navigation
do not merge! Orca add monorail ibi - #307
Open
daniel-heppner-ibigroup wants to merge 79 commits into
Open
daniel-heppner-ibigroup wants to merge 79 commits into
daniel-heppner-ibigroup wants to merge 79 commits into
Conversation
daniel-heppner-ibigroup
force-pushed
the
orca-add-monorail-ibi
branch
2 times, most recently
from
June 19, 2026 13:17
7fe7812 to
790d0a0
Compare
The TRIAS endpoint ran the request body through an XSLT transformer built from an unhardened TransformerFactory, so a DOCTYPE declaring an external entity was resolved while parsing: an anonymous caller could read local files and make the server issue requests to internal services (XXE). Requests are now read through a SAX reader that rejects a document type declaration outright, which neither the OJP nor the TRIAS profile allows. The OJP endpoint only avoided the same problem because of a default in the JAXB implementation; it now goes through the same reader.
daniel-heppner-ibigroup
force-pushed
the
orca-add-monorail-ibi
branch
from
September 25, 2026 21:41
5360034 to
8023031
Compare
…/test-dependencies Update Test dependencies
…-trias-xxe Harden XML document parsing in OJP and TRIAS requests
…el-osm-decoding Decode OSM PBF data in parallel
Anyone with triage access to the upstream repository can label a PR, and a labeled PR is merged, built and released by a fork's release workflow without further review. The GraphQL query that lists the labeled PRs now also reads the labeling events, and a new optional config `include_prs_labelers` lists the GitHub logins allowed to set the `include_prs_label`. The release stops before anything is merged if the last user who set the label on a PR is not in the list. The head read together with the label is verified when the PR is fetched, so the code merged is the code that was listed. The API token is removed from the environment after the query, so Maven does not inherit it when testing the merged PRs. Omitting the config keeps the current behaviour, with a warning.
…athwayedge-staircount Treat negative `stair_count` as stairs in `PathwayEdge`
…imes-usage Add wildcard type parameter to `TripTimes` usages across codebase
Update NeTEx Java Model to v2.0.16
…ly-application Only build the container image from the application module
Graph.countEdges() walks all 4.3M vertices of the Norwegian graph and dereferences every outgoing edge array, only to format the |E| value of the "Graph loaded." log line. Measured on 8 tst pods, this takes 248-306 ms (median 265 ms) on the main thread during startup, with 218 of 218 JFR samples in that window landing in countEdges(). The deserialized edge collection is already at hand in SerializedGraphObject, and its size is by construction the same number, so use it instead. The log method only reads state of the object it is called on, so make it an instance method.
…unt-edges Avoid counting edges when logging the graph load status
Upstream merge 2026-06-09
daniel-heppner-ibigroup
force-pushed
the
orca-add-monorail-ibi
branch
from
September 25, 2026 21:53
8023031 to
7eb8191
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
12 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
To be completed by pull request submitter:
closes #45).To be completed by @opentripplanner/plc: