Repository navigation
Upstream merge 2026-09-28 - #323
Merged
Merged
Conversation
The TRIAS endpoint ran the request body through an XSLT transformer built from an unhardened TransformerFactory, so a DOCTYPE declaring an external entity was resolved while parsing: an anonymous caller could read local files and make the server issue requests to internal services (XXE). Requests are now read through a SAX reader that rejects a document type declaration outright, which neither the OJP nor the TRIAS profile allows. The OJP endpoint only avoided the same problem because of a default in the JAXB implementation; it now goes through the same reader.
…/test-dependencies Update Test dependencies
Anyone with triage access to the upstream repository can label a PR, and a labeled PR is merged, built and released by a fork's release workflow without further review. The GraphQL query that lists the labeled PRs now also reads the labeling events, and a new optional config `include_prs_labelers` lists the GitHub logins allowed to set the `include_prs_label`. The release stops before anything is merged if the last user who set the label on a PR is not in the list. The head read together with the label is verified when the PR is fetched, so the code merged is the code that was listed. The API token is removed from the environment after the query, so Maven does not inherit it when testing the merged PRs. Omitting the config keeps the current behaviour, with a warning.
…-trias-xxe Harden XML document parsing in OJP and TRIAS requests
…el-osm-decoding Decode OSM PBF data in parallel
…-file Verify who labeled the PRs merged by the custom release script
…up-island-pruning Use custom collections to speed up island pruning
…imes-usage Add wildcard type parameter to `TripTimes` usages across codebase
Graph.countEdges() walks all 4.3M vertices of the Norwegian graph and dereferences every outgoing edge array, only to format the |E| value of the "Graph loaded." log line. Measured on 8 tst pods, this takes 248-306 ms (median 265 ms) on the main thread during startup, with 218 of 218 JFR samples in that window landing in countEdges(). The deserialized edge collection is already at hand in SerializedGraphObject, and its size is by construction the same number, so use it instead. The log method only reads state of the object it is called on, so make it an instance method.
Update NeTEx Java Model to v2.0.16
…ly-application Only build the container image from the application module
…unt-edges Avoid counting edges when logging the graph load status
(cherry picked from commit 7e6063c)
(cherry picked from commit d7d3c6d)
(cherry picked from commit 9b22cfb)
(cherry picked from commit 7eb8191)
…/debug-ui-dependencies-(non-major) Update Debug UI dependencies (non-major)
…week (sandbox) ORCA fares: add CT free fares week oct 2026
…fares (sandbox) ORCA Fare Module: enable Monorail fares
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
12 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This one add changes to the ORCA fare calculator courtesy of @daniel-heppner-ibigroup.