Branch: refs/heads/advisory-affected-packages-include-legacy Home: https://github.com/xwiki/xwiki-dev-llm Commit: fb8a5c5f34902b20de7c53e0eea27945fcd6f5e0 https://github.com/xwiki/xwiki-dev-llm/commit/fb8a5c5f34902b20de7c53e0eea279... Author: Simon Urli <[email protected]> Date: 2026-09-11 (Fri, 11 Sep 2026) Changed paths: M xwiki/skills/xwiki-security-advisory/SKILL.md Log Message: ----------- [Misc] List the legacy package too in a security advisory's affected products * A vulnerable module's backward-compatibility counterpart AspectJ-weaves the wrapped module's classes into itself, so it ships its own copy of the vulnerable bytecode: an instance running the legacy jar is vulnerable, and a scanner matching only the main artifact reports it as clean. * Give the naming explicitly ("legacy-" is an infix, xwiki-platform-legacy-oldcore), since the "-legacy module" wording used elsewhere leads to guessing a suffix and a package name GitHub cannot match. * Add the weaveDependencies check and the drop condition, so the rule does not over-list a legacy module that only re-exports unrelated deprecated APIs. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications