Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-dev-llm Commit: fb8a5c5f34902b20de7c53e0eea27945fcd6f5e0 https://github.com/xwiki/xwiki-dev-llm/commit/fb8a5c5f34902b20de7c53e0eea279... Author: Simon Urli <[email protected]> Date: 2026-09-11 (Fri, 11 Sep 2026) Changed paths: M xwiki/skills/xwiki-security-advisory/SKILL.md Log Message: ----------- [Misc] List the legacy package too in a security advisory's affected products * A vulnerable module's backward-compatibility counterpart AspectJ-weaves the wrapped module's classes into itself, so it ships its own copy of the vulnerable bytecode: an instance running the legacy jar is vulnerable, and a scanner matching only the main artifact reports it as clean. * Give the naming explicitly ("legacy-" is an infix, xwiki-platform-legacy-oldcore), since the "-legacy module" wording used elsewhere leads to guessing a suffix and a package name GitHub cannot match. * Add the weaveDependencies check and the drop condition, so the rule does not over-list a legacy module that only re-exports unrelated deprecated APIs. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Commit: ad93bceb937e0f0090e48f1aa46e91f82cc2e7ae https://github.com/xwiki/xwiki-dev-llm/commit/ad93bceb937e0f0090e48f1aa46e91... Author: Vincent Massol <[email protected]> Date: 2026-09-12 (Sat, 12 Sep 2026) Changed paths: M xwiki/skills/xwiki-security-advisory/SKILL.md Log Message: ----------- Merge pull request #132 from xwiki/advisory-affected-packages-include-legacy [Misc] List the legacy package too in a security advisory's affected products Compare: https://github.com/xwiki/xwiki-dev-llm/compare/e993a9fac142...ad93bceb937e To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications