Jabref Daily: Zotero Compatibility and Security Hardening
JabRef merged a security fix for XML entity expansion vulnerabilities and made major progress on Zotero interoperability, while also patching a Gradle startup bug and reinforcing developer workflow policies. The Zotero work spans multiple linked pull requests and architecture decisions, signaling a multi-week effort still in progress.
Duration: PT2M22S
Episode overview
This episode is a short developer briefing from Jabref Daily.
It explains recent repository work in plain language.
- Show: Jabref Daily
- Published: 2026-07-26T04:00:04Z
- Audio duration: PT2M22S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good day. It's July 26th, 2026, and here's what mattered in the JabRef codebase.
The top story is security: PR sixteen-three-five-nine closes out six CodeQL alerts related to XML external entity expansion, touching fetchers like the ArXiv and ISIDORE fetchers, plus the Marc XML parser and Medline importer. If you work with any XML-based import code, expect stricter parser configuration going…
The second theme is Zotero compatibility, and it's the biggest thread this cycle. PR sixteen-two-eight-two introduces a Zotero-parseable reference mark, reverting an earlier approach from PR sixteen-two-one-zero and adding a dedicated Zotero reference mark class. That PR alone drew twenty-nine comments and a change…
Third, reliability fixes for everyday development. PR sixteen-three-three-four fixes embedded Postgres so `jabgui run` actually starts across platforms — worth remembering if your local Gradle run has been failing. And PR sixteen-three-five-four tightens the bot that nags contributors to follow up on stale reviews,…
A few smaller but notable fixes: quote-aware parsing for custom terminal commands in PR sixteen-three-five-three, a fix for duplicate BST style filenames in…
What's next:…