the group can be found at [Early Disclosure Membership].

## Security Bulletins

Information about previous Istio vulnerabilities can be found on the
[Security Bulletins] page.

[Support Announcements]: https://istio.io/news/support/
[Istio Security Vulnerabilities]: https://istio.io/about/security-vulnerabilities/
[Security Bulletins]: https://istio.io/news/security/

@Named
public class DefaultRootLocator implements RootLocator {

    public boolean isRootDirectory(Path dir) {
        if (Files.isDirectory(dir.resolve(".mvn"))) {
            return true;
        }
        // we're too early to use the modelProcessor ...
        Path pom = dir.resolve("pom.xml");
        try (InputStream is = Files.newInputStream(pom)) {
            XMLStreamReader parser = new WstxInputFactory().createXMLStreamReader(is);

/**
 * Interface used to locate the root directory for a given project.
 *
 * The root locator is usually looked up from the plexus container.
 * One notable exception is the computation of the early {@code session.rootDirectory}
 * property which happens very early.  The implementation used in this case
 * will be discovered using the JDK service mechanism.
 *
 * The default implementation will look for a {@code .mvn} child directory

/** `101 Switching Protocols` (HTTP/1.1 - RFC 7231) */
const val HTTP_SWITCHING_PROTOCOLS = 101

/** `102 Processing` (WebDAV - RFC 2518)  */
const val HTTP_PROCESSING = 102

/** `103 Early Hints (Early Hints - RFC 8297)` */
const val HTTP_EARLY_HINTS = 103

// --- 2xx Success ---
// /** `2xx Success` (HTTP/1.0 - RFC 7231)  */
// const val HTTP_SUCCESS = 200

/** `200 OK` (HTTP/1.0 - RFC 7231)  */
const val HTTP_OK = 200

  private OverflowAvoidingLockSupport() {}

  static void parkNanos(@CheckForNull Object blocker, long nanos) {
    // Even in the extremely unlikely event that a thread unblocks itself early after only 68 years,
    // this is indistinguishable from a spurious wakeup, which LockSupport allows.
    LockSupport.parkNanos(blocker, min(nanos, MAX_NANOSECONDS_THRESHOLD));
  }

      // actual response status.
      code == 100 -> true

      // Handle Processing (102) & Early Hints (103) and any new codes without failing
      // 100 and 101 are the exceptions with different meanings
      // But Early Hints not currently exposed
      code in (102 until 200) -> true

      else -> false
    }

# it enables a derived --config setting.  If RBE is not available (i.e. there
# is no --config setting), bazel would fail and quit. This script does a quick
# check This script checks for such errors early
if ! grep "rbe_$TFCI_BAZEL_TARGET_SELECTING_CONFIG_PREFIX" .bazelrc; then
  cat <<EOF
ERROR: RBE was enabled via the 'rbe' env in the 'TFCI' variable.
       TFCI: $TFCI

     * instance construction.
     *
     * @param session the Maven session
     * @throws MavenExecutionException in case of issue
     */
    // TODO This is too early for build extensions, so maybe just remove it?
    public void afterSessionStart(MavenSession session) throws MavenExecutionException {
        // do nothing
    }

    /**
     * Invoked after all projects were built.

        null, "" -> null
        else -> protocol
      }
    } else {
      super.getSelectedProtocol(sslSocket)
    }

  companion object {
    val isSupported: Boolean =
      try {
        // Trigger an early exception over a fatal error, prefer a RuntimeException over Error.
        Class.forName("org.bouncycastle.jsse.provider.BouncyCastleJsseProvider", false, javaClass.classLoader)

        true

   * a CountdownLatch).
   */
  @Throws(InterruptedException::class)
  abstract fun dispatch(request: RecordedRequest): MockResponse

  /**
   * Returns an early guess of the next response, used for policy on how an incoming request should
   * be received. The default implementation returns an empty response. Mischievous implementations