the group can be found at [Early Disclosure Membership].

## Security Bulletins

Information about previous Istio vulnerabilities can be found on the
[Security Bulletins] page.

[Support Announcements]: https://istio.io/news/support/
[Istio Security Vulnerabilities]: https://istio.io/about/security-vulnerabilities/
[Security Bulletins]: https://istio.io/news/security/

    The problem is that GWT responds poorly to two .gwt.xml files in the same
    Java package; see https://goo.gl/pRV3Yn for details.

    The summary is that it ignores one file in favor of the other.
    util.concurrent, like nearly all our packages, has two .gwt.xml files: one
    for prod and one for tests. However, unlike our other packages, as of this
    writing it has test supersource but no prod supersource.

    The problem is that GWT responds poorly to two .gwt.xml files in the same
    Java package; see https://goo.gl/pRV3Yn for details.

    The summary is that it ignores one file in favor of the other.
    util.concurrent, like nearly all our packages, has two .gwt.xml files: one
    for prod and one for tests. However, unlike our other packages, as of this
    writing it has test supersource but no prod supersource.

    The problem is that GWT responds poorly to two .gwt.xml files in the same
    Java package; see https://goo.gl/pRV3Yn for details.

    The summary is that it ignores one file in favor of the other.
    util.concurrent, like nearly all our packages, has two .gwt.xml files: one
    for prod and one for tests. However, unlike our other packages, as of this
    writing it has test supersource but no prod supersource.

    The problem is that GWT responds poorly to two .gwt.xml files in the same
    Java package; see https://goo.gl/pRV3Yn for details.

    The summary is that it ignores one file in favor of the other.
    util.concurrent, like nearly all our packages, has two .gwt.xml files: one
    for prod and one for tests. However, unlike our other packages, as of this
    writing it has test supersource but no prod supersource.

@Named
public class DefaultRootLocator implements RootLocator {

    public boolean isRootDirectory(Path dir) {
        if (Files.isDirectory(dir.resolve(".mvn"))) {
            return true;
        }
        // we're too early to use the modelProcessor ...
        Path pom = dir.resolve("pom.xml");
        try (InputStream is = Files.newInputStream(pom)) {
            XMLStreamReader parser = new WstxInputFactory().createXMLStreamReader(is);

    The problem is that GWT responds poorly to two .gwt.xml files in the same
    Java package; see https://goo.gl/pRV3Yn for details.

    The summary is that it ignores one file in favor of the other.
    util.concurrent, like nearly all our packages, has two .gwt.xml files: one
    for prod and one for tests. However, unlike our other packages, as of this
    writing it has test supersource but no prod supersource.

    The problem is that GWT responds poorly to two .gwt.xml files in the same
    Java package; see https://goo.gl/pRV3Yn for details.

    The summary is that it ignores one file in favor of the other.
    util.concurrent, like nearly all our packages, has two .gwt.xml files: one
    for prod and one for tests. However, unlike our other packages, as of this
    writing it has test supersource but no prod supersource.

    The problem is that GWT responds poorly to two .gwt.xml files in the same
    Java package; see https://goo.gl/pRV3Yn for details.

    The summary is that it ignores one file in favor of the other.
    util.concurrent, like nearly all our packages, has two .gwt.xml files: one
    for prod and one for tests. However, unlike our other packages, as of this
    writing it has test supersource but no prod supersource.

    The problem is that GWT responds poorly to two .gwt.xml files in the same
    Java package; see https://goo.gl/pRV3Yn for details.

    The summary is that it ignores one file in favor of the other.
    util.concurrent, like nearly all our packages, has two .gwt.xml files: one
    for prod and one for tests. However, unlike our other packages, as of this
    writing it has test supersource but no prod supersource.