It looks like the XML-RPC endpoint doesn't have collision detection. This can lead to lost
edits.

Since xml-rpc is done over http, if-match and etag headers should work to prevent this.
However any existing clients will have to be updated to use it.

I don't see anything in the xmlrpc spec that is designed to prevent this.

Possible sequence that results in lost data:


  user 1 xmlrpc display issue1 status is open
  user 2 xmlrpc display issue1 status is open
  user 2 modifies status to closed via set call
  user 1 modifies status to new via set call

user2's changes are lost.