We're looking at locking down our code to make sure we cover any injection possibilities.
Some of our queries use VALUES to specify a number of values at once.
Is it possible to use .parameter() to set a list of values?
The JavaDoc seems to indicate that you can only set a single value for a variable.
This is reasonable and we've heard it before, but it's indeed not supported currently (the problem isn't just the API but also that the query above is not syntactically correct SPARQL due to ?oValues).
We have an internal ticket #7925 for it but no firm target date yet.