diff --git a/CHANGELOG.md b/CHANGELOG.md index 3ac5974..54229f4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,14 +4,14 @@ Released entries are grounded in the linked immutable tags, GitHub release notes and retained README announcements. Dates below are GitHub publication dates in UTC where a release record exists; older announcement/tag dates are labeled. An open proposal is not a release. Historical tags, assets and signatures remain -unchanged. [1.5.0 is available from Central](releases/1.5.0-central-publication.md). +unchanged. [1.5.1 is available from Central](releases/1.5.1-central-publication.md). ## Unreleased -## 1.5.1 — release preparation, 2026-10-15 UTC +## 1.5.1 — 2026-10-15 UTC -Documentation and build-maintenance patch; publication is tracked in the -[release record](releases/1.5.1.md). Encoding behavior and public APIs are unchanged. +Documentation and build-maintenance patch; publication is verified in the +[publication record](releases/1.5.1-central-publication.md). Encoding behavior and public APIs are unchanged. - Clarify JavaScript encoding modes, output growth, and insertion-boundary requirements for #243; distinguish JSON whole-string HTML embedding from diff --git a/README.md b/README.md index 49062e7..ce07999 100644 --- a/README.md +++ b/README.md @@ -9,15 +9,14 @@ has no runtime dependencies; optional JSP and Jakarta adapters provide view-laye bindings. Encoding is one part of [XSS prevention][xss], alongside safe templates, URL validation and other application controls. -**1.5.1 release preparation:** this patch release clarifies the JavaScript and -JSON documentation and strengthens parser regression tests. Encoder behavior, -public APIs, and runtime dependencies are unchanged from 1.5.0. Publication is -not complete; the dependency example below targets the prepared release. See -[the 1.5.1 release record](releases/1.5.1.md) for availability and verification. - -The latest verified Central release remains [1.5.0](releases/1.5.0-central-publication.md) -until 1.5.1 publication is confirmed. It introduced the parser-boundary security -fixes retained in 1.5.1; versions through 1.4.1 do not contain those fixes. See +**1.5.1 is available from Maven Central.** This patch release clarifies the +JavaScript and JSON documentation and strengthens parser regression tests. +Encoder behavior, public APIs, and runtime dependencies are unchanged from 1.5.0. +See the [release notes](releases/1.5.1.md) and +[publication verification](releases/1.5.1-central-publication.md). + +The parser-boundary security fixes introduced in 1.5.0 remain in effect; +versions through 1.4.1 do not contain those fixes. See [the security advisory](https://github.com/OWASP/owasp-java-encoder/security/advisories/GHSA-g8p6-7r8f-qrpv) and [VERIFYING.md](VERIFYING.md). @@ -47,11 +46,11 @@ on the same classpath or module path. See the [runtime matrix](compatibility/REA [dependency/license inventory](docs/dependencies.md). `encoder-esapi` was retired after 1.4.1 and is not included or supported in -1.5.0. Applications using it must [migrate away from the adapter](docs/encoder-esapi-retirement.md). +1.5.x. Applications using it must [migrate away from the adapter](docs/encoder-esapi-retirement.md). -Published 1.5.0 API documentation (1.5.1 indexing follows publication): [core](https://javadoc.io/doc/org.owasp.encoder/encoder/1.5.0/), -[javax JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jsp/1.5.0/) and -[Jakarta JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jakarta-jsp/1.5.0/). +Published 1.5.1 API documentation: [core](https://javadoc.io/doc/org.owasp.encoder/encoder/1.5.1/), +[javax JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jsp/1.5.1/) and +[Jakarta JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jakarta-jsp/1.5.1/). ```java import org.owasp.encoder.Encode; diff --git a/RELEASING.md b/RELEASING.md index 9e331ac..a487f50 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -6,7 +6,7 @@ Do not tag, publish, or announce a release until **all open issues and all open pull requests have been handled**. Before considering release approval, inventory the full open backlog and record the outcome and supporting review or verification for every item. Completing a maintenance batch does not satisfy -this gate on its own. Keep current development at `1.5.1-SNAPSHOT` until maintainers +this gate on its own. Keep current development at `1.5.2-SNAPSHOT` until maintainers deliberately create the exact release commit after the technical gates pass. Changing that commit to a release version is release preparation, not release approval. @@ -15,7 +15,7 @@ the final backlog inventory and dispositions for #110 and #169. A closed tracker does not waive this gate: repeat the complete open-issue/PR inventory when a new release is actually proposed and obtain release approval then. -The signed 1.5.0 release has been [published to Central and verified](releases/1.5.0-central-publication.md). +The signed 1.5.1 release has been [published to Central and verified](releases/1.5.1-central-publication.md). Repeat these gates for each subsequent release. Do not rebuild or replace published artifacts, republish existing coordinates, or move release tags. @@ -156,7 +156,7 @@ uploading. Keep an audit record of the exact uploaded bundle and its SHA-256. 4. Set the fixed versions in the security advisories and publish the advisories in coordination with the available release. Do not announce a Central version that has not actually published. -5. Set main to the next unreleased version (for example `1.5.1-SNAPSHOT` or +5. Set main to the next unreleased version (for example `1.5.2-SNAPSHOT` or `1.6.0-SNAPSHOT`, chosen through version review), update `jakarta-test` accordingly, and reset the SCM tag to `HEAD`. Advance `public.api.baseline.version` and its old support-API classpaths to the newly published immutable release. diff --git a/SECURITY.md b/SECURITY.md index 2fb50c3..9ac9e9d 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,15 +2,15 @@ ## Supported Versions -Version **1.5.1** is being prepared as a documentation and build-maintenance -patch. It preserves the 1.5.0 security fixes and introduces no new encoder -security fix. Until [publication is verified](releases/1.5.1.md), 1.5.0 remains -the current supported release shown below. - -Version **1.5.0**, published **2026-09-28 UTC**, is the current security release. -The [signed GitHub assets](https://github.com/OWASP/owasp-java-encoder/releases/tag/v1.5.0) -and [Maven Central publication](releases/1.5.0-central-publication.md) have been -independently verified. See [GHSA-g8p6-7r8f-qrpv](https://github.com/OWASP/owasp-java-encoder/security/advisories/GHSA-g8p6-7r8f-qrpv) +Version **1.5.1**, published **2026-10-15 UTC**, is the current supported +release. This documentation and build-maintenance patch preserves the 1.5.0 +security fixes and introduces no new encoder security fix. The +[signed GitHub assets](https://github.com/OWASP/owasp-java-encoder/releases/tag/v1.5.1) +and [Maven Central publication](releases/1.5.1-central-publication.md) have been +verified against the retained signed artifacts. + +Version **1.5.0**, published **2026-09-28 UTC**, introduced the security fixes. +See [GHSA-g8p6-7r8f-qrpv](https://github.com/OWASP/owasp-java-encoder/security/advisories/GHSA-g8p6-7r8f-qrpv) for affected versions and migration guidance. Only the latest 1.x release receives security fixes. Fixes ship in a new release; @@ -18,9 +18,9 @@ older release lines are not patched. | Maven coordinate | Supported | Not supported | | --------------------------------------- | --------- | ------------- | -| `org.owasp.encoder:encoder` | 1.5.0 | < 1.5.0 | -| `org.owasp.encoder:encoder-jsp` | 1.5.0 | < 1.5.0 | -| `org.owasp.encoder:encoder-jakarta-jsp` | 1.5.0 | < 1.5.0 | +| `org.owasp.encoder:encoder` | 1.5.1 | < 1.5.1 | +| `org.owasp.encoder:encoder-jsp` | 1.5.1 | < 1.5.1 | +| `org.owasp.encoder:encoder-jakarta-jsp` | 1.5.1 | < 1.5.1 | The optional `org.owasp.encoder:encoder-esapi` artifact is retired. Version 1.4.1 is its final published release, no version is currently supported, and no @@ -91,7 +91,7 @@ release tag, then verify: ```sh gpg --import KEYS -gpg --verify encoder-1.5.0.jar.asc encoder-1.5.0.jar +gpg --verify encoder-1.5.1.jar.asc encoder-1.5.1.jar gpg --verify SHA256SUMS.asc SHA256SUMS gpg --verify SHA512SUMS.asc SHA512SUMS shasum -a 256 -c SHA256SUMS diff --git a/VERIFYING.md b/VERIFYING.md index 67d7277..7cd25ae 100644 --- a/VERIFYING.md +++ b/VERIFYING.md @@ -6,15 +6,14 @@ identity authority. Obtain [KEYS](KEYS) from a trusted project revision and chec the fingerprint before use. Never import private key material to verify a release. For 1.4.1 and later releases until a documented rotation, the expected project key -is `1C5F632B86809F2F5DB25092BEA0075F94074A9B`. The [1.5.1 release record](releases/1.5.1.md#verification-and-evidence) -tracks signing and publication of the prepared patch release. Do not treat a -prepared release as available. The [1.5.0 publication verification](releases/1.5.0-central-publication.md) -continues to record the previous verified artifacts and signatures. +is `1C5F632B86809F2F5DB25092BEA0075F94074A9B`. The [1.5.1 publication verification](releases/1.5.1-central-publication.md) +records the signed tag, exact bundle, and comparison of Central and GitHub +downloads against the retained signed artifacts. ## Fresh public-only keyring Download the artifact, its original `.asc`, and the trusted `KEYS`. This example -targets 1.5.1 once its publication is verified. For historical releases, use the full +targets the published 1.5.1 release. For historical releases, use the full fingerprint mapped below and review the historical key's expiry and algorithms. Commands use GnuPG and `shasum` (or equivalent SHA tools). diff --git a/compatibility/README.md b/compatibility/README.md index 2d8ddd8..e0329ef 100644 --- a/compatibility/README.md +++ b/compatibility/README.md @@ -84,9 +84,9 @@ fail these guards. During ordinary `./mvnw verify`, Animal Sniffer checks each library against the Java 8 API signature. This catches linkage such as Java 9's covariant `CharBuffer.flip()` even when bytecode still has class version 52. japicmp checks public/protected API -binary and source compatibility against **1.5.0** for the **1.5.1** release. The baseline guard selects the latest preceding semantic release tag, +binary and source compatibility against **1.5.1** during **1.5.2-SNAPSHOT** development. The baseline guard selects the latest preceding semantic release tag, including signed source commits integrated by squash merge; fetch all release tags -before running it. The old support classpath matches the 1.5.0 POMs (JSP 2.3.3, +before running it. The old support classpath matches the 1.5.1 POMs (JSP 2.3.3, Jakarta Servlet 6.1.0 and EL 6.0.1). Independent minimum-consumer fixtures remain unchanged. Update these pins together after each release. Missing types are not broadly ignored: dependencies are resolved so inherited API changes @@ -138,7 +138,7 @@ multi-release layout remain unchanged. ## Published identities and development import ranges -The tables below describe the published **1.5.0** artifacts. The names are +The tables below describe the published **1.5.1** artifacts. The names are historical identities preserved in 1.x; the OSGi import floors reflect the new 1.5 calls and must not be projected onto older published JARs. diff --git a/core/pom.xml b/core/pom.xml index 23ee89f..00e4b1a 100644 --- a/core/pom.xml +++ b/core/pom.xml @@ -42,7 +42,7 @@ org.owasp.encoder encoder-parent - 1.5.1 + 1.5.2-SNAPSHOT encoder diff --git a/jakarta-test/pom.xml b/jakarta-test/pom.xml index 5c74cb9..042ec3e 100644 --- a/jakarta-test/pom.xml +++ b/jakarta-test/pom.xml @@ -31,7 +31,7 @@ 3.1.7 - 1.5.1 + 1.5.2-SNAPSHOT diff --git a/jakarta/pom.xml b/jakarta/pom.xml index 9b6e436..78994e6 100644 --- a/jakarta/pom.xml +++ b/jakarta/pom.xml @@ -42,7 +42,7 @@ org.owasp.encoder encoder-parent - 1.5.1 + 1.5.2-SNAPSHOT encoder-jakarta-jsp diff --git a/jsp/pom.xml b/jsp/pom.xml index 2a9ab40..7c907b5 100644 --- a/jsp/pom.xml +++ b/jsp/pom.xml @@ -42,7 +42,7 @@ org.owasp.encoder encoder-parent - 1.5.1 + 1.5.2-SNAPSHOT encoder-jsp diff --git a/pom.xml b/pom.xml index f00396d..762761e 100644 --- a/pom.xml +++ b/pom.xml @@ -41,7 +41,7 @@ org.owasp.encoder encoder-parent - 1.5.1 + 1.5.2-SNAPSHOT pom OWASP Java Encoder Project @@ -78,7 +78,7 @@ scm:git:git@github.com:OWASP/owasp-java-encoder.git scm:git:https://github.com/OWASP/owasp-java-encoder.git https://github.com/OWASP/owasp-java-encoder - v1.5.1 + HEAD @@ -121,7 +121,7 @@ - 1.5.0 + 1.5.1 ${settings.localRepository}/org/owasp/encoder/${project.artifactId}/${public.api.baseline.version}/${project.artifactId}-${public.api.baseline.version}.jar ${project.build.directory}/${project.build.finalName}.jar diff --git a/releases/1.5.1-central-publication.md b/releases/1.5.1-central-publication.md new file mode 100644 index 0000000..21c17e3 --- /dev/null +++ b/releases/1.5.1-central-publication.md @@ -0,0 +1,88 @@ +# OWASP Java Encoder 1.5.1 publication + +Published **2026-10-15 UTC**. Jim Manico's authenticated Central Portal session +published deployment `f6912b08-4418-4251-8227-2ac11a3f061b` after validation. + +## Immutable release identities + +- Exact tested source: `1ab0cfbececf9969452fe03cbf5b5504b03a8b1b`. +- Signed tag: `v1.5.1`; annotated object `b57592cbd66aee94ae5b71863a8b20fe2cabfa71`. +- Signing fingerprint: `1C5F632B86809F2F5DB25092BEA0075F94074A9B`. +- [Central bundle](https://github.com/OWASP/owasp-java-encoder/releases/download/v1.5.1/owasp-java-encoder-1.5.1-central-bundle.zip) + SHA-256: `fcb226abfee84db155f27d40fe78173a96524d74dfc14a577eb1106ef57337f8`. +- Source timestamp: `2026-10-15T16:37:02Z`. + +[PR #245](https://github.com/OWASP/owasp-java-encoder/pull/245) merged as +`04c06e65ac2b18e8ec14798c33529445a7bab6d4`. Its tree is identical to the tested +source. The signed tag deliberately points to the exact tested source commit. +Do not move it or rebuild/re-sign the published artifacts. + +## Download verification + +At **16:58:19 UTC**, all nine binary/source/Javadoc JARs, four POMs, +and thirteen detached signatures were downloaded from public Maven Central. +All **26 files matched the retained signed files byte for byte**. All thirteen +signatures verified against the full expected project fingerprint using a fresh +public-only keyring. + +| Artifact | Published files | +| --- | --- | +| `encoder` | [1.5.1](https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder/1.5.1/) | +| `encoder-jsp` | [1.5.1](https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder-jsp/1.5.1/) | +| `encoder-jakarta-jsp` | [1.5.1](https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder-jakarta-jsp/1.5.1/) | +| `encoder-parent` | [1.5.1](https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder-parent/1.5.1/) | + +Neither the optional test WAR nor the retired ESAPI adapter is published. + +All **32 GitHub assets** were downloaded and matched the retained files before +the [GitHub release](https://github.com/OWASP/owasp-java-encoder/releases/tag/v1.5.1) +was published at **17:00:47 UTC**. They include the exact bundle, +thirteen payloads and signatures, public `KEYS`, and signed +[SHA256SUMS](https://github.com/OWASP/owasp-java-encoder/releases/download/v1.5.1/SHA256SUMS) +and [SHA512SUMS](https://github.com/OWASP/owasp-java-encoder/releases/download/v1.5.1/SHA512SUMS). +Both manifest signatures and the tag signature verified against the project key. +See [VERIFYING.md](../VERIFYING.md). + +## Build, compatibility, and review evidence + +The retained artifacts used Eclipse Temurin **17.0.20.1+1**, the committed Maven +**3.10.0** wrapper, macOS arm64, UTC, and the recorded source timestamp. The signed +clean-cache reactor passed **2,290 tests**. A separate fresh-cache Docker/browser +and packaged-WAR build passed **2,297 tests**. Both had zero failures, errors or +skips. All thirteen unsigned payloads matched two independent fresh source-export +builds byte for byte. Public API checks against 1.5.0 and the isolated Java 17 +packaged consumers passed locally; 17 artifact-guard tests and effective-POM SCM +checks also passed. The three Javadoc JARs and library manifest identities were +inspected before publication. + +Release-head [Java CI](https://github.com/OWASP/owasp-java-encoder/actions/runs/38771023057), +[packaged consumers](https://github.com/OWASP/owasp-java-encoder/actions/runs/38771023272) +and [CodeQL](https://github.com/OWASP/owasp-java-encoder/actions/runs/38771023186) +passed. Packaged consumers cover Java 8/11/17/21/25, with a separate Java 8 unit-test +job. The first consumer run hit a transient JaCoCo download failure before the +build; rerunning the failed workflow succeeded without source/dependency changes. +Post-merge [Java CI](https://github.com/OWASP/owasp-java-encoder/actions/runs/38772461159), +[consumers](https://github.com/OWASP/owasp-java-encoder/actions/runs/38772461134), and +[CodeQL](https://github.com/OWASP/owasp-java-encoder/actions/runs/38772461061) also passed. + +The full open-issue/PR inventory was empty at **16:51 UTC** before upload. Issue +#243's encoding-change request was declined after independent model reviews; +the Javadoc and test corrections merged in #244. Jim explicitly authorized the +maintainer PR review bypass for this release. This records a review exception, +not independent maintainer approval. Required CI/security gates passed. + +This documentation/build patch preserves 1.5.0 behavior and security fixes; it +does not introduce a new encoder security fix or require a new security advisory. +See the [release notes](1.5.1.md). + +## Publication follow-up + +Main resumes at `1.5.2-SNAPSHOT` with the immutable 1.5.1 API baseline and SCM +`HEAD`. The support API classpaths remain aligned with the unchanged 1.5.1 POMs. +README examples and the security policy point to published 1.5.1. + +The OWASP project page's announcement and primary downloads were updated through +its current admin editor. At 17:01 UTC, hosted javadoc.io had not yet indexed 1.5.1; +the verified Javadoc JARs were already available from Central and GitHub. +Pre-publication notices in the immutable source tag remain historical. This +later record confirms publication without altering those sources or signatures. diff --git a/releases/1.5.1.md b/releases/1.5.1.md index 02da306..1473546 100644 --- a/releases/1.5.1.md +++ b/releases/1.5.1.md @@ -1,9 +1,10 @@ # OWASP Java Encoder 1.5.1 -**Publication status: preparation in progress; not yet published.** This is a +**Published 2026-10-15 UTC to Maven Central and GitHub.** See the +[publication verification](1.5.1-central-publication.md). This is a documentation and build-maintenance patch release. It preserves the encoding behavior and security fixes in 1.5.0 and introduces no new encoder security fix. -Do not infer Maven Central availability from a successful build or a Git tag. +Central downloads were compared with the retained signed artifacts. ## Highlights and compatibility @@ -43,7 +44,7 @@ dependencies. See [CHANGELOG.md](../CHANGELOG.md) for details. ## Coordinates and availability Group `org.owasp.encoder`, version `1.5.1`: `encoder`, `encoder-jsp`, -`encoder-jakarta-jsp`, and parent `encoder-parent`. Publication is pending. +`encoder-jakarta-jsp`, and parent `encoder-parent` are published. The optional `jakarta-test` WAR is not published. `encoder-esapi` remains retired after 1.4.1 and is not included. @@ -56,15 +57,16 @@ The reviewed source timestamp is `2026-10-15T16:37:02Z`. The project signing identity is **OWASP Java Encoder Release**, full primary fingerprint `1C5F632B86809F2F5DB25092BEA0075F94074A9B`. Verify payload signatures and signed checksum manifests using [KEYS](../KEYS) and -[VERIFYING.md](../VERIFYING.md). The release must retain the exact signed bundle; -publication verification will record its SHA-256 and compare all nine JARs, -four POMs, and thirteen detached signatures against Central downloads. +[VERIFYING.md](../VERIFYING.md). The [publication record](1.5.1-central-publication.md) +records the exact source and signed tag, retained bundle SHA-256, and successful +comparison of all nine JARs, four POMs, and thirteen detached signatures from +Central. All 32 GitHub assets were downloaded and compared before publication. -Before signing or publication, run the clean-cache reactor and browser checks, -packaged consumers, and deterministic payload comparison described in -[RELEASING.md](../RELEASING.md). Required CI must pass on the exact prepared -release commit. The final source commit, signed tag, build/CI results, bundle -hash, and publication state will be recorded with the completed release. +The signed clean-cache build passed 2,290 tests; the separate Docker/browser/WAR +build passed 2,297, with zero failures, errors or skips. All 13 unsigned payloads +matched two independent fresh builds. Required CI passed, including Java 8 tests, +packaged consumers on Java 8/11/17/21/25, and CodeQL. No encoder implementation or +public runtime dependency changed. ## Backlog and review disposition @@ -76,5 +78,9 @@ passed. No other open issue or PR remained at that inventory point. Jim Manico authorized the maintainer PR review bypass for this release. This is an audit-visible review exception, not independent maintainer approval; -required CI/security checks remain mandatory. Recheck the full inventory before -publication and complete the release-preparation PR before tagging. +all required CI/security checks passed. The release-preparation PR +[#245](https://github.com/OWASP/owasp-java-encoder/pull/245) merged as +`04c06e65ac2b18e8ec14798c33529445a7bab6d4`. The full open-issue/PR inventory was +empty at 16:51 UTC immediately before the Central upload. The signed tag points +to the exact tested source `1ab0cfbececf9969452fe03cbf5b5504b03a8b1b`, whose tree +is identical to that merge commit.