Record 1.5.1 publication and resume 1.5.2 development

CHANGELOG.md

@@ -4,14 +4,14 @@ Released entries are grounded in the linked immutable tags, GitHub release notes
 and retained README announcements. Dates below are GitHub publication dates in
 UTC where a release record exists; older announcement/tag dates are labeled.
 An open proposal is not a release. Historical tags, assets and signatures remain
-unchanged. [1.5.0 is available from Central](releases/1.5.0-central-publication.md).
+unchanged. [1.5.1 is available from Central](releases/1.5.1-central-publication.md).
 
 ## Unreleased
 
-## 1.5.1 — release preparation, 2026-10-15 UTC
+## 1.5.1 — 2026-10-15 UTC
 
-Documentation and build-maintenance patch; publication is tracked in the
-[release record](releases/1.5.1.md). Encoding behavior and public APIs are unchanged.
+Documentation and build-maintenance patch; publication is verified in the
+[publication record](releases/1.5.1-central-publication.md). Encoding behavior and public APIs are unchanged.
 
 - Clarify JavaScript encoding modes, output growth, and insertion-boundary
   requirements for #243; distinguish JSON whole-string HTML embedding from

README.md

@@ -9,15 +9,14 @@ has no runtime dependencies; optional JSP and Jakarta adapters provide view-laye
 bindings. Encoding is one part of [XSS prevention][xss], alongside
 safe templates, URL validation and other application controls.
 
-**1.5.1 release preparation:** this patch release clarifies the JavaScript and
-JSON documentation and strengthens parser regression tests. Encoder behavior,
-public APIs, and runtime dependencies are unchanged from 1.5.0. Publication is
-not complete; the dependency example below targets the prepared release. See
-[the 1.5.1 release record](releases/1.5.1.md) for availability and verification.
-
-The latest verified Central release remains [1.5.0](releases/1.5.0-central-publication.md)
-until 1.5.1 publication is confirmed. It introduced the parser-boundary security
-fixes retained in 1.5.1; versions through 1.4.1 do not contain those fixes. See
+**1.5.1 is available from Maven Central.** This patch release clarifies the
+JavaScript and JSON documentation and strengthens parser regression tests.
+Encoder behavior, public APIs, and runtime dependencies are unchanged from 1.5.0.
+See the [release notes](releases/1.5.1.md) and
+[publication verification](releases/1.5.1-central-publication.md).
+
+The parser-boundary security fixes introduced in 1.5.0 remain in effect;
+versions through 1.4.1 do not contain those fixes. See
 [the security advisory](https://github.com/OWASP/owasp-java-encoder/security/advisories/GHSA-g8p6-7r8f-qrpv)
 and [VERIFYING.md](VERIFYING.md).
 
@@ -47,11 +46,11 @@ on the same classpath or module path. See the [runtime matrix](compatibility/REA
 [dependency/license inventory](docs/dependencies.md).
 
 `encoder-esapi` was retired after 1.4.1 and is not included or supported in
-1.5.0. Applications using it must [migrate away from the adapter](docs/encoder-esapi-retirement.md).
+1.5.x. Applications using it must [migrate away from the adapter](docs/encoder-esapi-retirement.md).
 
-Published 1.5.0 API documentation (1.5.1 indexing follows publication): [core](https://javadoc.io/doc/org.owasp.encoder/encoder/1.5.0/),
-[javax JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jsp/1.5.0/) and
-[Jakarta JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jakarta-jsp/1.5.0/).
+Published 1.5.1 API documentation: [core](https://javadoc.io/doc/org.owasp.encoder/encoder/1.5.1/),
+[javax JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jsp/1.5.1/) and
+[Jakarta JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jakarta-jsp/1.5.1/).
 
 ```java
 import org.owasp.encoder.Encode;

RELEASING.md

@@ -6,7 +6,7 @@ Do not tag, publish, or announce a release until **all open issues and all
 open pull requests have been handled**. Before considering release approval,
 inventory the full open backlog and record the outcome and supporting review
 or verification for every item. Completing a maintenance batch does not satisfy
-this gate on its own. Keep current development at `1.5.1-SNAPSHOT` until maintainers
+this gate on its own. Keep current development at `1.5.2-SNAPSHOT` until maintainers
 deliberately create the exact release commit after the technical gates pass.
 Changing that commit to a release version is release preparation, not release approval.
 
@@ -15,7 +15,7 @@ the final backlog inventory and dispositions for #110 and #169. A closed tracker
 does not waive this gate: repeat the complete open-issue/PR inventory when a new
 release is actually proposed and obtain release approval then.
 
-The signed 1.5.0 release has been [published to Central and verified](releases/1.5.0-central-publication.md).
+The signed 1.5.1 release has been [published to Central and verified](releases/1.5.1-central-publication.md).
 Repeat these gates for each subsequent release. Do not rebuild or replace
 published artifacts, republish existing coordinates, or move release tags.
 
@@ -156,7 +156,7 @@ uploading. Keep an audit record of the exact uploaded bundle and its SHA-256.
 4. Set the fixed versions in the security advisories and publish the advisories
    in coordination with the available release. Do not announce a Central version
    that has not actually published.
-5. Set main to the next unreleased version (for example `1.5.1-SNAPSHOT` or
+5. Set main to the next unreleased version (for example `1.5.2-SNAPSHOT` or
    `1.6.0-SNAPSHOT`, chosen through version review), update `jakarta-test`
    accordingly, and reset the SCM tag to `HEAD`. Advance `public.api.baseline.version`
    and its old support-API classpaths to the newly published immutable release.

SECURITY.md

@@ -2,25 +2,25 @@
 
 ## Supported Versions
 
-Version **1.5.1** is being prepared as a documentation and build-maintenance
-patch. It preserves the 1.5.0 security fixes and introduces no new encoder
-security fix. Until [publication is verified](releases/1.5.1.md), 1.5.0 remains
-the current supported release shown below.
-
-Version **1.5.0**, published **2026-09-28 UTC**, is the current security release.
-The [signed GitHub assets](https://github.com/OWASP/owasp-java-encoder/releases/tag/v1.5.0)
-and [Maven Central publication](releases/1.5.0-central-publication.md) have been
-independently verified. See [GHSA-g8p6-7r8f-qrpv](https://github.com/OWASP/owasp-java-encoder/security/advisories/GHSA-g8p6-7r8f-qrpv)
+Version **1.5.1**, published **2026-10-15 UTC**, is the current supported
+release. This documentation and build-maintenance patch preserves the 1.5.0
+security fixes and introduces no new encoder security fix. The
+[signed GitHub assets](https://github.com/OWASP/owasp-java-encoder/releases/tag/v1.5.1)
+and [Maven Central publication](releases/1.5.1-central-publication.md) have been
+verified against the retained signed artifacts.
+
+Version **1.5.0**, published **2026-09-28 UTC**, introduced the security fixes.
+See [GHSA-g8p6-7r8f-qrpv](https://github.com/OWASP/owasp-java-encoder/security/advisories/GHSA-g8p6-7r8f-qrpv)
 for affected versions and migration guidance.
 
 Only the latest 1.x release receives security fixes. Fixes ship in a new release;
 older release lines are not patched.
 
 | Maven coordinate                        | Supported | Not supported |
 | --------------------------------------- | --------- | ------------- |
-| `org.owasp.encoder:encoder`             | 1.5.0     | < 1.5.0       |
-| `org.owasp.encoder:encoder-jsp`         | 1.5.0     | < 1.5.0       |
-| `org.owasp.encoder:encoder-jakarta-jsp` | 1.5.0     | < 1.5.0       |
+| `org.owasp.encoder:encoder`             | 1.5.1     | < 1.5.1       |
+| `org.owasp.encoder:encoder-jsp`         | 1.5.1     | < 1.5.1       |
+| `org.owasp.encoder:encoder-jakarta-jsp` | 1.5.1     | < 1.5.1       |
 
 The optional `org.owasp.encoder:encoder-esapi` artifact is retired. Version
 1.4.1 is its final published release, no version is currently supported, and no
@@ -91,7 +91,7 @@ release tag, then verify:
 
 ```sh
 gpg --import KEYS
-gpg --verify encoder-1.5.0.jar.asc encoder-1.5.0.jar
+gpg --verify encoder-1.5.1.jar.asc encoder-1.5.1.jar
 gpg --verify SHA256SUMS.asc SHA256SUMS
 gpg --verify SHA512SUMS.asc SHA512SUMS
 shasum -a 256 -c SHA256SUMS

VERIFYING.md

@@ -6,15 +6,14 @@ identity authority. Obtain [KEYS](KEYS) from a trusted project revision and chec
 the fingerprint before use. Never import private key material to verify a release.
 
 For 1.4.1 and later releases until a documented rotation, the expected project key
-is `1C5F632B86809F2F5DB25092BEA0075F94074A9B`. The [1.5.1 release record](releases/1.5.1.md#verification-and-evidence)
-tracks signing and publication of the prepared patch release. Do not treat a
-prepared release as available. The [1.5.0 publication verification](releases/1.5.0-central-publication.md)
-continues to record the previous verified artifacts and signatures.
+is `1C5F632B86809F2F5DB25092BEA0075F94074A9B`. The [1.5.1 publication verification](releases/1.5.1-central-publication.md)
+records the signed tag, exact bundle, and comparison of Central and GitHub
+downloads against the retained signed artifacts.
 
 ## Fresh public-only keyring
 
 Download the artifact, its original `.asc`, and the trusted `KEYS`. This example
-targets 1.5.1 once its publication is verified. For historical releases, use the full
+targets the published 1.5.1 release. For historical releases, use the full
 fingerprint mapped below and review the historical key's expiry and algorithms.
 Commands use GnuPG and `shasum` (or equivalent SHA tools).
 

compatibility/README.md

@@ -84,9 +84,9 @@ fail these guards.
 During ordinary `./mvnw verify`, Animal Sniffer checks each library against the Java 8
 API signature. This catches linkage such as Java 9's covariant `CharBuffer.flip()`
 even when bytecode still has class version 52. japicmp checks public/protected API
-binary and source compatibility against **1.5.0** for the **1.5.1** release. The baseline guard selects the latest preceding semantic release tag,
+binary and source compatibility against **1.5.1** during **1.5.2-SNAPSHOT** development. The baseline guard selects the latest preceding semantic release tag,
 including signed source commits integrated by squash merge; fetch all release tags
-before running it. The old support classpath matches the 1.5.0 POMs (JSP 2.3.3,
+before running it. The old support classpath matches the 1.5.1 POMs (JSP 2.3.3,
 Jakarta Servlet 6.1.0 and EL 6.0.1). Independent minimum-consumer fixtures remain
 unchanged. Update these pins together after each release. Missing
 types are not broadly ignored: dependencies are resolved so inherited API changes
@@ -138,7 +138,7 @@ multi-release layout remain unchanged.
 
 ## Published identities and development import ranges
 
-The tables below describe the published **1.5.0** artifacts. The names are
+The tables below describe the published **1.5.1** artifacts. The names are
 historical identities preserved in 1.x; the OSGi import floors reflect the new
 1.5 calls and must not be projected onto older published JARs.
 

core/pom.xml

@@ -42,7 +42,7 @@
     <parent>
         <groupId>org.owasp.encoder</groupId>
         <artifactId>encoder-parent</artifactId>
-        <version>1.5.1</version>
+        <version>1.5.2-SNAPSHOT</version>
     </parent>
 
     <artifactId>encoder</artifactId>

jakarta-test/pom.xml

@@ -31,7 +31,7 @@
         <jackson.build.version>3.1.7</jackson.build.version>
         <!-- Must equal the version in the root pom.xml so this app tests the
              encoder-jakarta-jsp built in the same reactor. CI checks this. -->
-        <encoder.version>1.5.1</encoder.version>
+        <encoder.version>1.5.2-SNAPSHOT</encoder.version>
     </properties>
     <dependencies>
         <dependency>

jakarta/pom.xml

@@ -42,7 +42,7 @@
     <parent>
         <groupId>org.owasp.encoder</groupId>
         <artifactId>encoder-parent</artifactId>
-        <version>1.5.1</version>
+        <version>1.5.2-SNAPSHOT</version>
     </parent>
 
     <artifactId>encoder-jakarta-jsp</artifactId>

jsp/pom.xml

@@ -42,7 +42,7 @@
     <parent>
         <groupId>org.owasp.encoder</groupId>
         <artifactId>encoder-parent</artifactId>
-        <version>1.5.1</version>
+        <version>1.5.2-SNAPSHOT</version>
     </parent>
 
     <artifactId>encoder-jsp</artifactId>

pom.xml

@@ -41,7 +41,7 @@
 
     <groupId>org.owasp.encoder</groupId>
     <artifactId>encoder-parent</artifactId>
-    <version>1.5.1</version>
+    <version>1.5.2-SNAPSHOT</version>
     <packaging>pom</packaging>
 
     <name>OWASP Java Encoder Project</name>
@@ -78,7 +78,7 @@
         <developerConnection>scm:git:git@github.com:OWASP/owasp-java-encoder.git</developerConnection>
         <connection>scm:git:https://github.com/OWASP/owasp-java-encoder.git</connection>
         <url>https://github.com/OWASP/owasp-java-encoder</url>
-        <tag>v1.5.1</tag>
+        <tag>HEAD</tag>
     </scm>
 
     <issueManagement>
@@ -121,7 +121,7 @@
         <!-- Most recent immutable release strictly older than this project version;
              scripts/tests/test_release_baselines.py checks all local release tags,
              including release commits integrated by squash merge. -->
-        <public.api.baseline.version>1.5.0</public.api.baseline.version>
+        <public.api.baseline.version>1.5.1</public.api.baseline.version>
         <japicmp.old.classpath>${settings.localRepository}/org/owasp/encoder/${project.artifactId}/${public.api.baseline.version}/${project.artifactId}-${public.api.baseline.version}.jar</japicmp.old.classpath>
         <japicmp.new.classpath>${project.build.directory}/${project.build.finalName}.jar</japicmp.new.classpath>
         <!-- Each module sets its published Bundle-SymbolicName explicitly (#137). -->

releases/1.5.1-central-publication.md

@@ -0,0 +1,88 @@
+# OWASP Java Encoder 1.5.1 publication
+
+Published **2026-10-15 UTC**. Jim Manico's authenticated Central Portal session
+published deployment `f6912b08-4418-4251-8227-2ac11a3f061b` after validation.
+
+## Immutable release identities
+
+- Exact tested source: `1ab0cfbececf9969452fe03cbf5b5504b03a8b1b`.
+- Signed tag: `v1.5.1`; annotated object `b57592cbd66aee94ae5b71863a8b20fe2cabfa71`.
+- Signing fingerprint: `1C5F632B86809F2F5DB25092BEA0075F94074A9B`.
+- [Central bundle](https://github.com/OWASP/owasp-java-encoder/releases/download/v1.5.1/owasp-java-encoder-1.5.1-central-bundle.zip)
+  SHA-256: `fcb226abfee84db155f27d40fe78173a96524d74dfc14a577eb1106ef57337f8`.
+- Source timestamp: `2026-10-15T16:37:02Z`.
+
+[PR #245](https://github.com/OWASP/owasp-java-encoder/pull/245) merged as
+`04c06e65ac2b18e8ec14798c33529445a7bab6d4`. Its tree is identical to the tested
+source. The signed tag deliberately points to the exact tested source commit.
+Do not move it or rebuild/re-sign the published artifacts.
+
+## Download verification
+
+At **16:58:19 UTC**, all nine binary/source/Javadoc JARs, four POMs,
+and thirteen detached signatures were downloaded from public Maven Central.
+All **26 files matched the retained signed files byte for byte**. All thirteen
+signatures verified against the full expected project fingerprint using a fresh
+public-only keyring.
+
+| Artifact | Published files |
+| --- | --- |
+| `encoder` | [1.5.1](https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder/1.5.1/) |
+| `encoder-jsp` | [1.5.1](https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder-jsp/1.5.1/) |
+| `encoder-jakarta-jsp` | [1.5.1](https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder-jakarta-jsp/1.5.1/) |
+| `encoder-parent` | [1.5.1](https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder-parent/1.5.1/) |
+
+Neither the optional test WAR nor the retired ESAPI adapter is published.
+
+All **32 GitHub assets** were downloaded and matched the retained files before
+the [GitHub release](https://github.com/OWASP/owasp-java-encoder/releases/tag/v1.5.1)
+was published at **17:00:47 UTC**. They include the exact bundle,
+thirteen payloads and signatures, public `KEYS`, and signed
+[SHA256SUMS](https://github.com/OWASP/owasp-java-encoder/releases/download/v1.5.1/SHA256SUMS)
+and [SHA512SUMS](https://github.com/OWASP/owasp-java-encoder/releases/download/v1.5.1/SHA512SUMS).
+Both manifest signatures and the tag signature verified against the project key.
+See [VERIFYING.md](../VERIFYING.md).
+
+## Build, compatibility, and review evidence
+
+The retained artifacts used Eclipse Temurin **17.0.20.1+1**, the committed Maven
+**3.10.0** wrapper, macOS arm64, UTC, and the recorded source timestamp. The signed
+clean-cache reactor passed **2,290 tests**. A separate fresh-cache Docker/browser
+and packaged-WAR build passed **2,297 tests**. Both had zero failures, errors or
+skips. All thirteen unsigned payloads matched two independent fresh source-export
+builds byte for byte. Public API checks against 1.5.0 and the isolated Java 17
+packaged consumers passed locally; 17 artifact-guard tests and effective-POM SCM
+checks also passed. The three Javadoc JARs and library manifest identities were
+inspected before publication.
+
+Release-head [Java CI](https://github.com/OWASP/owasp-java-encoder/actions/runs/38771023057),
+[packaged consumers](https://github.com/OWASP/owasp-java-encoder/actions/runs/38771023272)
+and [CodeQL](https://github.com/OWASP/owasp-java-encoder/actions/runs/38771023186)
+passed. Packaged consumers cover Java 8/11/17/21/25, with a separate Java 8 unit-test
+job. The first consumer run hit a transient JaCoCo download failure before the
+build; rerunning the failed workflow succeeded without source/dependency changes.
+Post-merge [Java CI](https://github.com/OWASP/owasp-java-encoder/actions/runs/38772461159),
+[consumers](https://github.com/OWASP/owasp-java-encoder/actions/runs/38772461134), and
+[CodeQL](https://github.com/OWASP/owasp-java-encoder/actions/runs/38772461061) also passed.
+
+The full open-issue/PR inventory was empty at **16:51 UTC** before upload. Issue
+#243's encoding-change request was declined after independent model reviews;
+the Javadoc and test corrections merged in #244. Jim explicitly authorized the
+maintainer PR review bypass for this release. This records a review exception,
+not independent maintainer approval. Required CI/security gates passed.
+
+This documentation/build patch preserves 1.5.0 behavior and security fixes; it
+does not introduce a new encoder security fix or require a new security advisory.
+See the [release notes](1.5.1.md).
+
+## Publication follow-up
+
+Main resumes at `1.5.2-SNAPSHOT` with the immutable 1.5.1 API baseline and SCM
+`HEAD`. The support API classpaths remain aligned with the unchanged 1.5.1 POMs.
+README examples and the security policy point to published 1.5.1.
+
+The OWASP project page's announcement and primary downloads were updated through
+its current admin editor. At 17:01 UTC, hosted javadoc.io had not yet indexed 1.5.1;
+the verified Javadoc JARs were already available from Central and GitHub.
+Pre-publication notices in the immutable source tag remain historical. This
+later record confirms publication without altering those sources or signatures.