From d9b0fd62497fb9276429a9ea972f4449ab320f2d Mon Sep 17 00:00:00 2001 From: Jim Manico Date: Sun, 18 Oct 2026 19:28:33 +0200 Subject: [PATCH] release: prepare Java Encoder 1.6.0 --- CHANGELOG.md | 6 ++ README.md | 20 +++--- SECURITY.md | 5 ++ VERIFYING.md | 13 ++-- compatibility/README.md | 2 +- core/pom.xml | 2 +- docs/compatibility-decisions.md | 11 ++-- docs/contexts.md | 9 ++- docs/usage.md | 12 ++-- jakarta-test/pom.xml | 2 +- jakarta/pom.xml | 2 +- jsp/pom.xml | 2 +- pom.xml | 6 +- releases/1.6.0.md | 106 ++++++++++++++++++++++++++++++++ 14 files changed, 158 insertions(+), 40 deletions(-) create mode 100644 releases/1.6.0.md diff --git a/CHANGELOG.md b/CHANGELOG.md index 45c7fbc..411a0d4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,12 @@ unchanged. [1.5.1 is available from Central](releases/1.5.1-central-publication. ## Unreleased +No changes yet. + +## 1.6.0 — release preparation + +Publication is pending; see the [release record](releases/1.6.0.md). + - Reduce unnecessary script-letter escaping in `forJavaScript` and `forJavaScriptBlock` (#243). Interior letters remain readable; the input's last character is escaped if it is C, I, P, R, S, or T (either case). Existing punctuation escapes and diff --git a/README.md b/README.md index ce07999..23cf93d 100644 --- a/README.md +++ b/README.md @@ -9,11 +9,13 @@ has no runtime dependencies; optional JSP and Jakarta adapters provide view-laye bindings. Encoding is one part of [XSS prevention][xss], alongside safe templates, URL validation and other application controls. -**1.5.1 is available from Maven Central.** This patch release clarifies the -JavaScript and JSON documentation and strengthens parser regression tests. -Encoder behavior, public APIs, and runtime dependencies are unchanged from 1.5.0. -See the [release notes](releases/1.5.1.md) and -[publication verification](releases/1.5.1-central-publication.md). +**1.6.0 release preparation:** this minor release reduces unnecessary JavaScript +letter escaping while preserving recognized HTML-token protection across trusted +fragments. Encoded bytes and streaming behavior change; see the +[release notes](releases/1.6.0.md) for migration and verification. +Publication is not complete; the dependency example below targets the prepared +release. The latest verified Central release remains +[1.5.1](releases/1.5.1-central-publication.md) until publication is confirmed. The parser-boundary security fixes introduced in 1.5.0 remain in effect; versions through 1.4.1 do not contain those fixes. See @@ -35,7 +37,7 @@ The three supported artifacts use group ID `org.owasp.encoder`: org.owasp.encoder encoder - 1.5.1 + 1.6.0 ``` @@ -46,9 +48,9 @@ on the same classpath or module path. See the [runtime matrix](compatibility/REA [dependency/license inventory](docs/dependencies.md). `encoder-esapi` was retired after 1.4.1 and is not included or supported in -1.5.x. Applications using it must [migrate away from the adapter](docs/encoder-esapi-retirement.md). +1.5.x or 1.6.0. Applications using it must [migrate away from the adapter](docs/encoder-esapi-retirement.md). -Published 1.5.1 API documentation: [core](https://javadoc.io/doc/org.owasp.encoder/encoder/1.5.1/), +Published 1.5.1 API documentation (1.6.0 indexing follows publication): [core](https://javadoc.io/doc/org.owasp.encoder/encoder/1.5.1/), [javax JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jsp/1.5.1/) and [Jakarta JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jakarta-jsp/1.5.1/). @@ -175,4 +177,4 @@ links distinguish maintainer support from OWASP Foundation donations. [xss]: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html [java-libraries]: https://devguide.owasp.org/en/05-implementation/03-secure-libraries/04-java-secure-libs/ [project]: https://owasp.org/projects/java-encoder -[release]: https://github.com/OWASP/owasp-java-encoder/releases/tag/v1.5.1 +[release]: https://github.com/OWASP/owasp-java-encoder/releases/tag/v1.6.0 diff --git a/SECURITY.md b/SECURITY.md index 9ac9e9d..e9feb1a 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,6 +2,11 @@ ## Supported Versions +Version **1.6.0** is being prepared as an output-encoding refinement. It preserves +recognized HTML-token protection from 1.5.0 and introduces no new encoder +security fix. Until [publication is verified](releases/1.6.0.md), 1.5.1 remains +the current supported release shown below. + Version **1.5.1**, published **2026-10-15 UTC**, is the current supported release. This documentation and build-maintenance patch preserves the 1.5.0 security fixes and introduces no new encoder security fix. The diff --git a/VERIFYING.md b/VERIFYING.md index 7cd25ae..fbb3cd1 100644 --- a/VERIFYING.md +++ b/VERIFYING.md @@ -6,14 +6,15 @@ identity authority. Obtain [KEYS](KEYS) from a trusted project revision and chec the fingerprint before use. Never import private key material to verify a release. For 1.4.1 and later releases until a documented rotation, the expected project key -is `1C5F632B86809F2F5DB25092BEA0075F94074A9B`. The [1.5.1 publication verification](releases/1.5.1-central-publication.md) -records the signed tag, exact bundle, and comparison of Central and GitHub -downloads against the retained signed artifacts. +is `1C5F632B86809F2F5DB25092BEA0075F94074A9B`. The [1.6.0 release record](releases/1.6.0.md#verification-and-evidence) +tracks signing and publication of the prepared release. Do not treat a prepared +release as available. The [1.5.1 publication verification](releases/1.5.1-central-publication.md) +records the previous verified artifacts and signatures. ## Fresh public-only keyring Download the artifact, its original `.asc`, and the trusted `KEYS`. This example -targets the published 1.5.1 release. For historical releases, use the full +targets 1.6.0 once its publication is verified. For historical releases, use the full fingerprint mapped below and review the historical key's expiry and algorithms. Commands use GnuPG and `shasum` (or equivalent SHA tools). @@ -22,7 +23,7 @@ verify_home=$(mktemp -d) chmod 700 "$verify_home" gpg --homedir "$verify_home" --batch --no-autostart --import KEYS expected_fingerprint=1C5F632B86809F2F5DB25092BEA0075F94074A9B -artifact=encoder-1.5.1.jar +artifact=encoder-1.6.0.jar gpg --homedir "$verify_home" --no-autostart --fingerprint "$expected_fingerprint" gpg --homedir "$verify_home" --batch --no-autostart --status-fd 1 \ --verify "$artifact.asc" "$artifact" > signature.status || exit 1 @@ -45,7 +46,7 @@ A Maven `.sha256` sidecar usually contains **only a hex digest**, not a filename After fetching it over the intended distribution channel, form a check manifest: ```sh -artifact=encoder-1.5.1.jar +artifact=encoder-1.6.0.jar expected_hash=$(tr -d '[:space:]' < "$artifact.sha256") printf '%s\n' "$expected_hash" | grep -Eq '^[[:xdigit:]]{64}$' || exit 1 printf '%s %s\n' "$expected_hash" "$artifact" | shasum -a 256 --check || exit 1 diff --git a/compatibility/README.md b/compatibility/README.md index e0329ef..944f265 100644 --- a/compatibility/README.md +++ b/compatibility/README.md @@ -84,7 +84,7 @@ fail these guards. During ordinary `./mvnw verify`, Animal Sniffer checks each library against the Java 8 API signature. This catches linkage such as Java 9's covariant `CharBuffer.flip()` even when bytecode still has class version 52. japicmp checks public/protected API -binary and source compatibility against **1.5.1** during **1.5.2-SNAPSHOT** development. The baseline guard selects the latest preceding semantic release tag, +binary and source compatibility against **1.5.1** for the prepared **1.6.0** release. The baseline guard selects the latest preceding semantic release tag, including signed source commits integrated by squash merge; fetch all release tags before running it. The old support classpath matches the 1.5.1 POMs (JSP 2.3.3, Jakarta Servlet 6.1.0 and EL 6.0.1). Independent minimum-consumer fixtures remain diff --git a/core/pom.xml b/core/pom.xml index 00e4b1a..f2a56f2 100644 --- a/core/pom.xml +++ b/core/pom.xml @@ -42,7 +42,7 @@ org.owasp.encoder encoder-parent - 1.5.2-SNAPSHOT + 1.6.0 encoder diff --git a/docs/compatibility-decisions.md b/docs/compatibility-decisions.md index 7a180f1..662f9e2 100644 --- a/docs/compatibility-decisions.md +++ b/docs/compatibility-decisions.md @@ -66,14 +66,13 @@ the CDATA maximum is 13×. Large CDATA values should use a Writer facade or `EncodedWriter`; String facades retain the complete result but grow according to actual output rather than reserving the maximum bound. -## Unreleased JavaScript output refinement (#243) +## JavaScript output refinement in 1.6.0 (#243) -Release recommendation: use a minor release (1.6.0), rather than assuming this -is patch-compatible. The evaluated values and supported HTML tokenizer protection +This change is prepared for the minor release 1.6.0, rather than a patch release. The evaluated values and supported HTML tokenizer protection remain intact, but encoded bytes, explicit-flush spelling, and the previous literal -substring prohibition change. This proposal records the migration and parser -validation requirements; the current development snapshot version is not release -authorization. Existing published artifacts remain unchanged. +substring prohibition change. This record describes the migration and parser +validation requirements; release preparation does not establish publication. +See the [release record](../releases/1.6.0.md) for status. Existing published artifacts remain unchanged. The script-fragment protection remains, with less escaping of ordinary letters. HTML punctuation and whitespace still use the 1.5 escapes. Of the letters in diff --git a/docs/contexts.md b/docs/contexts.md index 788d03d..eee577f 100644 --- a/docs/contexts.md +++ b/docs/contexts.md @@ -1,9 +1,8 @@ # Output contexts and boundaries -This guide describes the current development version, including the unreleased -JavaScript refinement for #243. Published 1.5.0 and 1.5.1 retain their broader -letter escapes; 1.5.1 clarified the 1.5.0 behavior without changing it. See the -[1.5.1 release record](../releases/1.5.1.md) for publication status. +This guide describes the prepared **1.6.0** release, including the JavaScript +refinement for #243. Published 1.5.0 and 1.5.1 retain their broader letter escapes. +See the [1.6.0 release record](../releases/1.6.0.md) for publication status. The [Encode Javadoc source](../core/src/main/java/org/owasp/encoder/Encode.java) is the detailed per-method contract; each method has a String-returning and a `(Writer out, String input)` overload. `Encoders` exposes shared stateless encoders; @@ -83,7 +82,7 @@ The general and block encoders prevent a nonempty encoded value from completing recognized `` with adjacent trusted literal text. They escape space, `!`, hyphen (`\x2d`), `<`, `>`, slash, and relevant controls throughout -the input. In the unreleased refinement for #243, letters from `script` (either case) are escaped +the input. In 1.6.0, letters from `script` (either case) are escaped only when they are the final input character. Interior letters remain readable; a longer name such as `` is not a script end tag. This preserves HTML tokenizer containment while allowing harmless raw `3.1.7 - 1.5.2-SNAPSHOT + 1.6.0 diff --git a/jakarta/pom.xml b/jakarta/pom.xml index 78994e6..8fc24c3 100644 --- a/jakarta/pom.xml +++ b/jakarta/pom.xml @@ -42,7 +42,7 @@ org.owasp.encoder encoder-parent - 1.5.2-SNAPSHOT + 1.6.0 encoder-jakarta-jsp diff --git a/jsp/pom.xml b/jsp/pom.xml index 7c907b5..1f1f103 100644 --- a/jsp/pom.xml +++ b/jsp/pom.xml @@ -42,7 +42,7 @@ org.owasp.encoder encoder-parent - 1.5.2-SNAPSHOT + 1.6.0 encoder-jsp diff --git a/pom.xml b/pom.xml index 762761e..5f24a83 100644 --- a/pom.xml +++ b/pom.xml @@ -41,7 +41,7 @@ org.owasp.encoder encoder-parent - 1.5.2-SNAPSHOT + 1.6.0 pom OWASP Java Encoder Project @@ -78,7 +78,7 @@ scm:git:git@github.com:OWASP/owasp-java-encoder.git scm:git:https://github.com/OWASP/owasp-java-encoder.git https://github.com/OWASP/owasp-java-encoder - HEAD + v1.6.0 @@ -115,7 +115,7 @@ - 2026-10-15T16:37:02Z + 2026-10-18T17:27:13Z UTF-8 UTF-8