Prepare Java Encoder 1.5.1 documentation patch release

CHANGELOG.md

@@ -8,13 +8,18 @@ unchanged. [1.5.0 is available from Central](releases/1.5.0-central-publication.
 
 ## Unreleased
 
+## 1.5.1 — release preparation, 2026-10-15 UTC
+
+Documentation and build-maintenance patch; publication is tracked in the
+[release record](releases/1.5.1.md). Encoding behavior and public APIs are unchanged.
+
 - Clarify JavaScript encoding modes, output growth, and insertion-boundary
   requirements for #243; distinguish JSON whole-string HTML embedding from
   JavaScript fragment protection. Correct internal HTML/XML comments and
   strengthen parser tests to verify script text, not only absence of a marker.
   Encoding behavior is unchanged.
-- Resume development at `1.5.1-SNAPSHOT`, with the immutable 1.5.0 public-API
-  baseline and its matching support APIs. Minimum-consumer fixtures are unchanged.
+- Verify public API compatibility against immutable 1.5.0 artifacts and their
+  matching support APIs. Minimum-consumer fixtures are unchanged.
 - Discover release tags independently of commit ancestry so squash merges cannot
   leave the compatibility baseline stale; add isolated Git regressions.
 - Record verified 1.5.0 publication and replace pending-availability notices.
@@ -30,6 +35,12 @@ unchanged. [1.5.0 is available from Central](releases/1.5.0-central-publication.
   module POMs are byte-identical to 3.9.16 builds
   ([validation](releases/maven-3.10.0-validation.md)).
 
+- Update isolated Tomcat/Jasper test engines to 9.0.123 and 10.1.61 and give
+  each its own Dependabot scan (#241, #242). These are test tooling, not
+  dependencies shipped inside the encoder libraries.
+- Update reviewed build tooling and pinned Actions, including japicmp 0.26.3,
+  Commons Lang 3.21.0, and the publisher's HttpClient 5.6.5 (#234, #237, #240).
+
 ## 1.5.0 — 2026-09-28 UTC
 
 This is a security release for

README.md

@@ -9,12 +9,16 @@ has no runtime dependencies; optional JSP and Jakarta adapters provide view-laye
 bindings. Encoding is one part of [XSS prevention][xss], alongside
 safe templates, URL validation and other application controls.
 
-**Released 2026-09-28:** version 1.5.0 fixes parser-boundary vulnerabilities in
-JavaScript-in-HTML, CDATA, and XML-comment fragment composition. Versions through
-1.4.1 do not contain those fixes. The [signed GitHub release][release] and
-[Maven Central artifacts](releases/1.5.0-central-publication.md) have been
-independently verified. See the [1.5.0 release notes](releases/1.5.0.md),
-[security advisory](https://github.com/OWASP/owasp-java-encoder/security/advisories/GHSA-g8p6-7r8f-qrpv)
+**1.5.1 release preparation:** this patch release clarifies the JavaScript and
+JSON documentation and strengthens parser regression tests. Encoder behavior,
+public APIs, and runtime dependencies are unchanged from 1.5.0. Publication is
+not complete; the dependency example below targets the prepared release. See
+[the 1.5.1 release record](releases/1.5.1.md) for availability and verification.
+
+The latest verified Central release remains [1.5.0](releases/1.5.0-central-publication.md)
+until 1.5.1 publication is confirmed. It introduced the parser-boundary security
+fixes retained in 1.5.1; versions through 1.4.1 do not contain those fixes. See
+[the security advisory](https://github.com/OWASP/owasp-java-encoder/security/advisories/GHSA-g8p6-7r8f-qrpv)
 and [VERIFYING.md](VERIFYING.md).
 
 ## Start using the OWASP Java Encoders
@@ -32,7 +36,7 @@ The three supported artifacts use group ID `org.owasp.encoder`:
 <dependency>
     <groupId>org.owasp.encoder</groupId>
     <artifactId>encoder</artifactId>
-    <version>1.5.0</version>
+    <version>1.5.1</version>
 </dependency>
 ```
 
@@ -45,7 +49,7 @@ on the same classpath or module path. See the [runtime matrix](compatibility/REA
 `encoder-esapi` was retired after 1.4.1 and is not included or supported in
 1.5.0. Applications using it must [migrate away from the adapter](docs/encoder-esapi-retirement.md).
 
-Published 1.5.0 API documentation: [core](https://javadoc.io/doc/org.owasp.encoder/encoder/1.5.0/),
+Published 1.5.0 API documentation (1.5.1 indexing follows publication): [core](https://javadoc.io/doc/org.owasp.encoder/encoder/1.5.0/),
 [javax JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jsp/1.5.0/) and
 [Jakarta JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jakarta-jsp/1.5.0/).
 
@@ -172,4 +176,4 @@ links distinguish maintainer support from OWASP Foundation donations.
 [xss]: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
 [java-libraries]: https://devguide.owasp.org/en/05-implementation/03-secure-libraries/04-java-secure-libs/
 [project]: https://owasp.org/projects/java-encoder
-[release]: https://github.com/OWASP/owasp-java-encoder/releases/tag/v1.5.0
+[release]: https://github.com/OWASP/owasp-java-encoder/releases/tag/v1.5.1

SECURITY.md

@@ -2,6 +2,11 @@
 
 ## Supported Versions
 
+Version **1.5.1** is being prepared as a documentation and build-maintenance
+patch. It preserves the 1.5.0 security fixes and introduces no new encoder
+security fix. Until [publication is verified](releases/1.5.1.md), 1.5.0 remains
+the current supported release shown below.
+
 Version **1.5.0**, published **2026-09-28 UTC**, is the current security release.
 The [signed GitHub assets](https://github.com/OWASP/owasp-java-encoder/releases/tag/v1.5.0)
 and [Maven Central publication](releases/1.5.0-central-publication.md) have been

VERIFYING.md

@@ -6,14 +6,15 @@ identity authority. Obtain [KEYS](KEYS) from a trusted project revision and chec
 the fingerprint before use. Never import private key material to verify a release.
 
 For 1.4.1 and later releases until a documented rotation, the expected project key
-is `1C5F632B86809F2F5DB25092BEA0075F94074A9B`. The [1.5.0 release record](releases/1.5.0.md#verification-and-evidence)
-covers its signed GitHub assets. The [Central publication verification](releases/1.5.0-central-publication.md)
-confirms that Central serves the same artifacts and signatures.
+is `1C5F632B86809F2F5DB25092BEA0075F94074A9B`. The [1.5.1 release record](releases/1.5.1.md#verification-and-evidence)
+tracks signing and publication of the prepared patch release. Do not treat a
+prepared release as available. The [1.5.0 publication verification](releases/1.5.0-central-publication.md)
+continues to record the previous verified artifacts and signatures.
 
 ## Fresh public-only keyring
 
 Download the artifact, its original `.asc`, and the trusted `KEYS`. This example
-verifies the published 1.5.0 release. For historical releases, use the full
+targets 1.5.1 once its publication is verified. For historical releases, use the full
 fingerprint mapped below and review the historical key's expiry and algorithms.
 Commands use GnuPG and `shasum` (or equivalent SHA tools).
 
@@ -22,7 +23,7 @@ verify_home=$(mktemp -d)
 chmod 700 "$verify_home"
 gpg --homedir "$verify_home" --batch --no-autostart --import KEYS
 expected_fingerprint=1C5F632B86809F2F5DB25092BEA0075F94074A9B
-artifact=encoder-1.5.0.jar
+artifact=encoder-1.5.1.jar
 gpg --homedir "$verify_home" --no-autostart --fingerprint "$expected_fingerprint"
 gpg --homedir "$verify_home" --batch --no-autostart --status-fd 1 \
   --verify "$artifact.asc" "$artifact" > signature.status || exit 1
@@ -45,7 +46,7 @@ A Maven `.sha256` sidecar usually contains **only a hex digest**, not a filename
 After fetching it over the intended distribution channel, form a check manifest:
 
 ```sh
-artifact=encoder-1.5.0.jar
+artifact=encoder-1.5.1.jar
 expected_hash=$(tr -d '[:space:]' < "$artifact.sha256")
 printf '%s\n' "$expected_hash" | grep -Eq '^[[:xdigit:]]{64}$' || exit 1
 printf '%s  %s\n' "$expected_hash" "$artifact" | shasum -a 256 --check || exit 1

compatibility/README.md

@@ -84,8 +84,7 @@ fail these guards.
 During ordinary `./mvnw verify`, Animal Sniffer checks each library against the Java 8
 API signature. This catches linkage such as Java 9's covariant `CharBuffer.flip()`
 even when bytecode still has class version 52. japicmp checks public/protected API
-binary and source compatibility against **1.5.0** during **1.5.1-SNAPSHOT**
-development. The baseline guard selects the latest preceding semantic release tag,
+binary and source compatibility against **1.5.0** for the **1.5.1** release. The baseline guard selects the latest preceding semantic release tag,
 including signed source commits integrated by squash merge; fetch all release tags
 before running it. The old support classpath matches the 1.5.0 POMs (JSP 2.3.3,
 Jakarta Servlet 6.1.0 and EL 6.0.1). Independent minimum-consumer fixtures remain

core/pom.xml

@@ -42,7 +42,7 @@
     <parent>
         <groupId>org.owasp.encoder</groupId>
         <artifactId>encoder-parent</artifactId>
-        <version>1.5.1-SNAPSHOT</version>
+        <version>1.5.1</version>
     </parent>
 
     <artifactId>encoder</artifactId>

docs/contexts.md

@@ -1,7 +1,8 @@
 # Output contexts and boundaries
 
-This guide describes the published version **1.5.0**; feature introductions are
-marked below. See the [verified downloads](../releases/1.5.0-central-publication.md).
+This guide describes **1.5.1**, which clarifies the unchanged 1.5.0 encoding
+behavior; feature introductions are marked below. See the
+[release record](../releases/1.5.1.md) for publication status.
 The [Encode Javadoc source](../core/src/main/java/org/owasp/encoder/Encode.java) is
 the detailed per-method contract; each method has a String-returning and a
 `(Writer out, String input)` overload. `Encoders` exposes shared stateless encoders;

docs/usage.md

@@ -1,7 +1,7 @@
 # Java and JSP examples
 
-These examples target the published version **1.5.0**. See the
-[verified downloads](../releases/1.5.0-central-publication.md).
+These examples target **1.5.1**, with unchanged encoding behavior from 1.5.0.
+See the [release record](../releases/1.5.1.md) for publication status.
 Features marked **1.5** are new in this release.
 
 ## HTML and Writer output
@@ -140,7 +140,7 @@ and the [packaged JSP engine checks](../compatibility/jsp-engine/README.md).
 ## Java modules
 
 The explicit module name for core is `owasp.encoder`. After verifying and obtaining
-`encoder-1.5.0.jar`, put that unchanged JAR in `lib/`, then create:
+`encoder-1.5.1.jar`, put that unchanged JAR in `lib/`, then create:
 
 `src/example.app/module-info.java`:
 

jakarta-test/pom.xml

@@ -31,7 +31,7 @@
         <jackson.build.version>3.1.7</jackson.build.version>
         <!-- Must equal the version in the root pom.xml so this app tests the
              encoder-jakarta-jsp built in the same reactor. CI checks this. -->
-        <encoder.version>1.5.1-SNAPSHOT</encoder.version>
+        <encoder.version>1.5.1</encoder.version>
     </properties>
     <dependencies>
         <dependency>

jakarta/pom.xml

@@ -42,7 +42,7 @@
     <parent>
         <groupId>org.owasp.encoder</groupId>
         <artifactId>encoder-parent</artifactId>
-        <version>1.5.1-SNAPSHOT</version>
+        <version>1.5.1</version>
     </parent>
 
     <artifactId>encoder-jakarta-jsp</artifactId>

jsp/pom.xml

@@ -42,7 +42,7 @@
     <parent>
         <groupId>org.owasp.encoder</groupId>
         <artifactId>encoder-parent</artifactId>
-        <version>1.5.1-SNAPSHOT</version>
+        <version>1.5.1</version>
     </parent>
 
     <artifactId>encoder-jsp</artifactId>

pom.xml

@@ -41,7 +41,7 @@
 
     <groupId>org.owasp.encoder</groupId>
     <artifactId>encoder-parent</artifactId>
-    <version>1.5.1-SNAPSHOT</version>
+    <version>1.5.1</version>
     <packaging>pom</packaging>
 
     <name>OWASP Java Encoder Project</name>
@@ -78,7 +78,7 @@
         <developerConnection>scm:git:git@github.com:OWASP/owasp-java-encoder.git</developerConnection>
         <connection>scm:git:https://github.com/OWASP/owasp-java-encoder.git</connection>
         <url>https://github.com/OWASP/owasp-java-encoder</url>
-        <tag>HEAD</tag>
+        <tag>v1.5.1</tag>
     </scm>
 
     <issueManagement>
@@ -114,8 +114,8 @@
     </contributors>
 
     <properties>
-        <!-- Stable development timestamp; set the reviewed source timestamp before release. -->
-        <project.build.outputTimestamp>2026-09-28T13:21:37Z</project.build.outputTimestamp>
+        <!-- Reviewed release-source timestamp; never build wall-clock time. -->
+        <project.build.outputTimestamp>2026-10-15T16:37:02Z</project.build.outputTimestamp>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
         <!-- Most recent immutable release strictly older than this project version;

releases/1.5.1.md

@@ -0,0 +1,80 @@
+# OWASP Java Encoder 1.5.1
+
+**Publication status: preparation in progress; not yet published.** This is a
+documentation and build-maintenance patch release. It preserves the encoding
+behavior and security fixes in 1.5.0 and introduces no new encoder security fix.
+Do not infer Maven Central availability from a successful build or a Git tag.
+
+## Highlights and compatibility
+
+- Clarify JavaScript encoding modes, output growth, and valid insertion
+  boundaries in Javadocs, guides, and matching JSP/Jakarta descriptions
+  ([#244](https://github.com/OWASP/owasp-java-encoder/pull/244)).
+- Explain why general/block modes retain script-letter escapes, while Source
+  mode already leaves the URL reported in
+  [#243](https://github.com/OWASP/owasp-java-encoder/issues/243) unchanged.
+- Distinguish JSON whole-string HTML embedding from JavaScript fragment
+  protection, and explain empty input, JavaScript escapes, HTML character
+  references, and surrounding-template requirements.
+- Strengthen regression tests to check the entire parsed script text. Add
+  opening-script tokenizer-state and invalid-boundary controls, documenting the
+  Jsoup mixed-case limitation verified separately in Chrome.
+
+No public API, encoded output, null/Unicode handling, or published runtime
+dependency changes are introduced by this patch. Java 8 remains the minimum
+runtime. Core retains no runtime dependencies; adapters retain their core and
+container-provided API dependencies. Maven coordinates, servlet namespaces,
+JPMS/automatic-module names, and OSGi identities are unchanged. Keep core and
+adapter versions aligned when upgrading; no new encoding migration is required
+from 1.5.0.
+
+The [1.5.0 security corrections](1.5.0.md) remain in effect. Applications still
+using older releases should follow that release's migration guidance and
+[GHSA-g8p6-7r8f-qrpv](https://github.com/OWASP/owasp-java-encoder/security/advisories/GHSA-g8p6-7r8f-qrpv).
+
+## Build maintenance
+
+Already-merged maintenance since 1.5.0 updates the wrapper to Maven 3.10.0,
+release-baseline tag discovery, reviewed build-plugin dependencies, isolated
+Tomcat/Jasper test engines, Dependabot routing, and pinned Actions. The optional
+Jakarta fixture's Jackson changes concern build tooling, not encoder runtime
+dependencies. See [CHANGELOG.md](../CHANGELOG.md) for details.
+
+## Coordinates and availability
+
+Group `org.owasp.encoder`, version `1.5.1`: `encoder`, `encoder-jsp`,
+`encoder-jakarta-jsp`, and parent `encoder-parent`. Publication is pending.
+The optional `jakarta-test` WAR is not published. `encoder-esapi` remains retired
+after 1.4.1 and is not included.
+
+## Verification and evidence
+
+The reference release toolchain is Eclipse Temurin **17.0.20.1+1**, the committed
+Maven **3.10.0** wrapper, and macOS arm64, with UTC locale/timezone settings.
+The reviewed source timestamp is `2026-10-15T16:37:02Z`.
+
+The project signing identity is **OWASP Java Encoder Release**, full primary
+fingerprint `1C5F632B86809F2F5DB25092BEA0075F94074A9B`. Verify payload signatures
+and signed checksum manifests using [KEYS](../KEYS) and
+[VERIFYING.md](../VERIFYING.md). The release must retain the exact signed bundle;
+publication verification will record its SHA-256 and compare all nine JARs,
+four POMs, and thirteen detached signatures against Central downloads.
+
+Before signing or publication, run the clean-cache reactor and browser checks,
+packaged consumers, and deterministic payload comparison described in
+[RELEASING.md](../RELEASING.md). Required CI must pass on the exact prepared
+release commit. The final source commit, signed tag, build/CI results, bundle
+hash, and publication state will be recorded with the completed release.
+
+## Backlog and review disposition
+
+The full open-issue/PR inventory was checked on **2026-10-15 at 16:37 UTC**.
+Issue #243 was closed after the documented decision to retain the encoding;
+its documentation and regression-test corrections merged in #244 as
+`ba3aaded6434bd5a3cd104649eb49f01f2445505`. All its required CI and CodeQL checks
+passed. No other open issue or PR remained at that inventory point.
+
+Jim Manico authorized the maintainer PR review bypass for this release.
+This is an audit-visible review exception, not independent maintainer approval;
+required CI/security checks remain mandatory. Recheck the full inventory before
+publication and complete the release-preparation PR before tagging.