From 32bf529dbd54f2808ff438c971b07a03106682de Mon Sep 17 00:00:00 2001 From: Jim Manico Date: Sun, 18 Oct 2026 19:48:08 +0200 Subject: [PATCH] Record verified 1.6.0 publication and resume development --- CHANGELOG.md | 4 +- README.md | 18 ++++---- RELEASING.md | 8 ++-- SECURITY.md | 23 ++++------ VERIFYING.md | 9 ++-- compatibility/README.md | 6 +-- core/pom.xml | 2 +- docs/compatibility-decisions.md | 2 +- docs/contexts.md | 2 +- docs/usage.md | 2 +- jakarta-test/pom.xml | 2 +- jakarta/pom.xml | 2 +- jsp/pom.xml | 2 +- pom.xml | 8 ++-- releases/1.6.0-central-publication.md | 63 +++++++++++++++++++++++++++ releases/1.6.0.md | 13 +++--- 16 files changed, 110 insertions(+), 56 deletions(-) create mode 100644 releases/1.6.0-central-publication.md diff --git a/CHANGELOG.md b/CHANGELOG.md index 411a0d4..0aa1567 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,9 +10,9 @@ unchanged. [1.5.1 is available from Central](releases/1.5.1-central-publication. No changes yet. -## 1.6.0 — release preparation +## 1.6.0 — 2026-10-18 UTC -Publication is pending; see the [release record](releases/1.6.0.md). +Publication is verified; see the [release record](releases/1.6.0.md). - Reduce unnecessary script-letter escaping in `forJavaScript` and `forJavaScriptBlock` (#243). Interior letters remain readable; the input's last diff --git a/README.md b/README.md index 23cf93d..89df4ea 100644 --- a/README.md +++ b/README.md @@ -9,13 +9,11 @@ has no runtime dependencies; optional JSP and Jakarta adapters provide view-laye bindings. Encoding is one part of [XSS prevention][xss], alongside safe templates, URL validation and other application controls. -**1.6.0 release preparation:** this minor release reduces unnecessary JavaScript -letter escaping while preserving recognized HTML-token protection across trusted -fragments. Encoded bytes and streaming behavior change; see the -[release notes](releases/1.6.0.md) for migration and verification. -Publication is not complete; the dependency example below targets the prepared -release. The latest verified Central release remains -[1.5.1](releases/1.5.1-central-publication.md) until publication is confirmed. +**1.6.0 is available from Maven Central.** This minor release reduces unnecessary +JavaScript letter escaping while preserving recognized HTML-token protection +across trusted fragments. Encoded bytes and streaming behavior change; see the +[release notes](releases/1.6.0.md) and +[publication verification](releases/1.6.0-central-publication.md). The parser-boundary security fixes introduced in 1.5.0 remain in effect; versions through 1.4.1 do not contain those fixes. See @@ -50,9 +48,9 @@ on the same classpath or module path. See the [runtime matrix](compatibility/REA `encoder-esapi` was retired after 1.4.1 and is not included or supported in 1.5.x or 1.6.0. Applications using it must [migrate away from the adapter](docs/encoder-esapi-retirement.md). -Published 1.5.1 API documentation (1.6.0 indexing follows publication): [core](https://javadoc.io/doc/org.owasp.encoder/encoder/1.5.1/), -[javax JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jsp/1.5.1/) and -[Jakarta JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jakarta-jsp/1.5.1/). +Published 1.6.0 API documentation (hosted indexing may lag publication): [core](https://javadoc.io/doc/org.owasp.encoder/encoder/1.6.0/), +[javax JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jsp/1.6.0/) and +[Jakarta JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jakarta-jsp/1.6.0/). ```java import org.owasp.encoder.Encode; diff --git a/RELEASING.md b/RELEASING.md index a487f50..7e1f212 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -6,7 +6,7 @@ Do not tag, publish, or announce a release until **all open issues and all open pull requests have been handled**. Before considering release approval, inventory the full open backlog and record the outcome and supporting review or verification for every item. Completing a maintenance batch does not satisfy -this gate on its own. Keep current development at `1.5.2-SNAPSHOT` until maintainers +this gate on its own. Keep current development at `1.6.1-SNAPSHOT` until maintainers deliberately create the exact release commit after the technical gates pass. Changing that commit to a release version is release preparation, not release approval. @@ -15,7 +15,7 @@ the final backlog inventory and dispositions for #110 and #169. A closed tracker does not waive this gate: repeat the complete open-issue/PR inventory when a new release is actually proposed and obtain release approval then. -The signed 1.5.1 release has been [published to Central and verified](releases/1.5.1-central-publication.md). +The signed 1.6.0 release has been [published to Central and verified](releases/1.6.0-central-publication.md). Repeat these gates for each subsequent release. Do not rebuild or replace published artifacts, republish existing coordinates, or move release tags. @@ -156,8 +156,8 @@ uploading. Keep an audit record of the exact uploaded bundle and its SHA-256. 4. Set the fixed versions in the security advisories and publish the advisories in coordination with the available release. Do not announce a Central version that has not actually published. -5. Set main to the next unreleased version (for example `1.5.2-SNAPSHOT` or - `1.6.0-SNAPSHOT`, chosen through version review), update `jakarta-test` +5. Set main to the next unreleased version (for example `1.6.1-SNAPSHOT` or + `1.7.0-SNAPSHOT`, chosen through version review), update `jakarta-test` accordingly, and reset the SCM tag to `HEAD`. Advance `public.api.baseline.version` and its old support-API classpaths to the newly published immutable release. Fetch all release tags before running the baseline regression: the tested diff --git a/SECURITY.md b/SECURITY.md index e9feb1a..f20468a 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,16 +2,11 @@ ## Supported Versions -Version **1.6.0** is being prepared as an output-encoding refinement. It preserves -recognized HTML-token protection from 1.5.0 and introduces no new encoder -security fix. Until [publication is verified](releases/1.6.0.md), 1.5.1 remains -the current supported release shown below. - -Version **1.5.1**, published **2026-10-15 UTC**, is the current supported -release. This documentation and build-maintenance patch preserves the 1.5.0 -security fixes and introduces no new encoder security fix. The -[signed GitHub assets](https://github.com/OWASP/owasp-java-encoder/releases/tag/v1.5.1) -and [Maven Central publication](releases/1.5.1-central-publication.md) have been +Version **1.6.0**, published **2026-10-18 UTC**, is the current supported +release. It reduces unnecessary JavaScript escaping while retaining recognized +HTML-token protection. It introduces no new encoder security fix. The +[signed GitHub assets](https://github.com/OWASP/owasp-java-encoder/releases/tag/v1.6.0) +and [Maven Central publication](releases/1.6.0-central-publication.md) were verified against the retained signed artifacts. Version **1.5.0**, published **2026-09-28 UTC**, introduced the security fixes. @@ -23,9 +18,9 @@ older release lines are not patched. | Maven coordinate | Supported | Not supported | | --------------------------------------- | --------- | ------------- | -| `org.owasp.encoder:encoder` | 1.5.1 | < 1.5.1 | -| `org.owasp.encoder:encoder-jsp` | 1.5.1 | < 1.5.1 | -| `org.owasp.encoder:encoder-jakarta-jsp` | 1.5.1 | < 1.5.1 | +| `org.owasp.encoder:encoder` | 1.6.0 | < 1.6.0 | +| `org.owasp.encoder:encoder-jsp` | 1.6.0 | < 1.6.0 | +| `org.owasp.encoder:encoder-jakarta-jsp` | 1.6.0 | < 1.6.0 | The optional `org.owasp.encoder:encoder-esapi` artifact is retired. Version 1.4.1 is its final published release, no version is currently supported, and no @@ -96,7 +91,7 @@ release tag, then verify: ```sh gpg --import KEYS -gpg --verify encoder-1.5.1.jar.asc encoder-1.5.1.jar +gpg --verify encoder-1.6.0.jar.asc encoder-1.6.0.jar gpg --verify SHA256SUMS.asc SHA256SUMS gpg --verify SHA512SUMS.asc SHA512SUMS shasum -a 256 -c SHA256SUMS diff --git a/VERIFYING.md b/VERIFYING.md index fbb3cd1..2376966 100644 --- a/VERIFYING.md +++ b/VERIFYING.md @@ -6,15 +6,14 @@ identity authority. Obtain [KEYS](KEYS) from a trusted project revision and chec the fingerprint before use. Never import private key material to verify a release. For 1.4.1 and later releases until a documented rotation, the expected project key -is `1C5F632B86809F2F5DB25092BEA0075F94074A9B`. The [1.6.0 release record](releases/1.6.0.md#verification-and-evidence) -tracks signing and publication of the prepared release. Do not treat a prepared -release as available. The [1.5.1 publication verification](releases/1.5.1-central-publication.md) -records the previous verified artifacts and signatures. +is `1C5F632B86809F2F5DB25092BEA0075F94074A9B`. The [1.6.0 publication verification](releases/1.6.0-central-publication.md) +records the signed tag, exact bundle and comparison of Central and GitHub +downloads against the retained signed artifacts. ## Fresh public-only keyring Download the artifact, its original `.asc`, and the trusted `KEYS`. This example -targets 1.6.0 once its publication is verified. For historical releases, use the full +targets the published 1.6.0 release. For historical releases, use the full fingerprint mapped below and review the historical key's expiry and algorithms. Commands use GnuPG and `shasum` (or equivalent SHA tools). diff --git a/compatibility/README.md b/compatibility/README.md index 944f265..a42229c 100644 --- a/compatibility/README.md +++ b/compatibility/README.md @@ -84,9 +84,9 @@ fail these guards. During ordinary `./mvnw verify`, Animal Sniffer checks each library against the Java 8 API signature. This catches linkage such as Java 9's covariant `CharBuffer.flip()` even when bytecode still has class version 52. japicmp checks public/protected API -binary and source compatibility against **1.5.1** for the prepared **1.6.0** release. The baseline guard selects the latest preceding semantic release tag, +binary and source compatibility against **1.6.0** during **1.6.1-SNAPSHOT** development. The baseline guard selects the latest preceding semantic release tag, including signed source commits integrated by squash merge; fetch all release tags -before running it. The old support classpath matches the 1.5.1 POMs (JSP 2.3.3, +before running it. The old support classpath matches the 1.6.0 POMs (JSP 2.3.3, Jakarta Servlet 6.1.0 and EL 6.0.1). Independent minimum-consumer fixtures remain unchanged. Update these pins together after each release. Missing types are not broadly ignored: dependencies are resolved so inherited API changes @@ -138,7 +138,7 @@ multi-release layout remain unchanged. ## Published identities and development import ranges -The tables below describe the published **1.5.1** artifacts. The names are +The tables below describe the published **1.6.0** artifacts. The names are historical identities preserved in 1.x; the OSGi import floors reflect the new 1.5 calls and must not be projected onto older published JARs. diff --git a/core/pom.xml b/core/pom.xml index f2a56f2..e192164 100644 --- a/core/pom.xml +++ b/core/pom.xml @@ -42,7 +42,7 @@ org.owasp.encoder encoder-parent - 1.6.0 + 1.6.1-SNAPSHOT encoder diff --git a/docs/compatibility-decisions.md b/docs/compatibility-decisions.md index 662f9e2..9d56a61 100644 --- a/docs/compatibility-decisions.md +++ b/docs/compatibility-decisions.md @@ -68,7 +68,7 @@ actual output rather than reserving the maximum bound. ## JavaScript output refinement in 1.6.0 (#243) -This change is prepared for the minor release 1.6.0, rather than a patch release. The evaluated values and supported HTML tokenizer protection +This change shipped in the minor release 1.6.0, rather than a patch release. The evaluated values and supported HTML tokenizer protection remain intact, but encoded bytes, explicit-flush spelling, and the previous literal substring prohibition change. This record describes the migration and parser validation requirements; release preparation does not establish publication. diff --git a/docs/contexts.md b/docs/contexts.md index eee577f..4b0a33a 100644 --- a/docs/contexts.md +++ b/docs/contexts.md @@ -1,6 +1,6 @@ # Output contexts and boundaries -This guide describes the prepared **1.6.0** release, including the JavaScript +This guide describes the published **1.6.0** release, including the JavaScript refinement for #243. Published 1.5.0 and 1.5.1 retain their broader letter escapes. See the [1.6.0 release record](../releases/1.6.0.md) for publication status. The [Encode Javadoc source](../core/src/main/java/org/owasp/encoder/Encode.java) is diff --git a/docs/usage.md b/docs/usage.md index cd84eb1..1fa572a 100644 --- a/docs/usage.md +++ b/docs/usage.md @@ -1,6 +1,6 @@ # Java and JSP examples -These examples target the prepared **1.6.0** release, including the JavaScript +These examples target the published **1.6.0** release, including the JavaScript refinement for #243. See the [release record](../releases/1.6.0.md) for publication status. Published 1.5.1 retains 1.5.0's broader letter escaping. Features marked **1.5** were introduced in 1.5.0. diff --git a/jakarta-test/pom.xml b/jakarta-test/pom.xml index 251a39a..1829be3 100644 --- a/jakarta-test/pom.xml +++ b/jakarta-test/pom.xml @@ -31,7 +31,7 @@ 3.1.7 - 1.6.0 + 1.6.1-SNAPSHOT diff --git a/jakarta/pom.xml b/jakarta/pom.xml index 8fc24c3..e3bf16c 100644 --- a/jakarta/pom.xml +++ b/jakarta/pom.xml @@ -42,7 +42,7 @@ org.owasp.encoder encoder-parent - 1.6.0 + 1.6.1-SNAPSHOT encoder-jakarta-jsp diff --git a/jsp/pom.xml b/jsp/pom.xml index 1f1f103..31fcb3d 100644 --- a/jsp/pom.xml +++ b/jsp/pom.xml @@ -42,7 +42,7 @@ org.owasp.encoder encoder-parent - 1.6.0 + 1.6.1-SNAPSHOT encoder-jsp diff --git a/pom.xml b/pom.xml index 5f24a83..f2821cf 100644 --- a/pom.xml +++ b/pom.xml @@ -41,7 +41,7 @@ org.owasp.encoder encoder-parent - 1.6.0 + 1.6.1-SNAPSHOT pom OWASP Java Encoder Project @@ -78,7 +78,7 @@ scm:git:git@github.com:OWASP/owasp-java-encoder.git scm:git:https://github.com/OWASP/owasp-java-encoder.git https://github.com/OWASP/owasp-java-encoder - v1.6.0 + HEAD @@ -114,14 +114,14 @@ - + 2026-10-18T17:27:13Z UTF-8 UTF-8 - 1.5.1 + 1.6.0 ${settings.localRepository}/org/owasp/encoder/${project.artifactId}/${public.api.baseline.version}/${project.artifactId}-${public.api.baseline.version}.jar ${project.build.directory}/${project.build.finalName}.jar diff --git a/releases/1.6.0-central-publication.md b/releases/1.6.0-central-publication.md new file mode 100644 index 0000000..1142797 --- /dev/null +++ b/releases/1.6.0-central-publication.md @@ -0,0 +1,63 @@ +# OWASP Java Encoder 1.6.0 publication + +Published **2026-10-18 UTC** through Jim Manico's authenticated Central Portal +session, deployment `20d0228a-2441-4941-8bbd-e5492c382921`, after validation. + +## Immutable identities + +- Exact tested source: `d9b0fd62497fb9276429a9ea972f4449ab320f2d`. +- Signed tag: `v1.6.0`; annotated object `43c92dc0289f2600ca00656423573cb80b233654`. +- Project fingerprint: `1C5F632B86809F2F5DB25092BEA0075F94074A9B`. +- Bundle SHA-256: `8d860714634ae3b53f19bb3ea326f639b74df96c0e82bc956d53f237b5804c16`. +- Reviewed source timestamp: `2026-10-18T17:27:13Z`. + +[Release PR #249](https://github.com/OWASP/owasp-java-encoder/pull/249) merged as +`5709c0c71428f03f69d22ba924df77ec3a0cb020`; its tree matches the exact tested +source. The signed tag points to that tested source. Do not move the tag or +rebuild, re-sign or replace published artifacts. + +## Download and signature verification + +At **2026-10-18T17:44:15.612249+00:00**, all nine binary/source/Javadoc JARs, four +POMs and thirteen detached signatures from Maven Central matched the retained +signed files byte for byte. All thirteen payload signatures and both checksum +manifest signatures verified with a fresh public-only keyring against the full +expected project fingerprint. The signed tag also verified with that fingerprint. + +All **32 GitHub release assets** were downloaded and matched the retained files. +They include the same bundle, thirteen payloads and their signatures, public +KEYS and signed SHA256SUMS/SHA512SUMS. See [VERIFYING.md](../VERIFYING.md). + +| Artifact | Verified Central files | +| --- | --- | +| encoder | [1.6.0](https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder/1.6.0/) | +| encoder-jsp | [1.6.0](https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder-jsp/1.6.0/) | +| encoder-jakarta-jsp | [1.6.0](https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder-jakarta-jsp/1.6.0/) | +| encoder-parent | [1.6.0](https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder-parent/1.6.0/) | + +The retired ESAPI adapter and optional test WAR are not published. + +## Acceptance and review + +The exact source passed clean-cache unsigned and signed reactor builds using +Temurin 17.0.20.1+1, Maven 3.10.0, macOS arm64 and the recorded UTC settings. +Two independent clean source-export builds produced the same thirteen unsigned +payloads, which also matched the signed build's payload bytes. The separate +Docker/browser/WAR gate, Java 17 packaged consumers, 36 repository tests, +17 compatibility tests and source/TLD parity passed. + +Final release-commit Java CI and packaged-consumer gates passed, including Java +8/11/17/21/25 consumers and Java 8 unit tests. Java, Actions and Python CodeQL +passed. The release preparation received focused Sol review; implementation and +model-identity evidence, limitations and migration consequences are recorded in +[the release notes](1.6.0.md). + +The complete open backlog was empty after #247 and #249 merged and #243 closed, +immediately before publication. Jim Manico authorized use of the existing +PR-only review bypass and instructed publication of the validated release. +This records an audit-visible review exception, not independent maintainer +approval. Required CI/security checks were not bypassed. + +Development resumes at **1.6.1-SNAPSHOT**, with API baseline **1.6.0**. The +immutable release source retains its preparation-stage notices; this record +confirms publication without altering the released sources or signatures. diff --git a/releases/1.6.0.md b/releases/1.6.0.md index 4408b47..546961b 100644 --- a/releases/1.6.0.md +++ b/releases/1.6.0.md @@ -1,10 +1,9 @@ # OWASP Java Encoder 1.6.0 -**Release preparation; not yet published.** The latest verified Central release -remains [1.5.1](1.5.1-central-publication.md). This minor release reduces +**Published 2026-10-18 UTC to Maven Central and GitHub.** See the +[publication verification](1.6.0-central-publication.md). This minor release reduces unnecessary JavaScript letter escaping while preserving recognized HTML-token protection across trusted fragments. It introduces no new encoder security fix. -Do not treat a successful build or staging validation as publication. ## Highlights and compatibility @@ -55,10 +54,10 @@ versions should follow that release's migration guidance and ## Coordinates and availability -Prepared group `org.owasp.encoder`, version `1.6.0`: `encoder`, `encoder-jsp`, +Published group `org.owasp.encoder`, version `1.6.0`: `encoder`, `encoder-jsp`, `encoder-jakarta-jsp`, and parent `encoder-parent`. The optional test WAR is not published. `encoder-esapi` remains retired after 1.4.1 and is not included. -No 1.6.0 Central availability is claimed until exact artifacts are verified. +All published artifacts and signatures matched the retained release byte for byte. ## Verification and evidence @@ -74,8 +73,8 @@ signatures and signed checksum manifests using [KEYS](../KEYS) and sources, clean-cache builds, packaged consumers, Docker/browser/WAR tests, reproducible unsigned payload comparison, all required CI/security checks, signature verification and comparison of published bytes with retained artifacts. -Those release-specific results and the final source/tag/bundle identities must -be recorded before publication is described as verified. +The [publication record](1.6.0-central-publication.md) records those passed gates +and the exact source, tag, bundle and downloaded-file identities. ## Backlog and review disposition