Record verified 1.6.0 publication and resume development

CHANGELOG.md

@@ -10,9 +10,9 @@ unchanged. [1.5.1 is available from Central](releases/1.5.1-central-publication.
 
 No changes yet.
 
-## 1.6.0 — release preparation
+## 1.6.0 — 2026-10-18 UTC
 
-Publication is pending; see the [release record](releases/1.6.0.md).
+Publication is verified; see the [release record](releases/1.6.0.md).
 
 - Reduce unnecessary script-letter escaping in `forJavaScript` and
   `forJavaScriptBlock` (#243). Interior letters remain readable; the input's last

README.md

@@ -9,13 +9,11 @@ has no runtime dependencies; optional JSP and Jakarta adapters provide view-laye
 bindings. Encoding is one part of [XSS prevention][xss], alongside
 safe templates, URL validation and other application controls.
 
-**1.6.0 release preparation:** this minor release reduces unnecessary JavaScript
-letter escaping while preserving recognized HTML-token protection across trusted
-fragments. Encoded bytes and streaming behavior change; see the
-[release notes](releases/1.6.0.md) for migration and verification.
-Publication is not complete; the dependency example below targets the prepared
-release. The latest verified Central release remains
-[1.5.1](releases/1.5.1-central-publication.md) until publication is confirmed.
+**1.6.0 is available from Maven Central.** This minor release reduces unnecessary
+JavaScript letter escaping while preserving recognized HTML-token protection
+across trusted fragments. Encoded bytes and streaming behavior change; see the
+[release notes](releases/1.6.0.md) and
+[publication verification](releases/1.6.0-central-publication.md).
 
 The parser-boundary security fixes introduced in 1.5.0 remain in effect;
 versions through 1.4.1 do not contain those fixes. See
@@ -50,9 +48,9 @@ on the same classpath or module path. See the [runtime matrix](compatibility/REA
 `encoder-esapi` was retired after 1.4.1 and is not included or supported in
 1.5.x or 1.6.0. Applications using it must [migrate away from the adapter](docs/encoder-esapi-retirement.md).
 
-Published 1.5.1 API documentation (1.6.0 indexing follows publication): [core](https://javadoc.io/doc/org.owasp.encoder/encoder/1.5.1/),
-[javax JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jsp/1.5.1/) and
-[Jakarta JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jakarta-jsp/1.5.1/).
+Published 1.6.0 API documentation (hosted indexing may lag publication): [core](https://javadoc.io/doc/org.owasp.encoder/encoder/1.6.0/),
+[javax JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jsp/1.6.0/) and
+[Jakarta JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jakarta-jsp/1.6.0/).
 
 ```java
 import org.owasp.encoder.Encode;

RELEASING.md

@@ -6,7 +6,7 @@ Do not tag, publish, or announce a release until **all open issues and all
 open pull requests have been handled**. Before considering release approval,
 inventory the full open backlog and record the outcome and supporting review
 or verification for every item. Completing a maintenance batch does not satisfy
-this gate on its own. Keep current development at `1.5.2-SNAPSHOT` until maintainers
+this gate on its own. Keep current development at `1.6.1-SNAPSHOT` until maintainers
 deliberately create the exact release commit after the technical gates pass.
 Changing that commit to a release version is release preparation, not release approval.
 
@@ -15,7 +15,7 @@ the final backlog inventory and dispositions for #110 and #169. A closed tracker
 does not waive this gate: repeat the complete open-issue/PR inventory when a new
 release is actually proposed and obtain release approval then.
 
-The signed 1.5.1 release has been [published to Central and verified](releases/1.5.1-central-publication.md).
+The signed 1.6.0 release has been [published to Central and verified](releases/1.6.0-central-publication.md).
 Repeat these gates for each subsequent release. Do not rebuild or replace
 published artifacts, republish existing coordinates, or move release tags.
 
@@ -156,8 +156,8 @@ uploading. Keep an audit record of the exact uploaded bundle and its SHA-256.
 4. Set the fixed versions in the security advisories and publish the advisories
    in coordination with the available release. Do not announce a Central version
    that has not actually published.
-5. Set main to the next unreleased version (for example `1.5.2-SNAPSHOT` or
-   `1.6.0-SNAPSHOT`, chosen through version review), update `jakarta-test`
+5. Set main to the next unreleased version (for example `1.6.1-SNAPSHOT` or
+   `1.7.0-SNAPSHOT`, chosen through version review), update `jakarta-test`
    accordingly, and reset the SCM tag to `HEAD`. Advance `public.api.baseline.version`
    and its old support-API classpaths to the newly published immutable release.
    Fetch all release tags before running the baseline regression: the tested

SECURITY.md

@@ -2,16 +2,11 @@
 
 ## Supported Versions
 
-Version **1.6.0** is being prepared as an output-encoding refinement. It preserves
-recognized HTML-token protection from 1.5.0 and introduces no new encoder
-security fix. Until [publication is verified](releases/1.6.0.md), 1.5.1 remains
-the current supported release shown below.
-
-Version **1.5.1**, published **2026-10-15 UTC**, is the current supported
-release. This documentation and build-maintenance patch preserves the 1.5.0
-security fixes and introduces no new encoder security fix. The
-[signed GitHub assets](https://github.com/OWASP/owasp-java-encoder/releases/tag/v1.5.1)
-and [Maven Central publication](releases/1.5.1-central-publication.md) have been
+Version **1.6.0**, published **2026-10-18 UTC**, is the current supported
+release. It reduces unnecessary JavaScript escaping while retaining recognized
+HTML-token protection. It introduces no new encoder security fix. The
+[signed GitHub assets](https://github.com/OWASP/owasp-java-encoder/releases/tag/v1.6.0)
+and [Maven Central publication](releases/1.6.0-central-publication.md) were
 verified against the retained signed artifacts.
 
 Version **1.5.0**, published **2026-09-28 UTC**, introduced the security fixes.
@@ -23,9 +18,9 @@ older release lines are not patched.
 
 | Maven coordinate                        | Supported | Not supported |
 | --------------------------------------- | --------- | ------------- |
-| `org.owasp.encoder:encoder`             | 1.5.1     | < 1.5.1       |
-| `org.owasp.encoder:encoder-jsp`         | 1.5.1     | < 1.5.1       |
-| `org.owasp.encoder:encoder-jakarta-jsp` | 1.5.1     | < 1.5.1       |
+| `org.owasp.encoder:encoder`             | 1.6.0     | < 1.6.0       |
+| `org.owasp.encoder:encoder-jsp`         | 1.6.0     | < 1.6.0       |
+| `org.owasp.encoder:encoder-jakarta-jsp` | 1.6.0     | < 1.6.0       |
 
 The optional `org.owasp.encoder:encoder-esapi` artifact is retired. Version
 1.4.1 is its final published release, no version is currently supported, and no
@@ -96,7 +91,7 @@ release tag, then verify:
 
 ```sh
 gpg --import KEYS
-gpg --verify encoder-1.5.1.jar.asc encoder-1.5.1.jar
+gpg --verify encoder-1.6.0.jar.asc encoder-1.6.0.jar
 gpg --verify SHA256SUMS.asc SHA256SUMS
 gpg --verify SHA512SUMS.asc SHA512SUMS
 shasum -a 256 -c SHA256SUMS

VERIFYING.md

@@ -6,15 +6,14 @@ identity authority. Obtain [KEYS](KEYS) from a trusted project revision and chec
 the fingerprint before use. Never import private key material to verify a release.
 
 For 1.4.1 and later releases until a documented rotation, the expected project key
-is `1C5F632B86809F2F5DB25092BEA0075F94074A9B`. The [1.6.0 release record](releases/1.6.0.md#verification-and-evidence)
-tracks signing and publication of the prepared release. Do not treat a prepared
-release as available. The [1.5.1 publication verification](releases/1.5.1-central-publication.md)
-records the previous verified artifacts and signatures.
+is `1C5F632B86809F2F5DB25092BEA0075F94074A9B`. The [1.6.0 publication verification](releases/1.6.0-central-publication.md)
+records the signed tag, exact bundle and comparison of Central and GitHub
+downloads against the retained signed artifacts.
 
 ## Fresh public-only keyring
 
 Download the artifact, its original `.asc`, and the trusted `KEYS`. This example
-targets 1.6.0 once its publication is verified. For historical releases, use the full
+targets the published 1.6.0 release. For historical releases, use the full
 fingerprint mapped below and review the historical key's expiry and algorithms.
 Commands use GnuPG and `shasum` (or equivalent SHA tools).
 

compatibility/README.md

@@ -84,9 +84,9 @@ fail these guards.
 During ordinary `./mvnw verify`, Animal Sniffer checks each library against the Java 8
 API signature. This catches linkage such as Java 9's covariant `CharBuffer.flip()`
 even when bytecode still has class version 52. japicmp checks public/protected API
-binary and source compatibility against **1.5.1** for the prepared **1.6.0** release. The baseline guard selects the latest preceding semantic release tag,
+binary and source compatibility against **1.6.0** during **1.6.1-SNAPSHOT** development. The baseline guard selects the latest preceding semantic release tag,
 including signed source commits integrated by squash merge; fetch all release tags
-before running it. The old support classpath matches the 1.5.1 POMs (JSP 2.3.3,
+before running it. The old support classpath matches the 1.6.0 POMs (JSP 2.3.3,
 Jakarta Servlet 6.1.0 and EL 6.0.1). Independent minimum-consumer fixtures remain
 unchanged. Update these pins together after each release. Missing
 types are not broadly ignored: dependencies are resolved so inherited API changes
@@ -138,7 +138,7 @@ multi-release layout remain unchanged.
 
 ## Published identities and development import ranges
 
-The tables below describe the published **1.5.1** artifacts. The names are
+The tables below describe the published **1.6.0** artifacts. The names are
 historical identities preserved in 1.x; the OSGi import floors reflect the new
 1.5 calls and must not be projected onto older published JARs.
 

core/pom.xml

@@ -42,7 +42,7 @@
     <parent>
         <groupId>org.owasp.encoder</groupId>
         <artifactId>encoder-parent</artifactId>
-        <version>1.6.0</version>
+        <version>1.6.1-SNAPSHOT</version>
     </parent>
 
     <artifactId>encoder</artifactId>

docs/compatibility-decisions.md

@@ -68,7 +68,7 @@ actual output rather than reserving the maximum bound.
 
 ## JavaScript output refinement in 1.6.0 (#243)
 
-This change is prepared for the minor release 1.6.0, rather than a patch release. The evaluated values and supported HTML tokenizer protection
+This change shipped in the minor release 1.6.0, rather than a patch release. The evaluated values and supported HTML tokenizer protection
 remain intact, but encoded bytes, explicit-flush spelling, and the previous literal
 substring prohibition change. This record describes the migration and parser
 validation requirements; release preparation does not establish publication.

docs/contexts.md

@@ -1,6 +1,6 @@
 # Output contexts and boundaries
 
-This guide describes the prepared **1.6.0** release, including the JavaScript
+This guide describes the published **1.6.0** release, including the JavaScript
 refinement for #243. Published 1.5.0 and 1.5.1 retain their broader letter escapes.
 See the [1.6.0 release record](../releases/1.6.0.md) for publication status.
 The [Encode Javadoc source](../core/src/main/java/org/owasp/encoder/Encode.java) is

docs/usage.md

@@ -1,6 +1,6 @@
 # Java and JSP examples
 
-These examples target the prepared **1.6.0** release, including the JavaScript
+These examples target the published **1.6.0** release, including the JavaScript
 refinement for #243. See the [release record](../releases/1.6.0.md) for publication
 status. Published 1.5.1 retains 1.5.0's broader letter escaping.
 Features marked **1.5** were introduced in 1.5.0.

jakarta-test/pom.xml

@@ -31,7 +31,7 @@
         <jackson.build.version>3.1.7</jackson.build.version>
         <!-- Must equal the version in the root pom.xml so this app tests the
              encoder-jakarta-jsp built in the same reactor. CI checks this. -->
-        <encoder.version>1.6.0</encoder.version>
+        <encoder.version>1.6.1-SNAPSHOT</encoder.version>
     </properties>
     <dependencies>
         <dependency>

jakarta/pom.xml

@@ -42,7 +42,7 @@
     <parent>
         <groupId>org.owasp.encoder</groupId>
         <artifactId>encoder-parent</artifactId>
-        <version>1.6.0</version>
+        <version>1.6.1-SNAPSHOT</version>
     </parent>
 
     <artifactId>encoder-jakarta-jsp</artifactId>

jsp/pom.xml

@@ -42,7 +42,7 @@
     <parent>
         <groupId>org.owasp.encoder</groupId>
         <artifactId>encoder-parent</artifactId>
-        <version>1.6.0</version>
+        <version>1.6.1-SNAPSHOT</version>
     </parent>
 
     <artifactId>encoder-jsp</artifactId>

pom.xml

@@ -41,7 +41,7 @@
 
     <groupId>org.owasp.encoder</groupId>
     <artifactId>encoder-parent</artifactId>
-    <version>1.6.0</version>
+    <version>1.6.1-SNAPSHOT</version>
     <packaging>pom</packaging>
 
     <name>OWASP Java Encoder Project</name>
@@ -78,7 +78,7 @@
         <developerConnection>scm:git:git@github.com:OWASP/owasp-java-encoder.git</developerConnection>
         <connection>scm:git:https://github.com/OWASP/owasp-java-encoder.git</connection>
         <url>https://github.com/OWASP/owasp-java-encoder</url>
-        <tag>v1.6.0</tag>
+        <tag>HEAD</tag>
     </scm>
 
     <issueManagement>
@@ -114,14 +114,14 @@
     </contributors>
 
     <properties>
-        <!-- Reviewed release-source timestamp; never build wall-clock time. -->
+        <!-- Stable development timestamp; set the reviewed source timestamp before release. -->
         <project.build.outputTimestamp>2026-10-18T17:27:13Z</project.build.outputTimestamp>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
         <!-- Most recent immutable release strictly older than this project version;
              scripts/tests/test_release_baselines.py checks all local release tags,
              including release commits integrated by squash merge. -->
-        <public.api.baseline.version>1.5.1</public.api.baseline.version>
+        <public.api.baseline.version>1.6.0</public.api.baseline.version>
         <japicmp.old.classpath>${settings.localRepository}/org/owasp/encoder/${project.artifactId}/${public.api.baseline.version}/${project.artifactId}-${public.api.baseline.version}.jar</japicmp.old.classpath>
         <japicmp.new.classpath>${project.build.directory}/${project.build.finalName}.jar</japicmp.new.classpath>
         <!-- Each module sets its published Bundle-SymbolicName explicitly (#137). -->

releases/1.6.0-central-publication.md

@@ -0,0 +1,63 @@
+# OWASP Java Encoder 1.6.0 publication
+
+Published **2026-10-18 UTC** through Jim Manico's authenticated Central Portal
+session, deployment `20d0228a-2441-4941-8bbd-e5492c382921`, after validation.
+
+## Immutable identities
+
+- Exact tested source: `d9b0fd62497fb9276429a9ea972f4449ab320f2d`.
+- Signed tag: `v1.6.0`; annotated object `43c92dc0289f2600ca00656423573cb80b233654`.
+- Project fingerprint: `1C5F632B86809F2F5DB25092BEA0075F94074A9B`.
+- Bundle SHA-256: `8d860714634ae3b53f19bb3ea326f639b74df96c0e82bc956d53f237b5804c16`.
+- Reviewed source timestamp: `2026-10-18T17:27:13Z`.
+
+[Release PR #249](https://github.com/OWASP/owasp-java-encoder/pull/249) merged as
+`5709c0c71428f03f69d22ba924df77ec3a0cb020`; its tree matches the exact tested
+source. The signed tag points to that tested source. Do not move the tag or
+rebuild, re-sign or replace published artifacts.
+
+## Download and signature verification
+
+At **2026-10-18T17:44:15.612249+00:00**, all nine binary/source/Javadoc JARs, four
+POMs and thirteen detached signatures from Maven Central matched the retained
+signed files byte for byte. All thirteen payload signatures and both checksum
+manifest signatures verified with a fresh public-only keyring against the full
+expected project fingerprint. The signed tag also verified with that fingerprint.
+
+All **32 GitHub release assets** were downloaded and matched the retained files.
+They include the same bundle, thirteen payloads and their signatures, public
+KEYS and signed SHA256SUMS/SHA512SUMS. See [VERIFYING.md](../VERIFYING.md).
+
+| Artifact | Verified Central files |
+| --- | --- |
+| encoder | [1.6.0](https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder/1.6.0/) |
+| encoder-jsp | [1.6.0](https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder-jsp/1.6.0/) |
+| encoder-jakarta-jsp | [1.6.0](https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder-jakarta-jsp/1.6.0/) |
+| encoder-parent | [1.6.0](https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder-parent/1.6.0/) |
+
+The retired ESAPI adapter and optional test WAR are not published.
+
+## Acceptance and review
+
+The exact source passed clean-cache unsigned and signed reactor builds using
+Temurin 17.0.20.1+1, Maven 3.10.0, macOS arm64 and the recorded UTC settings.
+Two independent clean source-export builds produced the same thirteen unsigned
+payloads, which also matched the signed build's payload bytes. The separate
+Docker/browser/WAR gate, Java 17 packaged consumers, 36 repository tests,
+17 compatibility tests and source/TLD parity passed.
+
+Final release-commit Java CI and packaged-consumer gates passed, including Java
+8/11/17/21/25 consumers and Java 8 unit tests. Java, Actions and Python CodeQL
+passed. The release preparation received focused Sol review; implementation and
+model-identity evidence, limitations and migration consequences are recorded in
+[the release notes](1.6.0.md).
+
+The complete open backlog was empty after #247 and #249 merged and #243 closed,
+immediately before publication. Jim Manico authorized use of the existing
+PR-only review bypass and instructed publication of the validated release.
+This records an audit-visible review exception, not independent maintainer
+approval. Required CI/security checks were not bypassed.
+
+Development resumes at **1.6.1-SNAPSHOT**, with API baseline **1.6.0**. The
+immutable release source retains its preparation-stage notices; this record
+confirms publication without altering the released sources or signatures.

releases/1.6.0.md

@@ -1,10 +1,9 @@
 # OWASP Java Encoder 1.6.0
 
-**Release preparation; not yet published.** The latest verified Central release
-remains [1.5.1](1.5.1-central-publication.md). This minor release reduces
+**Published 2026-10-18 UTC to Maven Central and GitHub.** See the
+[publication verification](1.6.0-central-publication.md). This minor release reduces
 unnecessary JavaScript letter escaping while preserving recognized HTML-token
 protection across trusted fragments. It introduces no new encoder security fix.
-Do not treat a successful build or staging validation as publication.
 
 ## Highlights and compatibility
 
@@ -55,10 +54,10 @@ versions should follow that release's migration guidance and
 
 ## Coordinates and availability
 
-Prepared group `org.owasp.encoder`, version `1.6.0`: `encoder`, `encoder-jsp`,
+Published group `org.owasp.encoder`, version `1.6.0`: `encoder`, `encoder-jsp`,
 `encoder-jakarta-jsp`, and parent `encoder-parent`. The optional test WAR is not
 published. `encoder-esapi` remains retired after 1.4.1 and is not included.
-No 1.6.0 Central availability is claimed until exact artifacts are verified.
+All published artifacts and signatures matched the retained release byte for byte.
 
 ## Verification and evidence
 
@@ -74,8 +73,8 @@ signatures and signed checksum manifests using [KEYS](../KEYS) and
 sources, clean-cache builds, packaged consumers, Docker/browser/WAR tests,
 reproducible unsigned payload comparison, all required CI/security checks,
 signature verification and comparison of published bytes with retained artifacts.
-Those release-specific results and the final source/tag/bundle identities must
-be recorded before publication is described as verified.
+The [publication record](1.6.0-central-publication.md) records those passed gates
+and the exact source, tag, bundle and downloaded-file identities.
 
 ## Backlog and review disposition