[dependabot]

Bumps the production-dependencies group with 4 updates in the / directory: org.apache.httpcomponents.client5:httpclient5, net.bytebuddy:byte-buddy, org.owasp.encoder:encoder and com.fasterxml.jackson.core:jackson-databind.

Updates org.apache.httpcomponents.client5:httpclient5 from 5.6.4 to 5.6.5

Changelog

Sourced from org.apache.httpcomponents.client5:httpclient5's changelog.

Release 5.6.5

This maintenance release fixes several defects found since the previous release including the defect in the async Brotli decompression code that can cause the message exchange to hang indefinitely. It also upgrades HttpCore to version 5.4.4.

Change Log

• Upgraded HttpCore to version 5.4.4. Contributed by Oleg Kalnichevski

• HTTPCLIENT-2433: Prevent concurrent HTTP/2 request body replay. Contributed by Matthias Kurz <m.kurz at irregular.at>

• HTTPCLIENT-2432: Fixed connection-pool leak in ResponseEntityProxy#cleanup() when runtime #disconnectEndpoint throws an exception (#883). Contributed by Victor Alekseev

• Decode punycode public suffixes in PublicSuffixMatcher#verify (#876). Contributed by Javid Khan

• Fixed Brotli decompression hang with large input buffers. Contributed by Arturo Bernal

• HTTP cache to treat malformed delta-seconds as absent. Contributed by Arturo Bernal Javid Khan

• Bug-fix: ResponseCachingPolicy incorrectly applies neverCache1_1ResponsesWithQueryString config parameter. This config parameter and related functionality will be deprecated in the next feature release and removed in the future. Contributed by Oleg Kalnichevski

• Removed invalid request version check from ResponseCachingPolicy. Contributed by Oleg Kalnichevski

• Fixed resource leaking on error in AsyncCachingExec Contributed by Jeremie Bolduc <16137441+Jouramie at users.noreply.github.com>

Commits

• e6970b4 HttpClient 5.6.5 release
• d0ff6ec Updated release notes for HttpClient 5.6.5 release
• 03a2abc Upgraded HttpCore to version 5.4.4
• 7ed9d66 HTTPCLIENT-2433: Prevent concurrent HTTP/2 request body replay
• bd278a6 Improved connection expiry and eviction example
• 02f11eb HTTPCLIENT-2432: fix connection-pool leak in ResponseEntityProxy.cleanup() wh...
• 8e45f17 decode punycode public suffixes in PublicSuffixMatcher.verify (#876)
• 6d8319a Fix Brotli decompression hang with large input buffers
• 908ccc1 treat malformed delta-seconds as absent in deltaSeconds
• 815043a Moved timeout and stale connection related integration tests into separate gr...
• Additional commits viewable in compare view

Updates net.bytebuddy:byte-buddy from 1.18.14 to 1.18.15

Changelog

Sourced from net.bytebuddy:byte-buddy's changelog.

Byte Buddy release notes

Commits

• f2dffef [publish] Releasing Byte Buddy 1.18.15
• 7af339e [release] Release new version
• 74b23dc Update ASM.
• 807fb56 Remove the sigstore dry run from the build pipeline.
• 2efd25c Break the build on binary incompatibility again.
• 29a92ee Update internal Byte Buddy and release notes.
• b6ebdb3 [publish] Start next development iteration 1.18.15-SNAPSHOT
• See full diff in compare view

Updates org.owasp.encoder:encoder from 1.5.0 to 1.6.0

Release notes

Sourced from org.owasp.encoder:encoder's releases.

OWASP Java Encoder 1.6.0

OWASP Java Encoder 1.6.0 reduces unnecessary JavaScript letter escaping while retaining recognized HTML-token protection across trusted fragments. It resolves #243 through #247. This is a minor release because emitted bytes and streaming behavior change.

Changes and migration

• forJavaScript and forJavaScriptBlock keep interior script-name letters readable. A final C, I, P, R, S, or T in either case still receives an escape. Punctuation and whitespace escapes remain.
• http://google.com now produces http:\/\/google.com; script becomes scrip\x74; i remains \x69. The rule is conservative: cat becomes ca\x74.
• HTML does not remove whitespace inside tag names. Escaping < in a complete value addresses the HTML tag delimiter concern, but a fragment may have its < supplied by trusted text. The terminal escape preserves that supported protection.
• General/block EncodedWriter callers must flush before writing directly to the wrapped writer. Explicit flushes safely emit pending letters/surrogates and can add escapes while preserving the JavaScript UTF-16 value. Low-level callers must retain unread input after UNDERFLOW and supply more input or mark end-of-input.
• Review snapshots, signatures and cache keys that depend on encoded bytes. Source and attribute-only methods are unchanged.

Public APIs, Java 8 support, runtime dependencies and module/bundle identities are unchanged. No new encoder security fix is introduced. The 1.5.0 protections remain; users of older versions should follow the security advisory. See the migration record.

Maven Central

Version 1.6.0 is published under org.owasp.encoder:

• encoder
• encoder-jsp
• encoder-jakarta-jsp
• encoder-parent

Keep core and adapter versions aligned. Do not combine javax and Jakarta adapters. The retired ESAPI adapter and optional test WAR are not included. Javadoc JARs are attached; hosted javadoc.io indexing can lag publication.

Verification

Exact tested source: d9b0fd62497fb9276429a9ea972f4449ab320f2d; signed tag: v1.6.0.

All 26 downloaded Central payload/signature files matched the retained originals byte for byte. All 13 payload signatures and both checksum-manifest signatures verify with project fingerprint 1C5F632B86809F2F5DB25092BEA0075F94074A9B. Attached bundle SHA-256: 8d860714634ae3b53f19bb3ea326f639b74df96c0e82bc956d53f237b5804c16.

The clean unsigned and signed builds, Docker/browser/WAR gate, packaged Java 17 consumers and repository checks passed. All thirteen unsigned payloads match two independent clean builds using Temurin 17.0.20.1+1 and Maven 3.10.0. Required CI passed, including Java 8/11/17/21/25 consumers, Java 8 tests and Java/Actions/Python CodeQL. Model-assisted review followed MODELS.md; no Daybreak review was completed before release. The documented maintainer review bypass was authorized; required CI/security checks were not bypassed.

Correction — 2026-10-18: The original review record described Daybreak access as unavailable, but the explicit picker-route probe had not been attempted. A subsequent probe succeeded, as recorded in [PR #251](OWASP/owasp-java-encoder#251). This establishes later access, not a pre-release review. The release tag and signed artifacts retain their original bytes.

Verify the attached signatures and signed checksum manifests with KEYS, SHA256SUMS, SHA512SUMS and VERIFYING.md. The immutable source retains preparation-stage notices; this release confirms publication without changing those sources or signatures.

OWASP Java Encoder 1.5.1 is a documentation and build-maintenance patch. Encoding behavior, public APIs, runtime dependencies, and Java 8 support are unchanged from 1.5.0.

What changed

• Clarify JavaScript encoding modes, output growth, and where encoded values can safely be inserted.
• Explain why script-letter escapes remain necessary in the general and block modes; Source mode already leaves the URL in #243 unchanged.
• Distinguish JSON whole-string HTML embedding from JavaScript fragment protection, with clearer surrounding-template requirements.
• Strengthen parser regression tests and include the build/test maintenance recorded in CHANGELOG.md.

The documentation changes are in #244. The release preparation is in #245. This patch preserves the security fixes from 1.5.0 and introduces no new encoder security fix. Users upgrading from versions older than 1.5.0 should read the 1.5.0 migration notes and security advisory.

Maven Central

Version 1.5.1 is published under org.owasp.encoder:

... (truncated)

Changelog

Sourced from org.owasp.encoder:encoder's changelog.

1.6.0 — 2026-10-18 UTC

Publication is verified; see the release record.

• Reduce unnecessary script-letter escaping in forJavaScript and forJavaScriptBlock (#243). Interior letters remain readable; the input's last character is escaped if it is C, I, P, R, S, or T (either case). Existing punctuation escapes and protection against recognized HTML tokens across trusted-text boundaries are preserved. Encoded bytes change, while JavaScript string values do not. Streaming encoders may retain one trailing letter; EncodedWriter.flush() safely emits it as a hex escape and any pending high surrogate as a Unicode escape. Explicit flushes can add safe escapes while preserving UTF-16 values. Direct Encoder.encode callers must retain unread input after underflow and supply more input or mark end-of-input, including for a pending ASCII letter.

1.5.1 — 2026-10-15 UTC

Documentation and build-maintenance patch; publication is verified in the publication record. Encoding behavior and public APIs are unchanged.

• Clarify JavaScript encoding modes, output growth, and insertion-boundary requirements for #243; distinguish JSON whole-string HTML embedding from JavaScript fragment protection. Correct internal HTML/XML comments and strengthen parser tests to verify script text, not only absence of a marker. Encoding behavior is unchanged.

• Verify public API compatibility against immutable 1.5.0 artifacts and their matching support APIs. Minimum-consumer fixtures are unchanged.

• Discover release tags independently of commit ancestry so squash merges cannot leave the compatibility baseline stale; add isolated Git regressions.

• Record verified 1.5.0 publication and replace pending-availability notices.

• Update Jackson core/databind to 3.1.7 in the unpublished Jakarta fixture's Spring Boot Maven plugin realm for GHSA-q4xh-88c3-wmh7, GHSA-wjgm-6hv5-3cvf, GHSA-wv8q-qhhj-9h54 and GHSA-cxp5-3px4-pw24. Published library dependencies and release artifacts are unchanged.

• Route Jackson plugin-realm pins and Maven wrapper upgrades out of the grouped Dependabot PR for individual review, and keep Jackson on its 3.1 line until the Boot parent moves. Security updates remain eligible.

• Build with Maven 3.10.0 through the committed wrapper and require it for signed releases. Ordinary builds still accept Maven 3.9.16 or later. Library JARs and module POMs are byte-identical to 3.9.16 builds (validation).

• Update isolated Tomcat/Jasper test engines to 9.0.123 and 10.1.61 and give each its own Dependabot scan (#241, #242). These are test tooling, not dependencies shipped inside the encoder libraries.

• Update reviewed build tooling and pinned Actions, including japicmp 0.26.3, Commons Lang 3.21.0, and the publisher's HttpClient 5.6.5 (#234, #237, #240).

Commits

• d9b0fd6 release: prepare Java Encoder 1.6.0
• 300ef20 Merge pull request #247 from OWASP/fix/issue-243-script-letter-escaping
• da8b7a0 Merge remote-tracking branch 'origin/main' into fix/issue-243-script-letter-e...
• 2c5bf4b Clarify issue 243 fragment protection and unreleased usage
• caa8aa4 Merge pull request #248 from OWASP/docs/model-review-workflow
• 9ea2823 Make model review guidance first-party project instructions
• 00d0eb2 Document model-assisted Java Encoder review workflow
• a596740 Reduce interior JavaScript letter escaping while preserving boundary safety
• 1d0e9f2 Merge pull request #246 from OWASP/release/1.5.1-published
• 5ce32da Record verified 1.5.1 publication and resume 1.5.2 development
• Additional commits viewable in compare view

Updates com.fasterxml.jackson.core:jackson-databind from 2.22.3 to 2.22.4

Commits

• a56a810 [maven-release-plugin] prepare release jackson-databind-2.22.4
• c172c5d Prep for 2.22.4 release
• 1e761c0 Merge branch '2.21' into 2.22
• fe3780f Post-release dep version bump
• a0e1fad [maven-release-plugin] prepare for next development iteration
• c92512e [maven-release-plugin] prepare release jackson-databind-2.21.8
• 0a41b7c Prep for 2.21.8 release
• ab63665 Remove stale empty 2.23.0 section from 2.22 release notes
• 2b5a04b Merge branch '2.21' into 2.22
• 3402e80 Merge branch '2.20' into 2.21
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions