The Apache Juneau team is pleased to announce the release of Apache Juneau 9.2.1.
Apache Juneau 9.2.1 is a security and bug-fix release for 9.2.0. It hardens REST server and client defaults, parser input handling and HTML template escaping, and adds no new features. Security: 9.2.1 fixes CVE-2026-73095, CVE-2026-121489, CVE-2026-96677, CVE-2026-73099, CVE-2026-73100, CVE-2026-73101, CVE-2026-73098, CVE-2026-73116 and CVE-2026-73117. All users of 9.2.0 and earlier should upgrade. Advisory: https://lists.apache.org/thread/8kz0t84gt8y5c9oh0rhvlh17p7owqyfk Highlights: DirectoryResource rejects requested paths that resolve outside its root directory (403). RestClient no longer sends credential headers when a redirect goes to a different origin or from https to http. CallLogger redacts sensitive headers (Authorization, Cookie, Set-Cookie, Proxy-Authorization, X-API-Key) by default. Server error responses no longer expose internal exception detail unless renderResponseStackTraces is on. The default maxInput drops from 100M to 1M, and the limit now also applies to multipart/form-data requests. The content query parameter now overrides the request body only on PUT and POST. RestResponse strips invalid characters from header values by default; new sendSafeRedirect() restricts redirect targets. Parsers reject oversized or invalid declared lengths, and turn out-of-memory into a ParseException. XmlReader always disables DTD processing; ClassSwap no longer runs static initializers while parsing. HTML document templates XML-escape SVL variable substitutions in the page chrome. Known issues: None known. Several fixes change default behavior and may need configuration on upgrade: apps that accept request bodies over 1M must raise @Rest(maxInput); clients that parsed exception detail from error responses need @Rest(renderResponseStackTraces="true"); clients that sent a body through the content query parameter on GET or other non-PUT/POST methods must send it as the request body; templates that injected HTML through request variables will now see it escaped. Downloads: https://downloads.apache.org/juneau/9.2.1/ GitHub Release: https://github.com/apache/juneau/releases/tag/juneau-9.2.1 Release notes: https://juneau.apache.org/#release-notes Thanks to Gary Gregory for his contributions to this release. The Apache Juneau Team
