This is an automated email from the ASF dual-hosted git repository.
jamesbognar pushed a commit to branch docs
in repository https://gitbox.apache.org/repos/asf/juneau.git
The following commit(s) were added to refs/heads/docs by this push:
new 74be0d550e docs: add TODO-126 security audit entry to 9.5.0 release
notes
74be0d550e is described below
commit 74be0d550e38471371e0a7789ace9f5a03ab8f8a
Author: James Bognar <[email protected]>
AuthorDate: Thu May 28 16:06:53 2026 -0400
docs: add TODO-126 security audit entry to 9.5.0 release notes
Co-authored-by: Cursor <[email protected]>
---
pages/release-notes/9.5.0.md | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/pages/release-notes/9.5.0.md b/pages/release-notes/9.5.0.md
index 8a55bbdce0..c0e74456cf 100644
--- a/pages/release-notes/9.5.0.md
+++ b/pages/release-notes/9.5.0.md
@@ -8,6 +8,10 @@ title: "Release 9.5.0"
Juneau 9.5.0 is a minor release with native OpenAPI 3.1 emission (alongside
Swagger v2, composed via the new four-class `org.apache.juneau.rest.docs` mixin
pack — `BasicSwaggerResource` / `BasicSwaggerUiResource` /
`BasicOpenApiResource` / `BasicRedocResource` — that replaces the
previously-considered `apiFormat` string knob), native TOML and YAML support,
BSON (Binary JSON) support for MongoDB-interoperable binary serialization, CBOR
(Concise Binary Object Representation) per RFC 8949 f [...]
+### Security
+
+- **Examples / starter / petstore path-traversal audit (TODO-126).**
Belt-and-suspenders CWE-22 pass on file-serving handlers in the example and
starter modules: `juneau-microservice` (`DirectoryResource`, `LogsResource`),
`juneau-microservice-jetty` (`DebugResource`), the
`juneau-my-jetty-microservice` starter, all four view-module `Basic*Resource`
handlers (`BasicThymeleafResource`, `BasicMustacheResource`,
`BasicFreemarkerResource`, `BasicJspResource`), and the three Jetty XML `jetty.
[...]
+
### juneau-marshall
#### Duration/Period wire format controls (TODO-4)
