renovate-bot opened a new pull request, #701: URL: https://github.com/apache/sling-org-apache-sling-starter/pull/701
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [org.owasp.encoder:encoder](https://owasp.org/projects/java-encoder) ([source](https://redirect.github.com/OWASP/owasp-java-encoder)) | `1.4.0` → `1.6.0` |  |  | --- ### Release Notes <details> <summary>OWASP/owasp-java-encoder (org.owasp.encoder:encoder)</summary> ### [`v1.6.0`](https://redirect.github.com/OWASP/owasp-java-encoder/blob/HEAD/CHANGELOG.md#160--2026-10-18-UTC) Publication is verified; see the [release record](releases/1.6.0.md). - Reduce unnecessary script-letter escaping in `forJavaScript` and `forJavaScriptBlock` ([#​243](https://redirect.github.com/OWASP/owasp-java-encoder/issues/243)). Interior letters remain readable; the input's last character is escaped if it is C, I, P, R, S, or T (either case). Existing punctuation escapes and protection against recognized HTML tokens across trusted-text boundaries are preserved. Encoded bytes change, while JavaScript string values do not. Streaming encoders may retain one trailing letter; `EncodedWriter.flush()` safely emits it as a hex escape and any pending high surrogate as a Unicode escape. Explicit flushes can add safe escapes while preserving UTF-16 values. Direct `Encoder.encode` callers must retain unread input after underflow and supply more input or mark end-of-input, including for a pending ASCII letter. ### [`v1.5.1`](https://redirect.github.com/OWASP/owasp-java-encoder/blob/HEAD/CHANGELOG.md#151--2026-10-15-UTC) Documentation and build-maintenance patch; publication is verified in the [publication record](releases/1.5.1-central-publication.md). Encoding behavior and public APIs are unchanged. - Clarify JavaScript encoding modes, output growth, and insertion-boundary requirements for [#​243](https://redirect.github.com/OWASP/owasp-java-encoder/issues/243); distinguish JSON whole-string HTML embedding from JavaScript fragment protection. Correct internal HTML/XML comments and strengthen parser tests to verify script text, not only absence of a marker. Encoding behavior is unchanged. - Verify public API compatibility against immutable 1.5.0 artifacts and their matching support APIs. Minimum-consumer fixtures are unchanged. - Discover release tags independently of commit ancestry so squash merges cannot leave the compatibility baseline stale; add isolated Git regressions. - Record verified 1.5.0 publication and replace pending-availability notices. - Update Jackson core/databind to 3.1.7 in the unpublished Jakarta fixture's Spring Boot Maven plugin realm for GHSA-q4xh-88c3-wmh7, GHSA-wjgm-6hv5-3cvf, GHSA-wv8q-qhhj-9h54 and GHSA-cxp5-3px4-pw24. Published library dependencies and release artifacts are unchanged. - Route Jackson plugin-realm pins and Maven wrapper upgrades out of the grouped Dependabot PR for individual review, and keep Jackson on its 3.1 line until the Boot parent moves. Security updates remain eligible. - Build with Maven 3.10.0 through the committed wrapper and require it for signed releases. Ordinary builds still accept Maven 3.9.16 or later. Library JARs and module POMs are byte-identical to 3.9.16 builds ([validation](releases/maven-3.10.0-validation.md)). - Update isolated Tomcat/Jasper test engines to 9.0.123 and 10.1.61 and give each its own Dependabot scan ([#​241](https://redirect.github.com/OWASP/owasp-java-encoder/issues/241), [#​242](https://redirect.github.com/OWASP/owasp-java-encoder/issues/242)). These are test tooling, not dependencies shipped inside the encoder libraries. - Update reviewed build tooling and pinned Actions, including japicmp 0.26.3, Commons Lang 3.21.0, and the publisher's HttpClient 5.6.5 ([#​234](https://redirect.github.com/OWASP/owasp-java-encoder/issues/234), [#​237](https://redirect.github.com/OWASP/owasp-java-encoder/issues/237), [#​240](https://redirect.github.com/OWASP/owasp-java-encoder/issues/240)). ### [`v1.5.0`](https://redirect.github.com/OWASP/owasp-java-encoder/blob/HEAD/CHANGELOG.md#150--2026-09-28-UTC) This is a security release for [GHSA-g8p6-7r8f-qrpv](https://redirect.github.com/OWASP/owasp-java-encoder/security/advisories/GHSA-g8p6-7r8f-qrpv). Signed artifact availability and independent verification are tracked in the [1.5.0 release record](releases/1.5.0.md). - build: stop Dependabot from recreating already-reviewed incompatible API, servlet-engine and build-tool version proposals. The ignores are limited to routine version updates in the rejected SemVer classes; security updates remain eligible. Mixed historical/current coordinates require manual version review because Dependabot classifies them from their lowest occurrence. - removed: retire the optional `encoder-esapi` adapter. Version 1.4.1 is its final published release and is no longer supported; no `encoder-esapi:1.5.0` artifact will be published. Consumers must remove the adapter and [migrate Java Encoder-backed calls to the direct context APIs](docs/encoder-esapi-retirement.md). Historical Maven artifacts remain immutable. - build: remove advisory-affected dependencies from active Maven plugin realms, including the separately invoked compatibility-fixture downloader; invoke the same japicmp engine without its obsolete reporting wrapper; and submit only actually invoked build plugins to GitHub's dependency graph. Shared inherited tooling is recorded once, and no Dependabot alert is dismissed or suppressed. - build/compatibility: update the published JSP provided API to 2.3.3 and the Jakarta test classpath to Servlet 6.1.0 and EL 6.0.1, while retaining independent JSP 2.2.1 and Java 8-compatible Jakarta minimum-consumer fixtures. Japicmp now resolves distinct old/new support classpaths so the 1.4.1 comparison remains complete. Dependabot scans the root Maven reactor once, rather than opening duplicate module proposals, and continues to scan the standalone compatibility-fixture project separately. - feat: all four `forJavaScript*` methods encode dollar sign (`$`) as `\x24`, backtick as `\x60`, and opening brace (`{`) as `\x7b` [#​129](https://redirect.github.com/OWASP/owasp-java-encoder/issues/129). Escaping `{` prevents input after a trusted `$` from completing `${...}`. Encoded output now supports literal text in ordinary (untagged) template literals as well as single- and double-quoted strings. This changes the encoded output while preserving its decoded JavaScript string value. Tagged templates (including `String.raw`), `${...}` expression bodies, JSON, and script URLs are unsupported; each method's HTML context restrictions still apply. - fix: all four `forJavaScript*` methods escape unpaired UTF-16 surrogates as `\uXXXX`, preserving their JavaScript string values through UTF-8 serialization [#​135](https://redirect.github.com/OWASP/owasp-java-encoder/issues/135), and escape DEL/C1 controls (U+007F to U+009F) as `\xNN` [#​163](https://redirect.github.com/OWASP/owasp-java-encoder/issues/163). Valid surrogate pairs and other non-ASCII text remain unescaped except U+2028/U+2029. These are output-fidelity changes; NEL was already ordinary JavaScript string data. - fix: the HTML/block JavaScript encoders escape every ASCII character that can contribute to case-insensitive `</script` or `<script` tokens or the `<!--` and `-->` script tokens, including their delimiters, so the encoding of any nonempty value cannot complete a delimiter supplied partly by adjacent trusted literal text. `forCDATA` represents every `]` and `>` with close/reopen sequences, preserving parsed text while breaking every nonempty encoded substring of `]]>`; its String facade grows with actual output instead of eagerly reserving the 13× maximum. `forXmlComment` replaces every hyphen with `~`. These are substantial compatibility-visible output changes; see the [migration record](docs/compatibility-decisions.md#15-parser-boundary-output-migration). - fix: `EncodedWriter` now enforces Writer lifecycle semantics: write, append and flush operations fail after close; repeated close is harmless; the first close finalizes pending input and still attempts the delegate close, preserving simultaneous failures with suppressed exceptions. Array-slice writes now use overflow-safe bounds validation, including `Integer.MAX_VALUE`-shaped ranges. - build: compare all three 1.5.0 artifacts against the immutable 1.4.1 public-API baseline, and verify that every publishable effective POM inherits repository-root SCM connection, developer connection and URL values without module-name suffixes. - feat: add `Encode.forJson` String/Writer methods, the `json` encoder context, and `forJson` tags and EL functions in both JSP and Jakarta tag libraries [#​145](https://redirect.github.com/OWASP/owasp-java-encoder/issues/145). The caller supplies double quotes. Output uses RFC 8259 string escapes and also escapes HTML script delimiters. Java `null` becomes the text `null` (the JSON string `"null"` when quoted); unpaired surrogates use Unicode escapes and may not interoperate with every JSON consumer. Prefer a serializer for complete JSON documents. - feat: add `forXml11`, `forXml11Content` and `forXml11Attribute` tags and EL functions to the advanced JSP and Jakarta taglibs, and `forXml11` to the basic taglibs [#​131](https://redirect.github.com/OWASP/owasp-java-encoder/issues/131). - deprecation: `Encoders.URI` and both `ForUriTag` classes are now deprecated like `Encode.forUri`, whose Javadoc now says what to use instead; the `forUri` TLD descriptions warn about double encoding, the adapter builds show deprecation call sites, and the README has a [forUri migration section](README.md#migrating-from-foruri) [#​130](https://redirect.github.com/OWASP/owasp-java-encoder/issues/130). - fix: the JSP and Jakarta bundles now declare the core version they need (`[1.5,2)`, because the tags call `Encode.forJson`) and the JSP API ranges they support, instead of unversioned imports that could wire to an older core and fail when a tag ran. Bundle symbolic names are now declared explicitly and unchanged [#​137](https://redirect.github.com/OWASP/owasp-java-encoder/issues/137). - fix: `forHtmlUnquotedAttribute` now replaces U+0085 (NEL) with a hyphen like the other C1 control characters, instead of emitting `&#​133;`, which HTML5 parsers decode as U+2026 [#​136](https://redirect.github.com/OWASP/owasp-java-encoder/issues/136). - fix: the XML 1.1 encoders (`forXml11`, `forXml11Content`, `forXml11Attribute`) now encode U+0085 (NEL) as `…` and U+2028 (line separator) as `
`, so they are not normalized to a line feed [#​136](https://redirect.github.com/OWASP/owasp-java-encoder/issues/136). - maintenance: clarify output-context contracts and expand XML 1.1 tests, fix clean reactor compilation, and remove the obsolete benchmark profile. ##### Build, compatibility and maintenance - Preserve original-JAR consumers on Java 8/11/17/21/25, explicit/automatic JPMS and Felix R6/R8; add final TLD-surface/Writer contract checks ([#​162](https://redirect.github.com/OWASP/owasp-java-encoder/issues/162), [#​167](https://redirect.github.com/OWASP/owasp-java-encoder/issues/167)). - Test packaged javax/Jakarta TLDs through isolated Tomcat/Jasper engines; retain required real-browser and executable-WAR checks with the modernized optional Boot 4.1.1 fixture ([#​179](https://redirect.github.com/OWASP/owasp-java-encoder/issues/179), [#​180](https://redirect.github.com/OWASP/owasp-java-encoder/issues/180)). - Pin and guard Actions, add CodeQL/dependency submissions/Dependabot, isolate Maven caches, and preserve required CI/security gates ([#​173](https://redirect.github.com/OWASP/owasp-java-encoder/issues/173), [#​177](https://redirect.github.com/OWASP/owasp-java-encoder/issues/177)). - Include Java 9 descriptors in source attachments; normalize source metadata and retain attribution ([#​184](https://redirect.github.com/OWASP/owasp-java-encoder/issues/184)). - Retire the dormant Maven Site/OSS parent, adopt verified Maven 3.9.16 wrapper and JDK 17 build policy, Checkstyle and measured unit coverage floors; isolate signing/publishing tools, verify local bundles and measure reproducibility ([#​185](https://redirect.github.com/OWASP/owasp-java-encoder/issues/185), [#​187](https://redirect.github.com/OWASP/owasp-java-encoder/issues/187)). This does not change the Java 8 library runtime baseline. - Add release verification, historical key evidence, and maintainer custody guidance ([#​164](https://redirect.github.com/OWASP/owasp-java-encoder/issues/164), [#​171](https://redirect.github.com/OWASP/owasp-java-encoder/issues/171), [#​185](https://redirect.github.com/OWASP/owasp-java-encoder/issues/185)). Historical signing-key authorization records ([#​110](https://redirect.github.com/OWASP/owasp-java-encoder/issues/110)) now distinguish retrospective maintainer authentication from historical GitHub/project records; see the [key verification record](releases/historical-key-authentication.md). Central publication and the reported completion of maintainer access/custody work ([#​111](https://redirect.github.com/OWASP/owasp-java-encoder/issues/111)) are recorded in the [publication follow-up](releases/1.4.1-central-publication.md). The [maintenance tracker](https://redirect.github.com/OWASP/owasp-java-encoder/issues/169) and [closeout record](docs/archive/maintenance-2026-09/maintenance-closeout.md) record the corresponding PRs, tests and dispositions; they are not approval to publish 1.5. ### [`v1.4.1`](https://redirect.github.com/OWASP/owasp-java-encoder/blob/HEAD/CHANGELOG.md#141--2026-09-26-UTC) [Signed GitHub release](https://redirect.github.com/OWASP/owasp-java-encoder/releases/tag/v1.4.1) ([tag created 2026-09-25 in America/Los_Angeles](https://redirect.github.com/OWASP/owasp-java-encoder/tree/v1.4.1)). **Available from Maven Central. Upgrade all four Java Encoder artifacts; versions through 1.4.0 are affected.** Central publication was verified on 2026-09-27 UTC (2026-09-26 in America/Los_Angeles); [all artifacts and signatures match the retained release](releases/1.4.1-central-publication.md). - Fix `EncodedWriter` context corruption during buffer overflow ([GHSA-57jg-769q-93vh](https://redirect.github.com/OWASP/owasp-java-encoder/security/advisories/GHSA-57jg-769q-93vh)). - Fix insufficient-lookahead infinite loops in `EncodedWriter` ([GHSA-q6jj-5396-8mq2](https://redirect.github.com/OWASP/owasp-java-encoder/security/advisories/GHSA-q6jj-5396-8mq2)). - Fix CSS String API maximum-output sizing for long U+2028/U+2029 runs ([GHSA-p9ff-j89j-9xhx](https://redirect.github.com/OWASP/owasp-java-encoder/security/advisories/GHSA-p9ff-j89j-9xhx)). - Preserve Java 8 runtime, public method signatures, Maven and JPMS identities; make adapter API dependencies transitively readable in module descriptors. - Pin the ESAPI adapter's default to 2.7.0.0 rather than a Maven version range. See the [full release record](releases/1.4.1.md) for affected entry points, coordinates, verification and publication status. Later 1.5 changes do not alter these retained artifacts. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/apache/sling-org-apache-sling-starter). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yMDIuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjIwMi4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbXX0=--> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
