This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to annotated tag 2.6.0-rc1 in repository https://gitbox.apache.org/repos/asf/ant-ivy.git
commit 2927c79ff1c23964dfd00cb45182657c35b2e899 Author: Stefan Bodewig <[email protected]> AuthorDate: Sun Jul 12 07:56:24 2026 +0200 prepare RC1 of Ivy 2.6.0 --- asciidoc/release-notes.adoc | 3 ++- ivy.xml | 2 +- version.properties | 2 +- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/asciidoc/release-notes.adoc b/asciidoc/release-notes.adoc index f3f6bd61..9bede4b8 100644 --- a/asciidoc/release-notes.adoc +++ b/asciidoc/release-notes.adoc @@ -19,7 +19,7 @@ = Ivy Release Announcement -XXXX Date XXXX - The Apache Ivy project is pleased to announce its 2.6.0 release. +15 July 2026 - The Apache Ivy project is pleased to announce its 2.6.0 release. == What is Ivy? Apache Ivy is a tool for managing (recording, tracking, resolving and reporting) project dependencies, characterized by flexibility, @@ -71,6 +71,7 @@ It also fixes issues where the dynamic revisions were replaced by versions from - FIX: the `ivy:deliver` task didn't include XML namespaces from a parent ivy module when merging the descriptors. (IVY-1658) (Thanks to Eric Milles) - FIX: the `ivy:checkdepsupdate` task no longer shows evicted versions. (IVY-1662) (Thanks to Eric Milles) +- FIX: CVE-2026-26032: Apache Ivy: PackagerResolver path traversal vulnerability == Committers and Contributors diff --git a/ivy.xml b/ivy.xml index 2841c3b0..4a6d24ab 100644 --- a/ivy.xml +++ b/ivy.xml @@ -21,7 +21,7 @@ xsi:noNamespaceSchemaLocation="http://ant.apache.org/ivy/schemas/ivy.xsd";> <info organisation="org.apache.ivy" module="ivy" - status="integration"> + status="release"> <description homepage="http://ant.apache.org/ivy/";> Apache Ivy is a tool for managing (recording, tracking, resolving and reporting) project dependencies. </description> diff --git a/version.properties b/version.properties index 699727af..491c47d2 100644 --- a/version.properties +++ b/version.properties @@ -22,7 +22,7 @@ target.ivy.bundle.version=2.6.0 # in case we want to add a qualifier such as alpha, beta, etc... # if non empty, add a '_' at the end of the qualifier, so the version would look like 1.2.3.alpha_200901011200 # NB: be careful with naming, OSGi orders version alphabetically. Suggested values: alpha_, beta_, cr1_ (for RC-1), final_ -target.ivy.bundle.version.qualifier=alpha_ +target.ivy.bundle.version.qualifier=final # Versions of dependencies
