Merge pull request #245 from OWASP/release/1.5.1

Prepare Java Encoder 1.5.1 documentation patch release

Author: jmanico

CHANGELOG.md

@@ -8,13 +8,18 @@ unchanged. [1.5.0 is available from Central](releases/1.5.0-central-publication.
 
 ## Unreleased
 
+## 1.5.1 — release preparation, 2026-10-15 UTC
+
+Documentation and build-maintenance patch; publication is tracked in the
+[release record](releases/1.5.1.md). Encoding behavior and public APIs are unchanged.
+
 - Clarify JavaScript encoding modes, output growth, and insertion-boundary
   requirements for #243; distinguish JSON whole-string HTML embedding from
   JavaScript fragment protection. Correct internal HTML/XML comments and
   strengthen parser tests to verify script text, not only absence of a marker.
   Encoding behavior is unchanged.
-- Resume development at `1.5.1-SNAPSHOT`, with the immutable 1.5.0 public-API
-  baseline and its matching support APIs. Minimum-consumer fixtures are unchanged.
+- Verify public API compatibility against immutable 1.5.0 artifacts and their
+  matching support APIs. Minimum-consumer fixtures are unchanged.
 - Discover release tags independently of commit ancestry so squash merges cannot
   leave the compatibility baseline stale; add isolated Git regressions.
 - Record verified 1.5.0 publication and replace pending-availability notices.
@@ -30,6 +35,12 @@ unchanged. [1.5.0 is available from Central](releases/1.5.0-central-publication.
   module POMs are byte-identical to 3.9.16 builds
   ([validation](releases/maven-3.10.0-validation.md)).
 
+- Update isolated Tomcat/Jasper test engines to 9.0.123 and 10.1.61 and give
+  each its own Dependabot scan (#241, #242). These are test tooling, not
+  dependencies shipped inside the encoder libraries.
+- Update reviewed build tooling and pinned Actions, including japicmp 0.26.3,
+  Commons Lang 3.21.0, and the publisher's HttpClient 5.6.5 (#234, #237, #240).
+
 ## 1.5.0 — 2026-09-28 UTC
 
 This is a security release for

README.md

@@ -9,12 +9,16 @@ has no runtime dependencies; optional JSP and Jakarta adapters provide view-laye
 bindings. Encoding is one part of [XSS prevention][xss], alongside
 safe templates, URL validation and other application controls.
 
-**Released 2026-09-28:** version 1.5.0 fixes parser-boundary vulnerabilities in
-JavaScript-in-HTML, CDATA, and XML-comment fragment composition. Versions through
-1.4.1 do not contain those fixes. The [signed GitHub release][release] and
-[Maven Central artifacts](releases/1.5.0-central-publication.md) have been
-independently verified. See the [1.5.0 release notes](releases/1.5.0.md),
-[security advisory](https://github.com/OWASP/owasp-java-encoder/security/advisories/GHSA-g8p6-7r8f-qrpv)
+**1.5.1 release preparation:** this patch release clarifies the JavaScript and
+JSON documentation and strengthens parser regression tests. Encoder behavior,
+public APIs, and runtime dependencies are unchanged from 1.5.0. Publication is
+not complete; the dependency example below targets the prepared release. See
+[the 1.5.1 release record](releases/1.5.1.md) for availability and verification.
+
+The latest verified Central release remains [1.5.0](releases/1.5.0-central-publication.md)
+until 1.5.1 publication is confirmed. It introduced the parser-boundary security
+fixes retained in 1.5.1; versions through 1.4.1 do not contain those fixes. See
+[the security advisory](https://github.com/OWASP/owasp-java-encoder/security/advisories/GHSA-g8p6-7r8f-qrpv)
 and [VERIFYING.md](VERIFYING.md).
 
 ## Start using the OWASP Java Encoders
@@ -32,7 +36,7 @@ The three supported artifacts use group ID `org.owasp.encoder`:
 <dependency>
     <groupId>org.owasp.encoder</groupId>
     <artifactId>encoder</artifactId>
-    <version>1.5.0</version>
+    <version>1.5.1</version>
 </dependency>
 ```
 
@@ -45,7 +49,7 @@ on the same classpath or module path. See the [runtime matrix](compatibility/REA
 `encoder-esapi` was retired after 1.4.1 and is not included or supported in
 1.5.0. Applications using it must [migrate away from the adapter](docs/encoder-esapi-retirement.md).
 
-Published 1.5.0 API documentation: [core](https://javadoc.io/doc/org.owasp.encoder/encoder/1.5.0/),
+Published 1.5.0 API documentation (1.5.1 indexing follows publication): [core](https://javadoc.io/doc/org.owasp.encoder/encoder/1.5.0/),
 [javax JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jsp/1.5.0/) and
 [Jakarta JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jakarta-jsp/1.5.0/).
 
@@ -172,4 +176,4 @@ links distinguish maintainer support from OWASP Foundation donations.
 [xss]: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
 [java-libraries]: https://devguide.owasp.org/en/05-implementation/03-secure-libraries/04-java-secure-libs/
 [project]: https://owasp.org/projects/java-encoder
-[release]: https://github.com/OWASP/owasp-java-encoder/releases/tag/v1.5.0
+[release]: https://github.com/OWASP/owasp-java-encoder/releases/tag/v1.5.1

SECURITY.md

@@ -2,6 +2,11 @@
 
 ## Supported Versions
 
+Version **1.5.1** is being prepared as a documentation and build-maintenance
+patch. It preserves the 1.5.0 security fixes and introduces no new encoder
+security fix. Until [publication is verified](releases/1.5.1.md), 1.5.0 remains
+the current supported release shown below.
+
 Version **1.5.0**, published **2026-09-28 UTC**, is the current security release.
 The [signed GitHub assets](https://github.com/OWASP/owasp-java-encoder/releases/tag/v1.5.0)
 and [Maven Central publication](releases/1.5.0-central-publication.md) have been

VERIFYING.md

@@ -6,14 +6,15 @@ identity authority. Obtain [KEYS](KEYS) from a trusted project revision and chec
 the fingerprint before use. Never import private key material to verify a release.
 
 For 1.4.1 and later releases until a documented rotation, the expected project key
-is `1C5F632B86809F2F5DB25092BEA0075F94074A9B`. The [1.5.0 release record](releases/1.5.0.md#verification-and-evidence)
-covers its signed GitHub assets. The [Central publication verification](releases/1.5.0-central-publication.md)
-confirms that Central serves the same artifacts and signatures.
+is `1C5F632B86809F2F5DB25092BEA0075F94074A9B`. The [1.5.1 release record](releases/1.5.1.md#verification-and-evidence)
+tracks signing and publication of the prepared patch release. Do not treat a
+prepared release as available. The [1.5.0 publication verification](releases/1.5.0-central-publication.md)
+continues to record the previous verified artifacts and signatures.
 
 ## Fresh public-only keyring
 
 Download the artifact, its original `.asc`, and the trusted `KEYS`. This example
-verifies the published 1.5.0 release. For historical releases, use the full
+targets 1.5.1 once its publication is verified. For historical releases, use the full
 fingerprint mapped below and review the historical key's expiry and algorithms.
 Commands use GnuPG and `shasum` (or equivalent SHA tools).
 
@@ -22,7 +23,7 @@ verify_home=$(mktemp -d)
 chmod 700 "$verify_home"
 gpg --homedir "$verify_home" --batch --no-autostart --import KEYS
 expected_fingerprint=1C5F632B86809F2F5DB25092BEA0075F94074A9B
-artifact=encoder-1.5.0.jar
+artifact=encoder-1.5.1.jar
 gpg --homedir "$verify_home" --no-autostart --fingerprint "$expected_fingerprint"
 gpg --homedir "$verify_home" --batch --no-autostart --status-fd 1 \
   --verify "$artifact.asc" "$artifact" > signature.status || exit 1
@@ -45,7 +46,7 @@ A Maven `.sha256` sidecar usually contains **only a hex digest**, not a filename
 After fetching it over the intended distribution channel, form a check manifest:
 
 ```sh
-artifact=encoder-1.5.0.jar
+artifact=encoder-1.5.1.jar
 expected_hash=$(tr -d '[:space:]' < "$artifact.sha256")
 printf '%s\n' "$expected_hash" | grep -Eq '^[[:xdigit:]]{64}$' || exit 1
 printf '%s  %s\n' "$expected_hash" "$artifact" | shasum -a 256 --check || exit 1

compatibility/README.md

@@ -84,8 +84,7 @@ fail these guards.
 During ordinary `./mvnw verify`, Animal Sniffer checks each library against the Java 8
 API signature. This catches linkage such as Java 9's covariant `CharBuffer.flip()`
 even when bytecode still has class version 52. japicmp checks public/protected API
-binary and source compatibility against **1.5.0** during **1.5.1-SNAPSHOT**
-development. The baseline guard selects the latest preceding semantic release tag,
+binary and source compatibility against **1.5.0** for the **1.5.1** release. The baseline guard selects the latest preceding semantic release tag,
 including signed source commits integrated by squash merge; fetch all release tags
 before running it. The old support classpath matches the 1.5.0 POMs (JSP 2.3.3,
 Jakarta Servlet 6.1.0 and EL 6.0.1). Independent minimum-consumer fixtures remain

core/pom.xml

@@ -42,7 +42,7 @@
     <parent>
         <groupId>org.owasp.encoder</groupId>
         <artifactId>encoder-parent</artifactId>
-        <version>1.5.1-SNAPSHOT</version>
+        <version>1.5.1</version>
     </parent>
 
     <artifactId>encoder</artifactId>

docs/contexts.md

@@ -1,7 +1,8 @@
 # Output contexts and boundaries
 
-This guide describes the published version **1.5.0**; feature introductions are
-marked below. See the [verified downloads](../releases/1.5.0-central-publication.md).
+This guide describes **1.5.1**, which clarifies the unchanged 1.5.0 encoding
+behavior; feature introductions are marked below. See the
+[release record](../releases/1.5.1.md) for publication status.
 The [Encode Javadoc source](../core/src/main/java/org/owasp/encoder/Encode.java) is
 the detailed per-method contract; each method has a String-returning and a
 `(Writer out, String input)` overload. `Encoders` exposes shared stateless encoders;

docs/usage.md

@@ -1,7 +1,7 @@
 # Java and JSP examples
 
-These examples target the published version **1.5.0**. See the
-[verified downloads](../releases/1.5.0-central-publication.md).
+These examples target **1.5.1**, with unchanged encoding behavior from 1.5.0.
+See the [release record](../releases/1.5.1.md) for publication status.
 Features marked **1.5** are new in this release.
 
 ## HTML and Writer output
@@ -140,7 +140,7 @@ and the [packaged JSP engine checks](../compatibility/jsp-engine/README.md).
 ## Java modules
 
 The explicit module name for core is `owasp.encoder`. After verifying and obtaining
-`encoder-1.5.0.jar`, put that unchanged JAR in `lib/`, then create:
+`encoder-1.5.1.jar`, put that unchanged JAR in `lib/`, then create:
 
 `src/example.app/module-info.java`:
 

jakarta-test/pom.xml

@@ -31,7 +31,7 @@
         <jackson.build.version>3.1.7</jackson.build.version>
         <!-- Must equal the version in the root pom.xml so this app tests the
              encoder-jakarta-jsp built in the same reactor. CI checks this. -->
-        <encoder.version>1.5.1-SNAPSHOT</encoder.version>
+        <encoder.version>1.5.1</encoder.version>
     </properties>
     <dependencies>
         <dependency>

jakarta/pom.xml

@@ -42,7 +42,7 @@
     <parent>
         <groupId>org.owasp.encoder</groupId>
         <artifactId>encoder-parent</artifactId>
-        <version>1.5.1-SNAPSHOT</version>
+        <version>1.5.1</version>
     </parent>
 
     <artifactId>encoder-jakarta-jsp</artifactId>