Merge pull request #249 from OWASP/release/1.6.0

release: prepare Java Encoder 1.6.0

Author: jmanico

CHANGELOG.md

@@ -8,6 +8,12 @@ unchanged. [1.5.1 is available from Central](releases/1.5.1-central-publication.
 
 ## Unreleased
 
+No changes yet.
+
+## 1.6.0 — release preparation
+
+Publication is pending; see the [release record](releases/1.6.0.md).
+
 - Reduce unnecessary script-letter escaping in `forJavaScript` and
   `forJavaScriptBlock` (#243). Interior letters remain readable; the input's last
   character is escaped if it is C, I, P, R, S, or T (either case). Existing punctuation escapes and

README.md

@@ -9,11 +9,13 @@ has no runtime dependencies; optional JSP and Jakarta adapters provide view-laye
 bindings. Encoding is one part of [XSS prevention][xss], alongside
 safe templates, URL validation and other application controls.
 
-**1.5.1 is available from Maven Central.** This patch release clarifies the
-JavaScript and JSON documentation and strengthens parser regression tests.
-Encoder behavior, public APIs, and runtime dependencies are unchanged from 1.5.0.
-See the [release notes](releases/1.5.1.md) and
-[publication verification](releases/1.5.1-central-publication.md).
+**1.6.0 release preparation:** this minor release reduces unnecessary JavaScript
+letter escaping while preserving recognized HTML-token protection across trusted
+fragments. Encoded bytes and streaming behavior change; see the
+[release notes](releases/1.6.0.md) for migration and verification.
+Publication is not complete; the dependency example below targets the prepared
+release. The latest verified Central release remains
+[1.5.1](releases/1.5.1-central-publication.md) until publication is confirmed.
 
 The parser-boundary security fixes introduced in 1.5.0 remain in effect;
 versions through 1.4.1 do not contain those fixes. See
@@ -35,7 +37,7 @@ The three supported artifacts use group ID `org.owasp.encoder`:
 <dependency>
     <groupId>org.owasp.encoder</groupId>
     <artifactId>encoder</artifactId>
-    <version>1.5.1</version>
+    <version>1.6.0</version>
 </dependency>
 ```
 
@@ -46,9 +48,9 @@ on the same classpath or module path. See the [runtime matrix](compatibility/REA
 [dependency/license inventory](docs/dependencies.md).
 
 `encoder-esapi` was retired after 1.4.1 and is not included or supported in
-1.5.x. Applications using it must [migrate away from the adapter](docs/encoder-esapi-retirement.md).
+1.5.x or 1.6.0. Applications using it must [migrate away from the adapter](docs/encoder-esapi-retirement.md).
 
-Published 1.5.1 API documentation: [core](https://javadoc.io/doc/org.owasp.encoder/encoder/1.5.1/),
+Published 1.5.1 API documentation (1.6.0 indexing follows publication): [core](https://javadoc.io/doc/org.owasp.encoder/encoder/1.5.1/),
 [javax JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jsp/1.5.1/) and
 [Jakarta JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jakarta-jsp/1.5.1/).
 
@@ -175,4 +177,4 @@ links distinguish maintainer support from OWASP Foundation donations.
 [xss]: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
 [java-libraries]: https://devguide.owasp.org/en/05-implementation/03-secure-libraries/04-java-secure-libs/
 [project]: https://owasp.org/projects/java-encoder
-[release]: https://github.com/OWASP/owasp-java-encoder/releases/tag/v1.5.1
+[release]: https://github.com/OWASP/owasp-java-encoder/releases/tag/v1.6.0

SECURITY.md

@@ -2,6 +2,11 @@
 
 ## Supported Versions
 
+Version **1.6.0** is being prepared as an output-encoding refinement. It preserves
+recognized HTML-token protection from 1.5.0 and introduces no new encoder
+security fix. Until [publication is verified](releases/1.6.0.md), 1.5.1 remains
+the current supported release shown below.
+
 Version **1.5.1**, published **2026-10-15 UTC**, is the current supported
 release. This documentation and build-maintenance patch preserves the 1.5.0
 security fixes and introduces no new encoder security fix. The

VERIFYING.md

@@ -6,14 +6,15 @@ identity authority. Obtain [KEYS](KEYS) from a trusted project revision and chec
 the fingerprint before use. Never import private key material to verify a release.
 
 For 1.4.1 and later releases until a documented rotation, the expected project key
-is `1C5F632B86809F2F5DB25092BEA0075F94074A9B`. The [1.5.1 publication verification](releases/1.5.1-central-publication.md)
-records the signed tag, exact bundle, and comparison of Central and GitHub
-downloads against the retained signed artifacts.
+is `1C5F632B86809F2F5DB25092BEA0075F94074A9B`. The [1.6.0 release record](releases/1.6.0.md#verification-and-evidence)
+tracks signing and publication of the prepared release. Do not treat a prepared
+release as available. The [1.5.1 publication verification](releases/1.5.1-central-publication.md)
+records the previous verified artifacts and signatures.
 
 ## Fresh public-only keyring
 
 Download the artifact, its original `.asc`, and the trusted `KEYS`. This example
-targets the published 1.5.1 release. For historical releases, use the full
+targets 1.6.0 once its publication is verified. For historical releases, use the full
 fingerprint mapped below and review the historical key's expiry and algorithms.
 Commands use GnuPG and `shasum` (or equivalent SHA tools).
 
@@ -22,7 +23,7 @@ verify_home=$(mktemp -d)
 chmod 700 "$verify_home"
 gpg --homedir "$verify_home" --batch --no-autostart --import KEYS
 expected_fingerprint=1C5F632B86809F2F5DB25092BEA0075F94074A9B
-artifact=encoder-1.5.1.jar
+artifact=encoder-1.6.0.jar
 gpg --homedir "$verify_home" --no-autostart --fingerprint "$expected_fingerprint"
 gpg --homedir "$verify_home" --batch --no-autostart --status-fd 1 \
   --verify "$artifact.asc" "$artifact" > signature.status || exit 1
@@ -45,7 +46,7 @@ A Maven `.sha256` sidecar usually contains **only a hex digest**, not a filename
 After fetching it over the intended distribution channel, form a check manifest:
 
 ```sh
-artifact=encoder-1.5.1.jar
+artifact=encoder-1.6.0.jar
 expected_hash=$(tr -d '[:space:]' < "$artifact.sha256")
 printf '%s\n' "$expected_hash" | grep -Eq '^[[:xdigit:]]{64}$' || exit 1
 printf '%s  %s\n' "$expected_hash" "$artifact" | shasum -a 256 --check || exit 1

compatibility/README.md

@@ -84,7 +84,7 @@ fail these guards.
 During ordinary `./mvnw verify`, Animal Sniffer checks each library against the Java 8
 API signature. This catches linkage such as Java 9's covariant `CharBuffer.flip()`
 even when bytecode still has class version 52. japicmp checks public/protected API
-binary and source compatibility against **1.5.1** during **1.5.2-SNAPSHOT** development. The baseline guard selects the latest preceding semantic release tag,
+binary and source compatibility against **1.5.1** for the prepared **1.6.0** release. The baseline guard selects the latest preceding semantic release tag,
 including signed source commits integrated by squash merge; fetch all release tags
 before running it. The old support classpath matches the 1.5.1 POMs (JSP 2.3.3,
 Jakarta Servlet 6.1.0 and EL 6.0.1). Independent minimum-consumer fixtures remain

core/pom.xml

@@ -42,7 +42,7 @@
     <parent>
         <groupId>org.owasp.encoder</groupId>
         <artifactId>encoder-parent</artifactId>
-        <version>1.5.2-SNAPSHOT</version>
+        <version>1.6.0</version>
     </parent>
 
     <artifactId>encoder</artifactId>

docs/compatibility-decisions.md

@@ -66,14 +66,13 @@ the CDATA maximum is 13×. Large CDATA values should use a Writer facade or
 `EncodedWriter`; String facades retain the complete result but grow according to
 actual output rather than reserving the maximum bound.
 
-## Unreleased JavaScript output refinement (#243)
+## JavaScript output refinement in 1.6.0 (#243)
 
-Release recommendation: use a minor release (1.6.0), rather than assuming this
-is patch-compatible. The evaluated values and supported HTML tokenizer protection
+This change is prepared for the minor release 1.6.0, rather than a patch release. The evaluated values and supported HTML tokenizer protection
 remain intact, but encoded bytes, explicit-flush spelling, and the previous literal
-substring prohibition change. This proposal records the migration and parser
-validation requirements; the current development snapshot version is not release
-authorization. Existing published artifacts remain unchanged.
+substring prohibition change. This record describes the migration and parser
+validation requirements; release preparation does not establish publication.
+See the [release record](../releases/1.6.0.md) for status. Existing published artifacts remain unchanged.
 
 The script-fragment protection remains, with less escaping of ordinary letters.
 HTML punctuation and whitespace still use the 1.5 escapes. Of the letters in

docs/contexts.md

@@ -1,9 +1,8 @@
 # Output contexts and boundaries
 
-This guide describes the current development version, including the unreleased
-JavaScript refinement for #243. Published 1.5.0 and 1.5.1 retain their broader
-letter escapes; 1.5.1 clarified the 1.5.0 behavior without changing it. See the
-[1.5.1 release record](../releases/1.5.1.md) for publication status.
+This guide describes the prepared **1.6.0** release, including the JavaScript
+refinement for #243. Published 1.5.0 and 1.5.1 retain their broader letter escapes.
+See the [1.6.0 release record](../releases/1.6.0.md) for publication status.
 The [Encode Javadoc source](../core/src/main/java/org/owasp/encoder/Encode.java) is
 the detailed per-method contract; each method has a String-returning and a
 `(Writer out, String input)` overload. `Encoders` exposes shared stateless encoders;
@@ -83,7 +82,7 @@ The general and block encoders prevent a nonempty encoded value from completing
 recognized `</script` or `<script` tokens (case-insensitive, followed by an HTML
 name delimiter), `<!--`, or `-->` with adjacent trusted literal text. They escape
 space, `!`, hyphen (`\x2d`), `<`, `>`, slash, and relevant controls throughout
-the input. In the unreleased refinement for #243, letters from `script` (either case) are escaped
+the input. In 1.6.0, letters from `script` (either case) are escaped
 only when they are the final input character. Interior letters remain readable;
 a longer name such as `</scripture>` is not a script end tag. This preserves
 HTML tokenizer containment while allowing harmless raw `</script` substrings

docs/usage.md

@@ -1,8 +1,8 @@
 # Java and JSP examples
 
-These examples describe the current development version, including the
-**unreleased** JavaScript refinement for #243. Published **1.5.1** retains
-1.5.0's broader letter escaping; see the [release record](../releases/1.5.1.md).
+These examples target the prepared **1.6.0** release, including the JavaScript
+refinement for #243. See the [release record](../releases/1.6.0.md) for publication
+status. Published 1.5.1 retains 1.5.0's broader letter escaping.
 Features marked **1.5** were introduced in 1.5.0.
 
 ## HTML and Writer output
@@ -62,8 +62,8 @@ result into an HTML-parsing API introduces another context to secure.
 
 This correction changes emitted text. HTML-script JavaScript uses additional
 hex escapes (including `\x2d` for hyphen and escapes for both cases of the
-letters in `script`) while preserving the JavaScript string value. In the
-unreleased refinement for #243, only a final `C`, `I`, `P`, `R`, `S`, or `T` (either case) receives that
+letters in `script`) while preserving the JavaScript string value. In
+1.6.0, only a final `C`, `I`, `P`, `R`, `S`, or `T` (either case) receives that
 letter escape; interior letters remain readable. For example, `script` becomes
 `scrip\x74` and `http://google.com` becomes `http:\/\/google.com`.
 The punctuation and terminal-letter escapes together prevent recognized HTML
@@ -159,7 +159,7 @@ and the [packaged JSP engine checks](../compatibility/jsp-engine/README.md).
 ## Java modules
 
 The explicit module name for core is `owasp.encoder`. After verifying and obtaining
-`encoder-1.5.1.jar`, put that unchanged JAR in `lib/`, then create:
+`encoder-1.6.0.jar`, put that unchanged JAR in `lib/`, then create:
 
 `src/example.app/module-info.java`:
 

jakarta-test/pom.xml

@@ -31,7 +31,7 @@
         <jackson.build.version>3.1.7</jackson.build.version>
         <!-- Must equal the version in the root pom.xml so this app tests the
              encoder-jakarta-jsp built in the same reactor. CI checks this. -->
-        <encoder.version>1.5.2-SNAPSHOT</encoder.version>
+        <encoder.version>1.6.0</encoder.version>
     </properties>
     <dependencies>
         <dependency>