Record verified 1.6.0 publication and resume development (#250)

Author: jmanico

CHANGELOG.md

@@ -10,9 +10,9 @@ unchanged. [1.5.1 is available from Central](releases/1.5.1-central-publication.
 
 No changes yet.
 
-## 1.6.0 — release preparation
+## 1.6.0 — 2026-10-18 UTC
 
-Publication is pending; see the [release record](releases/1.6.0.md).
+Publication is verified; see the [release record](releases/1.6.0.md).
 
 - Reduce unnecessary script-letter escaping in `forJavaScript` and
   `forJavaScriptBlock` (#243). Interior letters remain readable; the input's last

README.md

@@ -9,13 +9,11 @@ has no runtime dependencies; optional JSP and Jakarta adapters provide view-laye
 bindings. Encoding is one part of [XSS prevention][xss], alongside
 safe templates, URL validation and other application controls.
 
-**1.6.0 release preparation:** this minor release reduces unnecessary JavaScript
-letter escaping while preserving recognized HTML-token protection across trusted
-fragments. Encoded bytes and streaming behavior change; see the
-[release notes](releases/1.6.0.md) for migration and verification.
-Publication is not complete; the dependency example below targets the prepared
-release. The latest verified Central release remains
-[1.5.1](releases/1.5.1-central-publication.md) until publication is confirmed.
+**1.6.0 is available from Maven Central.** This minor release reduces unnecessary
+JavaScript letter escaping while preserving recognized HTML-token protection
+across trusted fragments. Encoded bytes and streaming behavior change; see the
+[release notes](releases/1.6.0.md) and
+[publication verification](releases/1.6.0-central-publication.md).
 
 The parser-boundary security fixes introduced in 1.5.0 remain in effect;
 versions through 1.4.1 do not contain those fixes. See
@@ -50,9 +48,9 @@ on the same classpath or module path. See the [runtime matrix](compatibility/REA
 `encoder-esapi` was retired after 1.4.1 and is not included or supported in
 1.5.x or 1.6.0. Applications using it must [migrate away from the adapter](docs/encoder-esapi-retirement.md).
 
-Published 1.5.1 API documentation (1.6.0 indexing follows publication): [core](https://javadoc.io/doc/org.owasp.encoder/encoder/1.5.1/),
-[javax JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jsp/1.5.1/) and
-[Jakarta JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jakarta-jsp/1.5.1/).
+Published 1.6.0 API documentation (hosted indexing may lag publication): [core](https://javadoc.io/doc/org.owasp.encoder/encoder/1.6.0/),
+[javax JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jsp/1.6.0/) and
+[Jakarta JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jakarta-jsp/1.6.0/).
 
 ```java
 import org.owasp.encoder.Encode;

RELEASING.md

@@ -6,7 +6,7 @@ Do not tag, publish, or announce a release until **all open issues and all
 open pull requests have been handled**. Before considering release approval,
 inventory the full open backlog and record the outcome and supporting review
 or verification for every item. Completing a maintenance batch does not satisfy
-this gate on its own. Keep current development at `1.5.2-SNAPSHOT` until maintainers
+this gate on its own. Keep current development at `1.6.1-SNAPSHOT` until maintainers
 deliberately create the exact release commit after the technical gates pass.
 Changing that commit to a release version is release preparation, not release approval.
 
@@ -15,7 +15,7 @@ the final backlog inventory and dispositions for #110 and #169. A closed tracker
 does not waive this gate: repeat the complete open-issue/PR inventory when a new
 release is actually proposed and obtain release approval then.
 
-The signed 1.5.1 release has been [published to Central and verified](releases/1.5.1-central-publication.md).
+The signed 1.6.0 release has been [published to Central and verified](releases/1.6.0-central-publication.md).
 Repeat these gates for each subsequent release. Do not rebuild or replace
 published artifacts, republish existing coordinates, or move release tags.
 
@@ -156,8 +156,8 @@ uploading. Keep an audit record of the exact uploaded bundle and its SHA-256.
 4. Set the fixed versions in the security advisories and publish the advisories
    in coordination with the available release. Do not announce a Central version
    that has not actually published.
-5. Set main to the next unreleased version (for example `1.5.2-SNAPSHOT` or
-   `1.6.0-SNAPSHOT`, chosen through version review), update `jakarta-test`
+5. Set main to the next unreleased version (for example `1.6.1-SNAPSHOT` or
+   `1.7.0-SNAPSHOT`, chosen through version review), update `jakarta-test`
    accordingly, and reset the SCM tag to `HEAD`. Advance `public.api.baseline.version`
    and its old support-API classpaths to the newly published immutable release.
    Fetch all release tags before running the baseline regression: the tested

SECURITY.md

@@ -2,16 +2,11 @@
 
 ## Supported Versions
 
-Version **1.6.0** is being prepared as an output-encoding refinement. It preserves
-recognized HTML-token protection from 1.5.0 and introduces no new encoder
-security fix. Until [publication is verified](releases/1.6.0.md), 1.5.1 remains
-the current supported release shown below.
-
-Version **1.5.1**, published **2026-10-15 UTC**, is the current supported
-release. This documentation and build-maintenance patch preserves the 1.5.0
-security fixes and introduces no new encoder security fix. The
-[signed GitHub assets](https://github.com/OWASP/owasp-java-encoder/releases/tag/v1.5.1)
-and [Maven Central publication](releases/1.5.1-central-publication.md) have been
+Version **1.6.0**, published **2026-10-18 UTC**, is the current supported
+release. It reduces unnecessary JavaScript escaping while retaining recognized
+HTML-token protection. It introduces no new encoder security fix. The
+[signed GitHub assets](https://github.com/OWASP/owasp-java-encoder/releases/tag/v1.6.0)
+and [Maven Central publication](releases/1.6.0-central-publication.md) were
 verified against the retained signed artifacts.
 
 Version **1.5.0**, published **2026-09-28 UTC**, introduced the security fixes.
@@ -23,9 +18,9 @@ older release lines are not patched.
 
 | Maven coordinate                        | Supported | Not supported |
 | --------------------------------------- | --------- | ------------- |
-| `org.owasp.encoder:encoder`             | 1.5.1     | < 1.5.1       |
-| `org.owasp.encoder:encoder-jsp`         | 1.5.1     | < 1.5.1       |
-| `org.owasp.encoder:encoder-jakarta-jsp` | 1.5.1     | < 1.5.1       |
+| `org.owasp.encoder:encoder`             | 1.6.0     | < 1.6.0       |
+| `org.owasp.encoder:encoder-jsp`         | 1.6.0     | < 1.6.0       |
+| `org.owasp.encoder:encoder-jakarta-jsp` | 1.6.0     | < 1.6.0       |
 
 The optional `org.owasp.encoder:encoder-esapi` artifact is retired. Version
 1.4.1 is its final published release, no version is currently supported, and no
@@ -96,7 +91,7 @@ release tag, then verify:
 
 ```sh
 gpg --import KEYS
-gpg --verify encoder-1.5.1.jar.asc encoder-1.5.1.jar
+gpg --verify encoder-1.6.0.jar.asc encoder-1.6.0.jar
 gpg --verify SHA256SUMS.asc SHA256SUMS
 gpg --verify SHA512SUMS.asc SHA512SUMS
 shasum -a 256 -c SHA256SUMS

VERIFYING.md

@@ -6,15 +6,14 @@ identity authority. Obtain [KEYS](KEYS) from a trusted project revision and chec
 the fingerprint before use. Never import private key material to verify a release.
 
 For 1.4.1 and later releases until a documented rotation, the expected project key
-is `1C5F632B86809F2F5DB25092BEA0075F94074A9B`. The [1.6.0 release record](releases/1.6.0.md#verification-and-evidence)
-tracks signing and publication of the prepared release. Do not treat a prepared
-release as available. The [1.5.1 publication verification](releases/1.5.1-central-publication.md)
-records the previous verified artifacts and signatures.
+is `1C5F632B86809F2F5DB25092BEA0075F94074A9B`. The [1.6.0 publication verification](releases/1.6.0-central-publication.md)
+records the signed tag, exact bundle and comparison of Central and GitHub
+downloads against the retained signed artifacts.
 
 ## Fresh public-only keyring
 
 Download the artifact, its original `.asc`, and the trusted `KEYS`. This example
-targets 1.6.0 once its publication is verified. For historical releases, use the full
+targets the published 1.6.0 release. For historical releases, use the full
 fingerprint mapped below and review the historical key's expiry and algorithms.
 Commands use GnuPG and `shasum` (or equivalent SHA tools).
 

compatibility/README.md

@@ -84,9 +84,9 @@ fail these guards.
 During ordinary `./mvnw verify`, Animal Sniffer checks each library against the Java 8
 API signature. This catches linkage such as Java 9's covariant `CharBuffer.flip()`
 even when bytecode still has class version 52. japicmp checks public/protected API
-binary and source compatibility against **1.5.1** for the prepared **1.6.0** release. The baseline guard selects the latest preceding semantic release tag,
+binary and source compatibility against **1.6.0** during **1.6.1-SNAPSHOT** development. The baseline guard selects the latest preceding semantic release tag,
 including signed source commits integrated by squash merge; fetch all release tags
-before running it. The old support classpath matches the 1.5.1 POMs (JSP 2.3.3,
+before running it. The old support classpath matches the 1.6.0 POMs (JSP 2.3.3,
 Jakarta Servlet 6.1.0 and EL 6.0.1). Independent minimum-consumer fixtures remain
 unchanged. Update these pins together after each release. Missing
 types are not broadly ignored: dependencies are resolved so inherited API changes
@@ -138,7 +138,7 @@ multi-release layout remain unchanged.
 
 ## Published identities and development import ranges
 
-The tables below describe the published **1.5.1** artifacts. The names are
+The tables below describe the published **1.6.0** artifacts. The names are
 historical identities preserved in 1.x; the OSGi import floors reflect the new
 1.5 calls and must not be projected onto older published JARs.
 

core/pom.xml

@@ -42,7 +42,7 @@
     <parent>
         <groupId>org.owasp.encoder</groupId>
         <artifactId>encoder-parent</artifactId>
-        <version>1.6.0</version>
+        <version>1.6.1-SNAPSHOT</version>
     </parent>
 
     <artifactId>encoder</artifactId>

docs/compatibility-decisions.md

@@ -68,7 +68,7 @@ actual output rather than reserving the maximum bound.
 
 ## JavaScript output refinement in 1.6.0 (#243)
 
-This change is prepared for the minor release 1.6.0, rather than a patch release. The evaluated values and supported HTML tokenizer protection
+This change shipped in the minor release 1.6.0, rather than a patch release. The evaluated values and supported HTML tokenizer protection
 remain intact, but encoded bytes, explicit-flush spelling, and the previous literal
 substring prohibition change. This record describes the migration and parser
 validation requirements; release preparation does not establish publication.

docs/contexts.md

@@ -1,6 +1,6 @@
 # Output contexts and boundaries
 
-This guide describes the prepared **1.6.0** release, including the JavaScript
+This guide describes the published **1.6.0** release, including the JavaScript
 refinement for #243. Published 1.5.0 and 1.5.1 retain their broader letter escapes.
 See the [1.6.0 release record](../releases/1.6.0.md) for publication status.
 The [Encode Javadoc source](../core/src/main/java/org/owasp/encoder/Encode.java) is

docs/usage.md

@@ -1,6 +1,6 @@
 # Java and JSP examples
 
-These examples target the prepared **1.6.0** release, including the JavaScript
+These examples target the published **1.6.0** release, including the JavaScript
 refinement for #243. See the [release record](../releases/1.6.0.md) for publication
 status. Published 1.5.1 retains 1.5.0's broader letter escaping.
 Features marked **1.5** were introduced in 1.5.0.