Merge pull request #246 from OWASP/release/1.5.1-published

Record 1.5.1 publication and resume 1.5.2 development

Author: jmanico

CHANGELOG.md

@@ -4,14 +4,14 @@ Released entries are grounded in the linked immutable tags, GitHub release notes
 and retained README announcements. Dates below are GitHub publication dates in
 UTC where a release record exists; older announcement/tag dates are labeled.
 An open proposal is not a release. Historical tags, assets and signatures remain
-unchanged. [1.5.0 is available from Central](releases/1.5.0-central-publication.md).
+unchanged. [1.5.1 is available from Central](releases/1.5.1-central-publication.md).
 
 ## Unreleased
 
-## 1.5.1 — release preparation, 2026-10-15 UTC
+## 1.5.1 — 2026-10-15 UTC
 
-Documentation and build-maintenance patch; publication is tracked in the
-[release record](releases/1.5.1.md). Encoding behavior and public APIs are unchanged.
+Documentation and build-maintenance patch; publication is verified in the
+[publication record](releases/1.5.1-central-publication.md). Encoding behavior and public APIs are unchanged.
 
 - Clarify JavaScript encoding modes, output growth, and insertion-boundary
   requirements for #243; distinguish JSON whole-string HTML embedding from

README.md

@@ -9,15 +9,14 @@ has no runtime dependencies; optional JSP and Jakarta adapters provide view-laye
 bindings. Encoding is one part of [XSS prevention][xss], alongside
 safe templates, URL validation and other application controls.
 
-**1.5.1 release preparation:** this patch release clarifies the JavaScript and
-JSON documentation and strengthens parser regression tests. Encoder behavior,
-public APIs, and runtime dependencies are unchanged from 1.5.0. Publication is
-not complete; the dependency example below targets the prepared release. See
-[the 1.5.1 release record](releases/1.5.1.md) for availability and verification.
-
-The latest verified Central release remains [1.5.0](releases/1.5.0-central-publication.md)
-until 1.5.1 publication is confirmed. It introduced the parser-boundary security
-fixes retained in 1.5.1; versions through 1.4.1 do not contain those fixes. See
+**1.5.1 is available from Maven Central.** This patch release clarifies the
+JavaScript and JSON documentation and strengthens parser regression tests.
+Encoder behavior, public APIs, and runtime dependencies are unchanged from 1.5.0.
+See the [release notes](releases/1.5.1.md) and
+[publication verification](releases/1.5.1-central-publication.md).
+
+The parser-boundary security fixes introduced in 1.5.0 remain in effect;
+versions through 1.4.1 do not contain those fixes. See
 [the security advisory](https://github.com/OWASP/owasp-java-encoder/security/advisories/GHSA-g8p6-7r8f-qrpv)
 and [VERIFYING.md](VERIFYING.md).
 
@@ -47,11 +46,11 @@ on the same classpath or module path. See the [runtime matrix](compatibility/REA
 [dependency/license inventory](docs/dependencies.md).
 
 `encoder-esapi` was retired after 1.4.1 and is not included or supported in
-1.5.0. Applications using it must [migrate away from the adapter](docs/encoder-esapi-retirement.md).
+1.5.x. Applications using it must [migrate away from the adapter](docs/encoder-esapi-retirement.md).
 
-Published 1.5.0 API documentation (1.5.1 indexing follows publication): [core](https://javadoc.io/doc/org.owasp.encoder/encoder/1.5.0/),
-[javax JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jsp/1.5.0/) and
-[Jakarta JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jakarta-jsp/1.5.0/).
+Published 1.5.1 API documentation: [core](https://javadoc.io/doc/org.owasp.encoder/encoder/1.5.1/),
+[javax JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jsp/1.5.1/) and
+[Jakarta JSP](https://javadoc.io/doc/org.owasp.encoder/encoder-jakarta-jsp/1.5.1/).
 
 ```java
 import org.owasp.encoder.Encode;

RELEASING.md

@@ -6,7 +6,7 @@ Do not tag, publish, or announce a release until **all open issues and all
 open pull requests have been handled**. Before considering release approval,
 inventory the full open backlog and record the outcome and supporting review
 or verification for every item. Completing a maintenance batch does not satisfy
-this gate on its own. Keep current development at `1.5.1-SNAPSHOT` until maintainers
+this gate on its own. Keep current development at `1.5.2-SNAPSHOT` until maintainers
 deliberately create the exact release commit after the technical gates pass.
 Changing that commit to a release version is release preparation, not release approval.
 
@@ -15,7 +15,7 @@ the final backlog inventory and dispositions for #110 and #169. A closed tracker
 does not waive this gate: repeat the complete open-issue/PR inventory when a new
 release is actually proposed and obtain release approval then.
 
-The signed 1.5.0 release has been [published to Central and verified](releases/1.5.0-central-publication.md).
+The signed 1.5.1 release has been [published to Central and verified](releases/1.5.1-central-publication.md).
 Repeat these gates for each subsequent release. Do not rebuild or replace
 published artifacts, republish existing coordinates, or move release tags.
 
@@ -156,7 +156,7 @@ uploading. Keep an audit record of the exact uploaded bundle and its SHA-256.
 4. Set the fixed versions in the security advisories and publish the advisories
    in coordination with the available release. Do not announce a Central version
    that has not actually published.
-5. Set main to the next unreleased version (for example `1.5.1-SNAPSHOT` or
+5. Set main to the next unreleased version (for example `1.5.2-SNAPSHOT` or
    `1.6.0-SNAPSHOT`, chosen through version review), update `jakarta-test`
    accordingly, and reset the SCM tag to `HEAD`. Advance `public.api.baseline.version`
    and its old support-API classpaths to the newly published immutable release.

SECURITY.md

@@ -2,25 +2,25 @@
 
 ## Supported Versions
 
-Version **1.5.1** is being prepared as a documentation and build-maintenance
-patch. It preserves the 1.5.0 security fixes and introduces no new encoder
-security fix. Until [publication is verified](releases/1.5.1.md), 1.5.0 remains
-the current supported release shown below.
-
-Version **1.5.0**, published **2026-09-28 UTC**, is the current security release.
-The [signed GitHub assets](https://github.com/OWASP/owasp-java-encoder/releases/tag/v1.5.0)
-and [Maven Central publication](releases/1.5.0-central-publication.md) have been
-independently verified. See [GHSA-g8p6-7r8f-qrpv](https://github.com/OWASP/owasp-java-encoder/security/advisories/GHSA-g8p6-7r8f-qrpv)
+Version **1.5.1**, published **2026-10-15 UTC**, is the current supported
+release. This documentation and build-maintenance patch preserves the 1.5.0
+security fixes and introduces no new encoder security fix. The
+[signed GitHub assets](https://github.com/OWASP/owasp-java-encoder/releases/tag/v1.5.1)
+and [Maven Central publication](releases/1.5.1-central-publication.md) have been
+verified against the retained signed artifacts.
+
+Version **1.5.0**, published **2026-09-28 UTC**, introduced the security fixes.
+See [GHSA-g8p6-7r8f-qrpv](https://github.com/OWASP/owasp-java-encoder/security/advisories/GHSA-g8p6-7r8f-qrpv)
 for affected versions and migration guidance.
 
 Only the latest 1.x release receives security fixes. Fixes ship in a new release;
 older release lines are not patched.
 
 | Maven coordinate                        | Supported | Not supported |
 | --------------------------------------- | --------- | ------------- |
-| `org.owasp.encoder:encoder`             | 1.5.0     | < 1.5.0       |
-| `org.owasp.encoder:encoder-jsp`         | 1.5.0     | < 1.5.0       |
-| `org.owasp.encoder:encoder-jakarta-jsp` | 1.5.0     | < 1.5.0       |
+| `org.owasp.encoder:encoder`             | 1.5.1     | < 1.5.1       |
+| `org.owasp.encoder:encoder-jsp`         | 1.5.1     | < 1.5.1       |
+| `org.owasp.encoder:encoder-jakarta-jsp` | 1.5.1     | < 1.5.1       |
 
 The optional `org.owasp.encoder:encoder-esapi` artifact is retired. Version
 1.4.1 is its final published release, no version is currently supported, and no
@@ -91,7 +91,7 @@ release tag, then verify:
 
 ```sh
 gpg --import KEYS
-gpg --verify encoder-1.5.0.jar.asc encoder-1.5.0.jar
+gpg --verify encoder-1.5.1.jar.asc encoder-1.5.1.jar
 gpg --verify SHA256SUMS.asc SHA256SUMS
 gpg --verify SHA512SUMS.asc SHA512SUMS
 shasum -a 256 -c SHA256SUMS

VERIFYING.md

@@ -6,15 +6,14 @@ identity authority. Obtain [KEYS](KEYS) from a trusted project revision and chec
 the fingerprint before use. Never import private key material to verify a release.
 
 For 1.4.1 and later releases until a documented rotation, the expected project key
-is `1C5F632B86809F2F5DB25092BEA0075F94074A9B`. The [1.5.1 release record](releases/1.5.1.md#verification-and-evidence)
-tracks signing and publication of the prepared patch release. Do not treat a
-prepared release as available. The [1.5.0 publication verification](releases/1.5.0-central-publication.md)
-continues to record the previous verified artifacts and signatures.
+is `1C5F632B86809F2F5DB25092BEA0075F94074A9B`. The [1.5.1 publication verification](releases/1.5.1-central-publication.md)
+records the signed tag, exact bundle, and comparison of Central and GitHub
+downloads against the retained signed artifacts.
 
 ## Fresh public-only keyring
 
 Download the artifact, its original `.asc`, and the trusted `KEYS`. This example
-targets 1.5.1 once its publication is verified. For historical releases, use the full
+targets the published 1.5.1 release. For historical releases, use the full
 fingerprint mapped below and review the historical key's expiry and algorithms.
 Commands use GnuPG and `shasum` (or equivalent SHA tools).
 

compatibility/README.md

@@ -84,9 +84,9 @@ fail these guards.
 During ordinary `./mvnw verify`, Animal Sniffer checks each library against the Java 8
 API signature. This catches linkage such as Java 9's covariant `CharBuffer.flip()`
 even when bytecode still has class version 52. japicmp checks public/protected API
-binary and source compatibility against **1.5.0** for the **1.5.1** release. The baseline guard selects the latest preceding semantic release tag,
+binary and source compatibility against **1.5.1** during **1.5.2-SNAPSHOT** development. The baseline guard selects the latest preceding semantic release tag,
 including signed source commits integrated by squash merge; fetch all release tags
-before running it. The old support classpath matches the 1.5.0 POMs (JSP 2.3.3,
+before running it. The old support classpath matches the 1.5.1 POMs (JSP 2.3.3,
 Jakarta Servlet 6.1.0 and EL 6.0.1). Independent minimum-consumer fixtures remain
 unchanged. Update these pins together after each release. Missing
 types are not broadly ignored: dependencies are resolved so inherited API changes
@@ -138,7 +138,7 @@ multi-release layout remain unchanged.
 
 ## Published identities and development import ranges
 
-The tables below describe the published **1.5.0** artifacts. The names are
+The tables below describe the published **1.5.1** artifacts. The names are
 historical identities preserved in 1.x; the OSGi import floors reflect the new
 1.5 calls and must not be projected onto older published JARs.
 

core/pom.xml

@@ -42,7 +42,7 @@
     <parent>
         <groupId>org.owasp.encoder</groupId>
         <artifactId>encoder-parent</artifactId>
-        <version>1.5.1</version>
+        <version>1.5.2-SNAPSHOT</version>
     </parent>
 
     <artifactId>encoder</artifactId>

jakarta-test/pom.xml

@@ -31,7 +31,7 @@
         <jackson.build.version>3.1.7</jackson.build.version>
         <!-- Must equal the version in the root pom.xml so this app tests the
              encoder-jakarta-jsp built in the same reactor. CI checks this. -->
-        <encoder.version>1.5.1</encoder.version>
+        <encoder.version>1.5.2-SNAPSHOT</encoder.version>
     </properties>
     <dependencies>
         <dependency>

jakarta/pom.xml

@@ -42,7 +42,7 @@
     <parent>
         <groupId>org.owasp.encoder</groupId>
         <artifactId>encoder-parent</artifactId>
-        <version>1.5.1</version>
+        <version>1.5.2-SNAPSHOT</version>
     </parent>
 
     <artifactId>encoder-jakarta-jsp</artifactId>

jsp/pom.xml

@@ -42,7 +42,7 @@
     <parent>
         <groupId>org.owasp.encoder</groupId>
         <artifactId>encoder-parent</artifactId>
-        <version>1.5.1</version>
+        <version>1.5.2-SNAPSHOT</version>
     </parent>
 
     <artifactId>encoder-jsp</artifactId>