From ad6cc916904882ad3905240bff1adb68a54d1cad Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 26 Oct 2026 09:31:32 +0000 Subject: [PATCH 1/2] Bump the maven-dependencies group across 1 directory with 7 updates Bumps the maven-dependencies group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [org.codehaus.plexus:plexus-archiver](https://github.com/codehaus-plexus/plexus-archiver) | `4.14.0` | `4.15.0` | | [com.github.siom79.japicmp:japicmp](https://github.com/siom79/japicmp) | `0.26.3` | `0.26.5` | | [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson-databind) | `2.22.3` | `2.22.4` | | [com.fasterxml.jackson.core:jackson-core](https://github.com/FasterXML/jackson-core) | `2.22.3` | `2.22.4` | | [org.apache.maven.plugins:maven-failsafe-plugin](https://github.com/apache/maven-surefire) | `3.6.0` | `3.6.1` | | [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) | `3.6.0` | `3.6.1` | | [org.springframework.boot:spring-boot-starter-parent](https://github.com/spring-projects/spring-boot) | `4.1.1` | `4.1.2` | Updates `org.codehaus.plexus:plexus-archiver` from 4.14.0 to 4.15.0 - [Release notes](https://github.com/codehaus-plexus/plexus-archiver/releases) - [Changelog](https://github.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md) - [Commits](https://github.com/codehaus-plexus/plexus-archiver/compare/plexus-archiver-4.14.0...plexus-archiver-4.15.0) Updates `com.github.siom79.japicmp:japicmp` from 0.26.3 to 0.26.5 - [Release notes](https://github.com/siom79/japicmp/releases) - [Changelog](https://github.com/siom79/japicmp/blob/master/release.py) - [Commits](https://github.com/siom79/japicmp/compare/japicmp-base-0.26.3...japicmp-base-0.26.5) Updates `com.fasterxml.jackson.core:jackson-databind` from 2.22.3 to 2.22.4 - [Commits](https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.22.3...jackson-databind-2.22.4) Updates `com.fasterxml.jackson.core:jackson-core` from 2.22.3 to 2.22.4 - [Commits](https://github.com/FasterXML/jackson-core/compare/jackson-core-2.22.3...jackson-core-2.22.4) Updates `org.apache.maven.plugins:maven-failsafe-plugin` from 3.6.0 to 3.6.1 - [Release notes](https://github.com/apache/maven-surefire/releases) - [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.6.0...surefire-3.6.1) Updates `org.apache.maven.plugins:maven-surefire-plugin` from 3.6.0 to 3.6.1 - [Release notes](https://github.com/apache/maven-surefire/releases) - [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.6.0...surefire-3.6.1) Updates `org.springframework.boot:spring-boot-starter-parent` from 4.1.1 to 4.1.2 - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](https://github.com/spring-projects/spring-boot/compare/v4.1.1...v4.1.2) --- updated-dependencies: - dependency-name: org.codehaus.plexus:plexus-archiver dependency-version: 4.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: maven-dependencies - dependency-name: com.github.siom79.japicmp:japicmp dependency-version: 0.26.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: maven-dependencies - dependency-name: com.fasterxml.jackson.core:jackson-databind dependency-version: 2.22.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: maven-dependencies - dependency-name: com.fasterxml.jackson.core:jackson-core dependency-version: 2.22.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: maven-dependencies - dependency-name: org.apache.maven.plugins:maven-failsafe-plugin dependency-version: 3.6.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: maven-dependencies - dependency-name: org.apache.maven.plugins:maven-surefire-plugin dependency-version: 3.6.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: maven-dependencies - dependency-name: org.springframework.boot:spring-boot-starter-parent dependency-version: 4.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: maven-dependencies ... Signed-off-by: dependabot[bot] --- core/pom.xml | 2 +- jakarta-test/pom.xml | 6 +++--- pom.xml | 18 +++++++++--------- 3 files changed, 13 insertions(+), 13 deletions(-) diff --git a/core/pom.xml b/core/pom.xml index e192164..3b33140 100644 --- a/core/pom.xml +++ b/core/pom.xml @@ -74,7 +74,7 @@ com.fasterxml.jackson.core jackson-databind - 2.22.3 + 2.22.4 test diff --git a/jakarta-test/pom.xml b/jakarta-test/pom.xml index 1829be3..3a2d747 100644 --- a/jakarta-test/pom.xml +++ b/jakarta-test/pom.xml @@ -5,7 +5,7 @@ org.springframework.boot spring-boot-starter-parent - 4.1.1 + 4.1.2 org.owasp.encoder.testing @@ -117,7 +117,7 @@ 12.3.1 org.apache.commonscommons-lang33.21.0 - org.codehaus.plexusplexus-archiver4.14.0 + org.codehaus.plexusplexus-archiver4.15.0 org.codehaus.plexusplexus-utils4.0.3 @@ -193,7 +193,7 @@ org.apache.maven.plugins maven-war-plugin - org.codehaus.plexusplexus-archiver4.14.0 + org.codehaus.plexusplexus-archiver4.15.0 org.codehaus.plexusplexus-utils4.0.3 diff --git a/pom.xml b/pom.xml index 378bac2..1f3d025 100644 --- a/pom.xml +++ b/pom.xml @@ -273,7 +273,7 @@ maven-source-plugin 3.4.0 - org.codehaus.plexusplexus-archiver4.14.0 + org.codehaus.plexusplexus-archiver4.15.0 org.codehaus.plexusplexus-utils4.0.3 @@ -283,7 +283,7 @@ 3.12.0 commons-beanutilscommons-beanutils1.11.0 - org.codehaus.plexusplexus-archiver4.14.0 + org.codehaus.plexusplexus-archiver4.15.0 org.codehaus.plexusplexus-utils4.0.3 @@ -298,12 +298,12 @@ org.apache.maven.plugins maven-failsafe-plugin - 3.6.0 + 3.6.1 org.apache.maven.plugins maven-surefire-plugin - 3.6.0 + 3.6.1 org.apache.maven.plugins @@ -323,7 +323,7 @@ 6.2.0 commons-beanutilscommons-beanutils1.11.0 - org.codehaus.plexusplexus-archiver4.14.0 + org.codehaus.plexusplexus-archiver4.15.0 @@ -341,7 +341,7 @@ com.github.siom79.japicmp japicmp - 0.26.3 + 0.26.5 @@ -414,7 +414,7 @@ 12.3.1 org.apache.commonscommons-lang33.21.0 - org.codehaus.plexusplexus-archiver4.14.0 + org.codehaus.plexusplexus-archiver4.15.0 org.codehaus.plexusplexus-utils4.0.3 @@ -654,8 +654,8 @@ org.codehaus.plexusplexus-utils3.6.2 - com.fasterxml.jackson.corejackson-databind2.22.3 - com.fasterxml.jackson.corejackson-core2.22.3 + com.fasterxml.jackson.corejackson-databind2.22.4 + com.fasterxml.jackson.corejackson-core2.22.4 com.fasterxml.jackson.corejackson-annotations2.22 org.apache.httpcomponents.client5httpclient55.6.5 org.apache.httpcomponents.core5httpcore55.4.4 From b2fc05aba90a47e940dc3c43e8eeeb2a3ce619fa Mon Sep 17 00:00:00 2001 From: Jim Manico Date: Mon, 26 Oct 2026 10:40:37 +0100 Subject: [PATCH 2/2] Drop Jakarta fixture overrides now covered by Boot 4.1.2 Boot 4.1.2 manages Tomcat 11.0.27, so the fixture's 11.0.26 override now downgrades Tomcat and fails RequireUpperBoundDeps. Its buildpack platform also brings Jackson 3.1.7, matching the plugin-realm pin, so remove the pin with its Dependabot rules and exact-version policy test as recorded in DEPENDENCY_DECISIONS.md. A policy test now guards against either override returning. Supersedes #256 and #257. --- .github/CI_SECURITY.md | 4 ++-- .github/DEPENDENCY_DECISIONS.md | 15 +++++++++++++ .github/dependabot.yml | 13 ------------ CHANGELOG.md | 5 +++++ jakarta-test/README.md | 9 ++++---- jakarta-test/pom.xml | 7 ------- scripts/tests/test_ci_policy.py | 37 ++++++++++----------------------- 7 files changed, 37 insertions(+), 53 deletions(-) diff --git a/.github/CI_SECURITY.md b/.github/CI_SECURITY.md index 72bb716..17a5060 100644 --- a/.github/CI_SECURITY.md +++ b/.github/CI_SECURITY.md @@ -88,8 +88,8 @@ configured. Review new action source and transitive downloads as well as pins. Do not dismiss alerts merely to reduce the count. Correct versions or graph semantics, submit the new graph, and let GitHub close packages that are no longer present. -Baseline-sensitive API, JSP-engine and build-plugin dependencies, the exact Boot -plugin-realm Jackson pins and the Maven distribution used by the wrapper are +Baseline-sensitive API, JSP-engine and build-plugin dependencies and the Maven +distribution used by the wrapper are excluded from the broad Maven **version-update group**, so unsuppressed proposals receive individual review. Reviewed incompatible minor and major proposal classes use `ignore.update-types`; GitHub applies those rules only to version updates, so diff --git a/.github/DEPENDENCY_DECISIONS.md b/.github/DEPENDENCY_DECISIONS.md index 1e71ddc..21cc3c4 100644 --- a/.github/DEPENDENCY_DECISIONS.md +++ b/.github/DEPENDENCY_DECISIONS.md @@ -100,6 +100,21 @@ platform brings the same or a newer Jackson, remove the pin, its ignore rules an the policy assertion together. Enforcer rules do not inspect plugin realms, so a stale exact pin would silently downgrade Boot's own Jackson. +## Boot 4.1.2 retires the fixture overrides — 2026-10-26 + +Grouped PR [#257](https://github.com/OWASP/owasp-java-encoder/pull/257) moves the +Jakarta fixture to Spring Boot **4.1.2**. Its `spring-boot-buildpack-platform` +brings Jackson databind/core **3.1.7**, equal to the plugin-realm pin above, so +the pin, its Dependabot ignore and group-exclusion rules, and the exact-version +policy assertion are removed together, as planned. Boot 4.1.2 also manages +Tomcat **11.0.27**, newer than the fixture's 11.0.26 override; keeping that +override failed `RequireUpperBoundDeps`, so it is removed too. A policy test now +fails if either override returns. + +PR [#256](https://github.com/OWASP/owasp-java-encoder/pull/256) proposed Jackson +3.1.8 for the pin. No advisory affects 3.1.7, so it is closed in favor of Boot's +managed version; a future Boot patch will carry later Jackson releases. + ## Maven 3.10.0 wrapper — 2026-10-11 Accept the Maven **3.10.0** distribution proposed by Dependabot PR diff --git a/.github/dependabot.yml b/.github/dependabot.yml index a69df70..6078c95 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -30,9 +30,6 @@ updates: - jakarta.servlet.jsp:jakarta.servlet.jsp-api - jakarta.servlet:jakarta.servlet-api - jakarta.el:jakarta.el-api - # Exact Boot plugin-realm pins checked by CI policy tests. - - tools.jackson.core:jackson-databind - - tools.jackson.core:jackson-core # The wrapper's Maven version is a separately reviewed toolchain change. - org.apache.maven:apache-maven maven-security: @@ -86,16 +83,6 @@ updates: # entries below own these coordinates instead. - dependency-name: org.apache.tomcat.embed:tomcat-embed-jasper - dependency-name: org.apache.tomcat:tomcat-annotations-api - # Keep Boot 4.1.1's plugin realm on its own 3.1 line; patches and - # security updates remain eligible. - - dependency-name: tools.jackson.core:jackson-databind - update-types: - - version-update:semver-minor - - version-update:semver-major - - dependency-name: tools.jackson.core:jackson-core - update-types: - - version-update:semver-minor - - version-update:semver-major # Each JSP engine fixture gets its own scan, limited to Tomcat. A module scan # reads the module and its parent POM but not sibling modules, so it sees one # engine line and proposes that line's patch release. Major updates would diff --git a/CHANGELOG.md b/CHANGELOG.md index fe28c08..5f1f70f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,11 @@ unchanged. [1.6.0 is available from Central](releases/1.6.0-central-publication. - Remove retired Maven Site sources and archive September maintenance records. - Refresh build/dependency documentation and clarify the 1.6.0 review record. Encoding behavior, public APIs, and published artifacts are unchanged. +- Update the unpublished Jakarta fixture to Spring Boot 4.1.2 and drop its + Tomcat and plugin-realm Jackson overrides, which Boot now matches or + exceeds. Refresh Maven build plugins, plexus-archiver, japicmp, and the + test/publisher-only Jackson 2.22.4. Published library dependencies are + unchanged. ## 1.6.0 — 2026-10-18 UTC diff --git a/jakarta-test/README.md b/jakarta-test/README.md index 6cdcb8a..64b2c99 100644 --- a/jakarta-test/README.md +++ b/jakarta-test/README.md @@ -38,11 +38,10 @@ A local Chrome-only diagnostic for the JavaScript suite remains available with ## Framework and API boundaries -As reviewed on 2026-09-25, this fixture uses supported Spring Boot **4.1.1** and -its managed dependencies, on JDK **17**, with Tomcat/Jasper **11.0.26** -(Servlet **6.1**, Pages **4.0**, EL **6.0**). The two deliberate BOM overrides are -Tomcat 11.0.26, which contains the September fixes absent from Boot's managed -11.0.24, and Selenium 4.49.0, aligned with the current reviewed browser image. +As reviewed on 2026-10-26, this fixture uses supported Spring Boot **4.1.2** and +its managed dependencies, on JDK **17**, with Tomcat/Jasper **11.0.27** +(Servlet **6.1**, Pages **4.0**, EL **6.0**). The one deliberate BOM override is +Selenium 4.49.0, aligned with the current reviewed browser image. Testcontainers **2.0.5**, JSTL API **3.0.2** and implementation **3.0.1** follow the Boot BOM. The standalone Servlet/Pages/EL API JARs are removed; Tomcat supplies the coherent implementation/API set. Both JSTL components remain packaged. diff --git a/jakarta-test/pom.xml b/jakarta-test/pom.xml index 3a2d747..c3b8ec4 100644 --- a/jakarta-test/pom.xml +++ b/jakarta-test/pom.xml @@ -22,13 +22,8 @@ true true 17 - - 11.0.26 4.49.0 - - 3.1.7 1.6.1-SNAPSHOT @@ -209,8 +204,6 @@ org.springframework.boot spring-boot-maven-plugin - tools.jackson.corejackson-databind${jackson.build.version} - tools.jackson.corejackson-core${jackson.build.version} org.apache.commonscommons-lang33.21.0 org.codehaus.plexusplexus-utils3.6.2 diff --git a/scripts/tests/test_ci_policy.py b/scripts/tests/test_ci_policy.py index 6e6f149..f965333 100644 --- a/scripts/tests/test_ci_policy.py +++ b/scripts/tests/test_ci_policy.py @@ -211,8 +211,6 @@ def test_dependabot_scopes_reviewed_ignores_to_version_updates(self): 'jakarta.el:jakarta.el-api': minor_and_major, 'org.apache.tomcat.embed:tomcat-embed-jasper': [], 'org.apache.tomcat:tomcat-annotations-api': [], - 'tools.jackson.core:jackson-databind': minor_and_major, - 'tools.jackson.core:jackson-core': minor_and_major, } self.assertEqual(expected, rules) self.assertEqual( @@ -252,12 +250,9 @@ def test_dependabot_routes_reviewed_coordinates_out_of_broad_group(self): if line.startswith(' - ')] self.assertEqual(len(excluded), len(set(excluded))) - # Pinned Boot plugin-realm Jackson and the wrapper's Maven distribution - # need individual review; a mixed group PR cannot pass their checks. - for coordinate in ('tools.jackson.core:jackson-databind', - 'tools.jackson.core:jackson-core', - 'org.apache.maven:apache-maven'): - self.assertIn(coordinate, excluded) + # The wrapper's Maven distribution needs individual review; a mixed + # group PR cannot pass its checks. + self.assertIn('org.apache.maven:apache-maven', excluded) ignore = parse_dependabot_ignore(maven.split(' ignore:\n', 1)[1]) versioned = {name for name, update_types in ignore.items() if update_types} @@ -345,25 +340,15 @@ def test_only_executed_plugins_are_submitted(self): self.assertLess(workflow.index('Resolve shared library build plugins'), workflow.index(app_command)) - def test_boot_plugin_jackson_fix_stays_in_its_own_realm(self): + def test_boot_plugin_realm_uses_boot_managed_jackson(self): + # Boot 4.1.2's buildpack platform brings the patched Jackson 3.1 line. + # A stale exact pin here would silently downgrade it, and Enforcer + # rules do not inspect plugin realms. app = ET.parse(ROOT / 'jakarta-test/pom.xml').getroot() - self.assertEqual('3.1.7', app.findtext( - 'p:properties/p:jackson.build.version', namespaces=version.NS)) - plugins = app.findall('p:build/p:plugins/p:plugin', version.NS) - boot = next(plugin for plugin in plugins - if plugin.findtext('p:artifactId', namespaces=version.NS) - == 'spring-boot-maven-plugin') - jackson = { - dep.findtext('p:artifactId', namespaces=version.NS): - dep.findtext('p:version', namespaces=version.NS) - for dep in boot.findall('p:dependencies/p:dependency', version.NS) - if dep.findtext('p:groupId', namespaces=version.NS) == 'tools.jackson.core' - } - self.assertEqual({ - 'jackson-core': '${jackson.build.version}', - 'jackson-databind': '${jackson.build.version}', - }, jackson) - for dep in app.findall('p:dependencies/p:dependency', version.NS): + self.assertIsNone(app.find( + 'p:properties/p:jackson.build.version', version.NS)) + self.assertIsNone(app.find('p:properties/p:tomcat.version', version.NS)) + for dep in app.iter('{%s}dependency' % version.NS['p']): self.assertNotEqual('tools.jackson.core', dep.findtext( 'p:groupId', namespaces=version.NS))