Update to Spring Boot 4.1.2 and drop fixture overrides it now covers

.github/CI_SECURITY.md

@@ -88,8 +88,8 @@ configured. Review new action source and transitive downloads as well as pins.
 Do not dismiss alerts merely to reduce the count. Correct versions or graph
 semantics, submit the new graph, and let GitHub close packages that are no longer
 present.
-Baseline-sensitive API, JSP-engine and build-plugin dependencies, the exact Boot
-plugin-realm Jackson pins and the Maven distribution used by the wrapper are
+Baseline-sensitive API, JSP-engine and build-plugin dependencies and the Maven
+distribution used by the wrapper are
 excluded from the broad Maven **version-update group**, so unsuppressed proposals
 receive individual review. Reviewed incompatible minor and major proposal classes use
 `ignore.update-types`; GitHub applies those rules only to version updates, so

.github/DEPENDENCY_DECISIONS.md

@@ -100,6 +100,21 @@ platform brings the same or a newer Jackson, remove the pin, its ignore rules an
 the policy assertion together. Enforcer rules do not inspect plugin realms, so a
 stale exact pin would silently downgrade Boot's own Jackson.
 
+## Boot 4.1.2 retires the fixture overrides — 2026-10-26
+
+Grouped PR [#257](https://github.com/OWASP/owasp-java-encoder/pull/257) moves the
+Jakarta fixture to Spring Boot **4.1.2**. Its `spring-boot-buildpack-platform`
+brings Jackson databind/core **3.1.7**, equal to the plugin-realm pin above, so
+the pin, its Dependabot ignore and group-exclusion rules, and the exact-version
+policy assertion are removed together, as planned. Boot 4.1.2 also manages
+Tomcat **11.0.27**, newer than the fixture's 11.0.26 override; keeping that
+override failed `RequireUpperBoundDeps`, so it is removed too. A policy test now
+fails if either override returns.
+
+PR [#256](https://github.com/OWASP/owasp-java-encoder/pull/256) proposed Jackson
+3.1.8 for the pin. No advisory affects 3.1.7, so it is closed in favor of Boot's
+managed version; a future Boot patch will carry later Jackson releases.
+
 ## Maven 3.10.0 wrapper — 2026-10-11
 
 Accept the Maven **3.10.0** distribution proposed by Dependabot PR

.github/dependabot.yml

@@ -30,9 +30,6 @@ updates:
           - jakarta.servlet.jsp:jakarta.servlet.jsp-api
           - jakarta.servlet:jakarta.servlet-api
           - jakarta.el:jakarta.el-api
-          # Exact Boot plugin-realm pins checked by CI policy tests.
-          - tools.jackson.core:jackson-databind
-          - tools.jackson.core:jackson-core
           # The wrapper's Maven version is a separately reviewed toolchain change.
           - org.apache.maven:apache-maven
       maven-security:
@@ -86,16 +83,6 @@ updates:
       # entries below own these coordinates instead.
       - dependency-name: org.apache.tomcat.embed:tomcat-embed-jasper
       - dependency-name: org.apache.tomcat:tomcat-annotations-api
-      # Keep Boot 4.1.1's plugin realm on its own 3.1 line; patches and
-      # security updates remain eligible.
-      - dependency-name: tools.jackson.core:jackson-databind
-        update-types:
-          - version-update:semver-minor
-          - version-update:semver-major
-      - dependency-name: tools.jackson.core:jackson-core
-        update-types:
-          - version-update:semver-minor
-          - version-update:semver-major
   # Each JSP engine fixture gets its own scan, limited to Tomcat. A module scan
   # reads the module and its parent POM but not sibling modules, so it sees one
   # engine line and proposes that line's patch release. Major updates would

CHANGELOG.md

@@ -11,6 +11,11 @@ unchanged. [1.6.0 is available from Central](releases/1.6.0-central-publication.
 - Remove retired Maven Site sources and archive September maintenance records.
 - Refresh build/dependency documentation and clarify the 1.6.0 review record.
   Encoding behavior, public APIs, and published artifacts are unchanged.
+- Update the unpublished Jakarta fixture to Spring Boot 4.1.2 and drop its
+  Tomcat and plugin-realm Jackson overrides, which Boot now matches or
+  exceeds. Refresh Maven build plugins, plexus-archiver, japicmp, and the
+  test/publisher-only Jackson 2.22.4. Published library dependencies are
+  unchanged.
 
 ## 1.6.0 — 2026-10-18 UTC
 

core/pom.xml

@@ -74,7 +74,7 @@
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>2.22.3</version>
+            <version>2.22.4</version>
             <scope>test</scope>
         </dependency>
         <!-- Parse the enclosing HTML independently of the JSON encoder. -->

jakarta-test/README.md

@@ -38,11 +38,10 @@ A local Chrome-only diagnostic for the JavaScript suite remains available with
 
 ## Framework and API boundaries
 
-As reviewed on 2026-09-25, this fixture uses supported Spring Boot **4.1.1** and
-its managed dependencies, on JDK **17**, with Tomcat/Jasper **11.0.26**
-(Servlet **6.1**, Pages **4.0**, EL **6.0**). The two deliberate BOM overrides are
-Tomcat 11.0.26, which contains the September fixes absent from Boot's managed
-11.0.24, and Selenium 4.49.0, aligned with the current reviewed browser image.
+As reviewed on 2026-10-26, this fixture uses supported Spring Boot **4.1.2** and
+its managed dependencies, on JDK **17**, with Tomcat/Jasper **11.0.27**
+(Servlet **6.1**, Pages **4.0**, EL **6.0**). The one deliberate BOM override is
+Selenium 4.49.0, aligned with the current reviewed browser image.
 Testcontainers **2.0.5**, JSTL API **3.0.2** and implementation **3.0.1** follow the
 Boot BOM. The standalone Servlet/Pages/EL API JARs are removed; Tomcat supplies
 the coherent implementation/API set. Both JSTL components remain packaged.

jakarta-test/pom.xml

@@ -5,7 +5,7 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <version>4.1.1</version>
+        <version>4.1.2</version>
         <relativePath/> <!-- lookup parent from repository -->
     </parent>
     <groupId>org.owasp.encoder.testing</groupId>
@@ -22,13 +22,8 @@
         <maven.install.skip>true</maven.install.skip>
         <skipPublishing>true</skipPublishing>
         <java.version>17</java.version>
-        <!-- September security fixes, newer than Boot 4.1.1's managed 11.0.24. -->
-        <tomcat.version>11.0.26</tomcat.version>
         <!-- Keep the client aligned with the reviewed, digest-pinned browser image. -->
         <selenium.version>4.49.0</selenium.version>
-        <!-- GHSA-q4xh-88c3-wmh7 / GHSA-wjgm-6hv5-3cvf / GHSA-wv8q-qhhj-9h54 /
-             GHSA-cxp5-3px4-pw24: Boot's separate plugin realm. -->
-        <jackson.build.version>3.1.7</jackson.build.version>
         <!-- Must equal the version in the root pom.xml so this app tests the
              encoder-jakarta-jsp built in the same reactor. CI checks this. -->
         <encoder.version>1.6.1-SNAPSHOT</encoder.version>
@@ -117,7 +112,7 @@
                         <version>12.3.1</version>
                     </dependency>
                     <dependency><groupId>org.apache.commons</groupId><artifactId>commons-lang3</artifactId><version>3.21.0</version></dependency>
-                    <dependency><groupId>org.codehaus.plexus</groupId><artifactId>plexus-archiver</artifactId><version>4.14.0</version></dependency>
+                    <dependency><groupId>org.codehaus.plexus</groupId><artifactId>plexus-archiver</artifactId><version>4.15.0</version></dependency>
                     <dependency><groupId>org.codehaus.plexus</groupId><artifactId>plexus-utils</artifactId><version>4.0.3</version></dependency>
                 </dependencies>
                 <configuration>
@@ -193,7 +188,7 @@
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-war-plugin</artifactId>
                 <dependencies>
-                    <dependency><groupId>org.codehaus.plexus</groupId><artifactId>plexus-archiver</artifactId><version>4.14.0</version></dependency>
+                    <dependency><groupId>org.codehaus.plexus</groupId><artifactId>plexus-archiver</artifactId><version>4.15.0</version></dependency>
                     <dependency><groupId>org.codehaus.plexus</groupId><artifactId>plexus-utils</artifactId><version>4.0.3</version></dependency>
                 </dependencies>
             </plugin>
@@ -209,8 +204,6 @@
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
                 <dependencies>
-                    <dependency><groupId>tools.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>${jackson.build.version}</version></dependency>
-                    <dependency><groupId>tools.jackson.core</groupId><artifactId>jackson-core</artifactId><version>${jackson.build.version}</version></dependency>
                     <dependency><groupId>org.apache.commons</groupId><artifactId>commons-lang3</artifactId><version>3.21.0</version></dependency>
                     <dependency><groupId>org.codehaus.plexus</groupId><artifactId>plexus-utils</artifactId><version>3.6.2</version></dependency>
                 </dependencies>

pom.xml

@@ -273,7 +273,7 @@
                     <artifactId>maven-source-plugin</artifactId>
                     <version>3.4.0</version>
                     <dependencies>
-                        <dependency><groupId>org.codehaus.plexus</groupId><artifactId>plexus-archiver</artifactId><version>4.14.0</version></dependency>
+                        <dependency><groupId>org.codehaus.plexus</groupId><artifactId>plexus-archiver</artifactId><version>4.15.0</version></dependency>
                         <dependency><groupId>org.codehaus.plexus</groupId><artifactId>plexus-utils</artifactId><version>4.0.3</version></dependency>
                     </dependencies>
                 </plugin>
@@ -283,7 +283,7 @@
                     <version>3.12.0</version>
                     <dependencies>
                         <dependency><groupId>commons-beanutils</groupId><artifactId>commons-beanutils</artifactId><version>1.11.0</version></dependency>
-                        <dependency><groupId>org.codehaus.plexus</groupId><artifactId>plexus-archiver</artifactId><version>4.14.0</version></dependency>
+                        <dependency><groupId>org.codehaus.plexus</groupId><artifactId>plexus-archiver</artifactId><version>4.15.0</version></dependency>
                         <dependency><groupId>org.codehaus.plexus</groupId><artifactId>plexus-utils</artifactId><version>4.0.3</version></dependency>
                     </dependencies>
                 </plugin>
@@ -298,12 +298,12 @@
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-failsafe-plugin</artifactId>
-                    <version>3.6.0</version>
+                    <version>3.6.1</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-surefire-plugin</artifactId>
-                    <version>3.6.0</version>
+                    <version>3.6.1</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
@@ -323,7 +323,7 @@
                     <version>6.2.0</version>
                     <dependencies>
                         <dependency><groupId>commons-beanutils</groupId><artifactId>commons-beanutils</artifactId><version>1.11.0</version></dependency>
-                        <dependency><groupId>org.codehaus.plexus</groupId><artifactId>plexus-archiver</artifactId><version>4.14.0</version></dependency>
+                        <dependency><groupId>org.codehaus.plexus</groupId><artifactId>plexus-archiver</artifactId><version>4.15.0</version></dependency>
                     </dependencies>
                 </plugin>
                 <plugin>
@@ -341,7 +341,7 @@
                         <dependency>
                             <groupId>com.github.siom79.japicmp</groupId>
                             <artifactId>japicmp</artifactId>
-                            <version>0.26.3</version>
+                            <version>0.26.5</version>
                         </dependency>
                     </dependencies>
                     <executions>
@@ -414,7 +414,7 @@
                         <version>12.3.1</version>
                     </dependency>
                     <dependency><groupId>org.apache.commons</groupId><artifactId>commons-lang3</artifactId><version>3.21.0</version></dependency>
-                    <dependency><groupId>org.codehaus.plexus</groupId><artifactId>plexus-archiver</artifactId><version>4.14.0</version></dependency>
+                    <dependency><groupId>org.codehaus.plexus</groupId><artifactId>plexus-archiver</artifactId><version>4.15.0</version></dependency>
                     <dependency><groupId>org.codehaus.plexus</groupId><artifactId>plexus-utils</artifactId><version>4.0.3</version></dependency>
                 </dependencies>
                 <configuration>
@@ -654,8 +654,8 @@
                         <!-- Mitigate reviewed upstream publisher dependencies; isolated plugin realm only. -->
                         <dependencies>
                             <dependency><groupId>org.codehaus.plexus</groupId><artifactId>plexus-utils</artifactId><version>3.6.2</version></dependency>
-                            <dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.22.3</version></dependency>
-                            <dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-core</artifactId><version>2.22.3</version></dependency>
+                            <dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.22.4</version></dependency>
+                            <dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-core</artifactId><version>2.22.4</version></dependency>
                             <dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-annotations</artifactId><version>2.22</version></dependency>
                             <dependency><groupId>org.apache.httpcomponents.client5</groupId><artifactId>httpclient5</artifactId><version>5.6.5</version></dependency>
                             <dependency><groupId>org.apache.httpcomponents.core5</groupId><artifactId>httpcore5</artifactId><version>5.4.4</version></dependency>

scripts/tests/test_ci_policy.py

@@ -211,8 +211,6 @@ def test_dependabot_scopes_reviewed_ignores_to_version_updates(self):
             'jakarta.el:jakarta.el-api': minor_and_major,
             'org.apache.tomcat.embed:tomcat-embed-jasper': [],
             'org.apache.tomcat:tomcat-annotations-api': [],
-            'tools.jackson.core:jackson-databind': minor_and_major,
-            'tools.jackson.core:jackson-core': minor_and_major,
         }
         self.assertEqual(expected, rules)
         self.assertEqual(
@@ -252,12 +250,9 @@ def test_dependabot_routes_reviewed_coordinates_out_of_broad_group(self):
                     if line.startswith('          - ')]
         self.assertEqual(len(excluded), len(set(excluded)))
 
-        # Pinned Boot plugin-realm Jackson and the wrapper's Maven distribution
-        # need individual review; a mixed group PR cannot pass their checks.
-        for coordinate in ('tools.jackson.core:jackson-databind',
-                           'tools.jackson.core:jackson-core',
-                           'org.apache.maven:apache-maven'):
-            self.assertIn(coordinate, excluded)
+        # The wrapper's Maven distribution needs individual review; a mixed
+        # group PR cannot pass its checks.
+        self.assertIn('org.apache.maven:apache-maven', excluded)
 
         ignore = parse_dependabot_ignore(maven.split('    ignore:\n', 1)[1])
         versioned = {name for name, update_types in ignore.items() if update_types}
@@ -345,25 +340,15 @@ def test_only_executed_plugins_are_submitted(self):
         self.assertLess(workflow.index('Resolve shared library build plugins'),
                         workflow.index(app_command))
 
-    def test_boot_plugin_jackson_fix_stays_in_its_own_realm(self):
+    def test_boot_plugin_realm_uses_boot_managed_jackson(self):
+        # Boot 4.1.2's buildpack platform brings the patched Jackson 3.1 line.
+        # A stale exact pin here would silently downgrade it, and Enforcer
+        # rules do not inspect plugin realms.
         app = ET.parse(ROOT / 'jakarta-test/pom.xml').getroot()
-        self.assertEqual('3.1.7', app.findtext(
-            'p:properties/p:jackson.build.version', namespaces=version.NS))
-        plugins = app.findall('p:build/p:plugins/p:plugin', version.NS)
-        boot = next(plugin for plugin in plugins
-                    if plugin.findtext('p:artifactId', namespaces=version.NS)
-                    == 'spring-boot-maven-plugin')
-        jackson = {
-            dep.findtext('p:artifactId', namespaces=version.NS):
-            dep.findtext('p:version', namespaces=version.NS)
-            for dep in boot.findall('p:dependencies/p:dependency', version.NS)
-            if dep.findtext('p:groupId', namespaces=version.NS) == 'tools.jackson.core'
-        }
-        self.assertEqual({
-            'jackson-core': '${jackson.build.version}',
-            'jackson-databind': '${jackson.build.version}',
-        }, jackson)
-        for dep in app.findall('p:dependencies/p:dependency', version.NS):
+        self.assertIsNone(app.find(
+            'p:properties/p:jackson.build.version', version.NS))
+        self.assertIsNone(app.find('p:properties/p:tomcat.version', version.NS))
+        for dep in app.iter('{%s}dependency' % version.NS['p']):
             self.assertNotEqual('tools.jackson.core', dep.findtext(
                 'p:groupId', namespaces=version.NS))