Bump owasp.encoder.version from 1.5.0 to 1.5.1

[dependabot]

Bumps owasp.encoder.version from 1.5.0 to 1.5.1.
Updates org.owasp.encoder:encoder from 1.5.0 to 1.5.1

Release notes

Sourced from org.owasp.encoder:encoder's releases.

OWASP Java Encoder 1.5.1 is a documentation and build-maintenance patch. Encoding behavior, public APIs, runtime dependencies, and Java 8 support are unchanged from 1.5.0.

What changed

• Clarify JavaScript encoding modes, output growth, and where encoded values can safely be inserted.
• Explain why script-letter escapes remain necessary in the general and block modes; Source mode already leaves the URL in #243 unchanged.
• Distinguish JSON whole-string HTML embedding from JavaScript fragment protection, with clearer surrounding-template requirements.
• Strengthen parser regression tests and include the build/test maintenance recorded in CHANGELOG.md.

The documentation changes are in #244. The release preparation is in #245. This patch preserves the security fixes from 1.5.0 and introduces no new encoder security fix. Users upgrading from versions older than 1.5.0 should read the 1.5.0 migration notes and security advisory.

Maven Central

Version 1.5.1 is published under org.owasp.encoder:

• encoder
• encoder-jsp
• encoder-jakarta-jsp
• encoder-parent

Keep core and adapter versions aligned. The retired ESAPI adapter and optional Jakarta test WAR are not included. The Javadoc JARs are attached. Hosted core, JSP, and Jakarta documentation is live and was checked against the released Javadoc content.

Verification

Exact tested source: 1ab0cfbececf9969452fe03cbf5b5504b03a8b1b; signed tag: v1.5.1.

All 26 downloaded Central payload/signature files match the retained originals byte for byte. All 13 payload signatures verify with the project key, full fingerprint 1C5F632B86809F2F5DB25092BEA0075F94074A9B. The attached bundle SHA-256 is fcb226abfee84db155f27d40fe78173a96524d74dfc14a577eb1106ef57337f8.

The signed build passed 2,290 tests; the separate browser/WAR build passed 2,297, with zero failures/errors/skips. All 13 unsigned payloads match two independent clean builds using Temurin 17.0.20.1+1 and Maven 3.10.0. Required CI passed, including packaged consumers on Java 8/11/17/21/25, Java 8 tests, and CodeQL.

Verify signatures and signed checksum manifests using the attached KEYS, SHA256SUMS, and SHA512SUMS and these instructions. Pending notices in the immutable source tag describe its preparation stage; this release confirms publication without changing those sources or signatures.

Changelog

Sourced from org.owasp.encoder:encoder's changelog.

1.5.1 — 2026-10-15 UTC

Documentation and build-maintenance patch; publication is verified in the publication record. Encoding behavior and public APIs are unchanged.

• Clarify JavaScript encoding modes, output growth, and insertion-boundary requirements for #243; distinguish JSON whole-string HTML embedding from JavaScript fragment protection. Correct internal HTML/XML comments and strengthen parser tests to verify script text, not only absence of a marker. Encoding behavior is unchanged.

• Verify public API compatibility against immutable 1.5.0 artifacts and their matching support APIs. Minimum-consumer fixtures are unchanged.

• Discover release tags independently of commit ancestry so squash merges cannot leave the compatibility baseline stale; add isolated Git regressions.

• Record verified 1.5.0 publication and replace pending-availability notices.

• Update Jackson core/databind to 3.1.7 in the unpublished Jakarta fixture's Spring Boot Maven plugin realm for GHSA-q4xh-88c3-wmh7, GHSA-wjgm-6hv5-3cvf, GHSA-wv8q-qhhj-9h54 and GHSA-cxp5-3px4-pw24. Published library dependencies and release artifacts are unchanged.

• Route Jackson plugin-realm pins and Maven wrapper upgrades out of the grouped Dependabot PR for individual review, and keep Jackson on its 3.1 line until the Boot parent moves. Security updates remain eligible.

• Build with Maven 3.10.0 through the committed wrapper and require it for signed releases. Ordinary builds still accept Maven 3.9.16 or later. Library JARs and module POMs are byte-identical to 3.9.16 builds (validation).

• Update isolated Tomcat/Jasper test engines to 9.0.123 and 10.1.61 and give each its own Dependabot scan (#241, #242). These are test tooling, not dependencies shipped inside the encoder libraries.

• Update reviewed build tooling and pinned Actions, including japicmp 0.26.3, Commons Lang 3.21.0, and the publisher's HttpClient 5.6.5 (#234, #237, #240).

Commits

• 1ab0cfb release: prepare Java Encoder 1.5.1 documentation patch
• ba3aade Clarify JavaScript encoding contracts and strengthen boundary tests (#244)
• cb18f7e Give each Tomcat JSP engine its own Dependabot scan (#242)
• 0753931 Update Tomcat JSP fixtures to 9.0.123 and 10.1.61 (#241)
• 1c08c6a Bump the maven-dependencies group across 1 directory with 2 updates (#237)
• 0d4cb88 Bump the actions group with 4 updates (#240)
• f200fae Move the Maven wrapper to 3.10.0 (#236)
• 914bd27 Bump org.apache.commons:commons-lang3 (#234)
• ee1e2a8 Update fixture Jackson to 3.1.7 and route pinned Dependabot updates (#233)
• 454a07c Complete 1.5.0 post-release cleanup (#230)
• Additional commits viewable in compare view

Updates org.owasp.encoder:encoder-jsp from 1.5.0 to 1.5.1

Release notes

Sourced from org.owasp.encoder:encoder-jsp's releases.

OWASP Java Encoder 1.5.1 is a documentation and build-maintenance patch. Encoding behavior, public APIs, runtime dependencies, and Java 8 support are unchanged from 1.5.0.

What changed

• Clarify JavaScript encoding modes, output growth, and where encoded values can safely be inserted.
• Explain why script-letter escapes remain necessary in the general and block modes; Source mode already leaves the URL in #243 unchanged.
• Distinguish JSON whole-string HTML embedding from JavaScript fragment protection, with clearer surrounding-template requirements.
• Strengthen parser regression tests and include the build/test maintenance recorded in CHANGELOG.md.

The documentation changes are in #244. The release preparation is in #245. This patch preserves the security fixes from 1.5.0 and introduces no new encoder security fix. Users upgrading from versions older than 1.5.0 should read the 1.5.0 migration notes and security advisory.

Maven Central

Version 1.5.1 is published under org.owasp.encoder:

• encoder
• encoder-jsp
• encoder-jakarta-jsp
• encoder-parent

Keep core and adapter versions aligned. The retired ESAPI adapter and optional Jakarta test WAR are not included. The Javadoc JARs are attached. Hosted core, JSP, and Jakarta documentation is live and was checked against the released Javadoc content.

Verification

Exact tested source: 1ab0cfbececf9969452fe03cbf5b5504b03a8b1b; signed tag: v1.5.1.

All 26 downloaded Central payload/signature files match the retained originals byte for byte. All 13 payload signatures verify with the project key, full fingerprint 1C5F632B86809F2F5DB25092BEA0075F94074A9B. The attached bundle SHA-256 is fcb226abfee84db155f27d40fe78173a96524d74dfc14a577eb1106ef57337f8.

The signed build passed 2,290 tests; the separate browser/WAR build passed 2,297, with zero failures/errors/skips. All 13 unsigned payloads match two independent clean builds using Temurin 17.0.20.1+1 and Maven 3.10.0. Required CI passed, including packaged consumers on Java 8/11/17/21/25, Java 8 tests, and CodeQL.

Verify signatures and signed checksum manifests using the attached KEYS, SHA256SUMS, and SHA512SUMS and these instructions. Pending notices in the immutable source tag describe its preparation stage; this release confirms publication without changing those sources or signatures.

Changelog

Sourced from org.owasp.encoder:encoder-jsp's changelog.

1.5.1 — 2026-10-15 UTC

Documentation and build-maintenance patch; publication is verified in the publication record. Encoding behavior and public APIs are unchanged.

• Clarify JavaScript encoding modes, output growth, and insertion-boundary requirements for #243; distinguish JSON whole-string HTML embedding from JavaScript fragment protection. Correct internal HTML/XML comments and strengthen parser tests to verify script text, not only absence of a marker. Encoding behavior is unchanged.

• Verify public API compatibility against immutable 1.5.0 artifacts and their matching support APIs. Minimum-consumer fixtures are unchanged.

• Discover release tags independently of commit ancestry so squash merges cannot leave the compatibility baseline stale; add isolated Git regressions.

• Record verified 1.5.0 publication and replace pending-availability notices.

• Update Jackson core/databind to 3.1.7 in the unpublished Jakarta fixture's Spring Boot Maven plugin realm for GHSA-q4xh-88c3-wmh7, GHSA-wjgm-6hv5-3cvf, GHSA-wv8q-qhhj-9h54 and GHSA-cxp5-3px4-pw24. Published library dependencies and release artifacts are unchanged.

• Route Jackson plugin-realm pins and Maven wrapper upgrades out of the grouped Dependabot PR for individual review, and keep Jackson on its 3.1 line until the Boot parent moves. Security updates remain eligible.

• Build with Maven 3.10.0 through the committed wrapper and require it for signed releases. Ordinary builds still accept Maven 3.9.16 or later. Library JARs and module POMs are byte-identical to 3.9.16 builds (validation).

• Update isolated Tomcat/Jasper test engines to 9.0.123 and 10.1.61 and give each its own Dependabot scan (#241, #242). These are test tooling, not dependencies shipped inside the encoder libraries.

• Update reviewed build tooling and pinned Actions, including japicmp 0.26.3, Commons Lang 3.21.0, and the publisher's HttpClient 5.6.5 (#234, #237, #240).

Commits

• 1ab0cfb release: prepare Java Encoder 1.5.1 documentation patch
• ba3aade Clarify JavaScript encoding contracts and strengthen boundary tests (#244)
• cb18f7e Give each Tomcat JSP engine its own Dependabot scan (#242)
• 0753931 Update Tomcat JSP fixtures to 9.0.123 and 10.1.61 (#241)
• 1c08c6a Bump the maven-dependencies group across 1 directory with 2 updates (#237)
• 0d4cb88 Bump the actions group with 4 updates (#240)
• f200fae Move the Maven wrapper to 3.10.0 (#236)
• 914bd27 Bump org.apache.commons:commons-lang3 (#234)
• ee1e2a8 Update fixture Jackson to 3.1.7 and route pinned Dependabot updates (#233)
• 454a07c Complete 1.5.0 post-release cleanup (#230)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)