Skip to content

Correct repository discovery metadata and safely retire stale wiki guidance #117

Closed
Closed
Correct repository discovery metadata and safely retire stale wiki guidance#117
Labels
area: docsConsumer/contributor documentation and project metadata.documentationenhancementpriority: P2Planned maintenance; follow the ordered batch and documented dependencies.triage: decisionDecision required before implementation; neither rejected nor accepted by triage.
Milestone
Batch 05 - Documentation and contributor experience

Description

@jmanico
jmanico
opened on Sep 24, 2026

Reviewed 2026-09-25 (America/Los_Angeles) against main at bd249f5. Execution order and cross-issue ownership: #169. Batch 05.

This scope replaces the dated implementation prescriptions in the original report and earlier comments; linked historical evidence remains useful but must be rechecked before implementation.

Live state and remaining work

The repository description still says Java 1.5+, topics remain defense/encoding/java/xss, and the wiki remains enabled. Historical wiki edits do not alone prove its current edit permissions; inspect the live setting before asserting public editability.

  • Update description/topics to Java 8+, contextual encoding and the distinction between zero-dependency core and adapters; align with current README.
  • Verify wiki permissions and restrict editing if necessary while reviewing its content. Archive unique useful material before choosing to hide the wiki; keep a recoverable record.
  • Reassess legacy grave-accent advice against current browser support and Support ordinary templates and preserve JavaScript Unicode data #155's contracts before migrating it. Do not republish obsolete workarounds as current security guidance.
  • After migration/link updates, make an explicit retain/hide decision and verify the public result. A custom social preview is optional, not a security or release blocker.
  • Coordinate separate OWASP website changes with that repository; do not assume editing this repository changes the external project page.

#128 owns canonical usage guidance; #108 settings hardening; #96 generated-site/Pages retirement. This issue does not authorize a blind deletion of documentation.

Activity

  1. jmanico
    added
    enhancement
    documentation
    on Sep 24, 2026
  2. jmanico
    added this to the Batch 05 - Documentation and contributor experience milestone on Sep 26, 2026
  3. jmanico
    changed the title [-]Update repository description and topics; restrict then retire the wiki[/-] [+]Correct repository discovery metadata and safely retire stale wiki guidance[/+] on Sep 26, 2026
  4. jmanico
    added
    priority: P2Planned maintenance; follow the ordered batch and documented dependencies.
    area: docsConsumer/contributor documentation and project metadata.
    triage: decisionDecision required before implementation; neither rejected nor accepted by triage.
    on Sep 26, 2026

  5. jmanico commented on Sep 26, 2026

    @jmanico
    jmanico
    on Sep 26, 2026
    MemberAuthor

    Completed with #189, merged as 8c32b2c69337b4883af13e4c9271c7726b0f6666 after Sol and final Astra review and all 28 final-head checks.

    • Live description now says Java 8+, contextual output encoding, zero-dependency core and optional JSP/Jakarta/ESAPI adapters. Homepage uses the current OWASP project URL; topics cover Java, OWASP, XSS, output encoding and the supported contexts/adapters. API and public-page readback match.
    • Verified the previously unrestricted wiki setting, restricted editing to push-access users, and archived all four latest pages byte-for-byte from a10dea70c502c02d072d3d9d2dc520d7c042587a in the repository archive. A complete history bundle is retained for recovery. Current usage/context guides replace the useful examples; obsolete IE grave-accent workarounds and unsafe CSS/URL examples are explicitly historical.
    • After the archive merged, hid the wiki without deleting its repository/history. Public unauthenticated /wiki now redirects to the repository front page; API has_wiki is false.
    • The independent OWASP website publication update remains with Complete release readiness: Central 1.4.1 publication and independent maintainer recovery #111. Repository metadata does not claim to update that site. No custom social preview is required.

    Community readback also confirms the three new issue forms, blank issues, private security routes, project contribution/CoC/PR files, both reviewed funding destinations, and zero CODEOWNERS errors. Discussions remains disabled. #169 will carry final post-merge workflow evidence and cleanup.

  6. jmanico
    closed this as completedon Sep 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area: docsConsumer/contributor documentation and project metadata.documentationenhancementpriority: P2Planned maintenance; follow the ordered batch and documented dependencies.triage: decisionDecision required before implementation; neither rejected nor accepted by triage.

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions