Skip to content

Maintenance execution plan: ordered batches and backlog review (2026-09-25) #169

Closed
#209
Closed
Maintenance execution plan: ordered batches and backlog review (2026-09-25)#169
#209
Labels
priority: P1High priority: security contracts, CI protection or consumer compatibility.type: trackingCross-batch execution order and completion evidence.

Description

@jmanico
jmanico
opened on Sep 26, 2026

Reviewed the complete open inventory on 2026-09-25 (America/Los_Angeles): 30 issues and 1 PR, against main at bd249f5. Read all issue bodies and discussion comments, reviewed the open PR diff/checks, compared recent merged/closed work, and rechecked relevant repository settings and Central availability. This tracker records the execution order; it does not implement or release the batches.

How to work this queue

Use the numbered milestones in order, with the dependencies below controlling merge order. Work that is independent and ready may proceed while external access or a preceding decision is blocked. priority: P0/P1/P2/P3 indicates urgency, area:* ownership, and triage:* disposition. security-review marks sensitive acceptance criteria, not a vulnerability classification. Keep batches reviewable; a batch need not be one giant PR.

Order Batch and items Execution rule
00 #111, #112 Correct consumer guidance now; finish exact signed 1.4.1 Central delivery when namespace access permits. Independent vault/access checks need actual evidence.
01 #100, #130 Align ESAPI URL/context semantics and deprecation guidance together, preserving supported encoder contexts.
02 #102, #109, #97, #119, #108 Pin/guard first, add scanning and updates, preserve complete CI gates, then enforce settings that depend on them. Independent settings hardening can start now.
03 #137, #131 / PR #168, #120, #93 Derive real OSGi API floors, finish XML 1.1 adapter review, test the final TLD surface through JSP engines, then decide/modernize the browser fixture.
04 #123, #96, #104, #122, #95, #103, #124, #125, #110 Normalize and decide site scope; coordinate toolchain/release changes; measure reproducibility and quality. Re-run final byte comparison after byte-affecting changes. Historical key records can proceed independently.
05 #128 (including #114), #115, #116, #117, #127 One coherent consumer front page plus release history, metadata and contributor guidance. Match final behavior and toolchain.
06 #142, #149 Record explicit keep/change/defer/reject decisions. Future API proposals are not approved simply by being organized.

Consolidation and single owners

Security and compatibility corrections made during organization

Open PR review

PR #168 at 7bfa00f3242c8918b7d201c8e55bbd7b1b31e00e contains delegating tag/TLD/test/doc changes with no core algorithm or dependency change. No new security regression identified in its diff. All 20 GitHub checks passed at review time, and independent local parity validation passed across 33 source files. A full local Maven rerun was not performed because Maven was unavailable in this session's PATH. Independent maintainer review remains required; triage did not approve or merge it. Its delivery batch includes the existing OSGi minimum-core problem.

Completion evidence and release gate

  • All initially open issues/PRs reviewed and assigned priority, area, disposition and numbered milestone.
  • Duplicated responsibilities consolidated; obsolete version assumptions and dangerous acceptance criteria corrected.
  • PR diff/checks reviewed and limits of local verification recorded.
  • For each batch, record merged PRs, validation and remaining blockers/explicit dispositions here as work completes.
  • Before any 1.5 release, re-inventory all then-open issues and PRs and satisfy the full backlog gate in RELEASING.md. Labeling, deferring, moving milestones or completing one batch is not release approval.

This tracker is the cross-batch index and intentionally has no single batch milestone. No source code, repository security setting, release asset, tag or PR merge is changed by this organization pass.

Batch 00 progress — 2026-09-25 (America/Los_Angeles)

Implementation: #171 merged at 2026-09-26 05:00:48 UTC as 6a3c3a9bd5d8eaa82c6ee956ab78ff9e11821b6f. All 20 GitHub checks passed on the PR head. After the normal merge was blocked by the approving-review requirement, Jim explicitly directed the merge and the administrator override was used. #112 is closed; batch 00 remains operationally incomplete under #111.

Detailed validation evidence.

Batch 01 complete — 2026-09-25 (America/Los_Angeles)

Batch 02 complete — 2026-09-25 (America/Los_Angeles)

Batch 03 complete — 2026-09-25 (America/Los_Angeles)

  • Constrain OSGi imports to actual adapter API requirements and freeze bundle identities #137 / Declare OSGi import ranges from actual API use and freeze bundle names #174: reviewed and approved the contributor's OSGi change at 28b57eb7d6cfb7b01dcbf7484da9d471e3ed1d3c, then merged normally as 159041aa5a668483d456d3c9e8e4a673b697e6cb after all 26 checks passed. Symbolic names are explicit and preserved, JSP/Jakarta core imports require [1.5,2) for JSON linkage, ESAPI uses the supported 1.4.1 security floor, and API ranges remain conservative. Real Felix R6/R8 consumers accept supported wiring and reject core 1.4.0; classpath/JPMS JSON linkage and 15 package guards pass. No embedded dependencies or new library/API baseline.
  • Add XML 1.1 tags and EL functions to both taglibs #131 / Add XML 1.1 tags and EL functions to both taglibs #168: reviewed and approved at ece754c3a094f591dc23213f317735f1b237b706, then merged normally as 2b8e7b3a90895fbcacb89c3b2894c461dc71843d after all 26 checks passed. Both adapters expose the three XML 1.1 contexts in advanced descriptors and forXml11 in basic descriptors, with direct Writer delegation and context restrictions. The intended forJava omission remains explicit. Existing contract tests expand automatically; 34-file JSP/Jakarta parity passes.
  • Render every current JSP and Jakarta tag/EL binding through isolated JSP engines #120 / Test every packaged taglib binding through real JSP engines #179: merged as e6bbebe8e8ee9043e9cd1328fdda18b3e55816b2 after all 26 checks passed on 96a1c64d0878fedf6919d6cadb65e542a974986f. Normal Docker-free verify now forks isolated maintained Tomcat/Jasper 9.0.122 and 10.1.60 engines. The actual packaged TLDs generate 144 bindings across both adapters, 1,152 complete response-byte assertions, and 144 JSP translation rejections for bodies/missing attributes. Coverage includes JSON/XML 1.1, hostile markup/Unicode/controls, buffer boundaries, null/missing values and EL coercion. Engine dependencies stay outside library test/runtime classpaths. Local clean verify passed 2,178 unit plus eight existing integration tests, API/signatures and the new engines; CI retains the Java 8/11/17/21/25 matrix and browser checks.
  • Decide and modernize the optional browser integration fixture without losing coverage #93 / Retain and modernize required browser and packaged WAR coverage #180: merged as 111d03390b96bba9fce33474cef413f8b07b6288 after all 26 checks passed on d215dc02f275d8cd9914fbaf6dd50cb8197e9446. Explicit decision: retain the required actual-browser suite because facade byte comparisons cannot replace its DOM, HTML parser and JavaScript grammar assertions. The optional fixture now uses supported Boot 4.1.1, coherent Tomcat 11.0.26 APIs, Testcontainers 2.0.5 and aligned Selenium 4.49.0; library support baselines remain unchanged. Browser/helper images are pinned by verified registry index digest, discarded recording is disabled, and browser/container/server cleanup is explicit. The executable WAR itself is launched and its packaged JSP/JSTL views and exact encoded cells are verified. Removed unused JSON/service/test scaffolding and duplicate API JARs while retaining required JSTL. The 34 packaged third-party coordinates returned no OSV advisories at review time; this does not cover OS images, build plugins or test-only dependencies.
  • Requested reviews: Sol reviewed all batch 02/03 changes in three scopes and independently read back the live repository controls. Its browser review identified unused JSP sessions rewriting a test URL; setting session=false fixed the startup assertion and the packaged test passed. Sol found no remaining actionable issues. Astra's final complete-diff review at 413177ce found no actionable correctness/security findings and independently passed 10 policy/parser tests, 15 artifact guards, parity, and exact WAR/JAR comparison. CI then exposed Testcontainers image-name compatibility handling; an explicit declaration retained the exact digest, and Astra reviewed the correction through d215dc02 with no findings. AI review is not recorded as independent maintainer approval. Jim explicitly directed review and merge; Test every packaged taglib binding through real JSP engines #179 and Retain and modernize required browser and packaged WAR coverage #180 used the documented PR-only review bypass, while required CI/security checks have no bypass and passed.
  • Final verification and cleanup: All 26 final PR checks passed, including five JavaScript browser tests, the server-rendered DOM test, executable-WAR test, exact reactor JAR inclusion, all required compatibility legs and CodeQL. All final-main workflows also passed: Java CI, packaged consumers, CodeQL, and dependency submission. All four batch issues are closed. Returned to clean synchronized main; removed the merged task/review branches and retained contributor fork branches, active Pages and unrelated work. The open automated dependency PRs remain for deliberate review in their owning batches. Complete release readiness: Central 1.4.1 publication and independent maintainer recovery #111 and the full 1.5 release gate remain unchanged. Continue with batch 04 as directed.

Batch 04 — implementation merged; historical-key evidence gap remains

Batch 05 complete — 2026-09-26 (America/Los_Angeles)

  • Delivery: PR #189 merged as 8c32b2c69337b4883af13e4c9271c7726b0f6666 after all 28 checks passed on final head 735ad8b4cf8c19510a2f6fbff350c7fb5a2a58cf. Sol reviewed the docs/adapters and metadata/community scopes; corrected findings include version/context wording, moved links and the missing release template. Final Sol and Astra reviews found no actionable findings, including the final merged-ESAPI-history correction. Model review is not independent maintainer approval. Jim's authorized PR-only review bypass was used; required CI/security checks have no bypass and passed.
  • Rewrite the README and context guide, incorporating #114 and current 1.5 contracts #128 (including consolidated Consolidated into #128: README commands, coordinates and taglib discovery #114): coherent consumer README plus context/String/Writer/JSP/EL/URL/JPMS guidance; all four coordinates; released 1.4.1 versus unreleased 1.5 labels; core/adapter dependency and packaging distinctions; non-goals and explicit exact-output versioning policy. All five exact Central 1.4.1 POMs still returned 404; the signed GitHub security-release notice remains prominent. A POM/artifact-provenance inventory covers 28 resolved third-party consumer compile/runtime/provided coordinates, with test/build/WAR graphs explicitly outside that inventory.
  • Create a verified changelog and reuse the existing security release-notes structure #115 / Refresh project/POM metadata while preserving historical authorship and bundle identities #116: verified changelog from tags, releases and merged changes; reusable release-note template and metadata checklist. Historical date discrepancies are labeled, not invented or overwritten. All four generated Bundle-Vendor/Bundle-DocURL entries and all five effective POMs use current OWASP organization/project metadata; maintainer roles and original Jeff Ichnowski authorship are accurate. Published names, Java 8, scopes and source notices remain intact.
  • Correct repository discovery metadata and safely retire stale wiki guidance #117: verified wiki editing was unrestricted, restricted it to push-access users, and archived all four latest pages byte-for-byte with hashes from a10dea70c502c02d072d3d9d2dc520d7c042587a. A verified complete-history Git bundle is retained. Current docs replace useful content and identify obsolete IE grave-accent/unsafe CSS/URL examples as historical. After merge, hid the wiki without deleting its history; unauthenticated /wiki redirects to the repository front page and API has_wiki is false. Live Java 8/context/core-versus-adapter description, current project homepage and 11 topics were read back. The external OWASP website remains separately coordinated under Complete release readiness: Central 1.4.1 publication and independent maintainer recovery #111; no social-preview blocker was added.
  • Add accurate contributor guidance and validated community/review metadata #127: project contribution guide, official OWASP Code of Conduct, PR template and three public issue forms with private security routes. Live issue chooser shows all three forms plus blank ordinary issues; Discussions stays disabled. CODEOWNERS lists verified admins Jim/Jeremy and GitHub reports zero errors. Existing enforcement is described accurately without new mandatory-owner/DCO/SLA requirements. Funding links distinguish the existing Add .well-known/funding-manifest-urls for FLOSS/fund #157 Manicode maintainer authorization from Foundation donations; both appear publicly in the enabled Sponsor section. GitHub detects the project contribution/CoC/PR files; its aggregate health score is not used as a substitute for live form verification.
  • Validation: fresh isolated clean verify passed the full tests, API/Java 8 signatures, coverage and both JSP engines; 17 artifact guards, 14 policy/verification tests, 34-file parity and Java 17 classpath/explicit-and-automatic-JPMS/Felix consumers passed. The documented module example ran against the original 1.4.1 JAR after full-fingerprint signature verification. Two clean reference builds after metadata changes produced identical copies of all 17 payloads (12 JARs/five POMs); the checked-in record records hashes, provenance and scope. Later documentation-only commits change no artifact inputs.
  • Post-merge: all four main workflows passed: Java CI, packaged consumers, CodeQL, and dependency submission. All five batch issues are closed. Merged task branch removed locally/remotely; continued batch 06 from synchronized main. No release/signing/tag operation occurred; Complete historical release-key records and verify consumer instructions #110/Complete release readiness: Central 1.4.1 publication and independent maintainer recovery #111 remain open.

Batch 06 decision queue complete — 2026-09-26 (America/Los_Angeles)

  • Delivery: PR #190 merged as 21705bdfe972f3a4458549fdbefe924b17b97096 after all 28 final-head checks passed on 70720012ab25d5218ef16811fbd6ef2f29127c44. Sol reviewed the committed four-file documentation diff, then Astra performed the final pass; neither found actionable findings. The authorized PR-only review bypass was used; required CI/security checks have no bypass and passed. Model reviews are not independent maintainer approval.
  • Decide future-major compatibility policy without committing 1.x to breaking changes #142 completed: the decision record gives explicit keep/defer decisions, consumer-fixture evidence, rationale and migration costs for every item: Java 8 baseline, explicit/automatic module identities, Jakarta/shared tag packages, forUri retention, javax/ESAPI adapter lifecycle and ESAPI compile scope, multi-release JARs, and exact-output versioning. No future break or removal date is approved; accepted future proposals require consumer-impact evidence and published migration notice before implementation. No speculative implementation tickets were created, and closed proposals stay closed. Already merged JSON/ordinary-template features remain accurately described. README, contribution and context guides link the record.
  • Decide whether strict base64url belongs in this output-encoding library #149 closed as NOT_PLANNED: transport encoding/canonical decoding stays outside Java Encoder. Documented the JDK 8+ byte API instead of adding Base64Url/facade/tag/EL surfaces. The record covers protocol-specific padding, non-canonical decoder acceptance, strict Unicode/error/resource-limit boundaries, view/output-context restrictions and the mismatch with Encoder/EncodedWriter byte grouping. Conditional implementation/test/API criteria are N/A because the utility is rejected; no submitted code is alleged vulnerable and no contributor implementation is assigned. Existing ESAPI delegates are untouched. Reconsideration needs a new narrow product decision, not a promised future feature.
  • Validation: the byte example compiled with javac --release 8 and printed AAEC on JDK 17; padded/unpadded JDK decoder behavior was checked. Relative links/anchors and whitespace passed; both reviewers independently checked the evidence. This is documentation only, so batch 05's final byte comparison remains applicable.
  • Final main workflows: all four passed on 21705bdfe972f3a4458549fdbefe924b17b97096: Java CI, packaged consumers, CodeQL, dependency submission. No failure or cancelled check is treated as success.
  • Cleanup: back on clean main, synchronized at 21705bd. Both merged batch branches removed locally/remotely; generated targets, isolated Maven/wrapper repositories, downloaded reference JDK, temporary verification homes and generated CLI state removed. Compact logs, both sets of verified comparison payloads and the complete wiki-history bundle are retained. Unrelated branches, Pages, user tabs and the user's Maven storage are preserved.
  • Remaining: Complete historical release-key records and verify consumer instructions #110 still needs independent authorization records for four early signing fingerprints. Complete release readiness: Central 1.4.1 publication and independent maintainer recovery #111 still owns Central namespace access/exact retained 1.4.1 delivery, independent custody drills and validated-then-dropped publisher rehearsals. Existing automated dependency proposals and other then-open work still require deliberate release-gate review. Completing these decision/documentation batches does not authorize a 1.5 release, signing, tagging or publication; the full RELEASING.md gate remains in force.

PR queue cleanup complete — 2026-09-26 (America/Los_Angeles)

  • Actions Update artifact actions with verified pins and strict digest checks #175: refreshed onto current main, reviewed official upload-artifact v7.0.1 (043fb46d1a93c77aae656e7c1c64a875d1fc6a0a) and download-artifact v8.0.1 (3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c) source/releases/client behavior, and updated ACTION_PINS. Named same-run packaged consumers explicitly retain ZIP creation/extraction and fail a digest mismatch. Node 24 runs on hosted runners independently of the Java 8 consumer JVM. No cross-run token or workflow-permission expansion. Actionlint and all 14 policy/verification tests passed. Sol and then Astra found no actionable issues; all 28 final-head checks passed on 9fafc772b8e7f55d44417a8b1f59b2ea69de2568. Merged as 011734abc029726a115811b53228cdaa789e7232.
  • Bump the maven-dependencies group across 6 directories with 17 updates #176 closed as superseded: previously delivered GPG/Central/versions-plugin/Boot/app changes, retired reporting paths, the accepted bundle-plugin update and deferred API baselines account for every proposal. It was not merged with failing CI. Closure rationale.
  • Bump the maven-dependencies group across 1 directory with 11 updates #188 closed as superseded by Update bundle plugin and isolate compatibility-sensitive dependency proposals #191: accepted only Bundle Plugin 6.2.0; deferred Checkstyle 14 (Java 21 requirement), Plexus 4 in publisher realms, changed public provided APIs/minimum test APIs, and Tomcat 11 replacing the javax/10.1 fixtures. These are dated compatibility decisions with explicit reconsideration criteria, not claims that all upgrades were applied or blanket advisory dismissals. Closure rationale and complete dependency decision record.
  • Focused Update bundle plugin and isolate compatibility-sensitive dependency proposals #191 merged as 18582d3c7b2e7cdf87e42ab093a7763524f0fe90 after all 28 checks passed on 952501f0854405b0456cddc2f6d5ffbbe45d44d5. The only artifact-input change is Bundle Plugin 6.1.2 → 6.2.0, with bnd 7.3.0 → 7.4.0. Eleven exact baseline-sensitive coordinates are excluded only from the broad Maven version-update group, so they receive individual review. Monitored directories, schedules, existing ignores and the separate security-update group are unchanged. No new ignore, security-alert dismissal or automatic merge was added.
  • Validation: fresh reference Temurin 17.0.20.1+1/Maven 3.9.16 clean verify passed 2,178 unit tests and eight integration tests, API/Java 8 signatures, coverage and both real JSP engines. Java 17 original-JAR classpath/explicit-and-automatic-JPMS/Felix consumers, old-core rejection, 17 artifact guards, 14 policy/verification tests and 34-file parity passed. Required CI covers the Docker/browser/WAR suite, ten ESAPI versions and Java 8/11/17/21/25 consumers. Both fresh reproducibility exports of d9d157d917c4b21208edcd52bdab5515e86a0a52 produced identical copies of all 17 payloads. Against batch 05, only the parent POM plugin version and four binary manifests' Created-By values changed; every JAR entry set and all other entry contents match. The checked-in validation record contains all hashes and scope limits.
  • Dependency evidence: the actual bundle-plugin closure has 61 distinct coordinates before and after; only the plugin, bndlib and bnd.util versions change. Those three selected new coordinates returned no OSV matches. This delta check does not certify the 58 inherited coordinates or the full build/runtime graph. Existing advisory review remains required.
  • Requested reviews: Sol reviewed Actions and Maven dispositions separately, corrected the already delivered versions-plugin attribution, then reviewed both final diffs. Astra's final passes found no actionable issues and independently checked all 17 payloads, baseline byte differences and unchanged security grouping. Model review is not independent maintainer approval. Jim authorized the merges; the existing PR-only review bypass was used, with all required CI/security checks passing and no bypass for those checks.
  • Post-merge verification: All four workflows passed on the Actions merge: Java CI, Packaged consumer compatibility, CodeQL, Dependency submission. All four also passed on final main 18582d3: Java CI, Packaged consumer compatibility, CodeQL, Dependency submission. Live SBOM readback confirms Bundle Plugin 6.2.0 and both bnd 7.4.0 artifacts coexist with ESAPI 2.7.0.0, Bouncy Castle 1.86 and Central plugin 0.11.0; the build/runtime/release graph coverage remains intact.
  • Cleanup: clean synchronized main at 18582d3; all merged/superseded task branches removed, temporary Maven worktree/build outputs/isolated caches/reference JDK removed, and compact logs plus both sets of verified payloads retained. Unrelated branches/Pages and user Maven storage are preserved. Both Maven and Actions Dependabot refresh jobs completed successfully. The Maven refresh generated 16 individual PRs (Bump jakarta.servlet.jsp:jakarta.servlet.jsp-api from 3.0.0 to 4.0.0 #192–Bump javax.servlet:javax.servlet-api from 3.0.1 to 4.0.1 in /jsp #207) for the already reviewed deferrals, including duplicate inherited parent-POM proposals from module scans. Every diff was inspected and closed with its specific compatibility rationale and links to the merged record; no new compatible upgrade was discarded. Redundant CI for closed proposals was cancelled where still running, not counted as successful verification. Final GitHub API readback: zero open PRs. Future version/security proposals remain eligible and need review on their own evidence.
  • Remaining release work: Complete historical release-key records and verify consumer instructions #110's four early fingerprint authorization gaps and Complete release readiness: Central 1.4.1 publication and independent maintainer recovery #111's Central publication/access, independent custody drills and publisher rehearsals remain open. No release signing, Portal upload, tag or publication was performed or authorized by this cleanup. The full 1.5 release gate remains in force.

Activity

  1. jmanico
    added
    priority: P1High priority: security contracts, CI protection or consumer compatibility.
    type: trackingCross-batch execution order and completion evidence.
    on Sep 26, 2026
  2. jmanico
    closed this as completedon Sep 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    priority: P1High priority: security contracts, CI protection or consumer compatibility.type: trackingCross-batch execution order and completion evidence.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions