[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.owasp.encoder:encoder (source)	1.5.0 → 1.6.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

OWASP/owasp-java-encoder (org.owasp.encoder:encoder)

v1.6.0

Publication is verified; see the release record.

• Reduce unnecessary script-letter escaping in forJavaScript and
  forJavaScriptBlock (#​243). Interior letters remain readable; the input's last
  character is escaped if it is C, I, P, R, S, or T (either case). Existing punctuation escapes and
  protection against recognized HTML tokens across trusted-text boundaries are
  preserved. Encoded bytes change, while JavaScript string values do not.
  Streaming encoders may retain one trailing letter; EncodedWriter.flush()
  safely emits it as a hex escape and any pending high surrogate as a Unicode
  escape. Explicit flushes can add safe escapes while preserving UTF-16 values.
  Direct Encoder.encode callers must retain unread input after underflow and
  supply more input or mark end-of-input, including for a pending ASCII letter.

v1.5.1

Documentation and build-maintenance patch; publication is verified in the
publication record. Encoding behavior and public APIs are unchanged.

• Clarify JavaScript encoding modes, output growth, and insertion-boundary
  requirements for #​243; distinguish JSON whole-string HTML embedding from
  JavaScript fragment protection. Correct internal HTML/XML comments and
  strengthen parser tests to verify script text, not only absence of a marker.
  Encoding behavior is unchanged.

• Verify public API compatibility against immutable 1.5.0 artifacts and their
  matching support APIs. Minimum-consumer fixtures are unchanged.

• Discover release tags independently of commit ancestry so squash merges cannot
  leave the compatibility baseline stale; add isolated Git regressions.

• Record verified 1.5.0 publication and replace pending-availability notices.

• Update Jackson core/databind to 3.1.7 in the unpublished Jakarta fixture's
  Spring Boot Maven plugin realm for GHSA-q4xh-88c3-wmh7, GHSA-wjgm-6hv5-3cvf,
  GHSA-wv8q-qhhj-9h54 and GHSA-cxp5-3px4-pw24. Published library dependencies
  and release artifacts are unchanged.

• Route Jackson plugin-realm pins and Maven wrapper upgrades out of the grouped
  Dependabot PR for individual review, and keep Jackson on its 3.1 line until the
  Boot parent moves. Security updates remain eligible.

• Build with Maven 3.10.0 through the committed wrapper and require it for signed
  releases. Ordinary builds still accept Maven 3.9.16 or later. Library JARs and
  module POMs are byte-identical to 3.9.16 builds
  (validation).

• Update isolated Tomcat/Jasper test engines to 9.0.123 and 10.1.61 and give
  each its own Dependabot scan (#​241, #​242). These are test tooling, not
  dependencies shipped inside the encoder libraries.

• Update reviewed build tooling and pinned Actions, including japicmp 0.26.3,
  Commons Lang 3.21.0, and the publisher's HttpClient 5.6.5 (#​234, #​237, #​240).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.