Skip to content

Commit e2053d2

Browse files
kwwallkwwall
committed
New release notes
1 parent e74b77d commit e2053d2

File tree

2 files changed

+213
-0
lines changed

2 files changed

+213
-0
lines changed

‎documentation/esapi4java-core-2.5.5.0-release-notes.txt

Lines changed: 199 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,199 @@
1+
Release notes for ESAPI 2.5.5.0
2+
Release date: 2024-10-06
3+
Project leaders:
4+
-Kevin W. Wall <[email protected]>
5+
-Matt Seil <[email protected]>
6+
7+
Previous release: ESAPI 2.5.4.0, 2024-05-30
8+
9+
10+
Executive Summary: Important Things to Note for this Release
11+
------------------------------------------------------------
12+
This is a minor release. All changes should be backward compatible with the previous ESAPI version.
13+
The updates cover the following areas:
14+
* Updates to dependencies and Maven plugins.
15+
* New logging feature added which should be useful in cloud environments where you are paying for log storage.
16+
See GitHub issue https://github.com/ESAPI/esapi-java-legacy/issues/844 for details.
17+
* Documentation clean-up.
18+
19+
Notes if you are not updating from the immediate previous release. release 2.5.4.0:
20+
* You need to read through the series of release notes FIRST, going in order.
21+
* For example, if you were updating from an older ESAPI release (say, 2.3.0.0), you should go back and FIRST read all the subsequent release notes in turn. For instance, if you are currently on release 2.3.0.0 and upgrading to (say) release 2.x.y.z, you should MINIMALLY read the sections "Changes Requiring Special Attention" in each of the subsequent release notes. So, going from release 2.3.0.0 to 2.x.y.z, you should in turn, read:
22+
23+
esapi4java-core-2.4.0.0-release-notes.txt
24+
esapi4java-core-2.5.0.0-release-notes.txt
25+
esapi4java-core-2.5.1.0-release-notes.txt
26+
esapi4java-core-2.5.2.0-release-notes.txt
27+
...etc., up through the current set of release notes...
28+
esapi4java-core-2.x.y.z-release-notes.txt
29+
30+
in that order. YOU HAVE BEEN WARNED!!! (These release notes are too large to put all this in a given document; very few read them thoroughly as it is.)
31+
32+
If your SCA tool is reporting any CVE from a direct or transitive dependency in ESAPI, before reporting it as an GitHub issue, please make sure that you review the vulnerability analysis written up in https://github.com/ESAPI/esapi-java-legacy/blob/develop/Vulnerability-Summary.md. Please email us or contact us in our GitHub Discussions page if you have questions about this. See also the SECURITY.md file to report any security issues with ESAPI.
33+
34+
You are encouraged to review the vulnerability analysis written up in https://github.com/ESAPI/esapi-java-legacy/blob/develop/Vulnerability-Summary.md and email us or contact us in our GitHub Discussions page if you have questions.
35+
36+
37+
=================================================================================================================
38+
39+
Basic ESAPI facts
40+
-----------------
41+
42+
ESAPI 2.5.4.0 release:
43+
207 Java source files
44+
4297 JUnit tests in 131 Java source files (0 failures, 0 errors, 0 tests skipped)
45+
46+
ESAPI 2.5.5.0 release:
47+
207 Java source files
48+
4315 JUnit tests in 133 Java source files (0 failures, 0 errors, 0 tests skipped)
49+
50+
8 GitHub Issues closed in this release, including those we've decided not to fix (marked 'wontfix' and 'falsepositive')
51+
(Reference: https://github.com/ESAPI/esapi-java-legacy/issues?q=is%3Aissue+state%3Aclosed+updated%3A%3E%3D2024-05-30)
52+
53+
Issue # GitHub Issue Title
54+
----------------------------------------------------------------------------------------------
55+
844 Update the logging properties to opt-out of the prefix events Component-Logger enhancement
56+
846 ESAPI.encoder().canonicalize() converts "&or" or similar strings without having trailing semicolon as logical operator
57+
847 Update ESAPI pom to use latest version of AntiSamy (1.7.6)
58+
851 Fix typos
59+
60+
61+
-----------------------------------------------------------------------------
62+
63+
Changes Requiring Special Attention
64+
65+
-----------------------------------------------------------------------------
66+
67+
Important JDK Support Announcement
68+
* ESAPI 2.3.0.0 was the last Java release to support Java 7. ESAPI 2.4.0 requires using Java 8 or later. See the ESAPI 2.4.0.0 release notes (https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.4.0.0-release-notes.txt) for details as to the reason.
69+
- This means if your project requires Java 7, you must use ESAPI 2.3.0.0 or earlier.
70+
71+
Important ESAPI Logging Changes
72+
73+
* Since ESAPI 2.5.0.0, support for logging directly via Log4J 1 has been removed. (This was two years after it haveing first been deprecated.) Thus, you only choice of ESAPI logging are
74+
- java.util.logging (JUL), which as been the default since ESAPI 2.2.1.0.
75+
* Set ESAPI.Logger=org.owasp.esapi.logging.java.JavaLogFactory in your ESAPI.properties file.
76+
- SLF4J (which your choice of supported SLF4J logging implemmentation)
77+
* Set ESAPI.Logger=org.owasp.esapi.logging.slf4j.Slf4JLogFactory in your ESAPI.properties file.
78+
* Logger configuration notes - If you are migrating from prior to ESAPI 2.2.1.1, you will need to update your ESAPI.properties file as logging-related configuration as per the ESAPI 2.2.1.1 release notes, which may be found at:
79+
https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.2.1.1-release-notes.txt#L39-L78
80+
81+
If you use ESAPI 2.5.0.0 or later, you will get an ClassNotFoundException as the root cause if you still have your ESAPI.Logger property set to use Log4J because the org.owasp.esapi.logger.log4j.Log4JFactory class has been completely removed from the ESAPI jar. If you are dead set on continuing to use Log4J 1, you ought to be able to do so via SLF4J. The set up for Log4J 1 (which has not be tested), should be similar to configure ESAPI to use SLF4J with Log4J 2 as described here:
82+
https://github.com/ESAPI/esapi-java-legacy/wiki/Using-ESAPI-with-SLF4J#slf4j-using-log4j-2x
83+
84+
-----------------------------------------------------------------------------
85+
86+
Remaining Known Issues / Problems
87+
88+
-----------------------------------------------------------------------------
89+
None known, other than the remaining open issues on GitHub.
90+
91+
-----------------------------------------------------------------------------
92+
93+
Other changes in this release, some of which not tracked via GitHub issues
94+
95+
-----------------------------------------------------------------------------
96+
97+
* Minor updates to README.md file with respect to version information.
98+
99+
-----------------------------------------------------------------------------
100+
101+
Developer Activity Report (Changes between release 2.5.4.0 and 2.5.5.0, i.e., between 2024-05-30 and 2024-10-06)
102+
Generated manually (this time) -- all errors are the fault of kwwall and his inability to do simple arithmetic.
103+
Note: This only lists merged PRs, not those that were closed as rejected.
104+
105+
Developer Total Total Number # Merged
106+
(GitHub ID) commits of Files Changed PRs
107+
============================================================
108+
DebajitKumarPhukan 7 1 1
109+
DarioViva42 57 44 1
110+
mickeyz07 10 12 1
111+
kwwall 2 2 1
112+
============================================================
113+
Total PRs: 4
114+
115+
-----------------------------------------------------------------------------
116+
117+
CHANGELOG: Create your own. May I suggest:
118+
119+
git log --stat --since=2024-05-30 --reverse --pretty=medium
120+
121+
which will show all the commits since just after the previous (2.5.4.0) release.
122+
123+
Alternately, you can download the most recent ESAPI source and run
124+
125+
mvn site
126+
127+
which will create a CHANGELOG file named 'target/site/changelog.html'
128+
129+
130+
-----------------------------------------------------------------------------
131+
132+
Direct and Transitive Runtime and Test Dependencies:
133+
134+
$ mvn -B dependency:tree
135+
[INFO] -----------------------< org.owasp.esapi:esapi >------------------------
136+
[INFO] Building ESAPI 2.5.5.0-SNAPSHOT
137+
[INFO] --------------------------------[ jar ]---------------------------------
138+
[INFO]
139+
[INFO] --- maven-dependency-plugin:3.7.1:tree (default-cli) @ esapi ---
140+
[INFO] org.owasp.esapi:esapi:jar:2.5.5.0-SNAPSHOT
141+
[INFO] +- javax.servlet:javax.servlet-api:jar:3.1.0:provided
142+
[INFO] +- javax.servlet.jsp:javax.servlet.jsp-api:jar:2.3.3:provided
143+
[INFO] +- xom:xom:jar:1.3.9:compile
144+
[INFO] +- commons-beanutils:commons-beanutils:jar:1.9.4:compile
145+
[INFO] | +- commons-logging:commons-logging:jar:1.2:compile
146+
[INFO] | \- commons-collections:commons-collections:jar:3.2.2:compile
147+
[INFO] +- commons-configuration:commons-configuration:jar:1.10:compile
148+
[INFO] +- commons-lang:commons-lang:jar:2.6:compile
149+
[INFO] +- commons-fileupload:commons-fileupload:jar:1.5:compile
150+
[INFO] +- org.apache.commons:commons-collections4:jar:4.5.0-M2:compile
151+
[INFO] +- org.apache-extras.beanshell:bsh:jar:2.0b6:compile
152+
[INFO] +- org.owasp.antisamy:antisamy:jar:1.7.6:compile
153+
[INFO] | +- commons-io:commons-io:jar:2.16.1:compile
154+
[INFO] | +- org.apache.httpcomponents.client5:httpclient5:jar:5.3.1:compile
155+
[INFO] | | \- org.apache.httpcomponents.core5:httpcore5-h2:jar:5.2.4:compile
156+
[INFO] | +- org.apache.httpcomponents.core5:httpcore5:jar:5.2.5:compile
157+
[INFO] | +- org.apache.xmlgraphics:batik-css:jar:1.17:compile
158+
[INFO] | | +- org.apache.xmlgraphics:batik-shared-resources:jar:1.17:compile
159+
[INFO] | | +- org.apache.xmlgraphics:batik-util:jar:1.17:compile
160+
[INFO] | | | +- org.apache.xmlgraphics:batik-constants:jar:1.17:compile
161+
[INFO] | | | \- org.apache.xmlgraphics:batik-i18n:jar:1.17:compile
162+
[INFO] | | \- org.apache.xmlgraphics:xmlgraphics-commons:jar:2.9:compile
163+
[INFO] | +- org.htmlunit:neko-htmlunit:jar:4.3.0:compile
164+
[INFO] | +- xerces:xercesImpl:jar:2.12.2:compile
165+
[INFO] | \- xml-apis:xml-apis-ext:jar:1.3.04:compile
166+
[INFO] +- org.slf4j:slf4j-api:jar:2.0.13:compile
167+
[INFO] +- xml-apis:xml-apis:jar:1.4.01:compile
168+
[INFO] +- com.github.spotbugs:spotbugs-annotations:jar:4.8.6:compile (optional)
169+
[INFO] | \- com.google.code.findbugs:jsr305:jar:3.0.2:compile (optional)
170+
[INFO] +- commons-codec:commons-codec:jar:1.17.0:test
171+
[INFO] +- junit:junit:jar:4.13.2:test
172+
[INFO] +- org.bouncycastle:bcprov-jdk18on:jar:1.78.1:test
173+
[INFO] +- org.hamcrest:hamcrest-core:jar:2.2:test
174+
[INFO] | \- org.hamcrest:hamcrest:jar:2.2:test
175+
[INFO] +- org.powermock:powermock-api-mockito2:jar:2.0.9:test
176+
[INFO] | \- org.powermock:powermock-api-support:jar:2.0.9:test
177+
[INFO] +- org.mockito:mockito-core:jar:3.12.4:test
178+
[INFO] | +- net.bytebuddy:byte-buddy:jar:1.11.13:test
179+
[INFO] | +- net.bytebuddy:byte-buddy-agent:jar:1.11.13:test
180+
[INFO] | \- org.objenesis:objenesis:jar:3.2:test
181+
[INFO] +- org.powermock:powermock-core:jar:2.0.9:test
182+
[INFO] | \- org.javassist:javassist:jar:3.27.0-GA:test
183+
[INFO] +- org.powermock:powermock-module-junit4:jar:2.0.9:test
184+
[INFO] | \- org.powermock:powermock-module-junit4-common:jar:2.0.9:test
185+
[INFO] +- org.powermock:powermock-reflect:jar:2.0.9:test
186+
[INFO] \- org.openjdk.jmh:jmh-core:jar:1.37:test
187+
[INFO] +- net.sf.jopt-simple:jopt-simple:jar:5.0.4:test
188+
[INFO] \- org.apache.commons:commons-math3:jar:3.6.1:test
189+
[INFO] ------------------------------------------------------------------------
190+
191+
-----------------------------------------------------------------------------
192+
193+
Acknowledgments:
194+
A special shout-out to our new ESAPI contributors, mickeyz07, DarioViva42, and DebajitKumarPhukan.
195+
Another hat tip to Dave Wichers and the AntiSamy crew for promptly releasing AntiSamy 1.7.0. And thanks to Matt Seil, Jeremiah Stacey, and all the ESAPI users who make this worthwhile. This is for you.
196+
197+
A special thanks to the ESAPI community from the ESAPI project co-leaders:
198+
Kevin W. Wall (kwwall) <== The irresponsible party for these release notes!
199+
Matt Seil (xeno6696)

‎scripts/vars.2.5.5.0

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Do NOT edit this file directly. It will be created by the new createVarsFile.sh script,
2+
# which should be run prior to the newReleaseNotes.sh script.
3+
4+
# ESAPI (new / current) version
5+
VERSION=2.5.5.0
6+
7+
# Previous ESAPI version
8+
PREV_VERSION=2.5.4.0
9+
10+
# Release date of current version in yyyy-mm-dd format
11+
YYYY_MM_DD_RELEASE_DATE=2024-10-06
12+
13+
# Previous ESAPI release date in same format
14+
PREV_RELEASE_DATE=2024-05-30

0 commit comments

Comments
 (0)