3.1.2

What's Changed

• Restrict build matrix to 'ubuntu-latest' OS by @vharseko in #190
• Exclude test and integration-test sources from CodeQL analysis by @vharseko in #205
• Enable javadoc doclint and fix all HTML/reference errors across the JDK matrix by @vharseko in #201
• Update commons-lang3 version to 3.20.0 by @vharseko in #184
• Update commons-text version to 1.15.0 by @vharseko in #185
• Migrate tests from Mockito 1 (mockito-all) to Mockito 2 (mockito-core) by @vharseko in #187
• Capitalize "JavaScript" in JsonPatchJavascriptValueTransformer docs by @vharseko in #188
• Fix typos and remove dead null check in DeployExternalDependencyMojo by @vharseko in #192
• Fix typos in InstallExternalDependencyMojo by @vharseko with @Copilot in #193
• Fix typo and temp-directory bug in ResolveExternalDependencyMojo by @vharseko in #195
• Enable persistit tests on JDK 26 and re-enable passing ignored tests by @vharseko in #240
• Add concurrency control to GitHub Actions workflows by @vharseko in #251
• Silence doclint "missing" warnings and fix remaining HTML/reference javadoc by @vharseko in #252
• Scan JavaScript/TypeScript, Python and Actions with CodeQL by @vharseko in #253
• Fix stale Javadoc @param/@throws tags (CodeQL unknown-javadoc-parameter, inconsistent-javadoc-throws) by @vharseko in #250
• Fix flaky WarmupTest.testWarmup (compare resident page set, not slot order) by @vharseko in #254
• Stabilize flaky TransactionTest2.transactionsConcurrentWithPersistitClose by @vharseko in #255
• Stabilize flaky TransactionIndexTest.testDeadlockedWwDependency by @vharseko in #256
• Make WarmupTest.readOrderIsSequential deterministic by @vharseko in #259
• Stabilize flaky JournalManagerTest.missingVolumePageHandling by @vharseko in #261
• Stabilize flaky CleanupManagerTest.testCleanupHappens by @vharseko in #262
• Validate the page before re-inserting an index pointer in fixIndexHole (bug 1017957 class race) by @vharseko in #263
• persistit: settle MVCC state at the end of Persistit.initialize() by @vharseko in #266
• persistit: keep JournalManager consistent when rollover fails near the block end by @vharseko in #267
• persistit: do not accept short writes when copying pages to the volume by @vharseko in #269
• Run integration tests in the default CI build by @vharseko in #270
• Clean up Javadoc warnings and fail the build on new ones by @vharseko in #271
• persistit: stabilize flaky MVCCPruneTest.testPruneAlternatingAbortedAndCommittedVersions by @vharseko in #273
• persistit: revalidate pending index insertions after the tree claim is dropped mid-store (bug 1017957 residual) by @vharseko in #275

Full Changelog: 3.1.1...3.1.2

3.1.1

What's Changed

• CVE-2026-27903 CVE-2026-27904 CVE-2026-26996 UI: update grunt to 1.6.2 to address vulnerabilities by @maximthomas in #174
• CVE-2025-58057 unbounded memory allocation in Netty's BrotliDecoder allows OOM via zip-bomb by @maximthomas in #176
• CVE-2025-7962 Jakarta Mail vulnerable to SMTP Injection (#1005) by @dependabot[bot] in #175
• [OpenIdentityPlatform/OpenAM#980] import jackson-bom to resolve ambiguous jackson versions by @maximthomas in #177
• import bc-jdk18on-bom to resolve ambiguous bouncycastle versions by @maximthomas in #178
• Retry external artifact downloads on transient network failures by @Copilot in #179
• Bump GitHub Actions to latest major versions by @Copilot in #180
• Rhino: migrate from servicemix to mozilla by @maximthomas in #181
• CVE-2026-45536 CVE-2026-45416 CVE-2026-44249 Netty: Unix-socket fd receive leaks descriptors when peer sends two at once Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking by @vharseko in #182
• Fix field projection collapsing nested JsonPointers to leaf names by @vharseko in #183

Full Changelog: 3.1.0...3.1.1

3.1.0

What's Changed

• Update build.yml add JDK 26 support by @vharseko in #166
• Fix NPE in ServletJwtSessionModuleTest due to commented-out mock stub by @Copilot in #168
• CVE-2025-67030 Plexus-Utils has a Directory Traversal vulnerability in its extractFile method by @dependabot[bot] in #167
• chore: bump actions/checkout to v6 and actions/cache to v5 by @Copilot in #170
• fix: correct issuedAtTime in JWT cool-off period test by @Copilot in #171
• Extract embedded POM from JAR during install/deploy instead of generating minimal stub by @Copilot in #169
• [OpenIdentityPlatform/OpenAM#980] Resolve duplicate dependencies by @maximthomas in #172
• CVE-2026-32588 CVE-2026-27314 Apache Cassandra has an authenticated DoS over CQL + is vulnerable to privilege escalation in an mTLS environment using MutualTlsAuthenticator by @dependabot[bot] in #173

New Contributors

• @Copilot made their first contribution in #168

Full Changelog: 3.0.4...3.1.0

3.0.4

What's Changed

• [OpenIdentityPlatform/OpenAM#193] Add SameSite cookie attribute support in XUI by @maximthomas in #165

Full Changelog: 3.0.3...3.0.4

3.0.3

What's Changed

• CVE-2026-24400 Fix XXE vulnerability in isXmlEqualTo assertion in assertj-core by @dependabot[bot] in #162
• Set project name to lower case for short version in doc-maven-plugin by @maximthomas in #163
• GHSA-72hv-8253-57qq Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition by @dependabot[bot] in #164

Full Changelog: 3.0.2...3.0.3

3.0.2

What's Changed

• CVE-2025-12183 CVE-2025-66566 LZ4 vulnerabilities by @maximthomas in #157
• CVE-2025-66453 Rhino has high CPU usage and potential DoS by @maximthomas in #158
• CVE-2025-23015, CVE-2024-27137, CVE-2025-24860 in cassandra-all by @maximthomas in #159
• CVE-2025-25247: Apache Felix Webconsole: XSS in services console by @maximthomas in #160

Full Changelog: 3.0.1...3.0.2

3.0.1

What's Changed

• Add support LTS JDK 25 by @vharseko in #154
• Update target JDK to 11 and move to JakartaEE 9 by @maximthomas in #132
• Build & deploy: add branch sustaining/2.4.x by @vharseko in #155
• Fix circle icon size calculation in less by @maximthomas in #156

Full Changelog: 2.4.1...3.0.1

2.4.1

What's Changed

• CVE-2024-38999 requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties by @maximthomas in #153
• move javax.version to servlet-api.version property in maven by @maximthomas in #152

Full Changelog: 2.4.0...2.4.1

2.4.0

What's Changed

• CVE-2019-11358 CVE-2020-11023 Update jQuery to 3.7.1 by @maximthomas in #147
• CVE-2025-48976 Apache Commons FileUpload: FileUpload DoS via part headers by @dependabot[bot] in #148
• CVE-2025-52999 jackson-core can throw a StackoverflowError when processing deeply nested data by @dependabot[bot] in #145
• CVE-2025-48924 Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs by @dependabot[bot] in #151
• Deploy: migrating from Legacy OSSRH to Central Portal by @vharseko in #143
• Set javax.servlet version in the dependency management section by @maximthomas in #144
• Bump jackson-core to 2.15.4 by @vharseko in #149
• Bump org.apache.maven.plugins.maven-shade-plugin 3.6.0 by @vharseko in #150

Full Changelog: 2.3.0...2.4.0

2.3.0

What's Changed

• Add support Java SE 24 by @vharseko in #138
• Update react.js CDN URL by @maximthomas in #139
• CVE-2024-13009 In Eclipse Jetty a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. by @maximthomas in #140
• Add jetty sever components to commons parent pom by @maximthomas in #141
• Set GlassFish Grizzly libraries version it commons pom by @maximthomas in #142

Full Changelog: 2.2.4...2.3.0