Sourced from org.json:json's releases.

20231013

Pull Request	Description
#793	Reverted #761
#792	update the docs for release 20231013
#783	optLong vs getLong inconsistencies
#782	Fix XMLTest.testIndentComplicatedJsonObjectWithArrayAndWithConfig() for Windows
#779	add validity check for JSONObject constructors
#778	Fix XMLTest.testIndentComplicatedJsonObjectWithArrayAndWithConfig() for Windows
#776	Update [JUnit to version 4.13.2
#774	Removing unneeded synchronization
#773	Add optJSONArray method to JSONObject with a default value
#772	Disallow nested objects and arrays as keys in objects
#779	Unit test cleanup
#769	Addressed Java 17 compile warnings
#764	Update CodeQL action version
#761	Add module-info
#759	JSON parsing should detect embedded
#753	Updated new object methods
#752	Fixes possible unit test bug when compiling/testing on Windows

20230618

Pull Request	Description
#749	Prep for release 20230618
#740	Fixed Flaky Tests Caused by JSON permutations
#734	Fixed Flaky Tests Caused by JSON permutations
#733	JSONTokener implemented java.io.Closeable
#731	Removing commented out code in JSONObject optDouble()
#729	Refactor ParserConfiguration class hierarchy

20230227

Pull Request	Description
#723	Protect JSONML from stack overflow exceptions caused by recursion
#720	Limit the XML nesting depth for CVE-2022-45688
#711	Revert pull 707 - interviewbit spam
#704	Move javadoc comments above the interface definition to make it visible
#703	Update Releases.md for JSONObject(Map): Throws NPE if key is null
#696	Update JSONPointerTest for NonDex compatibility
#694	Pretty print XML
#692	Example.md syntax highlight and indentation
#691	Create unit tests for various number formats

20220924

Pull Request	Description
#688	Update copyright to Public Domain
#687	Fix a typo
#685	JSONObject map type unit tests

... (truncated)

Sourced from org.json:json's changelog.

20231013 First release with minimum Java version 1.8. Recent commits, including fixes for CVE-2023-5072.

20230618 Final release with Java 1.6 compatibility. Future releases will require Java 1.8 or greater.

20230227 Fix for CVE-2022-45688 and recent commits

20220924 New License - public domain, and some minor updates

20220320 Wrap StackOverflow with JSONException

20211205 Recent commits and some bug fixes for similar()

20210307 Recent commits and potentially breaking fix to JSONPointer

• See full diff in compare view

Sourced from org.owasp.esapi:esapi's releases.

2.5.3.1

Major changes

ESAPI 2.5.3.1 is a minor point release that adds:

• Updated Javadoc for the Validator.isValidSafeHTML and ValidationRule.getValid methods.
• Adds an always-on log message (a single time only) if either of the isValidSafeHTML methods is invoked. The warning notes that the method is deprecated and provides a link to the GitHub Security Advisory.

Release Notes

The release notes for ESAPI release 2.5.3.1 are located at:

https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.5.3.1-release-notes.txt

Configuration files located in configuration jar

Note that the attached file "esapi-2.5.3.1-configuration.jar" contains the default ESAPI configuration files intended for used in production. Download the file and unjar it via 'jar xf'. After you unjar that configuration jar, look under the 'configuration/' directory. Most of the files you are interested in are located under 'configuration/esapi', such as ESAPI.properties, validation.properties, etc. The attached file "esapi-2.5.3.1-configuration.jar.asc" is a detached GPG signature of that the file "esapi-2.5.3.1-configuration.jar" that was signed by ESAPI project co-lead, Kevin W. Wall.

References

• GHSA-r68h-jhhj-9jvm was created and some partial, incomplete workarounds are discussed, but there is not patch available without major breakage of some client code. See Security Bulletin 12 for additional details.

2.5.3.0

Major changes

• The two Validator.isValidSafeHTML methods were deprecated. More details on this in GitHub Security Advisory GHSA-r68h-jhhj-9jvm.
• There is now a version of the ESAPI jar that should support the Jakarta Servlet API. See the release notes and the ESAPI GitHub wiki page Using ESAPI with Jakarta EE Servlet API Specification 5.0 and later for details.
• Updated to AntiSamy 1.7.4 which addresses CVE-2023-43643 , which really was not exploitable via ESAPI anyway. More details are in the release notes.

Release Notes

The release notes for ESAPI release 2.5.3.0 are located at:

• https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.5.3.0-release-notes.txt

Configuration files located in configuration jar

Note that the attached file "esapi-2.5.3.0-configuration.jar" contains the default ESAPI configuration files intended for used in production. Download the file and unjar it via 'jar xf'. After you unjar that configuration jar, look under the 'configuration/' directory. Most of the files you are interested in are located under 'configuration/esapi', such as ESAPI.properties, validation.properties, etc. The attached file "esapi-2.5.3.0-configuration.jar.asc" is a detached GPG signature of that the file "esapi-2.5.3.0-configuration.jar" that was signed by ESAPI project co-lead, Kevin W. Wall.

References

• GHSA-r68h-jhhj-9jvm was created and some partial, incomplete workarounds are discussed, but there is not patch available without major breakage of some client code. See Security Bulletin 12 for additional details.
• CVE-2023-43643 was addressed by the AntiSamy 1.7.4 upgrade. Even without this AntiSamy patch, ESAPI was not impacted.

The release notes contain a more complete list of what has changed / fixed in ESAPI 2.5.3.0.

2.5.2.0

Release Notes

The release notes for ESAPI release 2.5.2.0 are located at: https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.5.2.0-release-notes.txt

Configuration files located in configuration jar

Note that the attached file "esapi-2.5.2.0-configuration.jar" contains the default ESAPI configuration files intended for used in production. Download the file and unjar it via 'jar xf'. After you unjar that configuration jar, look under the 'configuration/' directory. Most of the files you are interested in are located under 'configuration/esapi', such as ESAPI.properties, validation.properties, etc. The attached file "esapi-2.5.2.0-configuration.jar.asc" is a detached GPG signature of that the file "esapi-2.5.2.0-configuration.jar" that was signed by ESAPI project co-lead, Kevin W. Wall.

CVEs addressed

• CVE-2023-24998 was remediated. See Security Bulletin 11 for details.

... (truncated)

• 7823a87 Remove '-SNAPSHOT' from release and update plugins & test dependencies.
• 9fb6366 Update dependency tree.
• 1a37a65 Merge pull request #818 from kwwall/2.5.3.1-prep
• 0ebbe72 New ESAPI 2.5.3.1 release notes. (Initial version.)
• 25beab9 Added new screenshot figures.
• 5b410c2 Fix Javadoc for the getValid method.
• 9e99897 Tweak both isValidSafeHTML methods to always log a warning mentioning depreca...
• ece7dc3 Javadoc changes for isValidSafeHTML methods.
• af0cea3 For planned 2.5.3.1 release.
• 2f6dad1 Changes to prepare for 2.5.3.1 release.
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.