Migrate Maven Central coordinates to org.owasp:java-html-sanitizer

Abierto
  • ¿Algo no está bien?
#531 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
25/100
Tipo de issue
Nueva funcionalidad
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
java
Área
build-system, release

Línea de trabajo

Start by reading the Maven relocation guide and auditing the parent and module coordinates, publication configuration, shim references, examples, and documentation named in the issue. Before changing release configuration, maintainers must confirm access to both publishing namespaces and decide how long to publish relocation POMs. Done means the migration plan covers compatibility, mixed Maven and Gradle dependency trees, security advisory continuity, migration instructions, and the release validation listed here.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Proposal

Move future Maven Central releases from:

com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer

to:

org.owasp:java-html-sanitizer

This would retire the legacy Google Code coordinates and make OWASP ownership clearer. Jim Manico administers the org.owasp namespace; confirm the release publishing identity has the necessary access before implementation.

Compatibility and migration

  • Preserve public Java packages (org.owasp.html), APIs, the JPMS module name (owasp.java.html.sanitizer), Java 8 compatibility, and the existing version sequence. Check OSGi bundle identity for unintended changes.
  • Leave existing Central releases unchanged. Publish a new relocation-only POM under the old coordinates pointing to the corresponding new release, retaining publishing access to the old namespace. Decide how long to continue publishing relocation POMs.
  • Document that consumers pinned to old releases do not automatically migrate or receive fixes. Cover dependency declarations, dependency management, exclusions, lockfiles, and repository allowlists.
  • Verify mixed dependency trees: an old transitive dependency and a new direct dependency must not silently leave duplicate sanitizer classes or cause an older version to load.
  • Preserve security advisory and scanner continuity across both coordinate families.

Implementation and validation

  • Audit parent/module coordinates, shim references, shading, publication configuration, integration checks, examples, and documentation. Choose project-specific parent coordinates to avoid collisions under the shared OWASP namespace.
  • Coordinate publishing credentials and the release procedure with maintainers.
  • Test relocation and mixed old/new dependency trees with Maven and Gradle, plus Java 8, JPMS, and OSGi compatibility as applicable.
  • Run the full reactor with ./mvnw clean verify and record the user-visible change under Next release in change_log.md.
  • Publish migration instructions and announce the transition before the first release under the new coordinates.

This issue is for agreeing on and tracking the migration before making release configuration changes.

References: Maven relocation guide, Central immutability policy, Gradle relocation guidance.

Lenguaje dominante
Java
Estrellas
958
Forks
237
Merge medio
21 min
PR fusionados (30 d)
21

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Issues similares

Más issues de Java

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.