Migrate Maven Central coordinates to org.owasp:java-html-sanitizer

Aperta
  • Qualcosa non va?
#531 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
25/100
Tipo di issue
Funzionalità
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
java
Ambito
build-system, release

Direzione di ricerca

Start by reading the Maven relocation guide and auditing the parent and module coordinates, publication configuration, shim references, examples, and documentation named in the issue. Before changing release configuration, maintainers must confirm access to both publishing namespaces and decide how long to publish relocation POMs. Done means the migration plan covers compatibility, mixed Maven and Gradle dependency trees, security advisory continuity, migration instructions, and the release validation listed here.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Proposal

Move future Maven Central releases from:

com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer

to:

org.owasp:java-html-sanitizer

This would retire the legacy Google Code coordinates and make OWASP ownership clearer. Jim Manico administers the org.owasp namespace; confirm the release publishing identity has the necessary access before implementation.

Compatibility and migration

  • Preserve public Java packages (org.owasp.html), APIs, the JPMS module name (owasp.java.html.sanitizer), Java 8 compatibility, and the existing version sequence. Check OSGi bundle identity for unintended changes.
  • Leave existing Central releases unchanged. Publish a new relocation-only POM under the old coordinates pointing to the corresponding new release, retaining publishing access to the old namespace. Decide how long to continue publishing relocation POMs.
  • Document that consumers pinned to old releases do not automatically migrate or receive fixes. Cover dependency declarations, dependency management, exclusions, lockfiles, and repository allowlists.
  • Verify mixed dependency trees: an old transitive dependency and a new direct dependency must not silently leave duplicate sanitizer classes or cause an older version to load.
  • Preserve security advisory and scanner continuity across both coordinate families.

Implementation and validation

  • Audit parent/module coordinates, shim references, shading, publication configuration, integration checks, examples, and documentation. Choose project-specific parent coordinates to avoid collisions under the shared OWASP namespace.
  • Coordinate publishing credentials and the release procedure with maintainers.
  • Test relocation and mixed old/new dependency trees with Maven and Gradle, plus Java 8, JPMS, and OSGi compatibility as applicable.
  • Run the full reactor with ./mvnw clean verify and record the user-visible change under Next release in change_log.md.
  • Publish migration instructions and announce the transition before the first release under the new coordinates.

This issue is for agreeing on and tracking the migration before making release configuration changes.

References: Maven relocation guide, Central immutability policy, Gradle relocation guidance.

Lingua principale
Java
Stelle
958
Fork
237
Merge medio
21m
PR unite (30g)
21

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Issue simili

Altre issue su Java

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.