Migrate Maven Central coordinates to org.owasp:java-html-sanitizer

Start by reading the Maven relocation guide and auditing the parent and module coordinates, publication configuration, shim references, examples, and documentation named in the issue. Before changing release configuration, maintainers must confirm access to both publishing namespaces and decide how long to publish relocation POMs. Done means the migration plan covers compatibility, mixed Maven and Gradle dependency trees, security advisory continuity, migration instructions, and the release validation listed here.

Proposal

Move future Maven Central releases from:

com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer

to:

org.owasp:java-html-sanitizer

This would retire the legacy Google Code coordinates and make OWASP ownership clearer. Jim Manico administers the org.owasp namespace; confirm the release publishing identity has the necessary access before implementation.

Compatibility and migration

• Preserve public Java packages (org.owasp.html), APIs, the JPMS module name (owasp.java.html.sanitizer), Java 8 compatibility, and the existing version sequence. Check OSGi bundle identity for unintended changes.
• Leave existing Central releases unchanged. Publish a new relocation-only POM under the old coordinates pointing to the corresponding new release, retaining publishing access to the old namespace. Decide how long to continue publishing relocation POMs.
• Document that consumers pinned to old releases do not automatically migrate or receive fixes. Cover dependency declarations, dependency management, exclusions, lockfiles, and repository allowlists.
• Verify mixed dependency trees: an old transitive dependency and a new direct dependency must not silently leave duplicate sanitizer classes or cause an older version to load.
• Preserve security advisory and scanner continuity across both coordinate families.

Implementation and validation

• Audit parent/module coordinates, shim references, shading, publication configuration, integration checks, examples, and documentation. Choose project-specific parent coordinates to avoid collisions under the shared OWASP namespace.
• Coordinate publishing credentials and the release procedure with maintainers.
• Test relocation and mixed old/new dependency trees with Maven and Gradle, plus Java 8, JPMS, and OSGi compatibility as applicable.
• Run the full reactor with ./mvnw clean verify and record the user-visible change under Next release in change_log.md.
• Publish migration instructions and announce the transition before the first release under the new coordinates.

This issue is for agreeing on and tracking the migration before making release configuration changes.

References: Maven relocation guide, Central immutability policy, Gradle relocation guidance.