OWASP / OWASP/owasp-java-encoder
Move the optional Jakarta integration app to a supported Spring Boot generation
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 541
- Forks
- 122
- Avg merge
- 9h 9m
- Merged PRs (30d)
- 1
Description
Follow-up to #90 (reviewed at 31588e1). This tracks work intentionally kept separate from the modernization PR.
Why
#90 moves jakarta-test/pom.xml to Boot 3.5.16 and Spring Framework 6.2.19 to address the identified dependency advisory while preserving the test app's existing Servlet 6 baseline.
Spring identifies 3.5.16 as the final OSS release of the 3.5 generation. A separate, deliberate major-version migration is needed for continued OSS updates. See the official release announcement.
Acceptance criteria
- Choose a supported Boot generation at implementation time and document its JDK, Servlet, JSP, EL, and container requirements.
- Upgrade the optional app and its test/container stack coherently using the appropriate dependency management.
- Retain the application-startup test and an actual Docker/Selenium test exercising the encoder's JSP tags and EL functions.
- Confirm the WAR packages and starts correctly and that documentation reflects how to run the tests locally and in CI.
- Keep Spring/Boot and newer container dependencies confined to the optional integration application, not the published encoder libraries.
- Do not silently raise the encoder libraries' Java or Jakarta Servlet compatibility baseline; preserve separate coverage for older supported consumers if the app now tests a newer container.
- Confirm the resulting dependency graph addresses the already identified Spring advisory and review newly selected dependencies.
This issue does not imply the published core encoder requires Spring Boot.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with jakarta-test/pom.xml and the changes from #90 at commit 31588e1, then review the existing application-startup and Docker/Selenium coverage. Determine a supported Spring Boot generation and document its runtime requirements; done means the optional WAR starts, JSP/EL encoder tests pass, documentation is updated, and published library compatibility remains unchanged.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, java, spring-boot
- Domain
- backend, build-system, documentation, testing
- Issue type
- Refactor
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100