[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
org.owasp.encoder:encoder (source)	1.5.0 → 1.5.1

---

Release Notes

OWASP/owasp-java-encoder (org.owasp.encoder:encoder)

v1.5.1

Compare Source

Documentation and build-maintenance patch; publication is verified in the
publication record. Encoding behavior and public APIs are unchanged.

• Clarify JavaScript encoding modes, output growth, and insertion-boundary
  requirements for #​243; distinguish JSON whole-string HTML embedding from
  JavaScript fragment protection. Correct internal HTML/XML comments and
  strengthen parser tests to verify script text, not only absence of a marker.
  Encoding behavior is unchanged.

• Verify public API compatibility against immutable 1.5.0 artifacts and their
  matching support APIs. Minimum-consumer fixtures are unchanged.

• Discover release tags independently of commit ancestry so squash merges cannot
  leave the compatibility baseline stale; add isolated Git regressions.

• Record verified 1.5.0 publication and replace pending-availability notices.

• Update Jackson core/databind to 3.1.7 in the unpublished Jakarta fixture's
  Spring Boot Maven plugin realm for GHSA-q4xh-88c3-wmh7, GHSA-wjgm-6hv5-3cvf,
  GHSA-wv8q-qhhj-9h54 and GHSA-cxp5-3px4-pw24. Published library dependencies
  and release artifacts are unchanged.

• Route Jackson plugin-realm pins and Maven wrapper upgrades out of the grouped
  Dependabot PR for individual review, and keep Jackson on its 3.1 line until the
  Boot parent moves. Security updates remain eligible.

• Build with Maven 3.10.0 through the committed wrapper and require it for signed
  releases. Ordinary builds still accept Maven 3.9.16 or later. Library JARs and
  module POMs are byte-identical to 3.9.16 builds
  (validation).

• Update isolated Tomcat/Jasper test engines to 9.0.123 and 10.1.61 and give
  each its own Dependabot scan (#​241, #​242). These are test tooling, not
  dependencies shipped inside the encoder libraries.

• Update reviewed build tooling and pinned Actions, including japicmp 0.26.3,
  Commons Lang 3.21.0, and the publisher's HttpClient 5.6.5 (#​234, #​237, #​240).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.