2.6.1.0

[kwwall]

Full Release Notes

Release notes for ESAPI release 2.6.1.0 are located at:

• https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.6.1.0-release-notes.txt

What's Changed

• Updated AntiSamy from release 1.7.7 to 1.7.8 which addresses the potentially exploitable vulnerability GHSA-73m2-qfq3-56cx. There is slim possibility that this could affect ESAPI users who have allowed certain CSS mark-up constructs to the AntiSamy policy file that they are using. However the default ESAPI AntiSamy policy file (antisamy-esapi.xml) does not permit CSS mark-up of any sort out unless it has been modified by the ESAPI client.
• Other minor updates to pom.xml

Full Changelog: esapi-2.6.0.0...esapi-2.6.1.0

Other Notes

You may see GHAS Dependabot references to https://github.com/ESAPI/esapi-java-legacy/security/dependabot/17 for this (and previous releases). For a more thorough discussion of this, please see Discussion #877.

Configuration Jar

Note the associated file "esapi-2.6.1.0-configuration.jar" contains the default ESAPI configuration
files under 'configuration/' (ESAPI.properties, validation.properties, etc.) and the file
"esapi-2.6.0.0-configuration.jar.asc" is a GPG signature of that jar file made by Kevin W. Wall.

---

This discussion was created from the release 2.6.1.0.

[kwwall]

And, now, it seems to be working. Looks like it was maybe a problem with my local cache. I had been getting this error message:

[ERROR] Failed to execute goal on project esapiHelloWorld: Could not resolve dependencies for project com.example:esapiHelloWorld:jar:1.0-SNAPSHOT: Failure to find org.owasp.esapi:esapi:jar:2.6.1.0 in https://repo.maven.apache.org/maven2 was cached in the local repository, resolution will not be reattempted until the update interval of central has elapsed or updates are forced -> [Help 1]

I deleted the local cache and now it's working.