Make the ESAPI dependency policy deterministic

[jmanico]

Why

The published encoder-esapi POM currently uses [2.5.1.0,3). A fresh build now resolves that range to 2.7.0.1-RC1, allowing repository contents and downstream dependency selection to change without a commit.

What changed

• replace the range with a fixed esapi.version default of 2.7.0.0, the current upstream-supported stable release
• retain an explicit -Desapi.version=... maintainer override
• document adapter compatibility separately from upstream security support
• test every stable ESAPI release from 2.5.1.0 through 2.7.0.0 in CI
• expand runtime coverage across Java-Encoder-backed methods, delegated text/binary methods, serialization, ESAPI configuration, and the ESAPI 2.7 encodeForSQL safety policy
• enforce dependency convergence in the ESAPI module
• document the resolved graph review and known upstream transitive advisories
• confirm all tested ESAPI versions derive the same JPMS module identity, esapi, coordinating with Fix JPMS dependency reads in the JSP, Jakarta, and ESAPI adapters #92 / Fix JPMS dependency reads in adapter modules #98

Security and runtime review

ESAPI 2.7.0.0 fixes CVE-2025-5878 and updates dependencies for CVE-2025-48976 and CVE-2025-48734. The 2026-09-11 graph review also found later advisories in ESAPI legacy Commons dependencies and HTTP Components brought through AntiSamy. The adapter does not force untested transitive upgrades; the new policy document records affected components, patched versions where available, and the need for application-level assessment.

Only ESAPI 2.7.0.0 is upstream security-supported. The earlier versions are retained solely as an adapter compatibility claim and migration safety net.

Validation

• mvn -B -ntp clean verify — 1,151 tests, no failures/errors/skips
• expanded ESAPI runtime suite passed against all 10 stable versions in the documented range
• dependency convergence passed for every tested version
• isolated fresh-cache clean install selected ESAPI 2.7.0.0
• installed consumer POM contains the fixed default and no range or RC selection
• adapter base classes remain Java 8 bytecode; JPMS identity remains esapi
• Checkstyle, Actionlint, XML validation, and git diff --check passed

Fixes #94

[Copilot]

🟢 Approval recommended

The fixed dependency policy, compatibility matrix, tests, and documentation consistently satisfy the stated requirements.

Pull request overview

Makes ESAPI dependency selection deterministic while documenting and validating compatibility and security expectations.

Changes:

• Pins ESAPI to 2.7.0.0 with an explicit override.
• Adds dependency convergence enforcement and CI coverage for ten stable releases.
• Expands adapter runtime tests and documents security implications.

File summaries

File	Description
README.md	Links the ESAPI dependency policy.
esapi/README.md	Documents compatibility, security, and JPMS policies.
esapi/pom.xml	Pins ESAPI and enforces dependency convergence.
.github/workflows/build.yaml	Adds the ESAPI compatibility matrix.
esapi/src/test/resources/.esapi/ESAPI.properties	Provides cross-version test configuration.
esapi/src/test/java/org/owasp/encoder/esapi/ESAPIEncoderTest.java	Expands runtime compatibility coverage.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jeremylong]

LGTM