Announcing ESAPI 2.5.0.0 release

[kwwall]

Release notes for ESAPI release 2.5.0.0 are located at:
https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.5.0.0-release-notes.txt

IMPORTANT:

• This release drops all support for ESAPI Logging using Log4J 1 (except through SLF4J). If your ESAPI.Logger property is set to use Log4J and you do not change it, you will get obscure Exceptions or Errors thrown. (Generally an ExceptionInInitializerError.)
• Because we've upgraded to AntiSamy 1.7.0, there are also some potentially breaking changes in this release if you have customized your antisamy-esapi.xml file.
• As begun in the previous release, this release only supports Java 8 or later.

If you do nothing else at least read this short "Changes Requiring Special Attention" section of the 2.5.0.0 release notes. You have been warned!

Finally, note that the file "esapi-2.5.0.0-configuration.jar" (see below) contains the default ESAPI configuration files under 'configuration/' (ESAPI.properties, validation.properties, etc.) and the file "esapi-2.5.0.0-configuration.jar.asc" is a GPG signature of that jar file made by 'Kevin W. Wall (GitHub signing key) [email protected]'.

---

This discussion was created from the release 2.5.0.0.

[kwwall]

Note: I uploaded ESAPI 2.5.0.0 to Maven Central a bit after midnight US/Eastern time last night, so it should now be available from download, as evidenced by https://repo1.maven.org/maven2/org/owasp/esapi/esapi/2.5.0.0/. However, no promises as to how long it will take to show up at the main Maven Central page for ESAPI or any other Maven Central search. (It took about 2.5 days for the ESAPI 2.4.0.0 release to show up on the main Maven Central page for ESAPI. And it already is showing via https://search.maven.org/search?q=ESAPI, but the 2.4.0.0 release never did show up there, as evidenced by https://search.maven.org/artifact/org.owasp.esapi/esapi.