From e2183d6170a250ad97289e4090e3faeec1eecadf Mon Sep 17 00:00:00 2001
From: kwwall <kevin.w.wall@gmail.com>
Date: Sun, 18 May 2025 23:00:36 -0400
Subject: [PATCH 1/7] Prep 'develop' branch for next (SNAPSHOT) ESAPI release.

---
 README.md | 4 ++--
 pom.xml   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index b0928bacb..4c4218298 100644
--- a/README.md
+++ b/README.md
@@ -30,7 +30,7 @@ specific Jakarta version of ESAPI, in Maven, you would specify your ESAPI depend
 <dependency>
     <groupId>org.owasp.esapi</groupId>
     <artifactId>esapi</artifactId>
-    <version>2.6.0.0</version>  <!-- Preferably the latest version, but > 2.5.3.0 -->
+    <version>2.6.1.0</version>  <!-- Preferably the latest version, but > 2.5.3.0 -->
     <classifier>jakarta</classifier>
 </dependency>
 ```
@@ -105,7 +105,7 @@ link to the specific release notes.
   the ESAPI GitHub Discussion https://github.com/ESAPI/esapi-java-legacy/discussions/841.
 
 # Locating ESAPI Jar files
-The [latest ESAPI release](https://github.com/ESAPI/esapi-java-legacy/releases/latest) is 2.6.0.0.
+The [latest ESAPI release](https://github.com/ESAPI/esapi-java-legacy/releases/latest) is 2.6.1.0.
 All the *regular* ESAPI jars, with the exception of the ESAPI configuration
 jar (i.e., esapi-2.#.#.#-configuration.jar) and its associated detached
 GPG signature, are available from Maven Central. The ESAPI configuration
diff --git a/pom.xml b/pom.xml
index 5da4fd7e1..a0e8f95f8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -3,7 +3,7 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>org.owasp.esapi</groupId>
     <artifactId>esapi</artifactId>
-    <version>2.6.1.0</version>
+    <version>2.7.0.0-SNAPSHOT</version>
     <packaging>jar</packaging>
 
     <distributionManagement>

From 7067804af1ce9a700acd9ca0cd25c43052bcdfeb Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 29 May 2025 10:35:16 -0400
Subject: [PATCH 2/7] Bump commons-beanutils:commons-beanutils from 1.9.4 to
 1.11.0 (#881)

Bumps commons-beanutils:commons-beanutils from 1.9.4 to 1.11.0.

---
updated-dependencies:
- dependency-name: commons-beanutils:commons-beanutils
  dependency-version: 1.11.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pom.xml b/pom.xml
index a0e8f95f8..f33ebd034 100644
--- a/pom.xml
+++ b/pom.xml
@@ -185,8 +185,8 @@
         <dependency>
             <groupId>commons-beanutils</groupId>
             <artifactId>commons-beanutils</artifactId>
-            <!-- We need to use 1.9.4 (or later) here to address CVE-2014-0114 and CVE-2019-10086. -->
-            <version>1.9.4</version>
+            <!-- We need to use 1.11.0 (or later) here to address CVE-2014-0114 and CVE-2019-10086. -->
+            <version>1.11.0</version>
             <!-- NOTE: commons-beanutils uses commons-collections 3.2.2. We use
                  commons-collections 4.2. Package names are different so this shouldn't
                  cause any problems as long as 3.x doesn't have any CVEs. May have to

From 5d6e2fda4dbec5f76ece8c617b589aa121e11a8c Mon Sep 17 00:00:00 2001
From: kwwall <kevin.w.wall@gmail.com>
Date: Sun, 1 Jun 2025 19:53:08 -0400
Subject: [PATCH 3/7] Update guessed release date for 2.6.1.0 to its actual
 release date. (Maven Central took a bit longer than anticipated.)

---
 documentation/esapi4java-core-2.6.1.0-release-notes.txt | 4 ++--
 scripts/vars.2.6.1.0                                    | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/documentation/esapi4java-core-2.6.1.0-release-notes.txt b/documentation/esapi4java-core-2.6.1.0-release-notes.txt
index 7f3c0a88b..e81f3bda0 100644
--- a/documentation/esapi4java-core-2.6.1.0-release-notes.txt
+++ b/documentation/esapi4java-core-2.6.1.0-release-notes.txt
@@ -1,5 +1,5 @@
 Release notes for ESAPI 2.6.1.0
-    Release date: 2025-05-18
+    Release date: 2025-05-19
     Project leaders:
         -Kevin W. Wall <kevin.w.wall@gmail.com>
         -Matt Seil <matt.seil@owasp.org>
@@ -93,7 +93,7 @@ None known, other than the remaining open issues on GitHub.
 
 -----------------------------------------------------------------------------
 
-* Changes since last release 2.6.0.0 and 2.6.1.0, i.e., changes between 2025-11-25 and 2025-05-18.
+* Changes since last release 2.6.0.0 and 2.6.1.0, i.e., changes between 2025-11-25 and 2025-05-19.
 
     Note: I am no longer going to provide the 'Developer Activity Report' that I used to this manually create in tabluar form. This is in part because I use to use 'mvn site' to assist with its creation, but neither the 'Developer Activiity' nor 'File Activity' sections of the 'mvn site' output is currently working.
 
diff --git a/scripts/vars.2.6.1.0 b/scripts/vars.2.6.1.0
index fba98e28d..b067cb61f 100644
--- a/scripts/vars.2.6.1.0
+++ b/scripts/vars.2.6.1.0
@@ -8,7 +8,7 @@ VERSION=2.6.1.0
 PREV_VERSION=2.6.0.0
 
 # Release date of current version in yyyy-mm-dd format
-YYYY_MM_DD_RELEASE_DATE=2025-05-18
+YYYY_MM_DD_RELEASE_DATE=2025-05-19
 
 # Previous ESAPI release date in same format
 PREV_RELEASE_DATE=2024-11-25

From 950a56b16508ec45456fe5a07e1e5c0a835f4c7c Mon Sep 17 00:00:00 2001
From: kwwall <kevin.w.wall@gmail.com>
Date: Sun, 1 Jun 2025 21:35:33 -0400
Subject: [PATCH 4/7] Updates to prep for ESAPI 2.6.2.0 release.

---
 .../esapi4java-core-2.6.2.0-release-notes.txt | 180 ++++++++++++++++++
 pom.xml                                       |   4 +-
 scripts/vars.2.6.2.0                          |  14 ++
 3 files changed, 196 insertions(+), 2 deletions(-)
 create mode 100644 documentation/esapi4java-core-2.6.2.0-release-notes.txt
 create mode 100644 scripts/vars.2.6.2.0

diff --git a/documentation/esapi4java-core-2.6.2.0-release-notes.txt b/documentation/esapi4java-core-2.6.2.0-release-notes.txt
new file mode 100644
index 000000000..63195628d
--- /dev/null
+++ b/documentation/esapi4java-core-2.6.2.0-release-notes.txt
@@ -0,0 +1,180 @@
+Release notes for ESAPI 2.6.2.0
+    Release date: 2025-06-01
+    Project leaders:
+        -Kevin W. Wall <kevin.w.wall@gmail.com>
+        -Matt Seil <matt.seil@owasp.org>
+
+Previous release: ESAPI 2.6.1.0, 2025-05-19
+
+
+Executive Summary: Important Things to Note for this Release
+------------------------------------------------------------
+This is a minor patch release with the intent of updating the Apache Commons BeanUtils dependency from v1.9.4 to v1.11.0 to CVE-2025-48734. This CVE wouuld only potentially affect application code that uses the ESAPI's AccessController component. It is extremently unlikely that anyone is using that because the default implmentation for that (the class "org.owasp.esapi.reference.DefaultAccessController") is really a toy implementation that doesn't scale to enterprise levels with out some customization. (The class "org.owasp.esapi.filters.ESAPIFilter" also uses "DefaultAccessController", but it is unlikely that anyone is using that either, unless they are using a customized AccessController implementation.) We plan to deprecate this ESAPI "DefaultAccessControler" shortly in a future release.
+
+Notes if you are not updating from the immediate previous release. release 2.6.1.0:
+    * You need to read through the series of release notes FIRST, going in order.
+    * For example, if you were updating from an older ESAPI release (say, 2.3.0.0), you should go back and FIRST read all the subsequent release notes in turn. For instance, if you are currently on release 2.3.0.0 and upgrading to (say) release 2.x.y.z, you should MINIMALLY read the sections "Changes Requiring Special Attention" in each of the subsequent release notes. So, going from release 2.3.0.0 to 2.x.y.z, you should in turn, read:
+
+    esapi4java-core-2.4.0.0-release-notes.txt
+    esapi4java-core-2.5.0.0-release-notes.txt
+    esapi4java-core-2.5.1.0-release-notes.txt
+    esapi4java-core-2.5.2.0-release-notes.txt
+    ...etc., up through the current set of release notes...
+    esapi4java-core-2.x.y.z-release-notes.txt
+
+in that order. YOU HAVE BEEN WARNED!!! (These release notes are too large to put all this in a given document; very few read them thoroughly as it is.)
+
+If your SCA tool is reporting any CVE from a direct or transitive dependency in ESAPI, before reporting it as an GitHub issue, please make sure that you review the vulnerability analysis written up in https://github.com/ESAPI/esapi-java-legacy/blob/develop/Vulnerability-Summary.md. Please email us or contact us in our GitHub Discussions page if you have questions about this. See also the SECURITY.md file to report any security issues with ESAPI.
+
+You are encouraged to review the vulnerability analysis written up in https://github.com/ESAPI/esapi-java-legacy/blob/develop/Vulnerability-Summary.md and email us or contact us in our GitHub Discussions page if you have questions.
+
+
+=================================================================================================================
+
+Basic ESAPI facts
+-----------------
+
+ESAPI 2.6.1.0 release:
+     207 Java source files
+    4312 JUnit tests in 133 Java source files
+
+ESAPI 2.6.2.0 release:
+     207 Java source files
+    4312 JUnit tests in 133 Java source files
+
+1 GitHub Issue closed in this release, including those we've decided not to fix (marked 'wontfix' and 'falsepositive').
+(Reference: https://github.com/ESAPI/esapi-java-legacy/issues?q=is%3Aissue+state%3Aclosed+updated%3A%3E%3D2025-05-19)
+
+Issue #         GitHub Issue Title
+----------------------------------------------------------------------------------------------
+883             Update Apache Commons BeanUtils from 1.9.4 to 1.11.0 to address CVE-2025-48734
+
+-----------------------------------------------------------------------------
+
+        Changes Requiring Special Attention
+
+-----------------------------------------------------------------------------
+Important JDK Support Announcement
+* ESAPI 2.3.0.0 was the last Java release to support Java 7. ESAPI 2.4.0 requires using Java 8 or later. See the ESAPI 2.4.0.0 release notes (https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.4.0.0-release-notes.txt) for details as to the reason.
+    - This means if your project requires Java 7, you must use ESAPI 2.3.0.0 or earlier.
+
+Important ESAPI Logging Changes
+
+* Since ESAPI 2.5.0.0, support for logging directly via Log4J 1 has been removed. (This was two years after it haveing first been deprecated.) Thus, you only choice of ESAPI logging are
+    - java.util.logging (JUL), which as been the default since ESAPI 2.2.1.0.
+        * Set ESAPI.Logger=org.owasp.esapi.logging.java.JavaLogFactory in your ESAPI.properties file.
+    - SLF4J (which your choice of supported SLF4J logging implemmentation)
+        * Set ESAPI.Logger=org.owasp.esapi.logging.slf4j.Slf4JLogFactory in your ESAPI.properties file.
+* Logger configuration notes - If you are migrating from prior to ESAPI 2.2.1.1, you will need to update your ESAPI.properties file as logging-related configuration as per the ESAPI 2.2.1.1 release notes, which may be found at:
+    https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.2.1.1-release-notes.txt#L39-L78
+
+If you use ESAPI 2.5.0.0 or later, you will get an ClassNotFoundException as the root cause if you still have your ESAPI.Logger property set to use Log4J because the org.owasp.esapi.logger.log4j.Log4JFactory class has been completely removed from the ESAPI jar.  If you are dead set on continuing to use Log4J 1, you ought to be able to do so via SLF4J. The set up for Log4J 1 (which has not be tested), should be similar to configure ESAPI to use SLF4J with Log4J 2 as described here:
+    https://github.com/ESAPI/esapi-java-legacy/wiki/Using-ESAPI-with-SLF4J#slf4j-using-log4j-2x
+
+-----------------------------------------------------------------------------
+
+        Remaining Known Issues / Problems
+
+-----------------------------------------------------------------------------
+None known, other than the remaining open issues on GitHub.
+
+-----------------------------------------------------------------------------
+
+        Other changes in this release, some of which not tracked via GitHub issues
+
+-----------------------------------------------------------------------------
+
+* Changes since last release 2.6.1.0 and 2.6.2.0, i.e., changes between 2025-05-19 and 2025-06-01).
+
+    Note: I am no longer going to provide the 'Developer Activity Report' that I used to this manually create in tabluar form. This is in part because I use to use 'mvn site' to assist with its creation, but neither the 'Developer Activiity' nor 'File Activity' sections of the 'mvn site' output is currently working.
+
+          That said, I don't care as this was always a major PITA and I think it had dubious value to start with.
+
+          Therefore, I am replacing it to a stock GitHub tag comparison of the current and previous release, which I can automate.
+
+    Please see,
+
+        https://github.com/ESAPI/esapi-java-legacy/compare/esapi-...esapi-2.6.2.0
+
+    for details. It contains all the information that the previous 'Developer Activity Reports' did and then some.
+
+-----------------------------------------------------------------------------
+
+CHANGELOG:      Create your own. May I suggest:
+
+        git log --stat --since=2025-05-19 --reverse --pretty=medium
+
+    which will show all the commits since just after the previous (2.6.1.0) release.
+
+    Alternately, you can download the most recent ESAPI source and run
+
+        mvn site
+
+    which will create a CHANGELOG file named 'target/site/changelog.html'
+
+
+-----------------------------------------------------------------------------
+
+Direct and Transitive Runtime and Test Dependencies:
+
+        $ mvn -B dependency:tree
+        ...
+        [INFO] --- maven-dependency-plugin:3.8.1:tree (default-cli) @ esapi ---
+        [INFO] org.owasp.esapi:esapi:jar:2.6.1.0
+        [INFO] +- javax.servlet:javax.servlet-api:jar:3.1.0:provided
+        [INFO] +- javax.servlet.jsp:javax.servlet.jsp-api:jar:2.3.3:provided
+        [INFO] +- xom:xom:jar:1.3.9:compile
+        [INFO] +- commons-beanutils:commons-beanutils:jar:1.11.0:compile
+        [INFO] |  +- commons-logging:commons-logging:jar:1.2:compile
+        [INFO] |  \- commons-collections:commons-collections:jar:3.2.2:compile
+        [INFO] +- commons-configuration:commons-configuration:jar:1.10:compile
+        [INFO] +- commons-lang:commons-lang:jar:2.6:compile
+        [INFO] +- commons-fileupload:commons-fileupload:jar:1.5:compile
+        [INFO] +- org.apache.commons:commons-collections4:jar:4.5.0-M2:compile
+        [INFO] +- org.apache-extras.beanshell:bsh:jar:2.0b6:compile
+        [INFO] +- org.owasp.antisamy:antisamy:jar:1.7.8:compile
+        [INFO] |  +- commons-io:commons-io:jar:2.19.0:compile
+        [INFO] |  +- org.apache.httpcomponents.client5:httpclient5:jar:5.4.4:compile
+        [INFO] |  |  \- org.apache.httpcomponents.core5:httpcore5-h2:jar:5.3.4:compile
+        [INFO] |  +- org.apache.httpcomponents.core5:httpcore5:jar:5.3.4:compile
+        [INFO] |  +- org.apache.xmlgraphics:batik-css:jar:1.19:compile
+        [INFO] |  |  +- org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile
+        [INFO] |  |  +- org.apache.xmlgraphics:batik-util:jar:1.19:compile
+        [INFO] |  |  |  +- org.apache.xmlgraphics:batik-constants:jar:1.19:compile
+        [INFO] |  |  |  \- org.apache.xmlgraphics:batik-i18n:jar:1.19:compile
+        [INFO] |  |  \- org.apache.xmlgraphics:xmlgraphics-commons:jar:2.11:compile
+        [INFO] |  +- org.htmlunit:neko-htmlunit:jar:4.11.0:compile
+        [INFO] |  +- xerces:xercesImpl:jar:2.12.2:compile
+        [INFO] |  \- xml-apis:xml-apis-ext:jar:1.3.04:compile
+        [INFO] +- org.slf4j:slf4j-api:jar:2.0.16:compile
+        [INFO] +- xml-apis:xml-apis:jar:1.4.01:compile
+        [INFO] +- com.github.spotbugs:spotbugs-annotations:jar:4.9.3:compile (optional)
+        [INFO] |  \- com.google.code.findbugs:jsr305:jar:3.0.2:compile (optional)
+        [INFO] +- commons-codec:commons-codec:jar:1.17.1:test
+        [INFO] +- junit:junit:jar:4.13.2:test
+        [INFO] +- org.bouncycastle:bcprov-jdk18on:jar:1.78.1:test
+        [INFO] +- org.hamcrest:hamcrest-core:jar:2.2:test
+        [INFO] |  \- org.hamcrest:hamcrest:jar:2.2:test
+        [INFO] +- org.powermock:powermock-api-mockito2:jar:2.0.9:test
+        [INFO] |  \- org.powermock:powermock-api-support:jar:2.0.9:test
+        [INFO] +- org.mockito:mockito-core:jar:3.12.4:test
+        [INFO] |  +- net.bytebuddy:byte-buddy:jar:1.11.13:test
+        [INFO] |  +- net.bytebuddy:byte-buddy-agent:jar:1.11.13:test
+        [INFO] |  \- org.objenesis:objenesis:jar:3.2:test
+        [INFO] +- org.powermock:powermock-core:jar:2.0.9:test
+        [INFO] |  \- org.javassist:javassist:jar:3.27.0-GA:test
+        [INFO] +- org.powermock:powermock-module-junit4:jar:2.0.9:test
+        [INFO] |  \- org.powermock:powermock-module-junit4-common:jar:2.0.9:test
+        [INFO] +- org.powermock:powermock-reflect:jar:2.0.9:test
+        [INFO] \- org.openjdk.jmh:jmh-core:jar:1.37:test
+        [INFO]    +- net.sf.jopt-simple:jopt-simple:jar:5.0.4:test
+        [INFO]    \- org.apache.commons:commons-math3:jar:3.6.1:test
+        [INFO] ------------------------------------------------------------------------
+-----------------------------------------------------------------------------
+
+Acknowledgments:
+    Thanks to GitHub Advanced Security's Dependabot SCA tool for flagging and fixing this one. And thanks to Matt Seil, Jeremiah Stacey, and all the ESAPI users who make this worthwhile. This is for you.
+
+A special thanks to the ESAPI community from the ESAPI project co-leaders:
+    Kevin W. Wall (kwwall) <== The irresponsible party for these release notes!
+    Matt Seil (xeno6696)
diff --git a/pom.xml b/pom.xml
index f33ebd034..6299b8c20 100644
--- a/pom.xml
+++ b/pom.xml
@@ -141,7 +141,7 @@
             <!-- TODO: Be sure to update. Should be date of previous official release -->
             <!-- Exact date in the form 'yyyy-dd-yy 00:00:00' should be used. You can find the previous release date -->
             <!-- in the previous release notes file under the 'documentation/' directory. -->
-        <date.prev_release>2024-11-25 00:00:00</date.prev_release>
+        <date.prev_release>2025-05-19 00:00:00</date.prev_release>
     </properties>
 
     <dependencies>
@@ -478,7 +478,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-clean-plugin</artifactId>
-                <version>3.4.1</version>
+                <version>3.5.0</version>
             </plugin>
 
             <plugin>
diff --git a/scripts/vars.2.6.2.0 b/scripts/vars.2.6.2.0
new file mode 100644
index 000000000..0252e8603
--- /dev/null
+++ b/scripts/vars.2.6.2.0
@@ -0,0 +1,14 @@
+# Do NOT edit this file directly. It will be created by the new createVarsFile.sh script,
+# which should be run prior to the newReleaseNotes.sh script.
+
+# ESAPI (new / current) version
+VERSION=2.6.2.0
+
+# Previous ESAPI version
+PREV_VERSION=2.6.1.0
+
+# Release date of current version in yyyy-mm-dd format
+YYYY_MM_DD_RELEASE_DATE=2025-06-01
+
+# Previous ESAPI release date in same format
+PREV_RELEASE_DATE=2025-05-19

From b68e75394390812c6c5f8382a40fb8b15955b594 Mon Sep 17 00:00:00 2001
From: kwwall <kevin.w.wall@gmail.com>
Date: Mon, 2 Jun 2025 21:15:18 -0400
Subject: [PATCH 5/7] Correct release date and other minor changes.

---
 documentation/esapi4java-core-2.6.2.0-release-notes.txt | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/documentation/esapi4java-core-2.6.2.0-release-notes.txt b/documentation/esapi4java-core-2.6.2.0-release-notes.txt
index 63195628d..a909feea2 100644
--- a/documentation/esapi4java-core-2.6.2.0-release-notes.txt
+++ b/documentation/esapi4java-core-2.6.2.0-release-notes.txt
@@ -1,5 +1,5 @@
 Release notes for ESAPI 2.6.2.0
-    Release date: 2025-06-01
+    Release date: 2025-06-02
     Project leaders:
         -Kevin W. Wall <kevin.w.wall@gmail.com>
         -Matt Seil <matt.seil@owasp.org>
@@ -76,7 +76,7 @@ If you use ESAPI 2.5.0.0 or later, you will get an ClassNotFoundException as the
         Remaining Known Issues / Problems
 
 -----------------------------------------------------------------------------
-None known, other than the remaining open issues on GitHub.
+None known, other than the remaining open issues on GitHub and that 'mvn site' fails to properly build some pieces as the ESAPI tag library Javadoc. I suspect this is related to problems with one or more of the Maven plugins.
 
 -----------------------------------------------------------------------------
 
@@ -84,7 +84,7 @@ None known, other than the remaining open issues on GitHub.
 
 -----------------------------------------------------------------------------
 
-* Changes since last release 2.6.1.0 and 2.6.2.0, i.e., changes between 2025-05-19 and 2025-06-01).
+* Changes since last release 2.6.1.0 and 2.6.2.0, i.e., changes between 2025-05-19 and 2025-06-02).
 
     Note: I am no longer going to provide the 'Developer Activity Report' that I used to this manually create in tabluar form. This is in part because I use to use 'mvn site' to assist with its creation, but neither the 'Developer Activiity' nor 'File Activity' sections of the 'mvn site' output is currently working.
 

From 38ce3a07c9a9cdb1c4b791be37c161c1ea675ba6 Mon Sep 17 00:00:00 2001
From: kwwall <kevin.w.wall@gmail.com>
Date: Mon, 2 Jun 2025 21:15:51 -0400
Subject: [PATCH 6/7] Correct release date.

---
 scripts/vars.2.6.2.0 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/vars.2.6.2.0 b/scripts/vars.2.6.2.0
index 0252e8603..244aeaf3b 100644
--- a/scripts/vars.2.6.2.0
+++ b/scripts/vars.2.6.2.0
@@ -8,7 +8,7 @@ VERSION=2.6.2.0
 PREV_VERSION=2.6.1.0
 
 # Release date of current version in yyyy-mm-dd format
-YYYY_MM_DD_RELEASE_DATE=2025-06-01
+YYYY_MM_DD_RELEASE_DATE=2025-06-02
 
 # Previous ESAPI release date in same format
 PREV_RELEASE_DATE=2025-05-19

From ba358e4955300b7e464fcd9d0c8dea31be1f8ad3 Mon Sep 17 00:00:00 2001
From: kwwall <kevin.w.wall@gmail.com>
Date: Mon, 2 Jun 2025 21:17:04 -0400
Subject: [PATCH 7/7] Corrected version to 2.6.2.0; was 2.7.0.0-SNAPSHOT.

---
 pom.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pom.xml b/pom.xml
index 6299b8c20..43072de09 100644
--- a/pom.xml
+++ b/pom.xml
@@ -3,7 +3,7 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>org.owasp.esapi</groupId>
     <artifactId>esapi</artifactId>
-    <version>2.7.0.0-SNAPSHOT</version>
+    <version>2.6.2.0</version>
     <packaging>jar</packaging>
 
     <distributionManagement>
@@ -185,7 +185,7 @@
         <dependency>
             <groupId>commons-beanutils</groupId>
             <artifactId>commons-beanutils</artifactId>
-            <!-- We need to use 1.11.0 (or later) here to address CVE-2014-0114 and CVE-2019-10086. -->
+            <!-- We need to use 1.11.0 (or later) here to address various CVEs. -->
             <version>1.11.0</version>
             <!-- NOTE: commons-beanutils uses commons-collections 3.2.2. We use
                  commons-collections 4.2. Package names are different so this shouldn't