Issues

restore missing security options subset for single mode

allow auto session rotate on unknown session cookie (disabled)

harden javasettings maven support

mavenLoad/createobject/etc doesn't respect lucee.enable.bundle.download=false

add lucee.enable.maven.download=false to disable maven downloads

Password.txt is NOT used.

enable lucee.security.limitEvaluation by default for Lucee 7

add a method to return a pom.xml for a list of bundles using the maven matcher for OSV scanner

update software.amazon.ion.java from 1.0.2 due to CVE-2024-21634

use stricter application options for admin (search results, implicit scopes, limit evaluation)

java udfs should be disabled when direct_java_access is disabled

add securityManager settings to getApplicationSettings()

reduce overhead of checkFileLocation

update commons-compress to 1.26.1, commons-io to 2.16.1

update to jsch - 0.2.17 - CVE-2023-48795 / terrapin ssh attack

filter out S3 secrets

update commons-compress to 1.24.0 due to tar related CVE-2023-42503

Secure XML by default

org.lucee.ehcache-2.10.9.2.jar has CVEs from jetty bundles / docker images

unbundle hibernate from standard distribution 5.4.1

update guava in ESAPI extension to 32.01 due to CVE

update docker images for 6.0 release (debian, java, nginx)

update commons-collections 3.2.1 to 4.4.0 in hibernate 5.4 extension

update hibernate extension dom4j lib due to CVEs

remove xmpcore from lucee core

update mysql to 8.0.33

update postgres jdbc to 42.6.0

don't deploy admin when not enabled

update zip extension CVE-2023-22899

add google OSV scanner workflow

update exasol extension to 7.1.16 due to CVE

Update apache tika to 1.28.4

update commons-codec to 1.15.0 for s3 ext v0.94

update httpclient to 4.5.13 due to CVE

update metadata-extractor in image extension to 2.18.0 due to CVE

Many vulnerable libs in Lucee preventing use in Government shops

update ORM ehcache lib to 2.10.9.2 due to CVE

move WEB-INF out of webroot by default for new installs

update zip4j to 2.10.0

update Jackson Databind in extensions

add function sanitizeHTML to esapi extension

admin crashes when file access set to local, trying to access userdata

update commons-io to 2.11

update commons-compress to 1.23

update Apache Commons Codec to 1.15

CFGlobal variables are created in an unsecure cookie

XSS on error pages

change HtmlEditFormat and HtmlCodeFormat to default to ESAPI encoders (Lucee 6)

Disable XML entities by default against XXE in Lucee 6.0 & 5.4