You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@causeway.apache.org by da...@apache.org on 2026/04/12 08:19:57 UTC
(causeway) branch main updated: copies over details of 3.5.0 and 3.6.0 releases
This is an automated email from the ASF dual-hosted git repository.
danhaywood pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/causeway.git
The following commit(s) were added to refs/heads/main by this push:
new c3ceb1d3b26 copies over details of 3.5.0 and 3.6.0 releases
c3ceb1d3b26 is described below
commit c3ceb1d3b26a245040406fe8475a83ff136f642f
Author: Dan Haywood <da...@haywood-associates.co.uk>
AuthorDate: Sun Apr 12 09:18:58 2026 +0100
copies over details of 3.5.0 and 3.6.0 releases
---
STATUS | 4 +++
antora/components/relnotes/modules/ROOT/nav.adoc | 4 +++
.../modules/ROOT/pages/2025/3.5.0/mignotes.adoc | 25 +++++++++++++
.../modules/ROOT/pages/2025/3.5.0/relnotes.adoc | 38 ++++++++++++++++++++
.../modules/ROOT/pages/2026/3.6.0/mignotes.adoc | 7 ++++
.../modules/ROOT/pages/2026/3.6.0/relnotes.adoc | 42 ++++++++++++++++++++++
.../relnotes/modules/ROOT/pages/about.adoc | 21 +++++++++++
antora/supplemental-ui/doap_causeway.rdf | 17 +++++++++
8 files changed, 158 insertions(+)
diff --git a/STATUS b/STATUS
index 46df6e18193..04817e12949 100644
--- a/STATUS
+++ b/STATUS
@@ -27,6 +27,10 @@ TLP releases:
* causeway-4.0.0-M1 : 13 Oct 2025
+ * causeway-3.6.0 : 9 Apr 2026
+
+ * causeway-3.5.0 : 17 Nov 2025
+
* causeway-3.4.0 : 8 Jul 2025
* causeway-3.3.0 : 8 Apr 2025
diff --git a/antora/components/relnotes/modules/ROOT/nav.adoc b/antora/components/relnotes/modules/ROOT/nav.adoc
index a3d57f39449..0d92883be8e 100644
--- a/antora/components/relnotes/modules/ROOT/nav.adoc
+++ b/antora/components/relnotes/modules/ROOT/nav.adoc
@@ -2,8 +2,12 @@
:Notice: Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at. http://www.apache.org/licenses/LICENSE-2.0 . Unless required by applicable law or ag [...]
+* 2026
+** xref:relnotes:ROOT:2026/3.6.0/relnotes.adoc[3.6.0]
+
* 2025
** xref:relnotes:ROOT:2025/4.0.0-M1/relnotes.adoc[4.0.0-M1]
+** xref:relnotes:ROOT:2025/3.5.0/relnotes.adoc[3.5.0]
** xref:relnotes:ROOT:2025/3.4.0/relnotes.adoc[3.4.0]
** xref:relnotes:ROOT:2025/3.3.0/relnotes.adoc[3.3.0]
** xref:relnotes:ROOT:2025/3.2.0/relnotes.adoc[3.2.0]
diff --git a/antora/components/relnotes/modules/ROOT/pages/2025/3.5.0/mignotes.adoc b/antora/components/relnotes/modules/ROOT/pages/2025/3.5.0/mignotes.adoc
new file mode 100644
index 00000000000..4d053896c05
--- /dev/null
+++ b/antora/components/relnotes/modules/ROOT/pages/2025/3.5.0/mignotes.adoc
@@ -0,0 +1,25 @@
+= Migrating from 3.4.0 to 3.5.0
+
+:Notice: Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at. http://www.apache.org/licenses/LICENSE-2.0 . Unless required by applicable law or ag [...]
+:page-partial:
+
+== Encrypted Bookmarks for view models
+
+This release automatically encrypts the bookmarks for view models so that they are not susceptible to forgery or serialization attacks.
+
+The encyrption is performed using an instance of `HmacAuthority`.
+By default, the framework creates a random instance each time it is started, meaning that any bookmarks (for view models, not entities) become invalid if the application is restarted, using the following code:
+
+[source,java]
+----
+@Configuration
+class EnableHmacAuthority {
+ @Bean
+ public HmacAuthority hmacAuthority() {
+ return HmacAuthority.HmacSHA256.randomInstance();
+ }
+}
+----
+
+To override this behaviour (so that bookmarks are not invalidated), provide your own instance of this bean.
+It's up to you how you choose to keep the seed value secret.
diff --git a/antora/components/relnotes/modules/ROOT/pages/2025/3.5.0/relnotes.adoc b/antora/components/relnotes/modules/ROOT/pages/2025/3.5.0/relnotes.adoc
new file mode 100644
index 00000000000..32f4206153a
--- /dev/null
+++ b/antora/components/relnotes/modules/ROOT/pages/2025/3.5.0/relnotes.adoc
@@ -0,0 +1,38 @@
+[[r3.5.0]]
+= 3.5.0
+
+:Notice: Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at. http://www.apache.org/licenses/LICENSE-2.0 . Unless required by applicable law or ag [...]
+:page-partial:
+
+
+This is primarily a security release to address CVE-2025-64408, which was a Java deserialization vulnerability to authenticated attackers.
+
+The vulnerability applied to view models, not entities.
+The fix involves encrypting the view model memento using HMAC 256 encryption key.
+By default, a new key is created each time the application is restarted, which means that any bookmark of a view model will become invalid in subsequent runs.
+
+If you require stable (but still secure) bookmarks across runs, then this can be done by providing a custom implementation of the `HmacAuthority` bean (to override the default provided by the framework).
+
+See the xref:2025/3.5.0/mignotes.adoc[Migration notes] for further details.
+
+
+== New Feature
+
+* link:https://issues.apache.org/jira/browse/CAUSEWAY-3942[CAUSEWAY-3942] - Support EclipseLink static weaving automatically.
+
+
+== Improvement
+
+* link:https://issues.apache.org/jira/browse/CAUSEWAY-3939[CAUSEWAY-3939] - Viewmodel Bookmark Overhaul (CVE-2025-64408).
+
+
+== Bug
+
+* link:https://issues.apache.org/jira/browse/CAUSEWAY-3938[CAUSEWAY-3938] - [Wicket Viewer] Editing uninitialized mandatory property causes exception
+* link:https://issues.apache.org/jira/browse/CAUSEWAY-3899[CAUSEWAY-3899] - NPE guard for DomainChangeRecord
+
+
+== Task
+
+* link:https://issues.apache.org/jira/browse/CAUSEWAY-3941[CAUSEWAY-3941] - Release activities, r3.5.0
+
diff --git a/antora/components/relnotes/modules/ROOT/pages/2026/3.6.0/mignotes.adoc b/antora/components/relnotes/modules/ROOT/pages/2026/3.6.0/mignotes.adoc
new file mode 100644
index 00000000000..a7fbcf15169
--- /dev/null
+++ b/antora/components/relnotes/modules/ROOT/pages/2026/3.6.0/mignotes.adoc
@@ -0,0 +1,7 @@
+= Migrating from 3.5.0 to 3.6.0
+
+:Notice: Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at. http://www.apache.org/licenses/LICENSE-2.0 . Unless required by applicable law or ag [...]
+:page-partial:
+
+No specific migration notes have been recorded to date.
+
diff --git a/antora/components/relnotes/modules/ROOT/pages/2026/3.6.0/relnotes.adoc b/antora/components/relnotes/modules/ROOT/pages/2026/3.6.0/relnotes.adoc
new file mode 100644
index 00000000000..dbd11966ce5
--- /dev/null
+++ b/antora/components/relnotes/modules/ROOT/pages/2026/3.6.0/relnotes.adoc
@@ -0,0 +1,42 @@
+[[r3.6.0]]
+= 3.6.0
+
+:Notice: Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at. http://www.apache.org/licenses/LICENSE-2.0 . Unless required by applicable law or ag [...]
+:page-partial:
+
+
+This is primarily a bugfix release, with one new feature, one small improvement and 7 bug fixes.
+
+This release also includes the usual dependency upgrades, and is based on:
+
+* Spring Boot 3.5.13
+* JPA EclipseLink 4.0.9
+* JDO DataNucleus 6.0.5
+* Apache Wicket 10.8.0
+* RestEasy 7.0.1.Final
+
+
+== New Feature
+
+* link:https://issues.apache.org/jira/browse/CAUSEWAY-3982[CAUSEWAY-3982] - extend auditing to only log on updates, not create or delete.
+
+
+== Improvement
+
+* link:https://issues.apache.org/jira/browse/CAUSEWAY-3948[CAUSEWAY-3948] - Pickup Webjar Version Strings automatically from Classpath
+
+
+== Bug
+
+* link:https://issues.apache.org/jira/browse/CAUSEWAY-3972[CAUSEWAY-3972] - [Commons] Internal OneShot Util may deadlock
+* link:https://issues.apache.org/jira/browse/CAUSEWAY-3966[CAUSEWAY-3966] - ApplicationFeatureViewModel may fail to properly instantiate
+* link:https://issues.apache.org/jira/browse/CAUSEWAY-3961[CAUSEWAY-3961] - [Wicket Viewer] Actions in Tables have wrong Result Routing
+* link:https://issues.apache.org/jira/browse/CAUSEWAY-3960[CAUSEWAY-3960] - [Wicket Viewer] Actions in Tables have wrong Usability/Visibility Logic
+* link:https://issues.apache.org/jira/browse/CAUSEWAY-3958[CAUSEWAY-3958] - [Wicket Viewer] Downloadlink may fail with Network Error
+* link:https://issues.apache.org/jira/browse/CAUSEWAY-3950[CAUSEWAY-3950] - [Wicket Viewer] Upload Button may trigger Download of same File
+* link:https://issues.apache.org/jira/browse/CAUSEWAY-3946[CAUSEWAY-3946] - NPE in EntityChangeTrackerDefault when Logging with DEBUG level
+
+
+== Task
+
+* link:https://issues.apache.org/jira/browse/CAUSEWAY-3986[CAUSEWAY-3986] - 3.6.0 release tasks
diff --git a/antora/components/relnotes/modules/ROOT/pages/about.adoc b/antora/components/relnotes/modules/ROOT/pages/about.adoc
index 67c8717ee3f..72b28b65448 100644
--- a/antora/components/relnotes/modules/ROOT/pages/about.adoc
+++ b/antora/components/relnotes/modules/ROOT/pages/about.adoc
@@ -16,6 +16,27 @@ This table summarises all releases of Apache Causeway to date.
| Bugs
| Detail
+| 9th Apr 2026
+| 3.6.0
+a| Apache Causeway 3.6.0
+| 1
+| 1
+| 7
+|
+* xref:relnotes:ROOT:2026/3.6.0/relnotes.adoc[Release Notes]
+* xref:relnotes:ROOT:2026/3.6.0/mignotes.adoc[Migration Notes]
+
+| 17th Nov 2025
+| 3.5.0
+a| Apache Causeway 3.5.0
+| 1
+| 1
+| 2
+|
+* xref:relnotes:ROOT:2025/3.5.0/relnotes.adoc[Release Notes]
+* xref:relnotes:ROOT:2025/3.5.0/mignotes.adoc[Migration Notes]
+
+
| 13th Oct 2025
| 4.0.0-M1
a| Apache Causeway 4.0.0-M1
diff --git a/antora/supplemental-ui/doap_causeway.rdf b/antora/supplemental-ui/doap_causeway.rdf
index 70f72c922aa..996699c6aa3 100644
--- a/antora/supplemental-ui/doap_causeway.rdf
+++ b/antora/supplemental-ui/doap_causeway.rdf
@@ -36,6 +36,23 @@
<category rdf:resource="http://projects.apache.org/category/web-framework" />
+ <release>
+ <Version>
+ <name>causeway</name>
+ <created>2026-04-09</created>
+ <revision>3.6.0</revision>
+ </Version>
+ </release>
+
+ <release>
+ <Version>
+ <name>causeway</name>
+ <created>2025-11-17</created>
+ <revision>3.5.0</revision>
+ </Version>
+ </release>
+
+
<release>
<Version>
<name>causeway</name>