6.1.1

What's Changed

• CVE-2026-27903 CVE-2026-27904 CVE-2026-26996 UI: update grunt to 1.6.2 to address vulnerabilities by @maximthomas in #159
• CVE-2025-13465, CVE-2021-23337 lodash vulnerabilities by @maximthomas in #160
• Add OpenApiMockResponseHandler — spec-driven mock API with realistic test data by @vharseko with @Copilot in #155
• Update org.openidentityplatform.openam version to 16.1.1 by @vharseko in #161
• Fix javadoc links and update JwtBuilderFilter title by @maximthomas in #153
• Docs: set neutral version for the docs by @maximthomas in #154
• chore: bump GitHub Actions to latest versions by @vharseko with @Copilot in #156

Full Changelog: 6.1.0...6.1.1

6.1.0

What's Changed

• JwtBuilderFilter Creates a JSON Web Token (JWT) with runtime data and puts the JWT by @maximthomas in #145
• OpenAPI/Swagger Validates inbound HTTP requests and outbound HTTP responses against an OpenAPI specification (Swagger 2.x or OpenAPI 3.x) by @maximthomas in #150
• LLMPromptGuardFilter Intercepts outgoing LLM API requests and scans every prompt for prompt-injection attacks before the request reaches the downstream model. Implements mitigations for OWASP LLM Top 10 (2025) risks LLM01 (Prompt Injection) and LLM07 (System Prompt Leakage) by @maximthomas in #148
• LLMProxyFilter controls token usage per user by @maximthomas in #146
• MCPServerFeaturesFilter enforces allow/deny policies for MCP (Model Context Protocol): features exchanged as JSON-RPC payloads with an MCP server. It inspects both incoming requests and outgoing responses and removes or rejects features according to the configured rules by @maximthomas in #144
• CVE-2026-24308 Apache ZooKeeper has improper handling of configuration values by @dependabot[bot] in #147
• Update build.yml add JDK 26 support by @vharseko in #152
• Update OpenAM dependency version to 16.0.6 by @vharseko in #151

Full Changelog: 6.0.2...6.1.0

6.0.2

What's Changed

• CVE-2024-56128 CVE-2025-27818 CVE-2025-27819 Apache Kafka Deserialization of Untrusted Data vulnerability, Incorrectly Implements Authentication Algorithm by @dependabot[bot] in #139
• CVE-2025-13465 Lodash has Prototype Pollution Vulnerability in _.unset and _.omit functions by @maximthomas in #141
• Fix ESAPI initialisation error by @maximthomas in #140
• Update org.openidentityplatform.openam to 16.0.5 by @vharseko in #142
• Docs: update supported Java versions by @maximthomas in #138

Full Changelog: 6.0.1...6.0.2

6.0.1

What's Changed

• Update target JDK to 11 and move to JakartaEE 9 by @maximthomas in #124
• Add support LTS JDK 25 by @vharseko in #129
• Update base docker image Java version to 25 LTS by @maximthomas in #134
• CVE-2024-38999 requirejs v2.3.6 was discovered to contain a prototype pollution by @maximthomas in #128
• CVE-2025-58457 Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands by @dependabot[bot] in #133
• Make access token resolver optional (fix empty accessTokenResolver error) by @maximthomas in #132
• Fix jakarta dependencies build error by @maximthomas in #136
• FIX Dependency management dependency version information is missing for dependency: com.sun.mail:jakarta.mail by @vharseko in #137
• Build & deploy: add branch sustaining/5.4.x by @vharseko in #130
• Fix missing antora docs error by @maximthomas in #131
• Update org.openidentityplatform.openam to 16.0.3 by @vharseko in #135
• Update README.md: add backers and sponsors by @vharseko in #126
• ISSUE_TEMPLATE: add "Vote to raise the priority" by @vharseko in #127

Full Changelog: 5.4.0...6.0.1

5.4.0

What's Changed

• CVE-2019-11358 CVE-2020-11023 Update jQuery to 3.7.1 by @maximthomas in #119
• CVE-2022-1537 file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write by @maximthomas in #113
• CVE-2022-1537, CVE-2022-0436: Update grunt to 1.6.1 by @maximthomas in #123
• Add root group permission to the Docker $CATALINA_HOME and $OPENIG_BASE directories by @maximthomas in #120
• Upgrade Mockito to 4.11.0 by @aldaris in #117
• Bump org.openidentityplatform.openam 15.2.0 by @vharseko in #121
• Make Installation Guide consistent with Getting Started by @aldaris in #110
• Update grunt and send in openig-ui by @maximthomas in #111
• Deploy: migrating from Legacy OSSRH to Central Portal by @vharseko in #115
• Bump org.apache.zookeeper:zookeeper from 3.9.2 to 3.9.3 by @dependabot[bot] in #116

Full Changelog: 5.3.2...5.4.0

5.3.2

What's Changed

• CVE-2025-27497 Fix Denial of Service (Dos) using alias loop by @vharseko in #105
• Add support Java SE 24 by @vharseko in #108
• Add ScriptableAccessTokenResolver to OAuth2ResourceServerFilter configuration by @maximthomas in #102
• Docs: add accessTokenResolver to the OAuth2ResourceServerFilter reference by @maximthomas in #103
• Add RemoteIpValve to the server.xml in the Docker images by @maximthomas in #106
• Fix docker env variables + add VERSION autodetect by @vharseko in #107
• Bump org.openidentityplatform.openam 15.1.4 by @vharseko in #99
• Fix documentation issues and update links by @maximthomas in #98
• Documentation update by @maximthomas in #100
• Docs: disable timestamp in javadoc by @maximthomas in #101
• Docs: fix links and move duration description to partials by @maximthomas in #104

Full Changelog: 5.3.1...5.3.2

5.3.1

What's Changed

• Docs in asciidoc & deploy antora docs after build by @maximthomas in #87
• [#81] Fix documentation links by @maximthomas in #89
• Publish asciidoc pdf to wiki on deploy and release by @maximthomas in #90
• Add JDK 23 build support by @vharseko in #91
• ADD maven-compiler-plugin release for cross compile compatibility by @vharseko in #92
• Bump org.openidentityplatform.openam 15.1.1 by @vharseko in #88
• Fix doc push error by @maximthomas in #93
• Bump org.openidentityplatform.openam 15.1.2 by @vharseko in #94
• Update release.yml docker/login-action@v3 by @vharseko in #97

Full Changelog: 5.3.0...5.3.1

5.3.0

What's Changed

• ADD JDK 22 support by @vharseko in #83
• Publish javadoc to the documentation site by @maximthomas in #85
• Switch docker to last LTS JRE 21 by @vharseko in #84
• Bump org.openidentityplatform.openam 15.1.0 by @vharseko in #82

Full Changelog: 5.2.4...5.3.0

5.2.4

What's Changed

• add missing docs by @maximthomas in #74
• build and publish docs to wiki by @maximthomas in #75
• Update README.md by @vharseko in #76
• Publish docs to https://doc.openidentityplatform.org by @maximthomas in #79
• Bump requirejs from 2.3.2 to 2.3.7 in /openig-ui by @dependabot in #80
• Bump nexus-staging-maven-plugin 1.7.0 by @vharseko in #78
• Bump org.openidentityplatform.openam 15.0.4 by @vharseko in #77

Full Changelog: 5.2.3...5.2.4

5.2.3

What's Changed

• Build add MacOs m1 arm64 support on jdk 1.8 by @vharseko in #67
• bump npm to LTS by @maximthomas in #68
• Bump org.openidentityplatform.openam 15.0.0 by @vharseko in #69
• CVE-2024-23944 Bump org.apache.zookeeper by @vharseko in #70
• Bump org.openidentityplatform.openam to 15.0.2 by @vharseko in #71

Full Changelog: 5.2.2...5.2.3