This is an automated email from the ASF dual-hosted git repository.
sseifert pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/sling-site.git
The following commit(s) were added to refs/heads/master by this push:
new 352db7da2 Sling 14 Release Notes (#248)
352db7da2 is described below
commit 352db7da28b0d1e151ee9c6516103f0d1efe0a66
Author: Stefan Seifert <[email protected]>
AuthorDate: Mon Mar 9 14:41:10 2026 +0100
Sling 14 Release Notes (#248)
---
src/main/jbake/content/news.md | 1 +
src/main/jbake/content/news/sling-14-released.md | 420 +++++++++++++++++++++++
2 files changed, 421 insertions(+)
diff --git a/src/main/jbake/content/news.md b/src/main/jbake/content/news.md
index d11035a14..af12a323b 100644
--- a/src/main/jbake/content/news.md
+++ b/src/main/jbake/content/news.md
@@ -5,6 +5,7 @@ tags=news
tableOfContents=false
~~~~~~
+* Released [Apache Sling 14](/news/sling-14-released.html) (March 9th, 2026).
* Security Advisory: [Apache Sling advisory regarding
CVE-2025-66516](./security/CVE-2025-66516.html)
* Apache Sling now supports Jakarta Servlet API 6.1 (June 28th)
* Released [Apache Sling 13](/news/sling-13-released.html) (January 17th,
2025).
diff --git a/src/main/jbake/content/news/sling-14-released.md
b/src/main/jbake/content/news/sling-14-released.md
new file mode 100644
index 000000000..464ba25af
--- /dev/null
+++ b/src/main/jbake/content/news/sling-14-released.md
@@ -0,0 +1,420 @@
+title=Apache Sling 14 released
+type=page
+status=published
+tags=launchpad
+~~~~~~
+
+The Sling 14 release contains numerous improvements, such as official Java 25
Support and supporting the Jakarta Servlet API, and various performance
improvements and updates.
+
+Read on to see more details about the individual improvements. To find out
more about running Sling, see our [getting started
page](/documentation/getting-started.html).
+
+## Official support for Java 25
+
+The Sling Starter and included modules are validated to work on Java 17, 21
and 25.
+
+Note that the `org.apache.sling.commons.threads` will not clean up leftover
`ThreadLocal` instances unless the `--add-opens
java.base/java.lang=ALL-UNNAMED` is passed to the JVM. This fix is already
applied to the [official Sling Starter Docker
image](https://hub.docker.com/r/apache/sling) and we anticipate further fixes
in this area.
+
+
+## Support Jakarta Servlet API 6.1 and switch to Jetty 12
+
+Sling Starter 14 runs on Jetty 12 and fully supports Jakarta Servlet API 6.1.
However, OSGi bundles implemented against the old Servlet API 4 are still
supported as well. You don't have to update your application code. New projects
should start using the latest Servlet API right away.
+
+See this talk for more details: [adaptTo() 2025 - Seamless Transition: Apache
Sling's Adoption of Jakarta Servlet
API](https://adapt.to/2025/schedule/seamless-transition-apache-slings-adoption-of-jakarta-servlet-api)
+
+
+## Drop support for Java 11
+
+All Sling modules that have been migrated to Jakarta Servlet API 6.1 have Java
17 as minimum version, so Java 11 is no longer supported for the Sling Starter.
+
+
+## Switch to jakarta.json completed
+
+All modules have been migrated from `org.json` to `jakarta.json` and the Sling
Starter 14 only comes with [Apache Johnzon](https://johnzon.apache.org/) 2.x.
If you still have modules using `org.json`, you can continue to use them, but
you have to deploy a 1.x version of `org.apache.sling.commons.json` in addition
to the 2.x version.
+
+
+## Switch to SLF4J 2
+
+The Sling starter and a couple of core modules have switched to SLF4J 2.
Apache Sling Commons Log 6 is included in Sling Starter 14 and comes with an
updated logback implementation and full support for SLF4J 2. Bundles using
SLF4J 1 are still supported.
+
+
+## Separate Bundle for Sling Event API
+
+The Sling Event API, which was exported by the implementation bundle before,
is now deployed as separate bundle `org.apache.sling.event.api` - ensuring a
proper separation of API and implementation.
+
+
+## Sling Starter
+
+Sling Starter now registers by default an JMX MBean platform powered by
[Apache Aries JMX](https://aries.apache.org/documentation/modules/jmx.html).
+
+By including a new JAXP Configurator bundle in the Sling Starter,
CVE-2025-66516 is fixed. See [Apache Sling advisory regarding
CVE-2025-66516](https://sling.apache.org/security/CVE-2025-66516.html) for
details.
+
+
+## Sling API
+
+Two small additions to Sling API:
+
+* [SLING-12815](https://issues.apache.org/jira/browse/SLING-12815) Expose
methods to escape/unescape characters which are invalid in Sling Resource names
+* [SLING-12441](https://issues.apache.org/jira/browse/SLING-12441) Support
InputStream based request parameters in Builders
+
+
+## Version updates
+
+All bundles have been updated to the latest versions.
+
+New bundles added to Sling Starter:
+
+* `org.apache.aries.jmx.mbeanserver-platform`
+* `org.apache.jackrabbit`:`oak-auth-external`
+
+The following bundles are removed from the Sling Starter:
+
+* `org.apache.sling.commons.johnzon` 1.x
+
+A couple of bundles changed their artifact ID and are thus replaced with the
latest version using the latest artifact ID (e.g. Commons Math, Jetty).
+
+
+### OSGi Core R8 compliance
+
+Sling Starter ships with [Apache Felix
7](https://felix.apache.org/documentation/index.html) which implements [OSGi
Core R8](https://docs.osgi.org/specification/osgi.core/8.0.0/) fully. In
addition it comes with Felix SCR 2.2 which implements [Declarative Services
1.5](https://docs.osgi.org/specification/osgi.cmpn/8.0.0/service.component.html)
(part of OSGi Compendium R8).
+
+
+## Aggregated list of changes
+
+Generated by
[starter-comparator](https://github.com/apache/sling-starter-comparator): Lists
all bundle changes since the last Starter release, including links to issues
found in the commit messages of the affected Sling bundles.
+
+Added:
+
+* `org.apache.aries.jmx`:**`org.apache.aries.jmx.mbeanserver-platform`** 0.0.1
+* `org.apache.commons`:**`commons-math3`** 3.6.1
+* `org.apache.felix`:**`org.apache.felix.http.jetty12`** 1.1.8
+* `org.apache.jackrabbit`:**`oak-auth-external`** 1.90.0
+* `org.apache.sling`:**`org.apache.sling.commons.log`** 6.0.4
+* `org.apache.sling`:**`org.apache.sling.event.api`** 1.0.4
+* `org.apache.sling`:**`org.apache.sling.jaxp-configurator`** 1.0.0
+
+Removed:
+
+* `org.apache.commons`:**`commons-math`** 2.2
+* `org.apache.felix`:**`org.apache.felix.http.jetty`** 5.1.26
+* `org.apache.sling`:**`org.apache.sling.commons.log`** 5.5.0
+* `org.slf4j`:**`slf4j-api`** 1.7.36
+
+Changed:
+
+* `com.composum.nodes`:**`composum-nodes-commons`** 4.3.4 -> 4.3.5
+* `com.composum.nodes`:**`composum-nodes-console`** 4.3.4 -> 4.3.5
+* `com.composum.nodes`:**`composum-nodes-jslibs`** 4.3.4 -> 4.3.5
+* `com.composum.nodes`:**`composum-nodes-pckgmgr`** 4.3.4 -> 4.3.5
+* `com.composum.nodes`:**`composum-nodes-usermgr`** 4.3.4 -> 4.3.5
+* `com.fasterxml.jackson.core`:**`jackson-annotations`** 2.18.2 -> 2.21
+* `com.fasterxml.jackson.core`:**`jackson-core`** 2.18.2 -> 2.21.1
+* `com.fasterxml.jackson.core`:**`jackson-databind`** 2.18.2 -> 2.21.1
+* `com.fasterxml.jackson.dataformat`:**`jackson-dataformat-xml`** 2.18.2 ->
2.21.1
+* `com.fasterxml.woodstox`:**`woodstox-core`** 7.1.0 -> 7.1.1
+* `commons-codec`:**`commons-codec`** 1.17.2 -> 1.21.0
+* `commons-fileupload`:**`commons-fileupload`** 1.5 -> 1.6.0
+* `commons-io`:**`commons-io`** 2.18.0 -> 2.21.0
+* `org.apache.commons`:**`commons-collections4`** 4.4 -> 4.5.0
+* `org.apache.commons`:**`commons-lang3`** 3.17.0 -> 3.20.0
+* `org.apache.commons`:**`commons-text`** 1.13.0 -> 1.15.0
+* `org.apache.felix`:**`org.apache.felix.healthcheck.core`** 2.2.0 -> 2.3.0
+* `org.apache.felix`:**`org.apache.felix.http.servlet-api`** 3.0.0 -> 6.1.0
+* `org.apache.felix`:**`org.apache.felix.http.webconsoleplugin`** 1.2.0 ->
1.2.2
+* `org.apache.felix`:**`org.apache.felix.scr`** 2.2.12 -> 2.2.14
+* `org.apache.felix`:**`org.apache.felix.webconsole`** 5.0.8 -> 5.0.18
+* `org.apache.jackrabbit`:**`jackrabbit-data`** 2.22.0 -> 2.22.3
+* `org.apache.jackrabbit`:**`jackrabbit-jcr-commons`** 2.22.0 -> 2.22.3
+* `org.apache.jackrabbit`:**`jackrabbit-spi`** 2.22.0 -> 2.22.3
+* `org.apache.jackrabbit`:**`jackrabbit-spi-commons`** 2.22.0 -> 2.22.3
+* `org.apache.jackrabbit`:**`jackrabbit-webdav`** 2.22.0 -> 2.22.3
+* `org.apache.jackrabbit`:**`oak-api`** 1.72.0 -> 1.90.0
+* `org.apache.jackrabbit`:**`oak-authorization-principalbased`** 1.72.0 ->
1.90.0
+* `org.apache.jackrabbit`:**`oak-blob`** 1.72.0 -> 1.90.0
+* `org.apache.jackrabbit`:**`oak-blob-plugins`** 1.72.0 -> 1.90.0
+* `org.apache.jackrabbit`:**`oak-commons`** 1.72.0 -> 1.90.0
+* `org.apache.jackrabbit`:**`oak-core`** 1.72.0 -> 1.90.0
+* `org.apache.jackrabbit`:**`oak-core-spi`** 1.72.0 -> 1.90.0
+* `org.apache.jackrabbit`:**`oak-jackrabbit-api`** 1.72.0 -> 1.90.0
+* `org.apache.jackrabbit`:**`oak-jcr`** 1.72.0 -> 1.90.0
+* `org.apache.jackrabbit`:**`oak-lucene`** 1.72.0 -> 1.90.0
+* `org.apache.jackrabbit`:**`oak-query-spi`** 1.72.0 -> 1.90.0
+* `org.apache.jackrabbit`:**`oak-security-spi`** 1.72.0 -> 1.90.0
+* `org.apache.jackrabbit`:**`oak-segment-tar`** 1.72.0 -> 1.90.0
+* `org.apache.jackrabbit`:**`oak-shaded-guava`** 1.72.0 -> 1.90.0
+* `org.apache.jackrabbit`:**`oak-store-composite`** 1.72.0 -> 1.90.0
+* `org.apache.jackrabbit`:**`oak-store-document`** 1.72.0 -> 1.90.0
+* `org.apache.jackrabbit`:**`oak-store-spi`** 1.72.0 -> 1.90.0
+* `org.apache.jackrabbit.vault`:**`org.apache.jackrabbit.vault`** 3.8.2 ->
4.2.0
+* `org.apache.pdfbox`:**`fontbox`** 2.0.32 -> 2.0.35
+* `org.apache.pdfbox`:**`pdfbox`** 2.0.32 -> 2.0.35
+*
`org.apache.servicemix.bundles`:**`org.apache.servicemix.bundles.thymeleaf`**
3.0.15.RELEASE_1 -> 3.1.2.RELEASE_1
+* `org.apache.sling`:**`org.apache.sling.adapter`** 2.2.0 -> 2.3.0
+ * [SLING-11152 Use official OSGi Converter
Implementation](https://issues.apache.org/jira/browse/SLING-11152) (Improvement)
+ * [SLING-12077 Migrate sling.adapter to
jakarta.json](https://issues.apache.org/jira/browse/SLING-12077) (Sub-task)
+ * [SLING-12677 Upate to Parent
62](https://issues.apache.org/jira/browse/SLING-12677) (Task)
+* `org.apache.sling`:**`org.apache.sling.api`** 2.27.6 -> 3.0.2
+ * [SLING-12390 Mention IllegalStateException for order
operation](https://issues.apache.org/jira/browse/SLING-12390) (Bug)
+ * [SLING-12441 Support InputStream based request parameters in
Builders](https://issues.apache.org/jira/browse/SLING-12441) (Improvement)
+ * [SLING-12465 Remove usage of org.apache.sling.commons.testing in
tests](https://issues.apache.org/jira/browse/SLING-12465) (Improvement)
+ * [SLING-12466 Fix javadoc for
Authenticator](https://issues.apache.org/jira/browse/SLING-12466) (Improvement)
+ * [SLING-12604 Enhance Sling API to support Jakarta
Servlet](https://issues.apache.org/jira/browse/SLING-12604) (Sub-task)
+ * [SLING-12643 Support Jakarta ServletAPI in
Scripting](https://issues.apache.org/jira/browse/SLING-12643) (Sub-task)
+ * [SLING-12677 Upate to Parent
62](https://issues.apache.org/jira/browse/SLING-12677) (Task)
+ * [SLING-12752 Support Jakarta Servlet
6.1](https://issues.apache.org/jira/browse/SLING-12752) (Improvement)
+ * [SLING-12753 Add constants for
sling.servlet.paths.strict](https://issues.apache.org/jira/browse/SLING-12753)
(Improvement)
+ * [SLING-12754 NPE in error
handling](https://issues.apache.org/jira/browse/SLING-12754) (Task)
+ * [SLING-12757 AbstractResource.getName() can throw
exceptions](https://issues.apache.org/jira/browse/SLING-12757) (Task)
+ * [SLING-12761 Use default method for deprecated method in
ResourceDecorator](https://issues.apache.org/jira/browse/SLING-12761)
(Improvement)
+ * [SLING-12781 Expose resource type and resource super type always also
via getValueMap()](https://issues.apache.org/jira/browse/SLING-12781) (Bug)
+ * [SLING-12815 Expose methods to escape/unescape characters which are
invalid in Sling Resource
names](https://issues.apache.org/jira/browse/SLING-12815) (Improvement)
+ * [SLING-12816 Clarify exceptions thrown from methods of
o.a.s.a.r.ValueMap/ModifiableValueMap](https://issues.apache.org/jira/browse/SLING-12816)
(Improvement)
+ * [SLING-12857 Allow null value for servlet
wrappers](https://issues.apache.org/jira/browse/SLING-12857) (Task)
+* `org.apache.sling`:**`org.apache.sling.auth.core`** 1.7.0 -> 2.0.2
+ * [SLING-12403 Ability to review sling authenticators handling
authentication request](https://issues.apache.org/jira/browse/SLING-12403)
(Improvement)
+ * [SLING-12448 Ability to review authenticated URL
](https://issues.apache.org/jira/browse/SLING-12448) (Improvement)
+ * [SLING-12605 Enhance Auth Core to support Jakarta Servlet
API](https://issues.apache.org/jira/browse/SLING-12605) (Sub-task)
+ * [SLING-12727 Auth Core: Update to Parent
62](https://issues.apache.org/jira/browse/SLING-12727) (Task)
+ * [SLING-12752 Support Jakarta Servlet
6.1](https://issues.apache.org/jira/browse/SLING-12752) (Improvement)
+ * [SLING-12885 AuthenticationHandler.FAILURE_REASON_CODES is deprecated
with no non-deprecated
replacement](https://issues.apache.org/jira/browse/SLING-12885) (Improvement)
+* `org.apache.sling`:**`org.apache.sling.auth.form`** 1.0.24 -> 2.0.0
+ * [SLING-12573 Fix build for
jdk17+](https://issues.apache.org/jira/browse/SLING-12573) (Improvement)
+ * [SLING-12889 Update to Parent
62](https://issues.apache.org/jira/browse/SLING-12889) (Improvement)
+ * [SLING-12890 bump commons-lang3 to
3.18.0](https://issues.apache.org/jira/browse/SLING-12890) (Improvement)
+ * [SLING-12891 bump pax.exam to
4.14.0](https://issues.apache.org/jira/browse/SLING-12891) (Improvement)
+ * [SLING-12957 migrate to Auth Core 2.x, Sling API 3.x and Jakarta
Servlet](https://issues.apache.org/jira/browse/SLING-12957) (Sub-task)
+ * [SLING-12972 provide a standalone login page for the o.a.s.auth.form
bundle](https://issues.apache.org/jira/browse/SLING-12972) (Sub-task)
+* `org.apache.sling`:**`org.apache.sling.bundleresource.impl`** 2.3.4 -> 2.4.0
+ * [SLING-11649 Check for null BundleContext while registering bundle
resources](https://issues.apache.org/jira/browse/SLING-11649) (Bug)
+ * [SLING-12063 Migrate sling.bundleresource.impl to
jakarta.json](https://issues.apache.org/jira/browse/SLING-12063) (Sub-task)
+ * [SLING-12694 Update to Parent
62](https://issues.apache.org/jira/browse/SLING-12694) (Task)
+* `org.apache.sling`:**`org.apache.sling.caconfig.impl`** 1.6.0 -> 1.7.2
+ * [SLING-12064 Migrate sling.caconfig.impl to
jakarta.json](https://issues.apache.org/jira/browse/SLING-12064) (Sub-task)
+ * [SLING-12147 caconfig-impl: Replace Sling XSS with OWASP
Encoder](https://issues.apache.org/jira/browse/SLING-12147) (Improvement)
+ * [SLING-12361 caconfig: Update to Parent 60, Java 11 Minimum
Version](https://issues.apache.org/jira/browse/SLING-12361) (Improvement)
+ * [SLING-12694 Update to Parent
62](https://issues.apache.org/jira/browse/SLING-12694) (Task)
+ * [SLING-12708 caconfig impl: Fix bnd Import-Package
statement](https://issues.apache.org/jira/browse/SLING-12708) (Bug)
+* `org.apache.sling`:**`org.apache.sling.commons.log.webconsole`** 1.0.2 ->
2.0.0
+ * [SLING-12924 Migrate common log webconsole plugin to jakarta
servlet](https://issues.apache.org/jira/browse/SLING-12924) (Improvement)
+* `org.apache.sling`:**`org.apache.sling.discovery.base`** 2.0.14 -> 2.1.0
+ * [SLING-12065 Migrate sling.discovery.base to
jakarta.json](https://issues.apache.org/jira/browse/SLING-12065) (Sub-task)
+ * [SLING-12699 Discovery Base & Commons: Make Build compatible with Java
17, Java 21](https://issues.apache.org/jira/browse/SLING-12699) (Task)
+* `org.apache.sling`:**`org.apache.sling.discovery.commons`** 1.0.28 -> 1.1.0
+ * [SLING-12066 Migrate sling.discovery.commons to
jakarta.json](https://issues.apache.org/jira/browse/SLING-12066) (Sub-task)
+ * [SLING-12699 Discovery Base & Commons: Make Build compatible with Java
17, Java 21](https://issues.apache.org/jira/browse/SLING-12699) (Task)
+* `org.apache.sling`:**`org.apache.sling.discovery.oak`** 1.2.46 -> 1.2.48
+* `org.apache.sling`:**`org.apache.sling.engine`** 2.16.0 -> 3.0.2
+ * [SLING-12607 Implement Jakarta Servlet based Sling
API](https://issues.apache.org/jira/browse/SLING-12607) (Sub-task)
+ * [SLING-12640 Setting Sling filter service property sling.filter.scope to
an invalid value does not disable the
filter.](https://issues.apache.org/jira/browse/SLING-12640) (Bug)
+ * [SLING-12661 Potential origins of violations to the RequestDispatcher
include API may run into OOM error on excessive
recursions](https://issues.apache.org/jira/browse/SLING-12661) (Improvement)
+ * [SLING-12697 Potential origins of violations to the RequestDispatcher
include API provides creates false positives on a committed
response](https://issues.apache.org/jira/browse/SLING-12697) (Improvement)
+ * [SLING-12728 Engine: Update to Parent
62](https://issues.apache.org/jira/browse/SLING-12728) (Task)
+ * [SLING-12752 Support Jakarta Servlet
6.1](https://issues.apache.org/jira/browse/SLING-12752) (Improvement)
+ * [SLING-12801 Error handler does not reset the response during
include](https://issues.apache.org/jira/browse/SLING-12801) (Bug)
+ * [SLING-12844 Potential origins of violations to the RequestDispatcher
include API skips too many on committed
responses](https://issues.apache.org/jira/browse/SLING-12844) (Bug)
+ * [SLING-12845 ProtectHeadersOnInclude functionality ignores changes to
the response buffer size](https://issues.apache.org/jira/browse/SLING-12845)
(Bug)
+ * [SLING-13049 Change "Content Type Header" error log to debug in
SlingRequestProcessorImpl](https://issues.apache.org/jira/browse/SLING-13049)
(Improvement)
+ * [SLING-13071 HTL use objects that adapt from the javax
SlingHttpServletRequest cannot be instantiated in a Jakarta context
](https://issues.apache.org/jira/browse/SLING-13071) (Bug)
+ * [SLING-13083 Code acessing the "request-parts-iterator" request
attribute broken after migration to
Jakarta](https://issues.apache.org/jira/browse/SLING-13083) (Bug)
+ * [SLING-13089 Filter Web Console Printer should expose HTTP Whiteboard
filters for Sling context as
well](https://issues.apache.org/jira/browse/SLING-13089) (Improvement)
+ * [SLING-13090 Filter Web Console Printer does not unwrap information for
JavaxToJakartaFilterWrapper](https://issues.apache.org/jira/browse/SLING-13090)
(Improvement)
+ * [SLING-13102 Add test coverage for TRACE-disabled handling and selector
validation](https://issues.apache.org/jira/browse/SLING-13102) (Improvement)
+* `org.apache.sling`:**`org.apache.sling.event`** 4.3.14 -> 4.4.0
+ * [SLING-9393 JobManager findJobs doesn't return hits when Templates are
used](https://issues.apache.org/jira/browse/SLING-9393) (Bug)
+ * [SLING-11422 Stop embedding the event.api package in the event
bundle](https://issues.apache.org/jira/browse/SLING-11422) (Improvement)
+ * [SLING-12078 Suspected race condition between TOPOLOGY_INIT and
JobManager.addJob](https://issues.apache.org/jira/browse/SLING-12078) (Bug)
+ * [SLING-12261 Sling Event: Update to sling-bundle-parent
62](https://issues.apache.org/jira/browse/SLING-12261) (Improvement)
+ * [SLING-12737 The method findJobs in JobManagerImpl does not accept a
template containing an
operation](https://issues.apache.org/jira/browse/SLING-12737) (Bug)
+ * [SLING-12743 Add condition readiness mechanism in JobManager to ensure
system stability.](https://issues.apache.org/jira/browse/SLING-12743) (Task)
+ * [SLING-12819 fix flaky
RoundRobinMaxParallelIT.testRoundRobinMaxParallel_fast](https://issues.apache.org/jira/browse/SLING-12819)
(Task)
+ * [SLING-12966 Remove reproducible build
workaround](https://issues.apache.org/jira/browse/SLING-12966) (Task)
+* `org.apache.sling`:**`org.apache.sling.fsresource`** 2.2.0 -> 2.3.0
+ * [SLING-11519 Generate adapter metadata json for adaptations natively
supported by FileResource](https://issues.apache.org/jira/browse/SLING-11519)
(Bug)
+ * [SLING-12071 Migrate sling.fsresource to
jakarta.json](https://issues.apache.org/jira/browse/SLING-12071) (Sub-task)
+ * [SLING-12491 Update to parent pom
52](https://issues.apache.org/jira/browse/SLING-12491) (Improvement)
+ * [SLING-12677 Upate to Parent
62](https://issues.apache.org/jira/browse/SLING-12677) (Task)
+ * [SLING-12680 FSResource: Eliminate ValueMap/Converter classes copied
from Sling API](https://issues.apache.org/jira/browse/SLING-12680) (Improvement)
+ * [SLING-12685 FSResource: Fix or work around flaky FileMonitor unit tests
on windows](https://issues.apache.org/jira/browse/SLING-12685) (Bug)
+* `org.apache.sling`:**`org.apache.sling.i18n`** 2.6.6 -> 3.0.0
+ * [SLING-12312 add support for Sling API 3.x and Jakarta
Servlet](https://issues.apache.org/jira/browse/SLING-12312) (Sub-task)
+ * [SLING-12899 Update to Parent
62](https://issues.apache.org/jira/browse/SLING-12899) (Improvement)
+* `org.apache.sling`:**`org.apache.sling.installer.core`** 3.14.2 -> 3.14.4
+ * [SLING-12843 Sling Installer ignores startlevel change of
bundles](https://issues.apache.org/jira/browse/SLING-12843) (Bug)
+* `org.apache.sling`:**`org.apache.sling.installer.factory.configuration`**
1.4.8 -> 1.4.10
+ * [SLING-12488 ConfigurationSerializerWebConsolePlugin: Emit configuration
properties in alphabetical
order](https://issues.apache.org/jira/browse/SLING-12488) (Improvement)
+ * [SLING-12495 ConfigurationSerializerWebConsolePlugin: Rework "Remove
properties" logic](https://issues.apache.org/jira/browse/SLING-12495) (Bug)
+* `org.apache.sling`:**`org.apache.sling.jcr.jackrabbit.accessmanager`** 4.0.2
-> 5.0.0
+ * [SLING-12868 migrate to Sling API 3.x and Jakarta
Servlet](https://issues.apache.org/jira/browse/SLING-12868) (Sub-task)
+ * [SLING-12897 Update to Parent
62](https://issues.apache.org/jira/browse/SLING-12897) (Improvement)
+* `org.apache.sling`:**`org.apache.sling.jcr.jackrabbit.usermanager`** 2.2.30
-> 3.0.0
+ * [SLING-12869 migrate to Sling API 3.x and Jakarta
Servlet](https://issues.apache.org/jira/browse/SLING-12869) (Sub-task)
+ * [SLING-12898 Update to Parent
62](https://issues.apache.org/jira/browse/SLING-12898) (Improvement)
+* `org.apache.sling`:**`org.apache.sling.jcr.oak.server`** 1.4.2 -> 1.4.4
+ * [SLING-12457 Make creation of Lucene index definition
configurable](https://issues.apache.org/jira/browse/SLING-12457) (New Feature)
+ * [SLING-12848 Introduce ContentRepository
Registration](https://issues.apache.org/jira/browse/SLING-12848) (Improvement)
+* `org.apache.sling`:**`org.apache.sling.jcr.registration`** 1.0.6 -> 1.0.10
+ * [SLING-11413 Update parent bundle (48) to
sling-jcr-registration](https://issues.apache.org/jira/browse/SLING-11413)
(Sub-task)
+ * [SLING-13013 Update to Parent
62](https://issues.apache.org/jira/browse/SLING-13013) (Improvement)
+ * [SLING-13023 JCR Repository Registration: Fix optional
imports](https://issues.apache.org/jira/browse/SLING-13023) (Bug)
+* `org.apache.sling`:**`org.apache.sling.jcr.repoinit`** 1.1.52 -> 1.1.54
+ * [SLING-12642 Repoinit: Improve privilege
retrieval](https://issues.apache.org/jira/browse/SLING-12642) (Task)
+ * [SLING-12662 Build with Java 11, 17 and
21](https://issues.apache.org/jira/browse/SLING-12662) (Task)
+ * [SLING-12663 Log total execution time for repoinit
statements](https://issues.apache.org/jira/browse/SLING-12663) (Task)
+ * [SLING-12668 Repoinit JCR: Forced multivalue property with single value
is not stored as multiple
property](https://issues.apache.org/jira/browse/SLING-12668) (Bug)
+ * [SLING-12670 RepoInit: Update to Parent
62](https://issues.apache.org/jira/browse/SLING-12670) (Task)
+* `org.apache.sling`:**`org.apache.sling.jcr.resource`** 3.3.2 -> 3.3.6
+ * [SLING-12742 Don't swallow java.io.NotSerializableException in
JcrPropertyMapCacheEntry.createValue()](https://issues.apache.org/jira/browse/SLING-12742)
(Improvement)
+ * [SLING-12781 Expose resource type and resource super type always also
via getValueMap()](https://issues.apache.org/jira/browse/SLING-12781) (Bug)
+ * [SLING-12940 ResourceChangeListener reads userData from external
events](https://issues.apache.org/jira/browse/SLING-12940) (Improvement)
+* `org.apache.sling`:**`org.apache.sling.models.api`** 1.5.4 -> 2.0.0
+ * [SLING-12694 Update to Parent
62](https://issues.apache.org/jira/browse/SLING-12694) (Task)
+ * [SLING-12874 migrate ModelFactory to Sling API 3.x and Jakarta
Servlet](https://issues.apache.org/jira/browse/SLING-12874) (Sub-task)
+* `org.apache.sling`:**`org.apache.sling.models.impl`** 1.7.8 -> 2.0.2
+ * [SLING-12875 migrate ModelFactoryImpl to Sling API 3.x and Jakarta
Servlet](https://issues.apache.org/jira/browse/SLING-12875) (Sub-task)
+ * [SLING-13050 Models Impl: Include Integration
Tests](https://issues.apache.org/jira/browse/SLING-13050) (Task)
+ * [SLING-13052 [SONAR] Add missing assertions to AdapterFactoryTest
(java:S2699)](https://issues.apache.org/jira/browse/SLING-13052) (Test)
+ * [SLING-13062 [Sling Models] Migrate basic injectors tests to JUnit
5](https://issues.apache.org/jira/browse/SLING-13062) (Improvement)
+ * [SLING-13063 [Sling Models] Migrate SlingObject, Self, and legacy
Injector tests to JUnit 5](https://issues.apache.org/jira/browse/SLING-13063)
(Improvement)
+ * [SLING-13064 [Sling Models] Migrate 'via' package unit tests to JUnit
5](https://issues.apache.org/jira/browse/SLING-13064) (Improvement)
+ * [SLING-13066 [Sling Models] Migrate implpicker and basic root tests to
JUnit 5](https://issues.apache.org/jira/browse/SLING-13066) (Improvement)
+ * [SLING-13068 Models: Update to Parent
65](https://issues.apache.org/jira/browse/SLING-13068) (Task)
+ * [SLING-13072 [Sling Models] Migrate defaults and inheritance root tests
to JUnit 5](https://issues.apache.org/jira/browse/SLING-13072) (Improvement)
+ * [SLING-13077 ExportServlet cannot adapt model to javax
SlingHttpServletRequest when running in a Jakarta Servlet
environment](https://issues.apache.org/jira/browse/SLING-13077) (Bug)
+ * [SLING-13079 Models Jackson Exporter: Include Integration
Tests](https://issues.apache.org/jira/browse/SLING-13079) (Task)
+ * [SLING-13088 [Sling Models] Migrate ModelAdapterFactory, Ordering, and
OSGi tests to JUnit 5](https://issues.apache.org/jira/browse/SLING-13088)
(Improvement)
+ * [SLING-13092 ModelConfigurationPrinter does not properly emit properties
containing an array](https://issues.apache.org/jira/browse/SLING-13092)
(Improvement)
+ * [SLING-13101 [Sling Models] Migrate Request, Resource, and PostConstruct
Tests to JUnit 5 ](https://issues.apache.org/jira/browse/SLING-13101)
(Improvement)
+ * [SLING-13115 [Sling Models] Migrate ServiceAdapters,
StaticFieldInjection, and Via Tests to JUnit
5](https://issues.apache.org/jira/browse/SLING-13115) (Improvement)
+* `org.apache.sling`:**`org.apache.sling.models.jacksonexporter`** 1.1.4 ->
2.0.0
+ * [SLING-11969 Improve the
ConfigurableSerializationModuleProvider](https://issues.apache.org/jira/browse/SLING-11969)
(Task)
+ * [SLING-12213 Update dependency
versions](https://issues.apache.org/jira/browse/SLING-12213) (Task)
+ * [SLING-12242 Improve unit tests
(JacksonExporterLimitSerializationTest)](https://issues.apache.org/jira/browse/SLING-12242)
(Task)
+ * [SLING-12360 Models: Update to Parent 60, Java 11 Minimum
Version](https://issues.apache.org/jira/browse/SLING-12360) (Improvement)
+ * [SLING-12840 Update to Sling API
3](https://issues.apache.org/jira/browse/SLING-12840) (Sub-task)
+* `org.apache.sling`:**`org.apache.sling.repoinit.parser`** 1.9.0 -> 1.9.2
+ * [SLING-12668 Repoinit JCR: Forced multivalue property with single value
is not stored as multiple
property](https://issues.apache.org/jira/browse/SLING-12668) (Bug)
+ * [SLING-12669 Repoinit: Fix unit test failure on
Windows](https://issues.apache.org/jira/browse/SLING-12669) (Bug)
+ * [SLING-12670 RepoInit: Update to Parent
62](https://issues.apache.org/jira/browse/SLING-12670) (Task)
+* `org.apache.sling`:**`org.apache.sling.resource.filter`** 1.0.0 -> 1.0.2
+ * [SLING-11562 Update parent bundle (49) to
sling-resource-filter](https://issues.apache.org/jira/browse/SLING-11562) (Task)
+ * [SLING-13013 Update to Parent
62](https://issues.apache.org/jira/browse/SLING-13013) (Improvement)
+ * [SLING-13014 Resource Filter: Update to JavaCC
3.0.1](https://issues.apache.org/jira/browse/SLING-13014) (Improvement)
+* `org.apache.sling`:**`org.apache.sling.resourceresolver`** 1.12.2 -> 2.0.2
+ * [SLING-12636 Resource Resolver: add test coverage for background
init](https://issues.apache.org/jira/browse/SLING-12636) (Sub-task)
+ * [SLING-12645 Resource Resolver: VanityPathMapEntriesTest - remove
historic test vector for query
paging](https://issues.apache.org/jira/browse/SLING-12645) (Sub-task)
+ * [SLING-12646 Resource Resolver: MapEntries: give doInit() a meaningful
name](https://issues.apache.org/jira/browse/SLING-12646) (Sub-task)
+ * [SLING-12648 Resource Resolver: MapEntries: factor out vanity path
handling](https://issues.apache.org/jira/browse/SLING-12648) (Sub-task)
+ * [SLING-12649 Resource Resolver: VanityPathMapEntriesTest - factor out
repeated uses of reflection](https://issues.apache.org/jira/browse/SLING-12649)
(Sub-task)
+ * [SLING-12651 ResourceResolver: avoid re-assignment of
resolveMapsMap](https://issues.apache.org/jira/browse/SLING-12651) (Sub-task)
+ * [SLING-12653 ResourceResolver: add test coverage for query exception
disabling optimized alias
handling](https://issues.apache.org/jira/browse/SLING-12653) (Sub-task)
+ * [SLING-12658 Resource Resolver: refactor vanity path handling -
encapsulate code for better isolation and unit
testing](https://issues.apache.org/jira/browse/SLING-12658) (Sub-task)
+ * [SLING-12664 Resource Resolver: MapEntries: drainQueue is part of event
handling (move it there)](https://issues.apache.org/jira/browse/SLING-12664)
(Sub-task)
+ * [SLING-12665 Resource Resolver: MapEntries: extract
VanityPathHandler](https://issues.apache.org/jira/browse/SLING-12665) (Sub-task)
+ * [SLING-12666 Resource Resolver: VanityPathHandler, address warnings,
refactor](https://issues.apache.org/jira/browse/SLING-12666) (Sub-task)
+ * [SLING-12667 Resource Resolver: cleanup/improve
VanityPathsMapEntriesTest](https://issues.apache.org/jira/browse/SLING-12667)
(Sub-task)
+ * [SLING-12671 ResourceResolver: add test coverage for vanity paths on
resources with name
extensions](https://issues.apache.org/jira/browse/SLING-12671) (Sub-task)
+ * [SLING-12679 ResourceResolver: incorrect metrics
init](https://issues.apache.org/jira/browse/SLING-12679) (Sub-task)
+ * [SLING-12684 ResourceResolver: update to latest Sling parent
pom](https://issues.apache.org/jira/browse/SLING-12684) (Task)
+ * [SLING-12686 Resource Resolver: add test coverage for events during VP
bg init](https://issues.apache.org/jira/browse/SLING-12686) (Sub-task)
+ * [SLING-12688 Resource Resolver: add test coverage for VP init
failure](https://issues.apache.org/jira/browse/SLING-12688) (Sub-task)
+ * [SLING-12696 ResourceResolver: alias refactoring - move alias related
code into single place](https://issues.apache.org/jira/browse/SLING-12696)
(Sub-task)
+ * [SLING-12700 Resource Resolver: add test coverage for vanity path cache
metrics](https://issues.apache.org/jira/browse/SLING-12700) (Sub-task)
+ * [SLING-12701 Resource Resolver: MapEntries - move alias handling into
inner class](https://issues.apache.org/jira/browse/SLING-12701) (Sub-task)
+ * [SLING-12703 ResourceResolver: initializeAliases after
MapEntries.dispose causes
NPE](https://issues.apache.org/jira/browse/SLING-12703) (Bug)
+ * [SLING-12716 Resource Resolver: Switch to Parent
62](https://issues.apache.org/jira/browse/SLING-12716) (Task)
+ * [SLING-12733 ResourceMapper.getMapping(...) may return
null](https://issues.apache.org/jira/browse/SLING-12733) (Improvement)
+ * [SLING-12735 Resource Resolver: AliasHandler
refactoring](https://issues.apache.org/jira/browse/SLING-12735) (Sub-task)
+ * [SLING-12741 NPE resource resolver during resource provider
unregisteration](https://issues.apache.org/jira/browse/SLING-12741) (Bug)
+ * [SLING-12752 Support Jakarta Servlet
6.1](https://issues.apache.org/jira/browse/SLING-12752) (Improvement)
+ * [SLING-12758 ResourceResolver: remove redundant check for absolute path
in alias](https://issues.apache.org/jira/browse/SLING-12758) (Sub-task)
+ * [SLING-12759 ResourceResolver: push 'non-optimized' alias handling from
ResourceResolverImpl into
AliasHandler](https://issues.apache.org/jira/browse/SLING-12759) (Sub-task)
+ * [SLING-12763 ResourceResolver: cleanup API of AliasHandler wrt
'optimized resolution'](https://issues.apache.org/jira/browse/SLING-12763)
(Sub-task)
+ * [SLING-12777 ResourceResolver: alias refactoring - make
ResourceMapperImpl ignorant of optimimized/non-optimized
case](https://issues.apache.org/jira/browse/SLING-12777) (Sub-task)
+ * [SLING-12787 ResourceResolver: alias refactoring - use Resource instead
of Path when getting
aliases](https://issues.apache.org/jira/browse/SLING-12787) (Sub-task)
+ * [SLING-12795 Resource Resolver: align behavior for cached ('optimized')
and non-cached case](https://issues.apache.org/jira/browse/SLING-12795)
(Sub-task)
+ * [SLING-12799 ResourceResolver: alias refactoring - check behavior when
aliases both on node and jcr:content child
node](https://issues.apache.org/jira/browse/SLING-12799) (Sub-task)
+ * [SLING-12804 ResourceResolver: alias refactoring - improve test coverage
of query statements](https://issues.apache.org/jira/browse/SLING-12804)
(Sub-task)
+ * [SLING-12806 Prevent creating resources with a name only consisting of
dots](https://issues.apache.org/jira/browse/SLING-12806) (Improvement)
+ * [SLING-12823 ResourceResolver: alias refactoring - avoid getting the
parent resource when path
sufficient](https://issues.apache.org/jira/browse/SLING-12823) (Sub-task)
+ * [SLING-12832 ResourceResolver: alias refactoring - move alias init into
Runnable](https://issues.apache.org/jira/browse/SLING-12832) (Sub-task)
+ * [SLING-12879 ResourceResolver: add option to run alias initializer in
background](https://issues.apache.org/jira/browse/SLING-12879) (Sub-task)
+ * [SLING-12884 ResourceResolver: refactor mocking in
AliasMapEntriesTest](https://issues.apache.org/jira/browse/SLING-12884)
(Sub-task)
+ * [SLING-12894 ResourceResolver: alias refactoring - support observation
events while bg init not
finished](https://issues.apache.org/jira/browse/SLING-12894) (Sub-task)
+ * [SLING-12896 ResourceResolver: alias refactoring - clean up vanity path
tests](https://issues.apache.org/jira/browse/SLING-12896) (Sub-task)
+ * [SLING-12900 ResourceResolver: improve test coverage for VP bg init vs
events, minor refactoring](https://issues.apache.org/jira/browse/SLING-12900)
(Sub-task)
+ * [SLING-12901 ResourceResolver: alias refactoring - NPE when attempting
to alias root](https://issues.apache.org/jira/browse/SLING-12901) (Sub-task)
+ * [SLING-12908 ResourceResolver: alias refactoring - remove warn/logging
for "non-optimize" case](https://issues.apache.org/jira/browse/SLING-12908)
(Sub-task)
+ * [SLING-12910 ResourceResolver: log all alias/vanity settings on
startup](https://issues.apache.org/jira/browse/SLING-12910) (Sub-task)
+ * [SLING-12911 ResourceResolver: alias refactoring - remove dead code
'isOptimized...'](https://issues.apache.org/jira/browse/SLING-12911) (Sub-task)
+ * [SLING-12912 ResourceResolver: alias handling: wire alias bg cache init
to OSGi](https://issues.apache.org/jira/browse/SLING-12912) (Sub-task)
+ * [SLING-12913 ResourceResolver: update commons-lang3 dependency to
3.18.0](https://issues.apache.org/jira/browse/SLING-12913) (Task)
+ * [SLING-12917 ResourceResolver: alias refactoring - log elapsed time for
draining observation queue (also add a timing formatter and use it
throughout)](https://issues.apache.org/jira/browse/SLING-12917) (Sub-task)
+* `org.apache.sling`:**`org.apache.sling.scripting.core`** 2.4.10 -> 3.0.2
+ * [SLING-12609 Implement Jakarta Servlet based Sling
API](https://issues.apache.org/jira/browse/SLING-12609) (Sub-task)
+ * [SLING-12643 Support Jakarta ServletAPI in
Scripting](https://issues.apache.org/jira/browse/SLING-12643) (Sub-task)
+ * [SLING-12730 Scripting: Update to Parent
62](https://issues.apache.org/jira/browse/SLING-12730) (Task)
+ * [SLING-12752 Support Jakarta Servlet
6.1](https://issues.apache.org/jira/browse/SLING-12752) (Improvement)
+ * [SLING-13070 ScriptContextProvider for bundled scripts does not properly
set JAKARTA_REQUEST and
JAKARTA_REPONSE](https://issues.apache.org/jira/browse/SLING-13070) (Bug)
+ * [SLING-13103 Wrong ResourceResolver set in script bindings after request
dispatch in a Jakarta
Context](https://issues.apache.org/jira/browse/SLING-13103) (Bug)
+* `org.apache.sling`:**`org.apache.sling.scripting.sightly`** 1.4.26-1.4.0 ->
2.0.0-1.4.0
+ * [SLING-12730 Scripting: Update to Parent
62](https://issues.apache.org/jira/browse/SLING-12730) (Task)
+ * [SLING-12755 Break cyclic dependencies between the
SightlyScriptEngineFactory and the BundledUnitManagerImpl
service](https://issues.apache.org/jira/browse/SLING-12755) (Bug)
+ * [SLING-12881 fix jacoco
analysis](https://issues.apache.org/jira/browse/SLING-12881) (Improvement)
+ * [SLING-12883 migrate to Sling API 3.x and Jakarta
Servlet](https://issues.apache.org/jira/browse/SLING-12883) (Sub-task)
+* `org.apache.sling`:**`org.apache.sling.scripting.sightly.js.provider`**
1.2.10 -> 1.2.14
+ * [SLING-12635 JS Use Scripts should only be read
on-demand](https://issues.apache.org/jira/browse/SLING-12635) (Bug)
+ * [SLING-12730 Scripting: Update to Parent
62](https://issues.apache.org/jira/browse/SLING-12730) (Task)
+ * [SLING-12755 Break cyclic dependencies between the
SightlyScriptEngineFactory and the BundledUnitManagerImpl
service](https://issues.apache.org/jira/browse/SLING-12755) (Bug)
+* `org.apache.sling`:**`org.apache.sling.scripting.spi`** 1.0.4 -> 2.0.0
+ * [SLING-12762 Support Jakarta Servlet API in Scripting
SPI](https://issues.apache.org/jira/browse/SLING-12762) (Sub-task)
+* `org.apache.sling`:**`org.apache.sling.servlets.get`** 2.2.0 -> 3.0.0
+ * [SLING-12610 Migrate Servlets Get to Jakarta Servlet
API](https://issues.apache.org/jira/browse/SLING-12610) (Sub-task)
+ * [SLING-12726 Servlets: Update to Parent
62](https://issues.apache.org/jira/browse/SLING-12726) (Task)
+ * [SLING-12751 Switch to SLF4J
2](https://issues.apache.org/jira/browse/SLING-12751) (Improvement)
+* `org.apache.sling`:**`org.apache.sling.servlets.post`** 2.6.0 -> 3.0.2
+ * [SLING-11971 Log duration of each
PostProcessor](https://issues.apache.org/jira/browse/SLING-11971) (Task)
+ * [SLING-12614 Add Jakarta Servlet based API to Post
Servlet](https://issues.apache.org/jira/browse/SLING-12614) (Sub-task)
+ * [SLING-12726 Servlets: Update to Parent
62](https://issues.apache.org/jira/browse/SLING-12726) (Task)
+ * [SLING-12751 Switch to SLF4J
2](https://issues.apache.org/jira/browse/SLING-12751) (Improvement)
+ * [SLING-12944 SlingPostServlet fails when resource contains property not
backed by JCR property](https://issues.apache.org/jira/browse/SLING-12944) (Bug)
+ * [SLING-13086 SlingPostServlet no longer register PostOperation services
after the Jakarta migration](https://issues.apache.org/jira/browse/SLING-13086)
(Bug)
+* `org.apache.sling`:**`org.apache.sling.servlets.resolver`** 2.11.8 -> 3.0.6
+ * [SLING-12433 [BundledScriptTracker] Fix
ConcurrentModificationException](https://issues.apache.org/jira/browse/SLING-12433)
(Bug)
+ * [SLING-12599 Make dependency to Apache Felix HC
optional](https://issues.apache.org/jira/browse/SLING-12599) (Improvement)
+ * [SLING-12608 Implement Jakarta Servlet based Sling
API](https://issues.apache.org/jira/browse/SLING-12608) (Sub-task)
+ * [SLING-12643 Support Jakarta ServletAPI in
Scripting](https://issues.apache.org/jira/browse/SLING-12643) (Sub-task)
+ * [SLING-12726 Servlets: Update to Parent
62](https://issues.apache.org/jira/browse/SLING-12726) (Task)
+ * [SLING-12729 Servlet Resolver: Integration tests fail with Java
21](https://issues.apache.org/jira/browse/SLING-12729) (Bug)
+ * [SLING-12739 Allow for selectively hiding scripts and servlets from the
Sling resolver](https://issues.apache.org/jira/browse/SLING-12739) (Improvement)
+ * [SLING-12752 Support Jakarta Servlet
6.1](https://issues.apache.org/jira/browse/SLING-12752) (Improvement)
+ * [SLING-12854 Allow for hiding scripts/servlets from the resolver (port
SLING-12739 to master)](https://issues.apache.org/jira/browse/SLING-12854)
(Task)
+ * [SLING-13016 RequestWrapper causes NPEs when serving bundled scripts if
'forceResourceType' is not
set](https://issues.apache.org/jira/browse/SLING-13016) (Bug)
+ * [SLING-13027 Servlets Resolver: Add Jakarta JSON
dependency](https://issues.apache.org/jira/browse/SLING-13027) (Improvement)
+ * [SLING-13091 Sling Servlet Resolver Web Console does not unwrap info
about
org.apache.sling.servlets.resolver.internal.ServletWrapperUtil$JakartaScriptServletWrapper](https://issues.apache.org/jira/browse/SLING-13091)
(Improvement)
+* `org.apache.sling`:**`org.apache.sling.settings`** 1.4.2 -> 1.5.0
+ * [SLING-11152 Use official OSGi Converter
Implementation](https://issues.apache.org/jira/browse/SLING-11152) (Improvement)
+ * [SLING-12988 Concurrent checks for a runmode can block under
concurrency](https://issues.apache.org/jira/browse/SLING-12988) (Task)
+ * [SLING-12989 Apply spotless
formatting](https://issues.apache.org/jira/browse/SLING-12989) (Task)
+ * [SLING-12990 Settings: update to latest
parent](https://issues.apache.org/jira/browse/SLING-12990) (Task)
+ * [SLING-12991 Settings: update commons-lang test
dependency](https://issues.apache.org/jira/browse/SLING-12991) (Task)
+* `org.apache.sling`:**`org.apache.sling.starter.content`** 1.0.16 -> 2.0.2
+ * [SLING-12882 Migrate Starter Content to sling api 3.0 and models api
2.0](https://issues.apache.org/jira/browse/SLING-12882) (Improvement)
+ * [SLING-12969 The OpenSans fonts are corrupted by the build
process](https://issues.apache.org/jira/browse/SLING-12969) (Bug)
+ * [SLING-12971 move the original auth.form login form to
o.a.s.starter.content
bundle](https://issues.apache.org/jira/browse/SLING-12971) (Sub-task)
+* `org.apache.sling`:**`org.apache.sling.xss`** 2.4.2 -> 2.4.8
+ * [SLING-12531 Update Sling
dependencies](https://issues.apache.org/jira/browse/SLING-12531) (Improvement)
+ * [SLING-12563 Remove java8 support for Sling
XSS](https://issues.apache.org/jira/browse/SLING-12563) (New Feature)
+ * [SLING-12569 Update esapi to
2.6.0.0](https://issues.apache.org/jira/browse/SLING-12569) (Task)
+ * [SLING-12616 Performance improvement in Sling XSS
bundle](https://issues.apache.org/jira/browse/SLING-12616) (Improvement)
+ * [SLING-12622 Review improvement of
SLING-12616](https://issues.apache.org/jira/browse/SLING-12622) (Task)
+ * [SLING-12628 Avoid import of
org.apache.commons.fileupload](https://issues.apache.org/jira/browse/SLING-12628)
(Improvement)
+ * [SLING-12677 Upate to Parent
62](https://issues.apache.org/jira/browse/SLING-12677) (Task)
+ * [SLING-12930 XSS API fails to build and run with Java 25 due to missing
Unsafe.ensureClassInitialized](https://issues.apache.org/jira/browse/SLING-12930)
(Improvement)
+* `org.freemarker`:**`freemarker`** 2.3.32 -> 2.3.34
+* `org.ow2.asm`:**`asm`** 9.7.1 -> 9.9.1
+* `org.ow2.asm`:**`asm-analysis`** 9.7.1 -> 9.9.1
+* `org.ow2.asm`:**`asm-commons`** 9.7.1 -> 9.9.1
+* `org.ow2.asm`:**`asm-tree`** 9.7.1 -> 9.9.1
+* `org.ow2.asm`:**`asm-util`** 9.7.1 -> 9.9.1
+* `org.owasp.encoder`:**`encoder`** 1.3.1 -> 1.4.0
+* `org.slf4j`:**`jcl-over-slf4j`** 1.7.36 -> 2.0.17
+* `org.slf4j`:**`log4j-over-slf4j`** 1.7.36 -> 2.0.17
