From 267ec52890ae636cb758f3a032751ac6bdc8084a Mon Sep 17 00:00:00 2001 From: Gary Gregory Date: Fri, 20 Feb 2026 07:42:44 -0500 Subject: [PATCH 01/10] Bump github/codeql-action from 4.32.2 to 4.32.3 --- .github/workflows/codeql-analysis.yml | 6 +++--- .github/workflows/scorecards-analysis.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 9ccfb03278..b1f4f562df 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -58,7 +58,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2 + uses: github/codeql-action/init@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -69,7 +69,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2 + uses: github/codeql-action/autobuild@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3 # â„šī¸ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl @@ -83,4 +83,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2 + uses: github/codeql-action/analyze@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3 diff --git a/.github/workflows/scorecards-analysis.yml b/.github/workflows/scorecards-analysis.yml index 7503f5e6b7..5bed385874 100644 --- a/.github/workflows/scorecards-analysis.yml +++ b/.github/workflows/scorecards-analysis.yml @@ -64,6 +64,6 @@ jobs: retention-days: 5 - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2 + uses: github/codeql-action/upload-sarif@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3 with: sarif_file: results.sarif From 21a016cec7ff2ea8a54a3af06d844ed152c6e5f2 Mon Sep 17 00:00:00 2001 From: Gary Gregory Date: Mon, 23 Feb 2026 10:59:18 -0500 Subject: [PATCH 02/10] Bump github/codeql-action from 4.32.0 to 4.32.4 --- .github/workflows/codeql-analysis.yml | 6 +++--- .github/workflows/scorecards-analysis.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index b1f4f562df..6c4aa3f571 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -58,7 +58,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3 + uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -69,7 +69,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3 + uses: github/codeql-action/autobuild@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4 # â„šī¸ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl @@ -83,4 +83,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3 + uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4 diff --git a/.github/workflows/scorecards-analysis.yml b/.github/workflows/scorecards-analysis.yml index 5bed385874..edcfc60f64 100644 --- a/.github/workflows/scorecards-analysis.yml +++ b/.github/workflows/scorecards-analysis.yml @@ -64,6 +64,6 @@ jobs: retention-days: 5 - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3 + uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4 with: sarif_file: results.sarif From 3b3d5d140c254096e0c57b315e02ef29c83793de Mon Sep 17 00:00:00 2001 From: Gary Gregory Date: Sat, 28 Feb 2026 07:54:37 -0500 Subject: [PATCH 03/10] Bump org.apache.commons:commons-parent from 96 to 97. --- pom.xml | 2 +- src/changes/changes.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index f2049d7fde..9f9b598f9a 100644 --- a/pom.xml +++ b/pom.xml @@ -20,7 +20,7 @@ org.apache.commons commons-parent - 96 + 97 commons-text 1.15.1-SNAPSHOT diff --git a/src/changes/changes.xml b/src/changes/changes.xml index 4bfbe4f854..55725d0208 100644 --- a/src/changes/changes.xml +++ b/src/changes/changes.xml @@ -49,7 +49,7 @@ The type attribute can be add,update,fix,remove. TextStringBuilder.append(char[], int, int) uses wrong variable in exception message #735. - Bump org.apache.commons:commons-parent from 93 to 96. + Bump org.apache.commons:commons-parent from 93 to 97. Bump the level of test coverage checks. Bump commons.bytebuddy.version from 1.18.2 to 1.18.4 #734. From 9a82768be95a3d39a547db1f77964e438b1d31b5 Mon Sep 17 00:00:00 2001 From: Gary Gregory Date: Mon, 2 Mar 2026 08:34:41 -0500 Subject: [PATCH 04/10] Bump github/codeql-action from 4.32.4 to 4.32.5 --- .github/workflows/codeql-analysis.yml | 6 +++--- .github/workflows/scorecards-analysis.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 6c4aa3f571..e2ee451b4e 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -58,7 +58,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4 + uses: github/codeql-action/init@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -69,7 +69,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4 + uses: github/codeql-action/autobuild@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5 # â„šī¸ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl @@ -83,4 +83,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4 + uses: github/codeql-action/analyze@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5 diff --git a/.github/workflows/scorecards-analysis.yml b/.github/workflows/scorecards-analysis.yml index edcfc60f64..326bbf4a43 100644 --- a/.github/workflows/scorecards-analysis.yml +++ b/.github/workflows/scorecards-analysis.yml @@ -64,6 +64,6 @@ jobs: retention-days: 5 - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4 + uses: github/codeql-action/upload-sarif@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5 with: sarif_file: results.sarif From f2929c201314e005a625fadfd887d595a092c9a9 Mon Sep 17 00:00:00 2001 From: Gary Gregory Date: Fri, 6 Mar 2026 07:36:39 -0500 Subject: [PATCH 05/10] Bump github/codeql-action from 4.32.5 to 4.32.6 --- .github/workflows/codeql-analysis.yml | 6 +++--- .github/workflows/scorecards-analysis.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index e2ee451b4e..4c52d9d27d 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -58,7 +58,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5 + uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -69,7 +69,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5 + uses: github/codeql-action/autobuild@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6 # â„šī¸ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl @@ -83,4 +83,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5 + uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6 diff --git a/.github/workflows/scorecards-analysis.yml b/.github/workflows/scorecards-analysis.yml index 326bbf4a43..81fbc1b5e8 100644 --- a/.github/workflows/scorecards-analysis.yml +++ b/.github/workflows/scorecards-analysis.yml @@ -64,6 +64,6 @@ jobs: retention-days: 5 - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5 + uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6 with: sarif_file: results.sarif From 5cad5482def411bf07814ddc6e58949149e69e5f Mon Sep 17 00:00:00 2001 From: Gary Gregory Date: Mon, 9 Mar 2026 08:44:19 -0400 Subject: [PATCH 06/10] Bump actions/upload-artifact from 6.0.0 to 7.0.0 --- .github/workflows/scorecards-analysis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecards-analysis.yml b/.github/workflows/scorecards-analysis.yml index 81fbc1b5e8..a35bf86eeb 100644 --- a/.github/workflows/scorecards-analysis.yml +++ b/.github/workflows/scorecards-analysis.yml @@ -57,7 +57,7 @@ jobs: publish_results: true - name: "Upload artifact" - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # 6.0.0 + uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 with: name: SARIF file path: results.sarif From a55f00858246e19a4dfd3fb0ddba0700b04dc978 Mon Sep 17 00:00:00 2001 From: Gary Gregory Date: Wed, 11 Mar 2026 21:52:45 -0400 Subject: [PATCH 07/10] Remove link to now malicious site --- .../LevenshteinDetailedDistance.java | 29 +------------------ .../text/similarity/LevenshteinDistance.java | 17 +---------- 2 files changed, 2 insertions(+), 44 deletions(-) diff --git a/src/main/java/org/apache/commons/text/similarity/LevenshteinDetailedDistance.java b/src/main/java/org/apache/commons/text/similarity/LevenshteinDetailedDistance.java index 4b4740ea9a..8ea040098d 100644 --- a/src/main/java/org/apache/commons/text/similarity/LevenshteinDetailedDistance.java +++ b/src/main/java/org/apache/commons/text/similarity/LevenshteinDetailedDistance.java @@ -132,7 +132,7 @@ public static LevenshteinDetailedDistance getDefaultInstance() { * *

* This implementation follows from Algorithms on Strings, Trees and Sequences by Dan Gusfield and Chas Emerick's implementation of the Levenshtein distance - * algorithm from http://www.merriampark.com/ld.htm + * algorithm. *

* *
@@ -271,18 +271,9 @@ private static  LevenshteinResults limitedCompare(SimilarityInput left, Si
      * 

* *

- * The previous implementation of the Levenshtein distance algorithm was from - * http://www.merriampark.com/ld.htm - *

- * - *

* Chas Emerick has written an implementation in Java, which avoids an OutOfMemoryError which can occur when my Java implementation is used with very large * strings. *

- *

- * This implementation of the Levenshtein distance algorithm is from - * http://www.merriampark.com/ldjava.htm - *

* *
      * unlimitedCompare(null, *)             = Throws {@link IllegalArgumentException}
@@ -416,18 +407,9 @@ public LevenshteinDetailedDistance(final Integer threshold) {
      * 

* *

- * The previous implementation of the Levenshtein distance algorithm was from - * http://www.merriampark.com/ld.htm - *

- * - *

* Chas Emerick has written an implementation in Java, which avoids an OutOfMemoryError which can occur when my Java implementation is used with very large * strings. *

- *

- * This implementation of the Levenshtein distance algorithm is from - * http://www.merriampark.com/ldjava.htm - *

* *
      * distance.apply(null, *)             = Throws {@link IllegalArgumentException}
@@ -461,18 +443,9 @@ public LevenshteinResults apply(final CharSequence left, final CharSequence righ
      * 

* *

- * The previous implementation of the Levenshtein distance algorithm was from - * http://www.merriampark.com/ld.htm - *

- * - *

* Chas Emerick has written an implementation in Java, which avoids an OutOfMemoryError which can occur when my Java implementation is used with very large * strings. *

- *

- * This implementation of the Levenshtein distance algorithm is from - * http://www.merriampark.com/ldjava.htm - *

* *
      * distance.apply(null, *)             = Throws {@link IllegalArgumentException}
diff --git a/src/main/java/org/apache/commons/text/similarity/LevenshteinDistance.java b/src/main/java/org/apache/commons/text/similarity/LevenshteinDistance.java
index d8b9e121ae..479b3fadea 100644
--- a/src/main/java/org/apache/commons/text/similarity/LevenshteinDistance.java
+++ b/src/main/java/org/apache/commons/text/similarity/LevenshteinDistance.java
@@ -55,7 +55,7 @@ public static LevenshteinDistance getDefaultInstance() {
      *
      * 

* This implementation follows from Algorithms on Strings, Trees and Sequences by Dan Gusfield and Chas Emerick's implementation of the Levenshtein distance - * algorithm from http://www.merriampark.com/ld.htm + * algorithm. *

* *
@@ -204,12 +204,6 @@ private static  int limitedCompare(SimilarityInput left, SimilarityInput

* *

- * The previous implementation of the Levenshtein distance algorithm was from - * - * https://web.archive.org/web/20120526085419/http://www.merriampark.com/ldjava.htm - *

- * - *

* This implementation only need one single-dimensional arrays of length s.length() + 1 *

* @@ -320,18 +314,9 @@ public LevenshteinDistance(final Integer threshold) { *

* *

- * The previous implementation of the Levenshtein distance algorithm was from - * http://www.merriampark.com/ld.htm - *

- * - *

* Chas Emerick has written an implementation in Java, which avoids an OutOfMemoryError which can occur when my Java implementation is used with very large * strings. *

- *

- * This implementation of the Levenshtein distance algorithm is from - * http://www.merriampark.com/ldjava.htm - *

* *
      * distance.apply(null, *)             = Throws {@link IllegalArgumentException}

From 7b76a31ba0ff432df88b7c2b1f9a52401d45120c Mon Sep 17 00:00:00 2001
From: Gary Gregory 
Date: Fri, 13 Mar 2026 09:08:53 -0400
Subject: [PATCH 08/10] Bump commons.bytebuddy.version from 1.18.4 to 1.18.7.

---
 pom.xml                 | 2 +-
 src/changes/changes.xml | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 9f9b598f9a..bc8e9a9200 100644
--- a/pom.xml
+++ b/pom.xml
@@ -48,7 +48,7 @@
     https://svn.apache.org/repos/infra/websites/production/commons/content/proper/commons-text
     site-content
     3.20.0
-    1.18.4
+    1.18.7
     1.6
     false
     1.37
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index 55725d0208..a3ae6cc2bc 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -52,6 +52,7 @@ The  type attribute can be add,update,fix,remove.
       Bump org.apache.commons:commons-parent from 93 to 97.
       Bump the level of test coverage checks.
       Bump commons.bytebuddy.version from 1.18.2 to 1.18.4 #734.
+      Bump commons.bytebuddy.version from 1.18.4 to 1.18.7.
     
     
       

From 6e2b964ae83f0bf020b6236cb97fb85795ddfc4b Mon Sep 17 00:00:00 2001
From: Gary Gregory 
Date: Thu, 19 Mar 2026 23:46:54 +0000
Subject: [PATCH 09/10] Add a reference to safe deserlialization

---
 src/site/xdoc/security.xml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/site/xdoc/security.xml b/src/site/xdoc/security.xml
index b211fd77bd..150584ad35 100644
--- a/src/site/xdoc/security.xml
+++ b/src/site/xdoc/security.xml
@@ -114,5 +114,10 @@
                 

- +
+

+ For information about safe deserialization, please see Safe Deserialization. +

+
+ From 040a75798ce48ce000ecc9af4e7e3a49690aff48 Mon Sep 17 00:00:00 2001 From: Gary Gregory Date: Fri, 20 Mar 2026 17:33:07 -0700 Subject: [PATCH 10/10] Bump github/codeql-action from 4.32.6 to 4.34.0 --- .github/workflows/codeql-analysis.yml | 6 +++--- .github/workflows/scorecards-analysis.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 4c52d9d27d..e072e3dd79 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -58,7 +58,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6 + uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4.34.0 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -69,7 +69,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6 + uses: github/codeql-action/autobuild@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4.34.0 # â„šī¸ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl @@ -83,4 +83,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6 + uses: github/codeql-action/analyze@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4.34.0 diff --git a/.github/workflows/scorecards-analysis.yml b/.github/workflows/scorecards-analysis.yml index a35bf86eeb..7182c34001 100644 --- a/.github/workflows/scorecards-analysis.yml +++ b/.github/workflows/scorecards-analysis.yml @@ -64,6 +64,6 @@ jobs: retention-days: 5 - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6 + uses: github/codeql-action/upload-sarif@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4.34.0 with: sarif_file: results.sarif