From 267ec52890ae636cb758f3a032751ac6bdc8084a Mon Sep 17 00:00:00 2001
From: Gary Gregory
Date: Fri, 20 Feb 2026 07:42:44 -0500
Subject: [PATCH 01/10] Bump github/codeql-action from 4.32.2 to 4.32.3
---
.github/workflows/codeql-analysis.yml | 6 +++---
.github/workflows/scorecards-analysis.yml | 2 +-
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 9ccfb03278..b1f4f562df 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -58,7 +58,7 @@ jobs:
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
- uses: github/codeql-action/init@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
+ uses: github/codeql-action/init@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -69,7 +69,7 @@ jobs:
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
# If this step fails, then you should remove it and run the build manually (see below)
- name: Autobuild
- uses: github/codeql-action/autobuild@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
+ uses: github/codeql-action/autobuild@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
# âšī¸ Command-line programs to run using the OS shell.
# đ https://git.io/JvXDl
@@ -83,4 +83,4 @@ jobs:
# make release
- name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
+ uses: github/codeql-action/analyze@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
diff --git a/.github/workflows/scorecards-analysis.yml b/.github/workflows/scorecards-analysis.yml
index 7503f5e6b7..5bed385874 100644
--- a/.github/workflows/scorecards-analysis.yml
+++ b/.github/workflows/scorecards-analysis.yml
@@ -64,6 +64,6 @@ jobs:
retention-days: 5
- name: "Upload to code-scanning"
- uses: github/codeql-action/upload-sarif@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
+ uses: github/codeql-action/upload-sarif@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
with:
sarif_file: results.sarif
From 21a016cec7ff2ea8a54a3af06d844ed152c6e5f2 Mon Sep 17 00:00:00 2001
From: Gary Gregory
Date: Mon, 23 Feb 2026 10:59:18 -0500
Subject: [PATCH 02/10] Bump github/codeql-action from 4.32.0 to 4.32.4
---
.github/workflows/codeql-analysis.yml | 6 +++---
.github/workflows/scorecards-analysis.yml | 2 +-
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index b1f4f562df..6c4aa3f571 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -58,7 +58,7 @@ jobs:
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
- uses: github/codeql-action/init@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
+ uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -69,7 +69,7 @@ jobs:
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
# If this step fails, then you should remove it and run the build manually (see below)
- name: Autobuild
- uses: github/codeql-action/autobuild@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
+ uses: github/codeql-action/autobuild@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
# âšī¸ Command-line programs to run using the OS shell.
# đ https://git.io/JvXDl
@@ -83,4 +83,4 @@ jobs:
# make release
- name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
+ uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
diff --git a/.github/workflows/scorecards-analysis.yml b/.github/workflows/scorecards-analysis.yml
index 5bed385874..edcfc60f64 100644
--- a/.github/workflows/scorecards-analysis.yml
+++ b/.github/workflows/scorecards-analysis.yml
@@ -64,6 +64,6 @@ jobs:
retention-days: 5
- name: "Upload to code-scanning"
- uses: github/codeql-action/upload-sarif@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
+ uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
with:
sarif_file: results.sarif
From 3b3d5d140c254096e0c57b315e02ef29c83793de Mon Sep 17 00:00:00 2001
From: Gary Gregory
Date: Sat, 28 Feb 2026 07:54:37 -0500
Subject: [PATCH 03/10] Bump org.apache.commons:commons-parent from 96 to 97.
---
pom.xml | 2 +-
src/changes/changes.xml | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/pom.xml b/pom.xml
index f2049d7fde..9f9b598f9a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -20,7 +20,7 @@
org.apache.commons
commons-parent
- 96
+ 97
commons-text
1.15.1-SNAPSHOT
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index 4bfbe4f854..55725d0208 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -49,7 +49,7 @@ The type attribute can be add,update,fix,remove.
TextStringBuilder.append(char[], int, int) uses wrong variable in exception message #735.
- Bump org.apache.commons:commons-parent from 93 to 96.
+ Bump org.apache.commons:commons-parent from 93 to 97.
Bump the level of test coverage checks.
Bump commons.bytebuddy.version from 1.18.2 to 1.18.4 #734.
From 9a82768be95a3d39a547db1f77964e438b1d31b5 Mon Sep 17 00:00:00 2001
From: Gary Gregory
Date: Mon, 2 Mar 2026 08:34:41 -0500
Subject: [PATCH 04/10] Bump github/codeql-action from 4.32.4 to 4.32.5
---
.github/workflows/codeql-analysis.yml | 6 +++---
.github/workflows/scorecards-analysis.yml | 2 +-
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 6c4aa3f571..e2ee451b4e 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -58,7 +58,7 @@ jobs:
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
- uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
+ uses: github/codeql-action/init@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -69,7 +69,7 @@ jobs:
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
# If this step fails, then you should remove it and run the build manually (see below)
- name: Autobuild
- uses: github/codeql-action/autobuild@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
+ uses: github/codeql-action/autobuild@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5
# âšī¸ Command-line programs to run using the OS shell.
# đ https://git.io/JvXDl
@@ -83,4 +83,4 @@ jobs:
# make release
- name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
+ uses: github/codeql-action/analyze@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5
diff --git a/.github/workflows/scorecards-analysis.yml b/.github/workflows/scorecards-analysis.yml
index edcfc60f64..326bbf4a43 100644
--- a/.github/workflows/scorecards-analysis.yml
+++ b/.github/workflows/scorecards-analysis.yml
@@ -64,6 +64,6 @@ jobs:
retention-days: 5
- name: "Upload to code-scanning"
- uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
+ uses: github/codeql-action/upload-sarif@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5
with:
sarif_file: results.sarif
From f2929c201314e005a625fadfd887d595a092c9a9 Mon Sep 17 00:00:00 2001
From: Gary Gregory
Date: Fri, 6 Mar 2026 07:36:39 -0500
Subject: [PATCH 05/10] Bump github/codeql-action from 4.32.5 to 4.32.6
---
.github/workflows/codeql-analysis.yml | 6 +++---
.github/workflows/scorecards-analysis.yml | 2 +-
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index e2ee451b4e..4c52d9d27d 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -58,7 +58,7 @@ jobs:
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
- uses: github/codeql-action/init@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5
+ uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -69,7 +69,7 @@ jobs:
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
# If this step fails, then you should remove it and run the build manually (see below)
- name: Autobuild
- uses: github/codeql-action/autobuild@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5
+ uses: github/codeql-action/autobuild@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
# âšī¸ Command-line programs to run using the OS shell.
# đ https://git.io/JvXDl
@@ -83,4 +83,4 @@ jobs:
# make release
- name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5
+ uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
diff --git a/.github/workflows/scorecards-analysis.yml b/.github/workflows/scorecards-analysis.yml
index 326bbf4a43..81fbc1b5e8 100644
--- a/.github/workflows/scorecards-analysis.yml
+++ b/.github/workflows/scorecards-analysis.yml
@@ -64,6 +64,6 @@ jobs:
retention-days: 5
- name: "Upload to code-scanning"
- uses: github/codeql-action/upload-sarif@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5
+ uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
with:
sarif_file: results.sarif
From 5cad5482def411bf07814ddc6e58949149e69e5f Mon Sep 17 00:00:00 2001
From: Gary Gregory
Date: Mon, 9 Mar 2026 08:44:19 -0400
Subject: [PATCH 06/10] Bump actions/upload-artifact from 6.0.0 to 7.0.0
---
.github/workflows/scorecards-analysis.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/scorecards-analysis.yml b/.github/workflows/scorecards-analysis.yml
index 81fbc1b5e8..a35bf86eeb 100644
--- a/.github/workflows/scorecards-analysis.yml
+++ b/.github/workflows/scorecards-analysis.yml
@@ -57,7 +57,7 @@ jobs:
publish_results: true
- name: "Upload artifact"
- uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # 6.0.0
+ uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
with:
name: SARIF file
path: results.sarif
From a55f00858246e19a4dfd3fb0ddba0700b04dc978 Mon Sep 17 00:00:00 2001
From: Gary Gregory
Date: Wed, 11 Mar 2026 21:52:45 -0400
Subject: [PATCH 07/10] Remove link to now malicious site
---
.../LevenshteinDetailedDistance.java | 29 +------------------
.../text/similarity/LevenshteinDistance.java | 17 +----------
2 files changed, 2 insertions(+), 44 deletions(-)
diff --git a/src/main/java/org/apache/commons/text/similarity/LevenshteinDetailedDistance.java b/src/main/java/org/apache/commons/text/similarity/LevenshteinDetailedDistance.java
index 4b4740ea9a..8ea040098d 100644
--- a/src/main/java/org/apache/commons/text/similarity/LevenshteinDetailedDistance.java
+++ b/src/main/java/org/apache/commons/text/similarity/LevenshteinDetailedDistance.java
@@ -132,7 +132,7 @@ public static LevenshteinDetailedDistance getDefaultInstance() {
*
*
* This implementation follows from Algorithms on Strings, Trees and Sequences by Dan Gusfield and Chas Emerick's implementation of the Levenshtein distance
- * algorithm from http://www.merriampark.com/ld.htm
+ * algorithm.
*
*
*
@@ -271,18 +271,9 @@ private static LevenshteinResults limitedCompare(SimilarityInput left, Si
*
*
*
- * The previous implementation of the Levenshtein distance algorithm was from
- * http://www.merriampark.com/ld.htm
- *
- *
- *
* Chas Emerick has written an implementation in Java, which avoids an OutOfMemoryError which can occur when my Java implementation is used with very large
* strings.
*
- *
- * This implementation of the Levenshtein distance algorithm is from
- * http://www.merriampark.com/ldjava.htm
- *
*
*
* unlimitedCompare(null, *) = Throws {@link IllegalArgumentException}
@@ -416,18 +407,9 @@ public LevenshteinDetailedDistance(final Integer threshold) {
*
*
*
- * The previous implementation of the Levenshtein distance algorithm was from
- * http://www.merriampark.com/ld.htm
- *
- *
- *
* Chas Emerick has written an implementation in Java, which avoids an OutOfMemoryError which can occur when my Java implementation is used with very large
* strings.
*
- *
- * This implementation of the Levenshtein distance algorithm is from
- * http://www.merriampark.com/ldjava.htm
- *
*
*
* distance.apply(null, *) = Throws {@link IllegalArgumentException}
@@ -461,18 +443,9 @@ public LevenshteinResults apply(final CharSequence left, final CharSequence righ
*
*
*
- * The previous implementation of the Levenshtein distance algorithm was from
- * http://www.merriampark.com/ld.htm
- *
- *
- *
* Chas Emerick has written an implementation in Java, which avoids an OutOfMemoryError which can occur when my Java implementation is used with very large
* strings.
*
- *
- * This implementation of the Levenshtein distance algorithm is from
- * http://www.merriampark.com/ldjava.htm
- *
*
*
* distance.apply(null, *) = Throws {@link IllegalArgumentException}
diff --git a/src/main/java/org/apache/commons/text/similarity/LevenshteinDistance.java b/src/main/java/org/apache/commons/text/similarity/LevenshteinDistance.java
index d8b9e121ae..479b3fadea 100644
--- a/src/main/java/org/apache/commons/text/similarity/LevenshteinDistance.java
+++ b/src/main/java/org/apache/commons/text/similarity/LevenshteinDistance.java
@@ -55,7 +55,7 @@ public static LevenshteinDistance getDefaultInstance() {
*
*
* This implementation follows from Algorithms on Strings, Trees and Sequences by Dan Gusfield and Chas Emerick's implementation of the Levenshtein distance
- * algorithm from http://www.merriampark.com/ld.htm
+ * algorithm.
*
*
*
@@ -204,12 +204,6 @@ private static int limitedCompare(SimilarityInput left, SimilarityInput
*
*
- * The previous implementation of the Levenshtein distance algorithm was from
- *
- * https://web.archive.org/web/20120526085419/http://www.merriampark.com/ldjava.htm
- *
- *
- *
* This implementation only need one single-dimensional arrays of length s.length() + 1
*
*
@@ -320,18 +314,9 @@ public LevenshteinDistance(final Integer threshold) {
*
*
*
- * The previous implementation of the Levenshtein distance algorithm was from
- * http://www.merriampark.com/ld.htm
- *
- *
- *
* Chas Emerick has written an implementation in Java, which avoids an OutOfMemoryError which can occur when my Java implementation is used with very large
* strings.
*
- *
- * This implementation of the Levenshtein distance algorithm is from
- * http://www.merriampark.com/ldjava.htm
- *
*
*
* distance.apply(null, *) = Throws {@link IllegalArgumentException}
From 7b76a31ba0ff432df88b7c2b1f9a52401d45120c Mon Sep 17 00:00:00 2001
From: Gary Gregory
Date: Fri, 13 Mar 2026 09:08:53 -0400
Subject: [PATCH 08/10] Bump commons.bytebuddy.version from 1.18.4 to 1.18.7.
---
pom.xml | 2 +-
src/changes/changes.xml | 1 +
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 9f9b598f9a..bc8e9a9200 100644
--- a/pom.xml
+++ b/pom.xml
@@ -48,7 +48,7 @@
https://svn.apache.org/repos/infra/websites/production/commons/content/proper/commons-text
site-content
3.20.0
- 1.18.4
+ 1.18.7
1.6
false
1.37
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index 55725d0208..a3ae6cc2bc 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -52,6 +52,7 @@ The type attribute can be add,update,fix,remove.
Bump org.apache.commons:commons-parent from 93 to 97.
Bump the level of test coverage checks.
Bump commons.bytebuddy.version from 1.18.2 to 1.18.4 #734.
+ Bump commons.bytebuddy.version from 1.18.4 to 1.18.7.
From 6e2b964ae83f0bf020b6236cb97fb85795ddfc4b Mon Sep 17 00:00:00 2001
From: Gary Gregory
Date: Thu, 19 Mar 2026 23:46:54 +0000
Subject: [PATCH 09/10] Add a reference to safe deserlialization
---
src/site/xdoc/security.xml | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/src/site/xdoc/security.xml b/src/site/xdoc/security.xml
index b211fd77bd..150584ad35 100644
--- a/src/site/xdoc/security.xml
+++ b/src/site/xdoc/security.xml
@@ -114,5 +114,10 @@
-