Apache Sling 14 released

The Sling 14 release contains numerous improvements, such as official Java 25 Support and supporting the Jakarta Servlet API, and various performance improvements and updates.

Read on to see more details about the individual improvements. To find out more about running Sling, see our getting started page.

Official support for Java 25

The Sling Starter and included modules are validated to work on Java 17, 21 and 25.

Note that the org.apache.sling.commons.threads will not clean up leftover ThreadLocal instances unless the --add-opens java.base/java.lang=ALL-UNNAMED is passed to the JVM. This fix is already applied to the official Sling Starter Docker image and we anticipate further fixes in this area.

Support Jakarta Servlet API 6.1 and switch to Jetty 12

Sling Starter 14 runs on Jetty 12 and fully supports Jakarta Servlet API 6.1. However, OSGi bundles implemented against the old Servlet API 4 are still supported as well. You don't have to update your application code. New projects should start using the latest Servlet API right away.

See this talk for more details: adaptTo() 2025 - Seamless Transition: Apache Sling's Adoption of Jakarta Servlet API

Drop support for Java 11

All Sling modules that have been migrated to Jakarta Servlet API 6.1 have Java 17 as minimum version, so Java 11 is no longer supported for the Sling Starter.

Switch to jakarta.json completed

All modules have been migrated from org.json to jakarta.json and the Sling Starter 14 only comes with Apache Johnzon 2.x. If you still have modules using org.json, you can continue to use them, but you have to deploy a 1.x version of org.apache.sling.commons.json in addition to the 2.x version.

Switch to SLF4J 2

The Sling starter and a couple of core modules have switched to SLF4J 2. Apache Sling Commons Log 6 is included in Sling Starter 14 and comes with an updated logback implementation and full support for SLF4J 2. Bundles using SLF4J 1 are still supported.

Separate Bundle for Sling Event API

The Sling Event API, which was exported by the implementation bundle before, is now deployed as separate bundle org.apache.sling.event.api - ensuring a proper separation of API and implementation.

Sling Starter

Sling Starter now registers by default an JMX MBean platform powered by Apache Aries JMX.

By including a new JAXP Configurator bundle in the Sling Starter, CVE-2025-66516 is fixed. See Apache Sling advisory regarding CVE-2025-66516 for details.

Sling API

Two small additions to Sling API:

• SLING-12815 Expose methods to escape/unescape characters which are invalid in Sling Resource names
• SLING-12441 Support InputStream based request parameters in Builders

Version updates

All bundles have been updated to the latest versions.

New bundles added to Sling Starter:

• org.apache.aries.jmx.mbeanserver-platform
• org.apache.jackrabbit:oak-auth-external

The following bundles are removed from the Sling Starter:

• org.apache.sling.commons.johnzon 1.x

A couple of bundles changed their artifact ID and are thus replaced with the latest version using the latest artifact ID (e.g. Commons Math, Jetty).

OSGi Core R8 compliance

Sling Starter ships with Apache Felix 7 which implements OSGi Core R8 fully. In addition it comes with Felix SCR 2.2 which implements Declarative Services 1.5 (part of OSGi Compendium R8).

Aggregated list of changes

Generated by starter-comparator: Lists all bundle changes since the last Starter release, including links to issues found in the commit messages of the affected Sling bundles.

Added:

• org.apache.aries.jmx:org.apache.aries.jmx.mbeanserver-platform 0.0.1
• org.apache.commons:commons-math3 3.6.1
• org.apache.felix:org.apache.felix.http.jetty12 1.1.8
• org.apache.jackrabbit:oak-auth-external 1.90.0
• org.apache.sling:org.apache.sling.commons.log 6.0.4
• org.apache.sling:org.apache.sling.event.api 1.0.4
• org.apache.sling:org.apache.sling.jaxp-configurator 1.0.0

Removed:

• org.apache.commons:commons-math 2.2
• org.apache.felix:org.apache.felix.http.jetty 5.1.26
• org.apache.sling:org.apache.sling.commons.log 5.5.0
• org.slf4j:slf4j-api 1.7.36

Changed:

• com.composum.nodes:composum-nodes-commons 4.3.4 -> 4.3.5
• com.composum.nodes:composum-nodes-console 4.3.4 -> 4.3.5
• com.composum.nodes:composum-nodes-jslibs 4.3.4 -> 4.3.5
• com.composum.nodes:composum-nodes-pckgmgr 4.3.4 -> 4.3.5
• com.composum.nodes:composum-nodes-usermgr 4.3.4 -> 4.3.5
• com.fasterxml.jackson.core:jackson-annotations 2.18.2 -> 2.21
• com.fasterxml.jackson.core:jackson-core 2.18.2 -> 2.21.1
• com.fasterxml.jackson.core:jackson-databind 2.18.2 -> 2.21.1
• com.fasterxml.jackson.dataformat:jackson-dataformat-xml 2.18.2 -> 2.21.1
• com.fasterxml.woodstox:woodstox-core 7.1.0 -> 7.1.1
• commons-codec:commons-codec 1.17.2 -> 1.21.0
• commons-fileupload:commons-fileupload 1.5 -> 1.6.0
• commons-io:commons-io 2.18.0 -> 2.21.0
• org.apache.commons:commons-collections4 4.4 -> 4.5.0
• org.apache.commons:commons-lang3 3.17.0 -> 3.20.0
• org.apache.commons:commons-text 1.13.0 -> 1.15.0
• org.apache.felix:org.apache.felix.healthcheck.core 2.2.0 -> 2.3.0
• org.apache.felix:org.apache.felix.http.servlet-api 3.0.0 -> 6.1.0
• org.apache.felix:org.apache.felix.http.webconsoleplugin 1.2.0 -> 1.2.2
• org.apache.felix:org.apache.felix.scr 2.2.12 -> 2.2.14
• org.apache.felix:org.apache.felix.webconsole 5.0.8 -> 5.0.18
• org.apache.jackrabbit:jackrabbit-data 2.22.0 -> 2.22.3
• org.apache.jackrabbit:jackrabbit-jcr-commons 2.22.0 -> 2.22.3
• org.apache.jackrabbit:jackrabbit-spi 2.22.0 -> 2.22.3
• org.apache.jackrabbit:jackrabbit-spi-commons 2.22.0 -> 2.22.3
• org.apache.jackrabbit:jackrabbit-webdav 2.22.0 -> 2.22.3
• org.apache.jackrabbit:oak-api 1.72.0 -> 1.90.0
• org.apache.jackrabbit:oak-authorization-principalbased 1.72.0 -> 1.90.0
• org.apache.jackrabbit:oak-blob 1.72.0 -> 1.90.0
• org.apache.jackrabbit:oak-blob-plugins 1.72.0 -> 1.90.0
• org.apache.jackrabbit:oak-commons 1.72.0 -> 1.90.0
• org.apache.jackrabbit:oak-core 1.72.0 -> 1.90.0
• org.apache.jackrabbit:oak-core-spi 1.72.0 -> 1.90.0
• org.apache.jackrabbit:oak-jackrabbit-api 1.72.0 -> 1.90.0
• org.apache.jackrabbit:oak-jcr 1.72.0 -> 1.90.0
• org.apache.jackrabbit:oak-lucene 1.72.0 -> 1.90.0
• org.apache.jackrabbit:oak-query-spi 1.72.0 -> 1.90.0
• org.apache.jackrabbit:oak-security-spi 1.72.0 -> 1.90.0
• org.apache.jackrabbit:oak-segment-tar 1.72.0 -> 1.90.0
• org.apache.jackrabbit:oak-shaded-guava 1.72.0 -> 1.90.0
• org.apache.jackrabbit:oak-store-composite 1.72.0 -> 1.90.0
• org.apache.jackrabbit:oak-store-document 1.72.0 -> 1.90.0
• org.apache.jackrabbit:oak-store-spi 1.72.0 -> 1.90.0
• org.apache.jackrabbit.vault:org.apache.jackrabbit.vault 3.8.2 -> 4.2.0
• org.apache.pdfbox:fontbox 2.0.32 -> 2.0.35
• org.apache.pdfbox:pdfbox 2.0.32 -> 2.0.35
• org.apache.servicemix.bundles:org.apache.servicemix.bundles.thymeleaf 3.0.15.RELEASE_1 -> 3.1.2.RELEASE_1
• org.apache.sling:org.apache.sling.adapter 2.2.0 -> 2.3.0
  • SLING-11152 Use official OSGi Converter Implementation (Improvement)
  • SLING-12077 Migrate sling.adapter to jakarta.json (Sub-task)
  • SLING-12677 Upate to Parent 62 (Task)
• org.apache.sling:org.apache.sling.api 2.27.6 -> 3.0.2
  • SLING-12390 Mention IllegalStateException for order operation (Bug)
  • SLING-12441 Support InputStream based request parameters in Builders (Improvement)
  • SLING-12465 Remove usage of org.apache.sling.commons.testing in tests (Improvement)
  • SLING-12466 Fix javadoc for Authenticator (Improvement)
  • SLING-12604 Enhance Sling API to support Jakarta Servlet (Sub-task)
  • SLING-12643 Support Jakarta ServletAPI in Scripting (Sub-task)
  • SLING-12677 Upate to Parent 62 (Task)
  • SLING-12752 Support Jakarta Servlet 6.1 (Improvement)
  • SLING-12753 Add constants for sling.servlet.paths.strict (Improvement)
  • SLING-12754 NPE in error handling (Task)
  • SLING-12757 AbstractResource.getName() can throw exceptions (Task)
  • SLING-12761 Use default method for deprecated method in ResourceDecorator (Improvement)
  • SLING-12781 Expose resource type and resource super type always also via getValueMap() (Bug)
  • SLING-12815 Expose methods to escape/unescape characters which are invalid in Sling Resource names (Improvement)
  • SLING-12816 Clarify exceptions thrown from methods of o.a.s.a.r.ValueMap/ModifiableValueMap (Improvement)
  • SLING-12857 Allow null value for servlet wrappers (Task)
• org.apache.sling:org.apache.sling.auth.core 1.7.0 -> 2.0.2
  • SLING-12403 Ability to review sling authenticators handling authentication request (Improvement)
  • SLING-12448 Ability to review authenticated URL (Improvement)
  • SLING-12605 Enhance Auth Core to support Jakarta Servlet API (Sub-task)
  • SLING-12727 Auth Core: Update to Parent 62 (Task)
  • SLING-12752 Support Jakarta Servlet 6.1 (Improvement)
  • SLING-12885 AuthenticationHandler.FAILURE_REASON_CODES is deprecated with no non-deprecated replacement (Improvement)
• org.apache.sling:org.apache.sling.auth.form 1.0.24 -> 2.0.0
  • SLING-12573 Fix build for jdk17+ (Improvement)
  • SLING-12889 Update to Parent 62 (Improvement)
  • SLING-12890 bump commons-lang3 to 3.18.0 (Improvement)
  • SLING-12891 bump pax.exam to 4.14.0 (Improvement)
  • SLING-12957 migrate to Auth Core 2.x, Sling API 3.x and Jakarta Servlet (Sub-task)
  • SLING-12972 provide a standalone login page for the o.a.s.auth.form bundle (Sub-task)
• org.apache.sling:org.apache.sling.bundleresource.impl 2.3.4 -> 2.4.0
  • SLING-11649 Check for null BundleContext while registering bundle resources (Bug)
  • SLING-12063 Migrate sling.bundleresource.impl to jakarta.json (Sub-task)
  • SLING-12694 Update to Parent 62 (Task)
• org.apache.sling:org.apache.sling.caconfig.impl 1.6.0 -> 1.7.2
  • SLING-12064 Migrate sling.caconfig.impl to jakarta.json (Sub-task)
  • SLING-12147 caconfig-impl: Replace Sling XSS with OWASP Encoder (Improvement)
  • SLING-12361 caconfig: Update to Parent 60, Java 11 Minimum Version (Improvement)
  • SLING-12694 Update to Parent 62 (Task)
  • SLING-12708 caconfig impl: Fix bnd Import-Package statement (Bug)
• org.apache.sling:org.apache.sling.commons.log.webconsole 1.0.2 -> 2.0.0
  • SLING-12924 Migrate common log webconsole plugin to jakarta servlet (Improvement)
• org.apache.sling:org.apache.sling.discovery.base 2.0.14 -> 2.1.0
  • SLING-12065 Migrate sling.discovery.base to jakarta.json (Sub-task)
  • SLING-12699 Discovery Base & Commons: Make Build compatible with Java 17, Java 21 (Task)
• org.apache.sling:org.apache.sling.discovery.commons 1.0.28 -> 1.1.0
  • SLING-12066 Migrate sling.discovery.commons to jakarta.json (Sub-task)
  • SLING-12699 Discovery Base & Commons: Make Build compatible with Java 17, Java 21 (Task)
• org.apache.sling:org.apache.sling.discovery.oak 1.2.46 -> 1.2.48
• org.apache.sling:org.apache.sling.engine 2.16.0 -> 3.0.2
  • SLING-12607 Implement Jakarta Servlet based Sling API (Sub-task)
  • SLING-12640 Setting Sling filter service property sling.filter.scope to an invalid value does not disable the filter. (Bug)
  • SLING-12661 Potential origins of violations to the RequestDispatcher include API may run into OOM error on excessive recursions (Improvement)
  • SLING-12697 Potential origins of violations to the RequestDispatcher include API provides creates false positives on a committed response (Improvement)
  • SLING-12728 Engine: Update to Parent 62 (Task)
  • SLING-12752 Support Jakarta Servlet 6.1 (Improvement)
  • SLING-12801 Error handler does not reset the response during include (Bug)
  • SLING-12844 Potential origins of violations to the RequestDispatcher include API skips too many on committed responses (Bug)
  • SLING-12845 ProtectHeadersOnInclude functionality ignores changes to the response buffer size (Bug)
  • SLING-13049 Change "Content Type Header" error log to debug in SlingRequestProcessorImpl (Improvement)
  • SLING-13071 HTL use objects that adapt from the javax SlingHttpServletRequest cannot be instantiated in a Jakarta context (Bug)
  • SLING-13083 Code acessing the "request-parts-iterator" request attribute broken after migration to Jakarta (Bug)
  • SLING-13089 Filter Web Console Printer should expose HTTP Whiteboard filters for Sling context as well (Improvement)
  • SLING-13090 Filter Web Console Printer does not unwrap information for JavaxToJakartaFilterWrapper (Improvement)
  • SLING-13102 Add test coverage for TRACE-disabled handling and selector validation (Improvement)
• org.apache.sling:org.apache.sling.event 4.3.14 -> 4.4.0
  • SLING-9393 JobManager findJobs doesn't return hits when Templates are used (Bug)
  • SLING-11422 Stop embedding the event.api package in the event bundle (Improvement)
  • SLING-12078 Suspected race condition between TOPOLOGY_INIT and JobManager.addJob (Bug)
  • SLING-12261 Sling Event: Update to sling-bundle-parent 62 (Improvement)
  • SLING-12737 The method findJobs in JobManagerImpl does not accept a template containing an operation (Bug)
  • SLING-12743 Add condition readiness mechanism in JobManager to ensure system stability. (Task)
  • SLING-12819 fix flaky RoundRobinMaxParallelIT.testRoundRobinMaxParallel_fast (Task)
  • SLING-12966 Remove reproducible build workaround (Task)
• org.apache.sling:org.apache.sling.fsresource 2.2.0 -> 2.3.0
  • SLING-11519 Generate adapter metadata json for adaptations natively supported by FileResource (Bug)
  • SLING-12071 Migrate sling.fsresource to jakarta.json (Sub-task)
  • SLING-12491 Update to parent pom 52 (Improvement)
  • SLING-12677 Upate to Parent 62 (Task)
  • SLING-12680 FSResource: Eliminate ValueMap/Converter classes copied from Sling API (Improvement)
  • SLING-12685 FSResource: Fix or work around flaky FileMonitor unit tests on windows (Bug)
• org.apache.sling:org.apache.sling.i18n 2.6.6 -> 3.0.0
  • SLING-12312 add support for Sling API 3.x and Jakarta Servlet (Sub-task)
  • SLING-12899 Update to Parent 62 (Improvement)
• org.apache.sling:org.apache.sling.installer.core 3.14.2 -> 3.14.4
  • SLING-12843 Sling Installer ignores startlevel change of bundles (Bug)
• org.apache.sling:org.apache.sling.installer.factory.configuration 1.4.8 -> 1.4.10
  • SLING-12488 ConfigurationSerializerWebConsolePlugin: Emit configuration properties in alphabetical order (Improvement)
  • SLING-12495 ConfigurationSerializerWebConsolePlugin: Rework "Remove properties" logic (Bug)
• org.apache.sling:org.apache.sling.jcr.jackrabbit.accessmanager 4.0.2 -> 5.0.0
  • SLING-12868 migrate to Sling API 3.x and Jakarta Servlet (Sub-task)
  • SLING-12897 Update to Parent 62 (Improvement)
• org.apache.sling:org.apache.sling.jcr.jackrabbit.usermanager 2.2.30 -> 3.0.0
  • SLING-12869 migrate to Sling API 3.x and Jakarta Servlet (Sub-task)
  • SLING-12898 Update to Parent 62 (Improvement)
• org.apache.sling:org.apache.sling.jcr.oak.server 1.4.2 -> 1.4.4
  • SLING-12457 Make creation of Lucene index definition configurable (New Feature)
  • SLING-12848 Introduce ContentRepository Registration (Improvement)
• org.apache.sling:org.apache.sling.jcr.registration 1.0.6 -> 1.0.10
  • SLING-11413 Update parent bundle (48) to sling-jcr-registration (Sub-task)
  • SLING-13013 Update to Parent 62 (Improvement)
  • SLING-13023 JCR Repository Registration: Fix optional imports (Bug)
• org.apache.sling:org.apache.sling.jcr.repoinit 1.1.52 -> 1.1.54
  • SLING-12642 Repoinit: Improve privilege retrieval (Task)
  • SLING-12662 Build with Java 11, 17 and 21 (Task)
  • SLING-12663 Log total execution time for repoinit statements (Task)
  • SLING-12668 Repoinit JCR: Forced multivalue property with single value is not stored as multiple property (Bug)
  • SLING-12670 RepoInit: Update to Parent 62 (Task)
• org.apache.sling:org.apache.sling.jcr.resource 3.3.2 -> 3.3.6
  • SLING-12742 Don't swallow java.io.NotSerializableException in JcrPropertyMapCacheEntry.createValue() (Improvement)
  • SLING-12781 Expose resource type and resource super type always also via getValueMap() (Bug)
  • SLING-12940 ResourceChangeListener reads userData from external events (Improvement)
• org.apache.sling:org.apache.sling.models.api 1.5.4 -> 2.0.0
  • SLING-12694 Update to Parent 62 (Task)
  • SLING-12874 migrate ModelFactory to Sling API 3.x and Jakarta Servlet (Sub-task)
• org.apache.sling:org.apache.sling.models.impl 1.7.8 -> 2.0.2
  • SLING-12875 migrate ModelFactoryImpl to Sling API 3.x and Jakarta Servlet (Sub-task)
  • SLING-13050 Models Impl: Include Integration Tests (Task)
  • SLING-13052 [SONAR] Add missing assertions to AdapterFactoryTest (java:S2699) (Test)
  • SLING-13062 [Sling Models] Migrate basic injectors tests to JUnit 5 (Improvement)
  • SLING-13063 [Sling Models] Migrate SlingObject, Self, and legacy Injector tests to JUnit 5 (Improvement)
  • SLING-13064 [Sling Models] Migrate 'via' package unit tests to JUnit 5 (Improvement)
  • SLING-13066 [Sling Models] Migrate implpicker and basic root tests to JUnit 5 (Improvement)
  • SLING-13068 Models: Update to Parent 65 (Task)
  • SLING-13072 [Sling Models] Migrate defaults and inheritance root tests to JUnit 5 (Improvement)
  • SLING-13077 ExportServlet cannot adapt model to javax SlingHttpServletRequest when running in a Jakarta Servlet environment (Bug)
  • SLING-13079 Models Jackson Exporter: Include Integration Tests (Task)
  • SLING-13088 [Sling Models] Migrate ModelAdapterFactory, Ordering, and OSGi tests to JUnit 5 (Improvement)
  • SLING-13092 ModelConfigurationPrinter does not properly emit properties containing an array (Improvement)
  • SLING-13101 [Sling Models] Migrate Request, Resource, and PostConstruct Tests to JUnit 5 (Improvement)
  • SLING-13115 [Sling Models] Migrate ServiceAdapters, StaticFieldInjection, and Via Tests to JUnit 5 (Improvement)
• org.apache.sling:org.apache.sling.models.jacksonexporter 1.1.4 -> 2.0.0
  • SLING-11969 Improve the ConfigurableSerializationModuleProvider (Task)
  • SLING-12213 Update dependency versions (Task)
  • SLING-12242 Improve unit tests (JacksonExporterLimitSerializationTest) (Task)
  • SLING-12360 Models: Update to Parent 60, Java 11 Minimum Version (Improvement)
  • SLING-12840 Update to Sling API 3 (Sub-task)
• org.apache.sling:org.apache.sling.repoinit.parser 1.9.0 -> 1.9.2
  • SLING-12668 Repoinit JCR: Forced multivalue property with single value is not stored as multiple property (Bug)
  • SLING-12669 Repoinit: Fix unit test failure on Windows (Bug)
  • SLING-12670 RepoInit: Update to Parent 62 (Task)
• org.apache.sling:org.apache.sling.resource.filter 1.0.0 -> 1.0.2
  • SLING-11562 Update parent bundle (49) to sling-resource-filter (Task)
  • SLING-13013 Update to Parent 62 (Improvement)
  • SLING-13014 Resource Filter: Update to JavaCC 3.0.1 (Improvement)
• org.apache.sling:org.apache.sling.resourceresolver 1.12.2 -> 2.0.2
  • SLING-12636 Resource Resolver: add test coverage for background init (Sub-task)
  • SLING-12645 Resource Resolver: VanityPathMapEntriesTest - remove historic test vector for query paging (Sub-task)
  • SLING-12646 Resource Resolver: MapEntries: give doInit() a meaningful name (Sub-task)
  • SLING-12648 Resource Resolver: MapEntries: factor out vanity path handling (Sub-task)
  • SLING-12649 Resource Resolver: VanityPathMapEntriesTest - factor out repeated uses of reflection (Sub-task)
  • SLING-12651 ResourceResolver: avoid re-assignment of resolveMapsMap (Sub-task)
  • SLING-12653 ResourceResolver: add test coverage for query exception disabling optimized alias handling (Sub-task)
  • SLING-12658 Resource Resolver: refactor vanity path handling - encapsulate code for better isolation and unit testing (Sub-task)
  • SLING-12664 Resource Resolver: MapEntries: drainQueue is part of event handling (move it there) (Sub-task)
  • SLING-12665 Resource Resolver: MapEntries: extract VanityPathHandler (Sub-task)
  • SLING-12666 Resource Resolver: VanityPathHandler, address warnings, refactor (Sub-task)
  • SLING-12667 Resource Resolver: cleanup/improve VanityPathsMapEntriesTest (Sub-task)
  • SLING-12671 ResourceResolver: add test coverage for vanity paths on resources with name extensions (Sub-task)
  • SLING-12679 ResourceResolver: incorrect metrics init (Sub-task)
  • SLING-12684 ResourceResolver: update to latest Sling parent pom (Task)
  • SLING-12686 Resource Resolver: add test coverage for events during VP bg init (Sub-task)
  • SLING-12688 Resource Resolver: add test coverage for VP init failure (Sub-task)
  • SLING-12696 ResourceResolver: alias refactoring - move alias related code into single place (Sub-task)
  • SLING-12700 Resource Resolver: add test coverage for vanity path cache metrics (Sub-task)
  • SLING-12701 Resource Resolver: MapEntries - move alias handling into inner class (Sub-task)
  • SLING-12703 ResourceResolver: initializeAliases after MapEntries.dispose causes NPE (Bug)
  • SLING-12716 Resource Resolver: Switch to Parent 62 (Task)
  • SLING-12733 ResourceMapper.getMapping(...) may return null (Improvement)
  • SLING-12735 Resource Resolver: AliasHandler refactoring (Sub-task)
  • SLING-12741 NPE resource resolver during resource provider unregisteration (Bug)
  • SLING-12752 Support Jakarta Servlet 6.1 (Improvement)
  • SLING-12758 ResourceResolver: remove redundant check for absolute path in alias (Sub-task)
  • SLING-12759 ResourceResolver: push 'non-optimized' alias handling from ResourceResolverImpl into AliasHandler (Sub-task)
  • SLING-12763 ResourceResolver: cleanup API of AliasHandler wrt 'optimized resolution' (Sub-task)
  • SLING-12777 ResourceResolver: alias refactoring - make ResourceMapperImpl ignorant of optimimized/non-optimized case (Sub-task)
  • SLING-12787 ResourceResolver: alias refactoring - use Resource instead of Path when getting aliases (Sub-task)
  • SLING-12795 Resource Resolver: align behavior for cached ('optimized') and non-cached case (Sub-task)
  • SLING-12799 ResourceResolver: alias refactoring - check behavior when aliases both on node and jcr:content child node (Sub-task)
  • SLING-12804 ResourceResolver: alias refactoring - improve test coverage of query statements (Sub-task)
  • SLING-12806 Prevent creating resources with a name only consisting of dots (Improvement)
  • SLING-12823 ResourceResolver: alias refactoring - avoid getting the parent resource when path sufficient (Sub-task)
  • SLING-12832 ResourceResolver: alias refactoring - move alias init into Runnable (Sub-task)
  • SLING-12879 ResourceResolver: add option to run alias initializer in background (Sub-task)
  • SLING-12884 ResourceResolver: refactor mocking in AliasMapEntriesTest (Sub-task)
  • SLING-12894 ResourceResolver: alias refactoring - support observation events while bg init not finished (Sub-task)
  • SLING-12896 ResourceResolver: alias refactoring - clean up vanity path tests (Sub-task)
  • SLING-12900 ResourceResolver: improve test coverage for VP bg init vs events, minor refactoring (Sub-task)
  • SLING-12901 ResourceResolver: alias refactoring - NPE when attempting to alias root (Sub-task)
  • SLING-12908 ResourceResolver: alias refactoring - remove warn/logging for "non-optimize" case (Sub-task)
  • SLING-12910 ResourceResolver: log all alias/vanity settings on startup (Sub-task)
  • SLING-12911 ResourceResolver: alias refactoring - remove dead code 'isOptimized...' (Sub-task)
  • SLING-12912 ResourceResolver: alias handling: wire alias bg cache init to OSGi (Sub-task)
  • SLING-12913 ResourceResolver: update commons-lang3 dependency to 3.18.0 (Task)
  • SLING-12917 ResourceResolver: alias refactoring - log elapsed time for draining observation queue (also add a timing formatter and use it throughout) (Sub-task)
• org.apache.sling:org.apache.sling.scripting.core 2.4.10 -> 3.0.2
  • SLING-12609 Implement Jakarta Servlet based Sling API (Sub-task)
  • SLING-12643 Support Jakarta ServletAPI in Scripting (Sub-task)
  • SLING-12730 Scripting: Update to Parent 62 (Task)
  • SLING-12752 Support Jakarta Servlet 6.1 (Improvement)
  • SLING-13070 ScriptContextProvider for bundled scripts does not properly set JAKARTA_REQUEST and JAKARTA_REPONSE (Bug)
  • SLING-13103 Wrong ResourceResolver set in script bindings after request dispatch in a Jakarta Context (Bug)
• org.apache.sling:org.apache.sling.scripting.sightly 1.4.26-1.4.0 -> 2.0.0-1.4.0
  • SLING-12730 Scripting: Update to Parent 62 (Task)
  • SLING-12755 Break cyclic dependencies between the SightlyScriptEngineFactory and the BundledUnitManagerImpl service (Bug)
  • SLING-12881 fix jacoco analysis (Improvement)
  • SLING-12883 migrate to Sling API 3.x and Jakarta Servlet (Sub-task)
• org.apache.sling:org.apache.sling.scripting.sightly.js.provider 1.2.10 -> 1.2.14
  • SLING-12635 JS Use Scripts should only be read on-demand (Bug)
  • SLING-12730 Scripting: Update to Parent 62 (Task)
  • SLING-12755 Break cyclic dependencies between the SightlyScriptEngineFactory and the BundledUnitManagerImpl service (Bug)
• org.apache.sling:org.apache.sling.scripting.spi 1.0.4 -> 2.0.0
  • SLING-12762 Support Jakarta Servlet API in Scripting SPI (Sub-task)
• org.apache.sling:org.apache.sling.servlets.get 2.2.0 -> 3.0.0
  • SLING-12610 Migrate Servlets Get to Jakarta Servlet API (Sub-task)
  • SLING-12726 Servlets: Update to Parent 62 (Task)
  • SLING-12751 Switch to SLF4J 2 (Improvement)
• org.apache.sling:org.apache.sling.servlets.post 2.6.0 -> 3.0.2
  • SLING-11971 Log duration of each PostProcessor (Task)
  • SLING-12614 Add Jakarta Servlet based API to Post Servlet (Sub-task)
  • SLING-12726 Servlets: Update to Parent 62 (Task)
  • SLING-12751 Switch to SLF4J 2 (Improvement)
  • SLING-12944 SlingPostServlet fails when resource contains property not backed by JCR property (Bug)
  • SLING-13086 SlingPostServlet no longer register PostOperation services after the Jakarta migration (Bug)
• org.apache.sling:org.apache.sling.servlets.resolver 2.11.8 -> 3.0.6
  • SLING-12433 [BundledScriptTracker] Fix ConcurrentModificationException (Bug)
  • SLING-12599 Make dependency to Apache Felix HC optional (Improvement)
  • SLING-12608 Implement Jakarta Servlet based Sling API (Sub-task)
  • SLING-12643 Support Jakarta ServletAPI in Scripting (Sub-task)
  • SLING-12726 Servlets: Update to Parent 62 (Task)
  • SLING-12729 Servlet Resolver: Integration tests fail with Java 21 (Bug)
  • SLING-12739 Allow for selectively hiding scripts and servlets from the Sling resolver (Improvement)
  • SLING-12752 Support Jakarta Servlet 6.1 (Improvement)
  • SLING-12854 Allow for hiding scripts/servlets from the resolver (port SLING-12739 to master) (Task)
  • SLING-13016 RequestWrapper causes NPEs when serving bundled scripts if 'forceResourceType' is not set (Bug)
  • SLING-13027 Servlets Resolver: Add Jakarta JSON dependency (Improvement)
  • SLING-13091 Sling Servlet Resolver Web Console does not unwrap info about org.apache.sling.servlets.resolver.internal.ServletWrapperUtil$JakartaScriptServletWrapper (Improvement)
• org.apache.sling:org.apache.sling.settings 1.4.2 -> 1.5.0
  • SLING-11152 Use official OSGi Converter Implementation (Improvement)
  • SLING-12988 Concurrent checks for a runmode can block under concurrency (Task)
  • SLING-12989 Apply spotless formatting (Task)
  • SLING-12990 Settings: update to latest parent (Task)
  • SLING-12991 Settings: update commons-lang test dependency (Task)
• org.apache.sling:org.apache.sling.starter.content 1.0.16 -> 2.0.2
  • SLING-12882 Migrate Starter Content to sling api 3.0 and models api 2.0 (Improvement)
  • SLING-12969 The OpenSans fonts are corrupted by the build process (Bug)
  • SLING-12971 move the original auth.form login form to o.a.s.starter.content bundle (Sub-task)
• org.apache.sling:org.apache.sling.xss 2.4.2 -> 2.4.8
  • SLING-12531 Update Sling dependencies (Improvement)
  • SLING-12563 Remove java8 support for Sling XSS (New Feature)
  • SLING-12569 Update esapi to 2.6.0.0 (Task)
  • SLING-12616 Performance improvement in Sling XSS bundle (Improvement)
  • SLING-12622 Review improvement of SLING-12616 (Task)
  • SLING-12628 Avoid import of org.apache.commons.fileupload (Improvement)
  • SLING-12677 Upate to Parent 62 (Task)
  • SLING-12930 XSS API fails to build and run with Java 25 due to missing Unsafe.ensureClassInitialized (Improvement)
• org.freemarker:freemarker 2.3.32 -> 2.3.34
• org.ow2.asm:asm 9.7.1 -> 9.9.1
• org.ow2.asm:asm-analysis 9.7.1 -> 9.9.1
• org.ow2.asm:asm-commons 9.7.1 -> 9.9.1
• org.ow2.asm:asm-tree 9.7.1 -> 9.9.1
• org.ow2.asm:asm-util 9.7.1 -> 9.9.1
• org.owasp.encoder:encoder 1.3.1 -> 1.4.0
• org.slf4j:jcl-over-slf4j 1.7.36 -> 2.0.17
• org.slf4j:log4j-over-slf4j 1.7.36 -> 2.0.17