13 May 23:29

bjagg

89d3728

Latest

Patch release on top of 3.4.2, focused on the resource-server consolidation work. Migrates CKEditor 4 from the legacy resource-server-content overlay's CKEditor 4.3.2 to webjar 4.22.1, picks up uPortal libraries 5.17.7 (the LESS deprecation fix), and adds a Maven release-cut script.

Refactor

Migrate CKEditor 4 to webjar 4.22.1 (#554)

configureContent.jsp formerly loaded CKEditor 4.3.2 via the resource-server-content overlay's /rs/ckeditor/4.3.2/... paths and the <rs:compressJs> taglib. The 4.3.2 sources have multiple historical XSS CVEs, and the resource-server-content overlay is being deleted in the upcoming resource-server 1.5.4 release.

This change swaps the JSP to consume CKEditor 4.22.1 from org.webjars.npm:ckeditor4 (the last free CKEditor 4 — 4.23+ moved to a paid LTS license) and drops the <rs:compressJs> calls. The resource-server-content overlay dependency is removed from pom.xml.

Dependency bumps

uPortal libraries 5.17.3 → 5.17.7 (#553)

Picks up uPortal's LESS pipeline deprecation fix (uPortal#2982 in v5.17.7) and the other patch-level fixes in the 5.17.4–5.17.7 range. No source-level changes in SimpleContentPortlet are required.

Tooling

Release script (#557, #558)

Add release-portlet.sh at the repo root — a Maven preflight + release cut script encoding the Maven release process for ecosystem components. Non-interactive: passes release version, development version, and tag on the CLI. Used to cut this release.
Renovate config update (#555)

Block renovate from raising PRs for the in-progress Jakarta/JUnit 5 migration and for retired Apereo projects.

Upgrade notes

Deployers updating from 3.4.2: drop-in replacement. CKEditor 4 still serves the same configuration API; only its bundled version moves from 4.3.2 (2014) to 4.22.1 (2023). If you've customized CKEditor templates against the 4.3.2 internal directory structure, verify they still load — webjar paths resolve under /resource-server/webjars/ckeditor4/4.22.1/... rather than /ResourceServingWebapp/rs/ckeditor/4.3.2/....
Deployers tracking the resource-server consolidation: this release removes SimpleContentPortlet's runtime dependency on the resource-server-content overlay. After the next resource-server release (1.5.4, where the dropped JS bundles ship), no SimpleContentPortlet code will need legacy /ResourceServingWebapp/ paths.

Assets 2

04 May 22:24

bjagg

SimpleContentPortlet-3.4.2

6b5869d

SimpleContentPortlet 3.4.2

Patch release on top of 3.4.1. Fixes the most user-visible regression of the 2026-05 fleet wave plus a fleet-wide listener cleanup.

Fix

The cms portlet couldn't render anything (PR #550). 3.4.1 shipped portletmvc4spring 5.3.4 (via Renovate). Starting at 5.2.1, portletmvc4spring's PortletRequestMappingHandlerAdapter.invokeHandlerMethod calls PortletRequest.getRenderParameters() unconditionally, which is a JSR-362 (Portlet 3.0) API method. uPortal/Pluto provides only JSR-286 (Portlet 2.0); Apache Pluto is in the Attic with no Portlet 3.0 / Jakarta path.

The result was that every portlet region rendered by the cms portlet failed with NoSuchMethodError — waffle-menu, notification-icon, feedback-navigation, legal-footer, portal-logo, attachments, logging-in, uportal-links. In the rendered page that showed up as "An error occurred loading this content" in the chrome regions, and it accounted for ~16 of the 23 Playwright smoke-test failures observed in uPortal-start after the 2026-05 fleet release wave. This was the most user-visible regression of the entire wave.

The fix pins portletmvc4spring.version to 5.2.0 — the last Portlet-2.0-compatible release. (uportal-portlet-parent v51 already declares 5.2.0 as its dependencyManagement default for the artifact; this patch aligns the local override with that default.) Renovate is now pinned at <= 5.2.0 so this bump can't recur.

The breakpoint was identified by bytecode-grepping PortletRequestMappingHandlerAdapter.class across portletmvc4spring 5.1.0 → 5.3.4 for references to getRenderParameters:

version	refs
5.1.0	0
5.2.0	0
5.2.1	1
5.2.2–5.3.4	1

Cleanup

Drop dead Logback ContextDetachingSCL listener from web.xml (PR #551). The class was part of Logback's J2EE selector machinery and was removed in Logback 1.3.x. With the 3.4.1 wave bumping Logback to 1.5.32, the listener was a tripwire that would fail context startup the moment Tomcat's listener-loading rules tightened. Same fix landing across the rest of the fleet.

Compatibility

Drop-in upgrade for any deployment running 3.4.1.
No schema changes, no API contract changes.
Java 11, Tomcat 8.5/9.x as before.

Out of scope

The broader Spring 4.3 → 5.3 / Hibernate 4.3 → 5.6 upgrade that 3.4.1 brought in stays. This patch only rolls back the one dep that introduced the Portlet 3.0 incompatibility.

Assets 2

03 May 07:41

bjagg

SimpleContentPortlet-3.4.1

ac6267e

SimpleContentPortlet 3.4.1

Latest 3.4.x maintenance release. Aligns SimpleContentPortlet to uportal-portlet-parent v51, retires CVE-bearing dependencies, drops a pile of redundant local plugin overrides now that the parent provides them at current versions, and modernizes the build/CI on top of three years of accumulated Renovate work.

No functional behavior changes. Drop-in upgrade for any deployment running 3.4.0.

Security fixes

CVE-2023-37460 — plexus-archiver symlink path traversal during WAR packaging. Picked up via maven-war-plugin 3.5.1 (inherited from parent v50+) and plexus-archiver 4.11.0.
CVE-2025-48924 — commons-lang 2.x denial-of-service in StringUtils.escapeJava. Resolved by migrating from commons-lang 2.6 to commons-lang3 (#545, source migration across 7 files).

Pom hygiene (the bulk of this release)

This release shipped a methodical cleanup of local plugin/dep overrides that had accumulated over years and were now redundant with parent v48+ defaults:

Drop local maven-compiler-plugin override + pin jakarta/hibernate-orm in renovate (#522). The compiler-plugin pin was duplicating the parent's binding; removed in favor of inheritance. Renovate pins added for jakarta.* and hibernate-orm so the bot stops opening major-version PRs that cross the Spring 6 / Jakarta migration boundary.
Drop local mockito-core override, inherit parent 4.9.0 (#525). The local mockito pin had drifted from the fleet; now matches every other portlet under uportal-portlet-parent.
Split jaxb-api and jaxb-runtime version properties (#526). The single jaxb.version property was incorrectly applied to both the API artifact (jakarta.xml.bind-api — 4.x line) and the runtime artifact (jaxb-runtime — 4.x line) which travel on different cadences in this codebase. Split into jaxb-api.version and jaxb-runtime.version so each can move independently.
Drop plexus-archiver plugin-level override on maven-war-plugin (#544). Parent v50 binds maven-war-plugin 3.5.1 with bundled plexus-archiver 4.10.4 (CVE-2023-37460 patched); the local override was holding back to 4.8.0.

Build / dependency modernization

Parent: uportal-portlet-parent:46 → 47 → 48 → 49 → 50 → 51. Each step kept master green; the v51 step required the commons-lang3 source migration above.
NOTICE: regenerated against the post-v51 dep tree (#549). Drops several Eclipse Equinox / Aether / Maven plugin shells that were transitive but unused at runtime; picks up Apache Commons Lang (lang3) and Apache FreeMarker; license-name normalization across several entries.
Direct dependency bumps over the 3.4.0 → 3.4.1 span:
- spring-core → 5.3.39 (latest in the 5.3 line; full Spring 6 migration is fleet-level)
- spring-data-jpa → 2.7.18
- portletmvc4spring → 5.3.4
- aws-java-sdk-s3 → 1.12.797
- commons-codec → 1.22.0
- commons-io → 2.22.0
- commons-collections4 → 4.5.0
- plexus-archiver → 4.11.0
- resource-server → 1.5.3
- uPortal-spring → 5.17.3
Maven plugin bumps: maven-enforcer-plugin 3.6.2, maven-javadoc-plugin 3.12.0, maven-release-plugin 3.3.1, maven-scm-provider-gitexe 2.2.1.

Frontend refresh

jQuery / Bootstrap update contributed by @Naenyn (#514).

CI / tooling

Java matrix narrowed to Java 11 only — matches the rest of the uPortal fleet under uportal-portlet-parent.
GitHub Actions: actions/checkout v4 → v6, actions/setup-java v4 → v5.
Renovate rules tightened — pins for commons-lang, jakarta.*, and hibernate-orm constrained to versions this codebase actually supports, so Renovate stops opening un-mergeable major-bump PRs.

Compatibility

Runs on Java 11 (the fleet floor for portlets under uportal-portlet-parent). Tomcat 8.5/9.x runtime as before.
Portlet API contract unchanged — JSR-286 portlet + Spring portlet MVC. No DB schema changes. No portlet preferences additions or renames.
Existing portlet preferences and stored content load without migration.

Follow-ups

Three open Renovate PRs are intentionally deferred — all gated by the broader Spring 6 / Jakarta EE migration:

#546 — replace org.hibernate:hibernate-c3p0 with org.hibernate.orm:hibernate-c3p0 7.x.
#547 — replace org.hibernate:hibernate-core with org.hibernate.orm:hibernate-core 7.x.
#548 — replace org.hibernate:hibernate-jpamodelgen with org.hibernate.orm:hibernate-processor 7.x.

The Hibernate 7.x line requires Jakarta Persistence 3.x and Spring 6 — incompatible with the current Spring 5.3 / javax.persistence stack here. Migration is tracked at the fleet level for a future major (4.0.0).

Contributors

Naenyn

Assets 2

19 Jan 17:09

loulou2u

SimpleContentPortlet-3.4.0

9734d81

SimpleContentPortlet-3.4.0

What's Changed

fix(deps): update dependency ch.qos.logback:logback-classic to v1.2.11 by @renovate in #404
fix(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.226 by @renovate in #405
fix(deps): update dependency org.jasig.portal:uportal-api-search to v5.11.1 by @renovate in #406
fix(deps): update dependency org.jasig.portal:uportal-spring to v5.11.1 by @renovate in #407
fix(deps): update slf4j.version to v1.7.36 by @renovate in #408
chore(deps): update actions/checkout action to v3 by @renovate in #409
chore(deps): update actions/setup-java action to v3 by @renovate in #410
fix(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.260 by @renovate in #414
chore(deps): update dependency org.apache.maven.scm:maven-scm-provider-gitexe to v1.13.0 by @renovate in #415
fix(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.271 by @renovate in #417
chore(deps): update dependency org.apache.maven.plugins:maven-enforcer-plugin to v3.1.0 by @renovate in #419
fix(deps): update jackson.version to v2.13.4 by @renovate in #418
fix(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.297 by @renovate in #420
fix(deps): update dependency ch.qos.logback:logback-classic to v1.4.0 by @renovate in #422
chore(deps): update dependency org.apache.maven.plugins:maven-release-plugin to v3.0.0-m6 by @renovate in #421
chore(deps): update dependency org.apache.maven.plugins:maven-compiler-plugin to v3.10.1 by @renovate in #396
fix(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.300 by @renovate in #423
fix(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.305 by @renovate in #426
fix(deps): update dependency org.jasig.portal:uportal-api-search to v5.12.0 by @renovate in #427
fix(deps): update dependency org.jasig.portal:uportal-spring to v5.12.0 by @renovate in #428
fix(deps): update dependency ch.qos.logback:logback-classic to v1.4.1 by @renovate in #425
fix(deps): update dependency ch.qos.logback:logback-classic to v1.4.3 by @renovate in #429
fix(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.316 by @renovate in #430
fix(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.326 by @renovate in #432
fix(deps): update dependency ch.qos.logback:logback-classic to v1.4.4 by @renovate in #431
fix(deps): update dependency ch.qos.logback:logback-classic to v1.4.5 by @renovate in #435
fix(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.362 by @renovate in #436
UPSE-287: added Java 11 github build; fixed logging by @groybal in #447
fix(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.386 by @renovate in #448
fix(deps): update dependency org.jasig.portal:uportal-api-search to v5.13.1 by @renovate in #449
fix(deps): update dependency org.jasig.portal:uportal-spring to v5.13.1 by @renovate in #450

Full Changelog: SimpleContentPortlet-3.3.2...SimpleContentPortlet-3.4.0

Contributors

renovate and groybal

Assets 2

24 Feb 17:49

bjagg

SimpleContentPortlet-3.3.2

7fcbdf0

SimpleContentPortlet-3.3.2

Changes since v3.3.1:

Fixes

fix: update XML files to address parsing error

Chores

chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.138
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.137
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.136
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.134
chore(deps): update dependency org.apache.maven.plugins:maven-release-plugin to v3.0.0-m5
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.133
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.132
chore(deps): update dependency org.apache.maven.scm:maven-scm-provider-gitexe to v1.12.2
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.131
chore(deps): update dependency ch.qos.logback:logback-classic to v1.2.10
chore(deps): update jackson.version to v2.13.1
chore(deps): update dependency ch.qos.logback:logback-classic to v1.2.9
chore(deps): update dependency ch.qos.logback:logback-classic to v1.2.8
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.129
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.128
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.126
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.124
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.122
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.121
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.119
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.118
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.117
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.116
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.115
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.114
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.113
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.112
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.111
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.109
chore(deps): update dependency ch.qos.logback:logback-classic to v1.2.7
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.108
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.107
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.105
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.104
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.102
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.101
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.100
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.99
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.98
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.96
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.95
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.94
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.89
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.88
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.85
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.84
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.83
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.81
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.80
chore(deps): update jackson.version to v2.13.0
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.78
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.77
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.74
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.73
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.71
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.70
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.69
chore(deps): update dependency org.apache.maven.scm:maven-scm-provider-gitexe to v1.12.0
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.66
chore(deps): update dependency org.apache.maven.plugins:maven-war-plugin to v3.3.2
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.65
chore(deps): update dependency ch.qos.logback:logback-classic to v1.2.6
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.62
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.61
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.60
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.59
chore(deps): update jackson.version to v2.12.5
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.58
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.57
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.56
chore(deps): update dependency org.mockito:mockito-core to v3.12.4
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.55
chore(deps): update dependency org.apache.maven.plugins:maven-war-plugin to v3.3.1
chore(deps): update dependency org.mockito:mockito-core to v3.12.3
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.54
ci: add java distribution to ci setup script
chore(deps): update actions/setup-java action to v2
chore(deps): update dependency org.mockito:mockito-core to v3.12.2
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.53
chore(deps): update dependency org.mockito:mockito-core to v3.12.1
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.51
chore(deps): update dependency org.mockito:mockito-core to v3.12.0
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.50
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.49
chore(deps): update dependency commons-io:commons-io to v2.11.0
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.47
chore(deps): update dependency org.jasig.portal:uportal-api-search to v5.11.0
chore(deps): update dependency org.apache.maven.scm:maven-scm-provider-gitexe to v1.11.3
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.46
chore(deps): update dependency org.jasig.portal:uportal-spring to v5.11.0
chore(deps): update jackson.version to v2.12.4
chore(deps): update slf4j.version to v1.7.32
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.44
chore(deps): update dependency org.apache.maven.plugins:maven-enforcer-plugin to v3
chore(deps): update dependency org.mockito:mockito-core to v3.11.2
chore(deps): update dependency ch.qos.logback:logback-classic to v1.2.5
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.16
chore(deps): update dependency commons-io:commons-io to v2.10.0
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.14
chore(deps): update dependency com.amazonaws:aws-java-sdk-s3 to v1.12.9
chore(deps): update slf4j.version to v1.7.31
ci: setup github actions for continuous integration
Update jackson.version to v2.12.3
Update dependency org.apache.maven.plugins:maven-release-plugin to v3.0.0-M4
Update dependency com.amazonaws:aws-java-sdk-s3 to v1.11.1030
Update dependency com.amazonaws:aws-java-sdk-s3 to v1.11.957
Update dependency junit:junit to v4.13.2
Update dependency org.mockito:mockito-core to v3.7.7
Update dependency com.amazonaws:aws-java-sdk-s3 to v1.11.937
Update jackson.version to v2.12.1
Update dependency org.mockito:mockito-core to v3.7.0
Update dependency org.jasig.portal:uPortal-spring to v5.9.0
Update dependency org.jasig.portal:uPortal-api-search to v5.9.0
Update dependency com.amazonaws:aws-java-sdk-s3 to v1.11.930
Update dependency com.amazonaws:aws-java-sdk-s3 to v1.11.924
Update dependency org.hsqldb:hsqldb to v2.5.1
Update dependency com.amazonaws:aws-java-sdk-s3 to v1.11.916
Update jackson.version to v2.12.0
Update dependency org.mockito:mockito-core to v3.6.28
Update spring core to v4.3.30.RELEASE
Update dependency com.amazonaws:aws-java-sdk-s3 to v1.11.907
Update dependency org.webjars.npm:pdfobject to v2.2.4
Update dependency org.mockito:mockito-core to v3.6.0
Update dependency com.amazonaws:aws-java-sdk-s3 to v1.11.882
Update dependency com.amazonaws:aws-java-sdk-s3 to v1.11.881
Update dependency junit:junit to v4.13.1
Update dependency com.amazonaws:aws-java-sdk-s3 to v1.11.878
Update jackson.version to v2.11.3
Update dependency commons-io:commons-io to v2.8.0
Update dependency com.amazonaws:aws-java-sdk-s3 to v1.11.871
Update dependency org.mockito:mockito-core to v3.5.13
Update dependency com.amazonaws:aws-java-sdk-s3 to v1.11.866
Update dependency com.amazonaws:aws-java-sdk-s3 to v1.11.865
Update dependency org.mockito:mockito-core to v3.5.11
Update dependency com.amazonaws:aws-java-sdk-s3 to v1.11.863
Update spring core to v4.3.29.RELEASE
Update dependency com.amazonaws:aws-java-sdk-s3 to v1.11.861
Update dependency com.amazonaws:aws-ja...