chore: release 3.3.0, and put 3.2.0's notes back - #23
Merged
Conversation
3.2.0 was already released — GitHub Release dated 2026-07-30, artifacts on Maven Central, tag v3.2.0 pointing at c99bb0e. I had read `VERSION=3.2.0-SNAPSHOT` in gradle.properties as "3.2.0 is unreleased", when it is the ordinary marker for the next development version. Two security fixes and a release commit went onto main under that misreading. Nothing shipped wrongly: the v3.2.0 tag was never moved, so the published artifact and its tag still agree. What had to be undone was the changelog. The [3.2.0] section in all three files is restored to exactly what shipped — verified byte-identical against `git show v3.2.0:` — and the two new entries move into a new [3.3.0]. 3.3.0 rather than 3.2.1: RedirectGuard is new public API, and SsrfGuardedHttpClient now REFUSES a delegate that follows redirects itself, which breaks anyone who passed Redirect.NORMAL. Those callers were getting no hop validation at all, so the break is the fix becoming visible — but it is a break, and a patch number would hide it. Major stays 3 because in this org the library major tracks the Spring Boot major, so the migration note carries the weight instead. Version references bumped in gradle.properties, both READMEs, both installation guides and both index pages. Changelog history untouched. Verified: ./gradlew build BUILD SUCCESSFUL, 239 tests, failures=0.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
먼저, 제 실수를 정정합니다
3.2.0은 이미 출시돼 있었습니다.
제가
gradle.properties의VERSION=3.2.0-SNAPSHOT을 "3.2.0 미출시"로 읽었는데, 그건 다음 개발 버전을 가리키는 관례입니다. 태그와 Maven Central을 먼저 확인했어야 했습니다. 그 오독 위에서 보안 수정 2건과 릴리스 커밋이 main에 올라갔습니다.잘못 나간 것은 없습니다.
v3.2.0태그를 옮기지 않았으므로 배포된 아티팩트와 태그는 여전히 일치합니다. 되돌려야 했던 건 CHANGELOG뿐입니다.이 PR이 하는 일
1.
[3.2.0]섹션을 출시본 그대로 복원 — 세 파일 모두git show v3.2.0:과 바이트 단위 동일 검증했습니다.이미 Maven Central에 나간 버전의 노트를 고치면 아티팩트와 changelog가 어긋납니다 — 애초의 실수보다 나쁩니다.
2. 새 항목 2건을
[3.3.0]으로 이동 — 리다이렉트 홉 정합성, 스캐너 스킴 커버리지.3. 버전 참조 3.3.0으로 —
gradle.properties, README 양어, installation 가이드 양어, index 양어. changelog 이력은 손대지 않았습니다.왜 3.2.1이 아니라 3.3.0인가
RedirectGuard는 신규 공개 APISsrfGuardedHttpClient가 리다이렉트를 스스로 따라가는 delegate를 거부 →Redirect.NORMAL을 넘기던 사람은 깨집니다그 호출부는 지금까지 홉 검증을 하나도 못 받고 있었습니다. 그러니 이 깨짐은 수정이 드러난 것이지만, 어쨌든 깨짐이고 패치 번호는 그걸 숨깁니다.
major를 안 올리는 건 org 규칙상 major가 Spring Boot major를 뜻하기 때문입니다. 대신 Migration 섹션이 그 무게를 집니다 —
newHttpClient()/newBuilder().build()는 이미NEVER라 대부분 영향 없고,NORMAL/ALWAYS를 넘기던 코드는 그것만 빼면 된다고 적었습니다.검증
./gradlew buildBUILD SUCCESSFUL, 239 tests, failures=0.머지 후
v3.3.0태그 → Maven Central + GitHub Release.