prepare RC1 of Ivy 2.6.0

asciidoc/release-notes.adoc

@@ -19,7 +19,7 @@
 
 = Ivy Release Announcement
 
-XXXX Date XXXX - The Apache Ivy project is pleased to announce its 2.6.0 release.
+15 July 2026 - The Apache Ivy project is pleased to announce its 2.6.0 release.
 
 == What is Ivy?
 Apache Ivy is a tool for managing (recording, tracking, resolving and reporting) project dependencies, characterized by flexibility,
@@ -71,6 +71,7 @@ It also fixes issues where the dynamic revisions were replaced by versions from
 - FIX: the `ivy:deliver` task didn't include XML namespaces from a parent ivy module when merging the descriptors. (IVY-1658)
   (Thanks to Eric Milles)
 - FIX: the `ivy:checkdepsupdate` task no longer shows evicted versions. (IVY-1662) (Thanks to Eric Milles)
+- FIX: CVE-2026-26032: Apache Ivy: PackagerResolver path traversal vulnerability
 
 == Committers and Contributors
 

ivy.xml

@@ -21,7 +21,7 @@
             xsi:noNamespaceSchemaLocation="http://ant.apache.org/ivy/schemas/ivy.xsd">
     <info organisation="org.apache.ivy"
            module="ivy"
-           status="integration">
+           status="release">
         <description homepage="http://ant.apache.org/ivy/">
         Apache Ivy is a tool for managing (recording, tracking, resolving and reporting) project dependencies.
         </description>

version.properties

@@ -22,7 +22,7 @@ target.ivy.bundle.version=2.6.0
 # in case we want to add a qualifier such as alpha, beta, etc...
 # if non empty, add a '_' at the end of the qualifier, so the version would look like 1.2.3.alpha_200901011200
 # NB: be careful with naming, OSGi orders version alphabetically. Suggested values: alpha_, beta_, cr1_ (for RC-1), final_
-target.ivy.bundle.version.qualifier=alpha_
+target.ivy.bundle.version.qualifier=final
 
 
 # Versions of dependencies