diff --git a/asciidoc/release-notes.adoc b/asciidoc/release-notes.adoc index f3f6bd61..9bede4b8 100644 --- a/asciidoc/release-notes.adoc +++ b/asciidoc/release-notes.adoc @@ -19,7 +19,7 @@ = Ivy Release Announcement -XXXX Date XXXX - The Apache Ivy project is pleased to announce its 2.6.0 release. +15 July 2026 - The Apache Ivy project is pleased to announce its 2.6.0 release. == What is Ivy? Apache Ivy is a tool for managing (recording, tracking, resolving and reporting) project dependencies, characterized by flexibility, @@ -71,6 +71,7 @@ It also fixes issues where the dynamic revisions were replaced by versions from - FIX: the `ivy:deliver` task didn't include XML namespaces from a parent ivy module when merging the descriptors. (IVY-1658) (Thanks to Eric Milles) - FIX: the `ivy:checkdepsupdate` task no longer shows evicted versions. (IVY-1662) (Thanks to Eric Milles) +- FIX: CVE-2026-26032: Apache Ivy: PackagerResolver path traversal vulnerability == Committers and Contributors diff --git a/ivy.xml b/ivy.xml index 2841c3b0..4a6d24ab 100644 --- a/ivy.xml +++ b/ivy.xml @@ -21,7 +21,7 @@ xsi:noNamespaceSchemaLocation="http://ant.apache.org/ivy/schemas/ivy.xsd"> + status="release"> Apache Ivy is a tool for managing (recording, tracking, resolving and reporting) project dependencies. diff --git a/version.properties b/version.properties index 699727af..491c47d2 100644 --- a/version.properties +++ b/version.properties @@ -22,7 +22,7 @@ target.ivy.bundle.version=2.6.0 # in case we want to add a qualifier such as alpha, beta, etc... # if non empty, add a '_' at the end of the qualifier, so the version would look like 1.2.3.alpha_200901011200 # NB: be careful with naming, OSGi orders version alphabetically. Suggested values: alpha_, beta_, cr1_ (for RC-1), final_ -target.ivy.bundle.version.qualifier=alpha_ +target.ivy.bundle.version.qualifier=final # Versions of dependencies