From 8644f1b12e17ec1d5d013d7ef84cc830ff5a6bf5 Mon Sep 17 00:00:00 2001 From: Maarten Coene <4728619+maartenc@users.noreply.github.com> Date: Wed, 18 Feb 2026 18:02:50 +0100 Subject: [PATCH 1/2] Use pattern --- .../ivy/plugins/resolver/packager/PackagerCacheEntry.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/java/org/apache/ivy/plugins/resolver/packager/PackagerCacheEntry.java b/src/java/org/apache/ivy/plugins/resolver/packager/PackagerCacheEntry.java index b262e55c..e2414f00 100644 --- a/src/java/org/apache/ivy/plugins/resolver/packager/PackagerCacheEntry.java +++ b/src/java/org/apache/ivy/plugins/resolver/packager/PackagerCacheEntry.java @@ -237,7 +237,7 @@ public class PackagerCacheEntry { } private static File getSubdir(File rootDir, ModuleRevisionId mr) { - return new File(rootDir, mr.getOrganisation() + File.separatorChar + mr.getName() - + File.separatorChar + mr.getRevision()); + String subDir = IvyPatternHelper.substitute("[organisation]/[module]/[revision]", mr); + return new File(rootDir, subDir); } } From 2927c79ff1c23964dfd00cb45182657c35b2e899 Mon Sep 17 00:00:00 2001 From: Stefan Bodewig Date: Sun, 12 Jul 2026 07:56:24 +0200 Subject: [PATCH 2/2] prepare RC1 of Ivy 2.6.0 --- asciidoc/release-notes.adoc | 3 ++- ivy.xml | 2 +- version.properties | 2 +- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/asciidoc/release-notes.adoc b/asciidoc/release-notes.adoc index f3f6bd61..9bede4b8 100644 --- a/asciidoc/release-notes.adoc +++ b/asciidoc/release-notes.adoc @@ -19,7 +19,7 @@ = Ivy Release Announcement -XXXX Date XXXX - The Apache Ivy project is pleased to announce its 2.6.0 release. +15 July 2026 - The Apache Ivy project is pleased to announce its 2.6.0 release. == What is Ivy? Apache Ivy is a tool for managing (recording, tracking, resolving and reporting) project dependencies, characterized by flexibility, @@ -71,6 +71,7 @@ It also fixes issues where the dynamic revisions were replaced by versions from - FIX: the `ivy:deliver` task didn't include XML namespaces from a parent ivy module when merging the descriptors. (IVY-1658) (Thanks to Eric Milles) - FIX: the `ivy:checkdepsupdate` task no longer shows evicted versions. (IVY-1662) (Thanks to Eric Milles) +- FIX: CVE-2026-26032: Apache Ivy: PackagerResolver path traversal vulnerability == Committers and Contributors diff --git a/ivy.xml b/ivy.xml index 2841c3b0..4a6d24ab 100644 --- a/ivy.xml +++ b/ivy.xml @@ -21,7 +21,7 @@ xsi:noNamespaceSchemaLocation="http://ant.apache.org/ivy/schemas/ivy.xsd"> + status="release"> Apache Ivy is a tool for managing (recording, tracking, resolving and reporting) project dependencies. diff --git a/version.properties b/version.properties index 699727af..491c47d2 100644 --- a/version.properties +++ b/version.properties @@ -22,7 +22,7 @@ target.ivy.bundle.version=2.6.0 # in case we want to add a qualifier such as alpha, beta, etc... # if non empty, add a '_' at the end of the qualifier, so the version would look like 1.2.3.alpha_200901011200 # NB: be careful with naming, OSGi orders version alphabetically. Suggested values: alpha_, beta_, cr1_ (for RC-1), final_ -target.ivy.bundle.version.qualifier=alpha_ +target.ivy.bundle.version.qualifier=final # Versions of dependencies