)]}'
{
  "log": [
    {
      "commit": "5e62aea825fb585ddd7c003b78057d5c11f35910",
      "tree": "8edcb599aafa771fe9760c2db6f1114dea4c8a2e",
      "parents": [
        "dc084636ae991e701886ffaa66922b7f326b9704"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sun Jul 26 13:50:49 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sun Jul 26 13:50:49 2026 -0400"
      },
      "message": "Fix stale Javadoc examples in EncoderSet/ObjectMerger/ObjectIntrospector (TODO-297 / READY-306)\n\ngetEncoder()/getEncoderMatch() (was findMatch), merge() (was merger),\ninvokeMethod() (was invoke) + undefined-var fix; keeps source Javadoc\nconsistent with the corrected doc pages so docs-from-Javadoc sync\nwon\u0027t regress.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "dc084636ae991e701886ffaa66922b7f326b9704",
      "tree": "49d9f2265a11c56674d575d73069beb4a9875a24",
      "parents": [
        "3b6cb854ed248eff913bea8b5567caa81b31dec6"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sun Jul 26 07:16:17 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sun Jul 26 07:16:17 2026 -0400"
      },
      "message": "Add TEST-04 coverage tests and fix RRPC POST dispatch (TODO-295, TODO-296)\n\nAdds ~156 targeted tests closing the TEST-04 coverage gaps: juneau-bean-mcp\naddX() null-init branches, juneau-marshall parser error/edge-case paths (incl. a\nnew PlainTextParser test), juneau-rest-server @RestOp arg-binding, the RRPC\nPolicy/ContentNegotiation families, and Hyperlink/HttpPartList coverage.\n\nWhile covering RRPC this surfaced and fixes a pre-existing defect: HTTP POST to an\n@RestOp(method\u003d\"RRPC\") operation 404\u0027d before invocation because\nRrpcRestOpSession derived the method key by splitting the path on the last \u0027/\u0027,\nbut RRPC keys (methodName/(paramTypes)) themselves contain a \u0027/\u0027. The key is now\ntaken from the URL-path-match remainder. Includes POST round-trip regression\ntests.\n"
    },
    {
      "commit": "3b6cb854ed248eff913bea8b5567caa81b31dec6",
      "tree": "4bc6539b7b6d2a188aca4f1bccebdd296e8a6276",
      "parents": [
        "8599116a82313e7b2ef8d2b6aa4e533d4c873f6e"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sat Jul 25 10:20:58 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sat Jul 25 10:20:58 2026 -0400"
      },
      "message": "Apply IDIOM-01/02 mechanical fixes across remaining modules (TODO-294)\n\nApplies the established Shorts-factory substitutions (l()/m()/set()/u()/o()/oe()/\neq()/h()) and cause-carrying exception overloads (iaex/isex/ioex/rex) to 141\nsites across the 24 non-core modules, completing the IDIOM-01/02 backlog begun\nunder TODO-287/289/290. Behavior-preserving; honors the FINISHED-241\ndeep-array-equality and FINISHED-287 no-matching-factory standing exceptions.\n"
    },
    {
      "commit": "8599116a82313e7b2ef8d2b6aa4e533d4c873f6e",
      "tree": "35b61cfadabe241c34fa02ace01ffc765dfad7eb",
      "parents": [
        "ed33c360d9866cf3fd9ce0af61c4bc7b67c57bd7"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sat Jul 25 08:20:45 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sat Jul 25 08:20:45 2026 -0400"
      },
      "message": "Fix Json5 collection freeze-bypass and standardize Unmodifiable inner-class names\n\nJson5Map/Json5List\u0027s Unmodifiable variants overrode only a subset of mutators,\nso a frozen instance could still be mutated (clear, putAll, putIfAbsent,\ncompute*, merge, replace*, the keySet()/entrySet()/values() views, add(Object),\naddAll, remove(Object), iterator-remove, sort, etc.). Extended both override\nsets to the full MarshalledMap/MarshalledList \"D4\" surface so the entire\nmutation surface throws.\n\nAlso standardized the marshall-family frozen-variant inner classes onto the\nproject\u0027s nested Unmodifiable convention (X.Unmodifiable extends X), renaming\nthe legacy UnmodifiableXxx names in Json5Map, Json5List, JsonMap, JsonList,\nMarshalledMap, and MarshalledList. Private-static, internal-only renames with\nno behavior or API change.\n"
    },
    {
      "commit": "ed33c360d9866cf3fd9ce0af61c4bc7b67c57bd7",
      "tree": "56849b53b52cccd7601181801dff2ddfdab66ed5",
      "parents": [
        "21f5389e0e2242eaea1e17000a0d8e838cf4e153"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 24 16:52:58 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 24 16:52:58 2026 -0400"
      },
      "message": "Resolve SonarLint findings across core, rest, and test-support modules\n\nFixes or suppresses a batch of SonarLint issues with no behavior change except\nthe noted ones: S8786 ReDoS regex rewrite in Config, S2259 null-guards in\nFileStore, S1452 CRTP-bounded return-type suppressions in jsonschema,\nS5778/S5976 test refactors, S110 suppressions on the HTTP-response hierarchy,\nS2886/S2160 dispositions in rest-server, S1135 stale-TODO rewording, and\nassorted S125/S112/S1659/S6201/S8924/S3415 cleanups.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "21f5389e0e2242eaea1e17000a0d8e838cf4e153",
      "tree": "5cb3c6a7a43c2d259c591846c7e8f82f83375263",
      "parents": [
        "3dc8ae26ea53d0b21b3d13209aa8719fd991f572"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 24 16:52:44 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 24 16:52:44 2026 -0400"
      },
      "message": "Add @Child annotation for host-side seeding of child REST contexts (TODO-182)\n\nAdds @Child and @Rest(childrenDefs\u003d...) mirroring @Mixin/mixinDefs, letting a\nhost seed a curated set of settings onto a routed child\u0027s otherwise-isolated\nRestContext. Additive-security attributes (guards, converters, roleGuard,\nrolesDeclared) prepend/AND-stack; child-wins scalars (callLogger,\npartSerializer, partParser, debug, defaultCharset, maxInput) act as fallbacks.\nSeeds never override a child\u0027s own explicit config; a child\u0027s noInherit cuts\nthe seed. Includes lazy-children seed threading and a fix to\ncomputeRawRestAnnotations() DefaultConfig partitioning. Also includes 7\nincidental java:S2259 false-positive suppressions in RestContext.java.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "3dc8ae26ea53d0b21b3d13209aa8719fd991f572",
      "tree": "300bf8d4ced3d0536ca90d0b847f4bd7fffbb3d8",
      "parents": [
        "a34c40a1a3832d62a455cfaf8fab1daae994c201"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 24 12:35:14 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 24 12:35:14 2026 -0400"
      },
      "message": "Fix bean copy() shallow-copying nested beans in OpenAPI-v3 DOM (TODO-266)\n\ncopy() on Components/Operation/PathItem/Callback/Parameter re-wrapped\nMap/List containers via the shallow single-arg overload while sharing the\nnested bean instances, aliasing them between the original and the copy.\nSwitched the 15 affected sites to the deep-copy mapper overload\n(Type::copy). Added 5 regression tests asserting nested container\nelements are distinct after copy() and mutations don\u0027t cross-leak.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "a34c40a1a3832d62a455cfaf8fab1daae994c201",
      "tree": "a76873e666af95a9e02fe7393d023e9ae82d8259",
      "parents": [
        "7410ac4f415981294553164e2939caefd3fe0a8e"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 24 09:08:15 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 24 09:08:15 2026 -0400"
      },
      "message": "TODO-291: Fix @ParentProperty injection through collections/maps\n\nA collection/map element\u0027s @ParentProperty now receives the nearest enclosing\nbean (skipping intermediate containers at any depth; null at root) instead of\nthe containing List/Map. Separates the parser\u0027s dual-purpose \u0027outer\u0027 param via a\nnew ParserSession.parentBean() tracker, applied across all 9 streaming parsers\nplus HOCON/HJSON reconciliation. Makes the canonical AddressBook/List\u003cPerson\u003e\nexample round-trip and unifies behavior across all formats.\n\nBehavior change for 10.0.0 (see release notes). New ParentPropertyContainer_Test\n(72 methods); full reactor gate green (122,889 tests, 0 failures).\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "7410ac4f415981294553164e2939caefd3fe0a8e",
      "tree": "9d6b3b5309af2af46d69dd7fd27eda761ee026ff",
      "parents": [
        "3124799065a3d5dcdf347a54f0a6b46b27a13da0"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 23 16:14:17 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 23 16:14:17 2026 -0400"
      },
      "message": "TODO-238: Final maintainer-decision pass; close Codebase Quality Registry umbrella\n\nRemovals (10.0.0 breaking-change window):\n- Schema.exclusiveMaximum()/exclusiveMinimum() boolean forms (callers migrated to emax()/emin())\n- HttpPartSchema.T_OBJECT_{CSV,PIPES,SSV,TSV} constants + their sole-purpose builders\n- XmlSerializer.DEFAULT_XS_NAMESPACE (protected, unused)\n\nSimplifications:\n- Collapse dead uri2-fallback branch in RdfSerializerSession/RdfStreamSerializerSession.getUri(...)\n- Simplify dead char-class sub-terms in ConfigMapEntry negation\n\nKept clusters recorded as registry exceptions (BUG-15, DEAD-03).\nFull reactor suite green: 135,326 tests, 0 failures.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "3124799065a3d5dcdf347a54f0a6b46b27a13da0",
      "tree": "d69ca37c939935a0d2ec94ece496dc8ee29aaa24",
      "parents": [
        "b156f17753af68876ab032ce97bc32d47899d64e"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 23 14:31:07 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 23 14:31:07 2026 -0400"
      },
      "message": "TODO-290: Add cause-carrying Shorts exception factories; convert 2 IDIOM-02 sites\n\nAdds the Throwable-first isex(Throwable, String, Object...) and bare-cause\nisex(Throwable) overloads to Shorts (completing the iaex/isex/rex/ioex\ncause-carrying family for symmetry; the other three already existed), with\nunit tests. Converts the 2 cause-carrying constructor sites flagged by the\nIDIOM sweep: LegacyHttpResponseAdapter (isex) and DumpsManager (rex).\nFull reactor suite green.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "b156f17753af68876ab032ce97bc32d47899d64e",
      "tree": "3bebf0583b5ba6af4aaeb22301442b057ced3651",
      "parents": [
        "b662ff060a34d3af870806d04a36192eeecb830c"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 23 14:05:40 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 23 14:05:40 2026 -0400"
      },
      "message": "TODO-289: Adopt Shorts idiom for IDIOM-01 sites in juneau-marshall + juneau-rest-server\n\nMechanical, behavior-preserving substitutions across 43 files (100 sites):\nCollections.unmodifiable*(...) -\u003e u(...), new ArrayList/LinkedList\u003c\u003e() -\u003e l()/ll(),\nnew HashMap/LinkedHashMap\u003c\u003e() -\u003e m(), and Objects.equals(...) -\u003e eq(...). Honors the\n*Utils and mutable-accumulator (SeoMixin/AuthFilterChain/DebugConfig) carve-outs;\n7 non-1:1 sites left as-is with rationale. Full reactor suite green.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "b662ff060a34d3af870806d04a36192eeecb830c",
      "tree": "5498b69741a78313bb8ee3db82c02c9d0884f63d",
      "parents": [
        "ead0677e3c3291e1eec0fec461b78f54c7ef99b7"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 23 13:28:11 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 23 13:28:11 2026 -0400"
      },
      "message": "TODO-288: Normalize generic type-argument comma spacing reactor-wide\n\nDrop the space after commas separating type arguments (Map\u003cString, Object\u003e\n-\u003e Map\u003cString,Object\u003e) at every nesting level, across all src/main and\nsrc/test, including inside Javadoc/comments. Pure whitespace; marshalling\noutput byte-identical (full reactor suite green, 135,324 tests / 0 failures).\n\nAlso updates the Eclipse formatter profile to enforce the no-space style for\ncode going forward, and adds scripts/normalize-generic-commas.py (the\ncomment-aware transform tool, retained for future use).\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "ead0677e3c3291e1eec0fec461b78f54c7ef99b7",
      "tree": "4a1f88f2e23411426142a28424e2849d00e7e8a9",
      "parents": [
        "f855dbcc5a7e14a0baaea2a575b02ce3d9350b2f"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 23 12:38:05 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 23 12:38:05 2026 -0400"
      },
      "message": "TODO-238: IDIOM sweep AUTO fixes for juneau-marshall + juneau-rest-server\n\nMechanical, behavior-preserving cleanups across src/main/java of\njuneau-core/juneau-marshall and juneau-rest/juneau-rest-server:\n\n- IDIOM-05: scope-aware pattern-variable renames for instanceof patterns\n- IDIOM-02: concat-message exception constructors converted to Shorts\n  `%s`-based factory methods (e.g. ioex(...))\n\nVerified green via full offline `mvn -o test` (marshall 77,220 tests +\nrest-server 426 tests, 0 failures) and lint-clean. Completes the IDIOM\ndimension reactor-wide, closing out the full 51x8 quality-registry grid.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "f855dbcc5a7e14a0baaea2a575b02ce3d9350b2f",
      "tree": "8ad959f780fb32c0c853ec08d0cefe765d4ab677",
      "parents": [
        "3ab2d1e856c60b863c0fdee08e6e6e7d445b85b5"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 23 10:17:19 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 23 10:17:19 2026 -0400"
      },
      "message": "TODO-268 follow-up: strip remaining tracker references in 3 test files\n\nCloses out 3 files held back from the main comment-stripping sweep\n(3ab2d1e856) because they mixed comment strips with test string-literal\nrewords (a @DisplayName and two assertion failure-message strings):\n\n- BeanInstantiator_Test.java: drop \"(TODO-143 Option D)\" from a\n  @DisplayName and \"under FINISHED-143 Option D\" from a comment.\n- Value_StableFolding_Test.java: drop \"(per RD #10)\" / \"(RD #10\n  caveat)\" references from javadoc/comments and from an assertFalse\n  failure message.\n- Settings_NoLeakedSources_Test.java: drop \"FINISHED-79\" references\n  from comments and from an assertEquals failure message.\n\nOnly human-readable comment/display/message text changed; no asserted\nvalues or executable logic were touched.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "3ab2d1e856c60b863c0fdee08e6e6e7d445b85b5",
      "tree": "7d8b904bccc28d2e397010b3d50498605497ae81",
      "parents": [
        "dec66c82a28eb31bf0258bc9b5bf37212d76c240"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 23 10:13:41 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 23 10:13:41 2026 -0400"
      },
      "message": "Strip stale bug/issue/TODO tracker references from code comments (TODO-268)\n\nReactor-wide sweep across 98 files (17 modules, main + test) removing\ncomment-only references such as `Bug #N`, `TODO-N`, `FINISHED/MAYBE-N`,\n`work item N`, and `Decision #N` that point at the gitignored\n`.work/todo` tracker, which is inaccessible to outside contributors.\nWhere the surrounding comment explained genuine non-obvious intent, the\nexplanation was kept and reworded to stand on its own; comments that\nexisted only to reference a tracker were deleted. Comment-only change,\nno code/behavior changes.\n\nExcludes 3 files (BeanInstantiator_Test, Value_StableFolding_Test,\nSettings_NoLeakedSources_Test) where the same cleanup also touched\nstring literals (@DisplayName / assertion messages), left for separate\nreview.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "dec66c82a28eb31bf0258bc9b5bf37212d76c240",
      "tree": "bccbef8ccc0327c51d82641645a06acb30049284",
      "parents": [
        "e32f1a586793de88bcfd82b6085f18228c886065"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 23 10:02:05 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 23 10:02:05 2026 -0400"
      },
      "message": "Fix reactor-wide Surefire failure caused by global excludedGroups property\n\nThe root pom declared a global \u003cexcludedGroups\u003emanual\u003c/excludedGroups\u003e\nproperty. Surefire\u0027s excludedGroups mojo parameter auto-binds to any\nproperty named \"excludedGroups\" in the effective POM (via\n@Parameter(property\u003d\"excludedGroups\")), so merely declaring it in the\nroot \u003cproperties\u003e fed it into every module\u0027s Surefire execution reactor-\nwide via inheritance - even with no \u003cconfiguration\u003e reference. Surefire\nhard-fails with \"groups/excludedGroups require TestNG, JUnit48+ or JUnit\n5\" as soon as that parameter is non-null (even resolving to empty), and\nseveral modules (e.g. juneau-rest-server-rdf) have no JUnit5 engine on\ntheir test classpath, breaking the build.\n\nFix: remove the global excludedGroups property and its pluginManagement\nSurefire reference from the root pom, and instead declare a local\nexcludedGroups property (default \"manual\", still overridable via\n-DexcludedGroups\u003d) only in the two modules that actually contain\n@Tag(\"manual\") tests and have the JUnit5 engine present -\njuneau-marshall and juneau-integration-tests.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "e32f1a586793de88bcfd82b6085f18228c886065",
      "tree": "2d0c7aceb5ce4eb1f4fb67afc2aef4543f202464",
      "parents": [
        "dfc800eea82074301d8a8012d31361043e7d3ed9"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 23 09:13:08 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 23 09:13:08 2026 -0400"
      },
      "message": "TODO-286: resolve null-effect doc/impl contradictions + enrich ambiguous sites\n\nTriage of 36 flagged sites from the TODO-265 null-effect sweep:\n- DOC-FIX (behavior-preserving) where the Javadoc contradicted traced reality:\n  BidiMap null-handling, BasicMediaTypeHeader \"never null\", and must-not-be-null\n  NPE docs on IfRange.isEtag, UrlPathMatch, MethodExecStats.\n- CODE-FIX (10.0.0 behavior change): make the fluent request/response\n  header/param/form assertions null-tolerant so asserting on an absent value no\n  longer NPEs; adds null-value test coverage.\n- Enrich the genuinely implementation-dependent Group 2 sites with the TODO-265\n  convention pointing at the relevant {@link} target; setContent() reuses the\n  existing leaf-type-dependent clause.\n- JsonSchemaMap left unchanged (contradiction refuted: ConcurrentHashMap rejects\n  null keys regardless).\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "dfc800eea82074301d8a8012d31361043e7d3ed9",
      "tree": "355ae237bfce300201e216ff48098ee00ab573fb",
      "parents": [
        "7901a7a66d85321b2125bb5d16b951fd929981fb"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 23 09:12:56 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 23 09:12:56 2026 -0400"
      },
      "message": "TODO-283: accept oversized classes as cohesive-by-design (add java:S6539)\n\nARCH-02 triage: add class-level @SuppressWarnings(\"java:S6539\") with a one-line\nrationale to 17 oversized-but-cohesive classes (RestClient, RestRequest,\nStringUtils, ClassInfo, CollectionUtils, BeanInstantiator, BeanMeta, Shorts,\nHttpPartSchema, MarshallUtils, MarshallingContext, SerializerSession,\nMarshalledMap, ParquetParserSession, HttpHeaders, JsonSchema, HtmlBuilder) so\nfuture sweeps don\u0027t re-flag them. No splits. Annotation-type declarations and\nthreshold-adjacent files intentionally left unsuppressed.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "7901a7a66d85321b2125bb5d16b951fd929981fb",
      "tree": "74f14d6b3161e3f70feab8ebb2a31dc9b04d83d0",
      "parents": [
        "a319b14a55bc32c9ef99aebd8cfa915801d3c4a2"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 23 09:12:42 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 23 09:12:42 2026 -0400"
      },
      "message": "TODO-279: triage @Disabled tests; drop LogRecord source-detection feature\n\n- Remove the unreliable JUL-style source detection from LogRecord: findSource()\n  stack-walk, the memoized source field, getSourceClassName()/getSourceMethodName()\n  overrides, and the {source}/{class}/{method} placeholder cases in formatted().\n  10.0.0 behavior change: formatted() no longer supports those placeholders, and\n  positional %N$s specifiers shift down one index. Deletes the 2 chronically\n  @Disabled tests that exercised it (feature confirmed self-contained, no other\n  consumers).\n- Convert BsonArrayDebug_Test and RoundTripLargeObjects_Test from @Disabled to\n  @Tag(\"manual\") so they\u0027re runnable on demand; add a property-driven\n  ${excludedGroups} (default \"manual\") Surefire mechanism so -DexcludedGroups\u003d\n  can re-enable them.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "a319b14a55bc32c9ef99aebd8cfa915801d3c4a2",
      "tree": "96196dc7cbb0ccaf539c4ae732ecb3c5000e26ab",
      "parents": [
        "49b93f9d98dde55f545c78672c95ed831ec58cc6"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 23 08:11:16 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 23 08:11:16 2026 -0400"
      },
      "message": "TODO-285: remove no-op/bogus Sonar @SuppressWarnings rule keys\n\nClean up 18 suppression occurrences (5 rule numbers) that silently no-op\nbecause the rule key doesn\u0027t match any real SonarCloud rule:\n\n- java:S2368 (StringFunctions) - nonexistent rule; concern already covered\n  by co-located S2386.\n- java:S6542 x13 (ObjectViewer/ObjectSorter/StringMatcherFactory/\n  NumberMatcherFactory/MarshallingContextConverter) - nonexistent rule\n  number (typo/dup of the Singleton rule S6548); removed. Confirmed via\n  live SonarCloud that S6548 does not fire on any of these classes, so no\n  replacement suppression was needed.\n- java:S6350 (FluentDateAssertion) - stray duplicate; real rule is an\n  unrelated javasecurity rule. The intended S2143 is already suppressed.\n- java:S6466 x2 (JsonParserSession/Json5ParserSession) - dead no-op with\n  zero Sonar findings ever at either site; removed with dangling comments.\n\nNo behavior change; affected modules build green.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "49b93f9d98dde55f545c78672c95ed831ec58cc6",
      "tree": "66bde5b1a2f243ead68cdbeb2fb79d33d1420102",
      "parents": [
        "50c0b9356d3274007a7c621f5ba2e1fb1d0380b3"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Wed Jul 22 14:26:31 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Wed Jul 22 14:26:31 2026 -0400"
      },
      "message": "TODO-280: add missing collection-family API methods to DTO beans\n\nAPI-01 fix from the reactor quality grid: bring List/Map properties to the\nfull 4-method family (setX(X...), setX(Collection\u003cX\u003e), addX(X...),\naddX(Collection\u003cX\u003e)) plus keyed Map single-entry adders across\njuneau-bean-mcp, juneau-bean-jsonapi, juneau-bean-jsonschema, and\njuneau-bean-openapi-v3.\n\nPure-additive (new overloads only; no existing signature changed or removed);\nround-trip marshalling stays byte-identical. 21 files, 61 new methods.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "50c0b9356d3274007a7c621f5ba2e1fb1d0380b3",
      "tree": "f455ff77607d4834011c1e04c952bd471812b47c",
      "parents": [
        "88ac18d1cd53d11bde62cf12efcd23af856230ef"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Wed Jul 22 14:26:23 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Wed Jul 22 14:26:23 2026 -0400"
      },
      "message": "Fix RateLimitGuard test flakiness with injectable time source\n\nMake the InMemoryStorage/Bucket token-bucket clock injectable (a LongSupplier\ndefaulting to System::nanoTime) so timing-sensitive tests can freeze the ~1s\nrefill window. Production behavior is unchanged (Storage.inMemory()/builder\nstill use the real clock; resolveKey() untouched).\n\nWire a frozen clock into the 5 RateLimitGuard* test classes whose 200-\u003e429\nassertions previously raced the refill window and could flake under heavy load.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "88ac18d1cd53d11bde62cf12efcd23af856230ef",
      "tree": "3e70bae885f16303780eb66afd362cb4b46df7f4",
      "parents": [
        "6b2bc2541968486812f3df19916f7ee152a9b9a0"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Wed Jul 22 12:10:34 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Wed Jul 22 12:10:34 2026 -0400"
      },
      "message": "TODO-265: enrich Javadoc with null-effect clauses reactor-wide\n\nComment-only sweep across 28 src/main modules (459 files, ~1,501 sites): adds\n\"@param ... Can be null \u003ceffect\u003e\" clauses (~1,285), \"@return ... or null \u003cwhen\u003e\"\nconditions (~98), and secondary \"Must not be null\" thrown-consequence notes (118),\nper the locked TODO-265 enrichment convention. No logic changes. 32 ambiguous\nsites (incl. some pre-existing doc/impl contradictions) were left unenriched and\ncaptured as a follow-up.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "6b2bc2541968486812f3df19916f7ee152a9b9a0",
      "tree": "33be848abb5b6bea6ed301e22d297664f7f71b32",
      "parents": [
        "5ef12bbbb13e10e9b1d2515449c8938b880347a9"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Wed Jul 22 09:08:51 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Wed Jul 22 09:08:51 2026 -0400"
      },
      "message": "TODO-282/284: TEST + DOC dimension gap-fill; fix no-op ConfigMap NPE suppression\n\nTODO-282 (TEST-01/02 structural gaps): rename *Test.java -\u003e *_Test.java to the\nrepo naming convention across config/marshall/rest-server-mcp/rest-mock, and fill\nmissing test-method/assertion-style gaps surfaced by the 2026-07-21 grid sweep.\nTODO-284 (DOC dimension): correctness fixes to Javadoc across ~13 modules\n(missing/incorrect docs, unclosed \u003cjs\u003e runs, bare-null prose, doclink gaps).\n\nAlso corrects a silently no-op suppression in ConfigMap: the S2259 NPE\nflow-analysis rule is registered under the javabugs: repo, so the prior\njava:S2259 suppression never applied; repointed to javabugs:S2259 (format is\nnon-null via the constructor default; symbolic execution can\u0027t prove it).\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "5ef12bbbb13e10e9b1d2515449c8938b880347a9",
      "tree": "2ec3e88685babbd090ea4f901f1e97b54c9ad9eb",
      "parents": [
        "1b74af9ed4c1604245be76881c84788f206f9ee3"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 21 20:22:49 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 21 20:22:49 2026 -0400"
      },
      "message": "TODO-281: resolve PARITY cluster (INI round-trip, openapi3 drift, Tomcat launcher)\n\nPARITY-01: add IniParser.Builder.kvSeparator(char) threaded through context/session\n(+ @IniConfig wiring) so a custom key/value separator round-trips; legacy \u003d/: behavior\npreserved when left at the default. PARITY-02: add getSiteName/setSiteName (x-siteName)\nand addProperty(String,SchemaInfo) to openapi-v3 for parity with swagger-v2, and document\nthe required(List)/requiredProperties(Set) divergence as intentional (no rename).\nPARITY-03: build TomcatMicroservice zero-config launcher + HealthProbeConfiguration\nmirroring the Jetty facade. Adds round-trip and smoke tests; new public API\n(IniParser.kvSeparator, TomcatMicroservice) noted for the 10.0.0 release notes.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "1b74af9ed4c1604245be76881c84788f206f9ee3",
      "tree": "b7a7a95f4130eb08b304099d390bef75a905f13b",
      "parents": [
        "dd848781209600eb64bb339a5eddd7f4831b2fb5"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 21 17:55:55 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 21 17:55:55 2026 -0400"
      },
      "message": "Reactor-wide SonarQube quality sweep + ConfigMap CoW + HTTP-entity equality\n\nSweep of open SonarQube issues across ~20 modules: real fixes where warranted\n(ReDoS regex hardening in Config, ThreadLocal leak cleanup, content-based\nequals/hashCode/toString for array-holding records (S6218), lambda-\u003emethod-ref\nconversions, extract-method refactors for cognitive complexity, redundant\nsealed permits removal, lock-free AtomicReference publication in McpRestServlet),\nplus false-positive suppressions carrying one-line rationale and a project-level\nS110 inheritance-depth exclusion for the HTTP status beans.\n\nAlso includes the ConfigMap copy-on-write redesign with an immutable State\nsnapshot and ConfigMapEntry record (TODO-258), and the HTTP-entity equality\ncontract redesign: SerializedEntity now includes serializer/schema in\nequals/hashCode and entity leaves use per-leaf equality to stop cross-leaf\nmatches while preserving the bean.equals(bean.unmodifiable()) invariant.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "dd848781209600eb64bb339a5eddd7f4831b2fb5",
      "tree": "1ddfa53900ffefc8bf6f4e3c4e4804ea5a90b9c0",
      "parents": [
        "29b83ce3d8478f4f3949b9f03181c3d2ce46bf5d"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 21 16:26:11 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 21 16:26:11 2026 -0400"
      },
      "message": "TODO-278: CRTP-convert the SerializerWriter format-writer hierarchy (10.0.0 breaking change)\n\nFull self-type conversion (family 4 of 4, previous family TODO-277 html5): SerializerWriter\ngenerified into an abstract self-typed root (SerializerWriter\u003cSELF extends SerializerWriter\u003cSELF\u003e\u003e\nextends java.io.Writer), with SELF-returning fluent methods including the java.io.Writer\nappend(...) overloads (legal covariant override, confirmed by spike). ~330 covariant\nreturn-narrowing overrides removed across the 13 format writers.\n\nConcrete-and-base split (Option A) for the three writers that are both directly instantiated\nand subclassed: JsonWriter/XmlWriter/HtmlWriter became abstract generic bases, each paired with\na new concrete leaf (BasicJsonWriter/BasicXmlWriter/BasicHtmlWriter) for direct-new sites;\nJcsWriter/SimpleHtmlWriter keep only their real-logic overrides. No mutation funnel added (hot-path\nwriter, plain CRTP only per Q2).\n\nSerializer output verified byte-identical. Impact is internal to juneau-marshall only.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "29b83ce3d8478f4f3949b9f03181c3d2ce46bf5d",
      "tree": "58d8e4b0e2a7454a2dea46758beb3789b371a02e",
      "parents": [
        "381d95f3732a259704cd4fd383f2c8cd39a271e0"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 21 15:10:04 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 21 15:10:04 2026 -0400"
      },
      "message": "TODO-277: CRTP-convert the html5 bean family (10.0.0 breaking change)\n\nGenerify HtmlElement and its 5 intermediate bases (HtmlElementVoid /\nHtmlElementText / HtmlElementRawText / HtmlElementMixed /\nHtmlElementContainer) into abstract self-typed CRTP roots\n(HtmlElement\u003cSELF extends HtmlElement\u003cSELF\u003e\u003e, etc.), mirroring the\nshipped BasicHttpEntity/BasicResource conversions (TODO-271/274) and\nthe jsonschema/atom conversions (TODO-275/276) earlier in this family\nseries.\n\n~7,282 covariant setter-narrowing overrides removed across the 108\nleaf element beans (A, Div, Span, Table, Input, Form, Img, Script,\nH1-H6, etc.) -- fluent setters now inherit the leaf type for free via\nCRTP instead of being re-declared per leaf. Leaves stay concrete and\nnon-generic, so HtmlBuilder factories / direct construction (new\nDiv(), etc.) and HTML/XML marshalling are unaffected.\n\nOpenApiUI / SwaggerUI helper return types narrowed to Div where\npossible and swept to HtmlElement\u003c?\u003e elsewhere to keep both green\nagainst the generified root.\n\nMarshalling verified byte-identical; no direct-instantiation sites of\nthe raw root or any intermediate base were found reactor-wide, so no\ntest rebase was required.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "381d95f3732a259704cd4fd383f2c8cd39a271e0",
      "tree": "5f9b13d3d7251b0211f21aa7086b26ebd107db21",
      "parents": [
        "b9247fbbfe266a6ad71fa0cba389ebaa92151169"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 21 14:00:03 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 21 14:00:03 2026 -0400"
      },
      "message": "Fix raw-type BasicHttpResponse references in HttpResponses (TODO-273 follow-up)\n\nBasicHttpResponse became a generic CRTP root (BasicHttpResponse\u003cSELF extends\nBasicHttpResponse\u003cSELF\u003e\u003e) in TODO-273, leaving several raw-type return types in\nHttpResponses. Parameterized each to BasicHttpResponse\u003c?\u003e.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "b9247fbbfe266a6ad71fa0cba389ebaa92151169",
      "tree": "a47fd4c7218d2b90b2d4e2329cb1ff591abbd8c8",
      "parents": [
        "3eaee549be66794cbaaf1f6720caf5f1193e8aad"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 21 13:59:53 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 21 13:59:53 2026 -0400"
      },
      "message": "TODO-276: CRTP-convert the atom bean family (10.0.0 breaking change)\n\nCommonEntry is now a self-typed root CommonEntry\u003cSELF extends CommonEntry\u003cSELF\u003e\u003e;\nremoved 42 covariant setter-narrowing overrides across Feed/Entry/Source (fluent\nsetters return the leaf type via the self-type instead of manual overrides).\nMarshalling is byte-identical; this is a source-visible generification of an\nexported bean family.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "3eaee549be66794cbaaf1f6720caf5f1193e8aad",
      "tree": "8ac68aaea6e2353307920c290fee33b7c7ba726e",
      "parents": [
        "283fa1db35b7aea97cdc45c8d139db8b2df12db7"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 21 12:59:31 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 21 12:59:31 2026 -0400"
      },
      "message": "TODO-275: CRTP-convert the jsonschema bean family (10.0.0 breaking change)\n\nGenerified JsonSchema and JsonSchemaProperty into self-typed CRTP roots\n(JsonSchema\u003cSELF extends JsonSchema\u003cSELF\u003e\u003e, JsonSchemaProperty\u003cSELF extends\nJsonSchemaProperty\u003cSELF\u003e\u003e), mirroring the shipped BasicHttpEntity/BasicResource\nconversions (TODO-271/274). The ~185 covariant setter-narrowing overrides on\nJsonSchemaProperty, JsonSchemaPropertySimpleArray, and JsonSchemaRef were\nremoved; fluent setters now return the leaf type for free via inheritance.\nRaw-type references reactor-wide were swept to the \u003c?\u003e wildcard where needed\nto keep unchecked-raw warnings off. Tests updated for the diamond-form direct\ninstantiation (new JsonSchema\u003c\u003e()) accepted by the spike gate; marshalling\n(JSON/XML/HTML round-trips) is byte-identical to pre-conversion behavior.\n\nFamily 1 of 4 in the TODO-272 CRTP-boilerplate discovery\u0027s conversion order\n(jsonschema -\u003e atom -\u003e html5 -\u003e SerializerWriter).\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "283fa1db35b7aea97cdc45c8d139db8b2df12db7",
      "tree": "de170f782e8586ad5ae9365c8c25d710e1eb65ea",
      "parents": [
        "8fe71e25e624974e8bcccc6c21becab5422f7337"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 21 11:17:11 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 21 11:17:11 2026 -0400"
      },
      "message": "Fix raw-type BasicResource reference in Remote_CommonInterfaces_Test (TODO-274 follow-up)\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "8fe71e25e624974e8bcccc6c21becab5422f7337",
      "tree": "9fd96cad6d53ddfebe3ca46be0a0bf75d2e98c7e",
      "parents": [
        "d0eaf21f4daa8ad5fc45aebe3cd4d9030ec0177b"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 21 11:14:14 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 21 11:14:14 2026 -0400"
      },
      "message": "TODO-273: Migrate the canonical juneau-rest-common HTTP stack to the funnel + nested-Unmodifiable immutability paradigm (10.0.0 breaking change)\n\nBrings the canonical next-gen HTTP stack to classic-twin parity with the\nTODO-271 immutable-beans paradigm:\n\n- BasicHttpResponse: abstract self-typed (CRTP) root\n  BasicHttpResponse\u003cSELF extends BasicHttpResponse\u003cSELF\u003e\u003e + single mutation\n  funnel + nested Unmodifiable snapshot; 22 response leaves keep their exact\n  leaf types (no base-type caller churn).\n- BasicHttpException: funnel-only root (no CRTP — a generic Throwable is\n  illegal per JLS 8.1.2) + nested Unmodifiable; 35 exception leaves keep\n  covariant overrides. equals/hashCode over statusLine + headers + message.\n- HttpHeaderList / HttpPartList: D4 collection-mutator-override variant\n  (snapshot-copy ctor + override the ArrayList mutator surface to throw);\n  content-only equals/hashCode.\n- Retire the old boolean unmodifiable + setUnmodifiable() + assertModifiable()\n  flag idiom on the canonical public types; use unmodifiable() (point-in-time\n  snapshot) + isUnmodifiable(). Mutating a frozen instance now throws\n  UnsupportedOperationException.\n- Migrate callers to x.unmodifiable(): canonical unit tests\n  (BasicHttpResponse_FluentSetters_Test, BasicHttpException_FluentSetters_Test)\n  and integration tests (ArgException_Test, SeeOtherRoot_Test).\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "d0eaf21f4daa8ad5fc45aebe3cd4d9030ec0177b",
      "tree": "acd2237013ef557f95115e63f46936ce75b12f33",
      "parents": [
        "9a744672287dad8bc9059e11f86ea26cb70c9f7e"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 21 10:36:51 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 21 10:36:51 2026 -0400"
      },
      "message": "TODO-274: CRTP-convert the classic BasicResource hierarchy (10.0.0 breaking change)\n\nGenerify BasicResource into an abstract self-typed (CRTP) root\nBasicResource\u003cSELF extends BasicResource\u003cSELF\u003e\u003e implements HttpResource, mirroring\nthe already-shipped BasicHttpEntity\u003cSELF\u003e precedent. Each of the 5 leaves\n(ByteArrayResource, FileResource, ReaderResource, StreamResource, StringResource)\ndrops its 15 covariant narrowing-setter overrides (~75 total deleted) and inherits\nleaf-typed fluent setters for free.\n\nGenerifying makes the root effectively abstract, so ResponseContent now materializes\nHttpResource/BasicResource response bodies as a concrete StreamResource (which IS-A\nBasicResource), and StreamResource gained an HttpResponse constructor for this. This\nkeeps the breaking surface narrow: .as(BasicResource.class) and @Remote methods\ndeclared to return BasicResource/HttpResource still work; only direct/reflective\nnew BasicResource(...) instantiation breaks. BasicResource_Test\u0027s direct-instantiation\nsites were rebased onto concrete leaves.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "9a744672287dad8bc9059e11f86ea26cb70c9f7e",
      "tree": "69faf59ff706364e755f5b1e3a52f62d3c3d3835",
      "parents": [
        "763c6aaec090d78415f009af096c6e2e11fca97d"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 21 08:53:01 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 21 08:53:01 2026 -0400"
      },
      "message": "TODO-271: Introduce nested-Unmodifiable snapshot immutability paradigm for classic HTTP bean families (10.0.0 breaking change)\n\nReplace the setUnmodifiable() flag idiom across the classic HTTP stack with a\nuniform \"funnel + snapshot\" immutability paradigm: all mutation flows through a\nsingle funnel method, and a frozen instance is produced by capturing a\nnested-Unmodifiable snapshot of state rather than toggling a runtime flag.\n\n- Add UnmodifiableBean marker (with logicalType()) as the common contract for\n  frozen snapshot beans.\n- Response family: CRTP on the non-Throwable BasicHttpResponse root (plus ~22\n  leaves) to delete covariant-setter boilerplate.\n- Entity family: CRTP on the BasicHttpEntity root (plus 6 leaves); resource\n  family reworked on BasicResource (plus 5 leaves).\n- Exception family: funnel-only on the Throwable BasicHttpException branch\n  (plus ~33 leaves) since JLS 8.1.2 forbids generic Throwable subclasses.\n- BasicStatusLine, HeaderList, PartList adopt the same snapshot paradigm;\n  content-based equality throughout.\n- Fix Thrown logical-type so frozen INSTANCE snapshot subclasses no longer leak\n  synthetic class names.\n- Remove now-dead field from BasicRuntimeException; retire ControlledArrayList\n  (and its test) which the flag idiom depended on.\n- Update RemoteMeta / ResponseContent (classic client) and affected tests;\n  add BasicHttpEntity/BasicHttpException/BasicHttpResponse tests.\n\nBreaking-change surface (10.0.0): setUnmodifiable() removed, response/entity\nroots are now generic/abstract, and equals() is content-based.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "763c6aaec090d78415f009af096c6e2e11fca97d",
      "tree": "978a342d79a172afad105db0fffbf70011841f33",
      "parents": [
        "0a7c46b7d651efbdced77e3284cb7c181cda0ce2"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Mon Jul 20 10:50:58 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Mon Jul 20 10:50:58 2026 -0400"
      },
      "message": "Fix deferred code bugs surfaced during Javadoc audits (TODO-270)\n\nCategory A (clear bugs): 3-arg serialize-only swap() overloads no longer\nalways-throw; prototext/toml tokenizer printf-injection hardening;\nJsonSchema.getAdditionalProperties() reads the correct backing field;\nConfig import statements implemented (ConfigMap.setImport/removeImport) +\nConfig.setImport honors its sectionName param; SwaggerException single\nformat pass; FluentRequestHeaderAssertion propagates its creator;\nCookieList null-coalesces null getCookies().\n\nCategory B (per maintainer resolutions): null-guard null-hostile lookup\ngetters (RrpcInterfaceMethodMeta, DebugConfig, BeanRegistry, ClassMeta.same,\nResourceDescription hashCode/compareTo); null-coalesce addDefault(...) and\nContentSecurityPolicy.directive varargs; set/get null-contract parity\n(HttpPartSchema enum setters, Iso8601Utils, McpServerConfig, RemoteOperationArg);\nrefresh stale Javadoc examples (AtomBuilder, MenuItemWidget, BasicDebugEnablement);\nhonor previously-ignored extension params (MarshallingTraverseSession.onError,\nJson5List.ofString, MarshallingSession.toBeanMap PropertyNamer).\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "0a7c46b7d651efbdced77e3284cb7c181cda0ce2",
      "tree": "1a4884d7c19b6420b9c4c86f192058c3f78cb985",
      "parents": [
        "6aba9f1fbd9772204b84d343adcff44b7064f3f6"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Mon Jul 20 09:05:36 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Mon Jul 20 09:05:36 2026 -0400"
      },
      "message": "Fix MessageFormat-vs-printf Javadoc inconsistencies + JUL logger GC pin\n\n- Reword ~98 files where Javadoc falsely claimed MessageFormat ({0}) support\n  for printf-routed messages; document java.util.Formatter (%s) semantics and\n  link via {@link String#format(String, Object...) String.format} (avoids FQCN\n  noise and unused-import warnings). (TODO-269)\n- Pin loggers whose level is set in JulLogBackend so JUL\u0027s weak-reference\n  LogManager cannot GC them mid-flight (fixes intermittent Loggers_Test 404).\n- Minor openapi-v3 unused-import cleanups.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "6aba9f1fbd9772204b84d343adcff44b7064f3f6",
      "tree": "6febd84c9b46756753a52c953ffe62b4b41914ec",
      "parents": [
        "ae8e1e3b0a6ca8d9530a3f02dca4664a2e3638ff"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Mon Jul 20 08:12:26 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Mon Jul 20 08:12:26 2026 -0400"
      },
      "message": "TODO-262: Reactor-wide Javadoc correctness audit — null-contract completeness + doc-vs-impl fixes across the entire main-source reactor.\n\nJavadoc-only pass (no behavior changes) covering all of juneau-core/*, juneau-rest/*\n(rest-common[-classic], rest-server, rest-client[-classic], 22 satellites), all 11\njuneau-bean/* modules, juneau-microservice/*, juneau-sc, examples, petstore, and\ntest-support modules. Documents null-parameter behavior where impls dereference or\ntolerate null, and corrects contradictory Javadoc (false Never-null/or-null returns,\nwrong @throws types, stale {@link} labels, copy-paste @return/descriptions, stale\nserialize/parse names from TODO-263, unescaped \u003c\u003e in examples, and Optional-return\n\"or null\" -\u003e \"or an empty Optional\"). Genuine behavior bugs discovered during the\nsweep were flagged (not fixed) for separate follow-up.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "ae8e1e3b0a6ca8d9530a3f02dca4664a2e3638ff",
      "tree": "b07a0190b91510807abbf7ceb7000fad86b78b86",
      "parents": [
        "ac4304e23774ab6ccca5e267aed5a96523457377"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sun Jul 19 18:42:38 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sun Jul 19 18:42:38 2026 -0400"
      },
      "message": "TODO-263: Rename Serializer.serialize(...) -\u003e write(...) and Parser.parse(...) -\u003e read(...) across the reactor (10.0.0 breaking change)\n\nRenames the two core marshalling entry points for symmetry with read/write,\naligning Serializer/Parser with the Marshaller facade (which already exposed\ndelegating read/write). Clean hard rename, no deprecated aliases.\n\nScope:\n- Serializer.serialize / SerializerSession.serialize -\u003e write (base + covariant\n  String/byte[] overrides); Parser.parse / ParserSession.parse -\u003e read (all overloads).\n- Abstract hooks doSerialize/doParse -\u003e doWrite/doRead across every format\n  serializer/parser override.\n- serializeToString -\u003e writeToString.\n- Parser \"into\"/\"args\" family: parseArgs/parseIntoCollection/parseIntoMap/\n  parseIntoBeanMap and the doParseInto* hooks -\u003e readArgs/readInto*/doReadInto*.\n- HTTP-part family: HttpPartSerializer.serialize / HttpPartParser.parse and the\n  Base*/OpenApiPart*/UonPart*/PartSession impls + top-level convenience methods -\u003e write/read.\n- Streaming interfaces in org.apache.juneau.marshall.stream: RecordReadable/\n  RecordWritable/TokenReadable/TokenWritable/ArrayRecordReadable/ArrayRecordWritable\n  parse*Records / parse*Tokens / serialize* -\u003e read* / write*.\n\nOut-of-scope same-named lookalikes left untouched (Version.parse, MediaType/\nMediaRanges/StringRanges.parse, Iso8601Utils/DateFormat/DurationFormat + temporal\nround-trip tests, swap/ClassMeta/Config calls). Fixed one static-import shadowing\nfallout (PlainTextParserSession bare read(reader) -\u003e IoUtils.read).\n\nWhole-reactor mvn -o clean install (with tests) GREEN.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "ac4304e23774ab6ccca5e267aed5a96523457377",
      "tree": "eb810d627f73628e3661413a61c7fa825dfe9b69",
      "parents": [
        "f6d03dd302e9c8344bd6833cb2a0be0ba96fe63e"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sun Jul 19 13:25:48 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sun Jul 19 13:25:48 2026 -0400"
      },
      "message": "Pre-10.0.0 cleanup batch: CopyUtils extraction + Shorts.cp aliases, null-coalesce/IDIOM sweeps, StringUtils de-Shorts, and assorted fixes\n\n- TODO-264: move the copyOf/cloneOf family into new CopyUtils (+ SwaggerCopyUtils/OpenApiCopyUtils); hard-remove CollectionUtils.copyOf (10.0.0 breaking change).\n- Add Shorts.cp(...) facade aliases for the CopyUtils.copyOf family; migrate consumer call sites.\n- TODO-261: null-coalesce (x\u003d\u003dnull?d:x) -\u003e Shorts.or(x,d) sweep + standardize static Shorts imports; boolean/Boolean sites kept as ternaries (Shorts.or overload ambiguity).\n- TODO-238: IDIOM-dimension mechanical sweep across non-churn modules.\n- TODO-267: de-Shorts StringUtils (use ObjectUtils.coalesce), completing the utils-layer Shorts-free invariant.\n- Collapse leftover MessageFormat \u0027\u0027-escapes in printf format strings.\n- openapi3: deep-copy fixes in bean copy-constructors (shared-mutable-bean bugs).\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "f6d03dd302e9c8344bd6833cb2a0be0ba96fe63e",
      "tree": "58961352df0469d728b3337a859cc037346dcde2",
      "parents": [
        "7cefcffaac14bd32a4374d32a94ecf7ebd464dac"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 17 16:08:34 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 17 16:08:34 2026 -0400"
      },
      "message": "TODO-238 — BUG-15: add null-guards to RestClient.request(method,url) (documented-non-null url was dereferenced unguarded, backing all verb methods + remote()).\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "7cefcffaac14bd32a4374d32a94ecf7ebd464dac",
      "tree": "e0933c5023f0e9a2f779bfab8c61ea041037d38e",
      "parents": [
        "4d6ccd07522d97b2d29376ad76efd916d756fb41"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 17 15:57:45 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 17 15:57:45 2026 -0400"
      },
      "message": "TODO-238 — BUG × juneau-rest-server fixes: BUG-09 request-derived leaks (CachingHttpServletRequest/UrlPath) + mutable-state exposure (RestMatcherList, Mixin, RestContext), BUG-15 auth null-guards; RestOpContext matcher immutable views + compareTo declaring-class tie-breaker. Public matcher getters X[]→List (10.0.0).\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "4d6ccd07522d97b2d29376ad76efd916d756fb41",
      "tree": "b621bde27503fdc70ee73831545a807f47569d37",
      "parents": [
        "6aeaa4ca3216dc491bcb231459b0de6fcba8b31c"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 17 12:56:34 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 17 12:56:34 2026 -0400"
      },
      "message": "TODO-238 — BUG × juneau-commons fixes (BUG-03 LocalDir hashCode, BUG-07 locale-safe casing, BUG-09 defensive copies, BUG-15 null guards, BUG-16 holder null-coerce) + make Version equals/hashCode/compareTo strict (prefix-matching moved to matches()). Breaking change (10.0.0).\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "6aeaa4ca3216dc491bcb231459b0de6fcba8b31c",
      "tree": "27a74cec83c4ac81bf41896725d32a64c7211b2c",
      "parents": [
        "75a787ee19aa7ab906912ec5579328819755cfb2"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 17 12:56:18 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 17 12:56:18 2026 -0400"
      },
      "message": "fix juneau-distrib dependency resolution under `mvn clean test` — depend on sibling main JARs instead of the package-only `zip:bin` assembly artifacts (keeps the reactor-ordering edge that prevents the MDEP-187 race; `dependency:copy` still fetches the zip:bin by coordinate at `package`). Regression from TODO-252.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "75a787ee19aa7ab906912ec5579328819755cfb2",
      "tree": "1a389f29be4c6e89cfc23efc97957cd70f6575a9",
      "parents": [
        "50edad73a9f010ba60caa4fa61b1f80a85295b95"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 17 10:38:28 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 17 10:38:28 2026 -0400"
      },
      "message": "READY-253 Case 4 — correct maxDepth truncation Javadocs + document @ParentProperty cyclic-graph contract (BUG-17); add recursion behavior-pinning tests. No wire change.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "50edad73a9f010ba60caa4fa61b1f80a85295b95",
      "tree": "05c8b1ff9ba0cfb15da4215d6e5f8a533a38ee27",
      "parents": [
        "8147b54482e26c02bfae74d676afa27a3cb1794a"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 17 09:52:25 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 17 09:52:25 2026 -0400"
      },
      "message": "READY-253 Cases 1-3 — pin acyclic invariants (BUG-17 false-positives): PathTraversal.JsonNode comment + Messages parent-chain termination test + HttpPartSchema deep-nesting finiteness test. No wire change.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "8147b54482e26c02bfae74d676afa27a3cb1794a",
      "tree": "68e5d905ffa9121b03fcc70a1f488145fb4b103d",
      "parents": [
        "3de8d52446b3bf3f99883e6c997476f3781eabff"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 17 09:23:48 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 17 09:24:08 2026 -0400"
      },
      "message": "TODO-252: Enable reactor -T1C parallel module test execution\n\nTune the Maven reactor for parallel-module test builds:\n- juneau-distrib/pom.xml: declare copied reactor artifacts as provided-scope\n  deps to fix the MDEP-187 dependency:copy ordering race under -T.\n- juneau-integration-tests/pom.xml: bump Surefire forkCount 4-\u003e8 on the\n  in-memory core bucket.\n- scripts/test.py: set PARALLELISM \u003d \"-T1C\" on build + test.\n- perf-baseline.txt: re-baseline for the parallel model (suite 281-\u003e130 plus\n  per-module refresh).\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "3de8d52446b3bf3f99883e6c997476f3781eabff",
      "tree": "b785672c028a27e6128fc1c1fb5075ebf0321e53",
      "parents": [
        "4aa7d56cfd51a1b0c8306ea9636259d8fcd75849",
        "5f5c50159f3ed8857bc73db2ec628905886f9be5"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 17 09:16:54 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 17 09:16:54 2026 -0400"
      },
      "message": "Merge pull request #352 from apache/dependabot/maven/org.apache.tomcat.embed-tomcat-embed-jasper-11.0.22\n\nbuild(deps-dev): bump org.apache.tomcat.embed:tomcat-embed-jasper from 10.1.34 to 11.0.22"
    },
    {
      "commit": "4aa7d56cfd51a1b0c8306ea9636259d8fcd75849",
      "tree": "cda303411380690705fd5af07e13bfddb991efe0",
      "parents": [
        "e754f4598e811cfc0464d577349c97e7cd27ec50",
        "d0bc03474e2a121fe6d6109949f24635b9385bbd"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 17 09:16:42 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 17 09:16:42 2026 -0400"
      },
      "message": "Merge pull request #362 from apache/dependabot/github_actions/github/codeql-action/analyze-02c5e83432fe5497fd85b873b6c9f16a8578e1d9\n\nbuild(deps): bump github/codeql-action/analyze from e5d2f324924c57b6cabef9bdd7a1c85d62a89be2 to 02c5e83432fe5497fd85b873b6c9f16a8578e1d9"
    },
    {
      "commit": "e754f4598e811cfc0464d577349c97e7cd27ec50",
      "tree": "d691bfed3fd2fa9b6075e67a887b4118da4c5273",
      "parents": [
        "56de4197bdf560966529989c2c473369f9f1b6c2",
        "5b22935e4466ea5852892f9d0b55ae95dffeb1dd"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 17 09:15:51 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 17 09:15:51 2026 -0400"
      },
      "message": "Merge pull request #361 from apache/dependabot/github_actions/github/codeql-action/init-02c5e83432fe5497fd85b873b6c9f16a8578e1d9\n\nbuild(deps): bump github/codeql-action/init from e5d2f324924c57b6cabef9bdd7a1c85d62a89be2 to 02c5e83432fe5497fd85b873b6c9f16a8578e1d9"
    },
    {
      "commit": "56de4197bdf560966529989c2c473369f9f1b6c2",
      "tree": "d9ded6db565635e71479709f7241ee5e8df3d95b",
      "parents": [
        "d271422a6d382ee69df6b44ef85e4152c887cbcd",
        "fe8ea3d62f96adca334a00bf08441e38af55dee3"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 17 09:15:29 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 17 09:15:29 2026 -0400"
      },
      "message": "Merge pull request #355 from apache/dependabot/github_actions/actions/cache-6\n\nbuild(deps): bump actions/cache from 5 to 6"
    },
    {
      "commit": "d271422a6d382ee69df6b44ef85e4152c887cbcd",
      "tree": "bb48eae8d644cfbc3488f5a472d6a396865dce95",
      "parents": [
        "a7eb82ebe1607052b0f365ff8b172180a1a46049",
        "70aae3f4844094b63455052b3532e418be7c01e4"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 17 09:15:11 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 17 09:15:11 2026 -0400"
      },
      "message": "Merge pull request #353 from apache/dependabot/maven/opentelemetry.version-1.63.0\n\nbuild(deps): bump opentelemetry.version from 1.62.0 to 1.63.0"
    },
    {
      "commit": "a7eb82ebe1607052b0f365ff8b172180a1a46049",
      "tree": "b93e82f25337ed5b20686772ab8900aeec2602d4",
      "parents": [
        "a4978362fbf78edc3d4eb4aad142dac73a162b13",
        "078449b05c1f80c961cbafa7d347cf310caf0bea"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 17 09:14:39 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 17 09:14:39 2026 -0400"
      },
      "message": "Merge pull request #351 from apache/dependabot/maven/org.jacoco-jacoco-maven-plugin-0.8.15\n\nbuild(deps): bump org.jacoco:jacoco-maven-plugin from 0.8.14 to 0.8.15"
    },
    {
      "commit": "a4978362fbf78edc3d4eb4aad142dac73a162b13",
      "tree": "d07a532a26e42a4a958984de22c688570f1c07d0",
      "parents": [
        "6f32e22d2fc58010771622711a67fab8bf33ed12",
        "a6bcea250efb2deb60e9dbb8926e973f7fc98517"
      ],
      "author": {
        "name": "James Bognar",
        "email": "james.bognar@salesforce.com",
        "time": "Fri Jul 17 09:14:25 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 17 09:14:25 2026 -0400"
      },
      "message": "Merge pull request #350 from apache/dependabot/maven/org.slf4j-slf4j-api-2.0.18\n\nbuild(deps-dev): bump org.slf4j:slf4j-api from 2.0.17 to 2.0.18"
    },
    {
      "commit": "6f32e22d2fc58010771622711a67fab8bf33ed12",
      "tree": "e195f8667ecbdee86d6703501ba0e28eb6767ba6",
      "parents": [
        "11c403c3e6e04bf8d563f43af229cae3a9aafbd5",
        "05dce41aead95867bc757eb7bd77d57bb8b2ed62"
      ],
      "author": {
        "name": "James Bognar",
        "email": "james.bognar@salesforce.com",
        "time": "Fri Jul 17 09:14:09 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 17 09:14:09 2026 -0400"
      },
      "message": "Merge pull request #349 from apache/dependabot/maven/org.sonarsource.scanner.maven-sonar-maven-plugin-5.7.0.6970\n\nbuild(deps-dev): bump org.sonarsource.scanner.maven:sonar-maven-plugin from 5.6.0.6792 to 5.7.0.6970"
    },
    {
      "commit": "11c403c3e6e04bf8d563f43af229cae3a9aafbd5",
      "tree": "1722e30e328ce463a84dacbaf86bdfdedba34d4f",
      "parents": [
        "080022b0bd39157e6fd494c21314b2cdfe485b79"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 17 08:44:59 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 17 08:44:59 2026 -0400"
      },
      "message": "TODO-255: Add Locale.ROOT casing helpers and sweep parse/match sites onto them\n\nAdds Shorts.lcr/ucr and StringUtils.lowerCaseRoot/upperCaseRoot as\nlocale-independent (Locale.ROOT) casing helpers for parse/match/normalize\ncode paths, and sweeps ~22 parse/match main files (+2 test files) off\ndefault-locale and Locale.ENGLISH casing onto them. Includes converting the\nthree REST HTTP-method sites (RestOpContext, RestSession, RestOperation) that\npreviously used toUpperCase(Locale.ENGLISH) for consistency with the sweep.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "080022b0bd39157e6fd494c21314b2cdfe485b79",
      "tree": "7ed4d0d8128a64a95b0feff603e0ea40f2f9d5d4",
      "parents": [
        "547e783793c3033047665195b2a99593f1f2a0b7"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 17 08:44:45 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jul 17 08:44:45 2026 -0400"
      },
      "message": "TODO-254: Harden HoconValue.getElements() against mutable-state exposure\n\nFollow-up to BUG-09 from the TODO-238 juneau-marshall quality-registry pilot.\nHoconArray.getElements() previously exposed the backing mutable element list;\nthis hardens it to prevent external mutation of internal parser state.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "d0bc03474e2a121fe6d6109949f24635b9385bbd",
      "tree": "d51ca7d1b1ab6a1948d2304d7559d856af08d915",
      "parents": [
        "547e783793c3033047665195b2a99593f1f2a0b7"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Jul 17 04:22:46 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 17 04:22:46 2026 +0000"
      },
      "message": "build(deps): bump github/codeql-action/analyze\n\nBumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from e5d2f324924c57b6cabef9bdd7a1c85d62a89be2 to 02c5e83432fe5497fd85b873b6c9f16a8578e1d9.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/e5d2f324924c57b6cabef9bdd7a1c85d62a89be2...02c5e83432fe5497fd85b873b6c9f16a8578e1d9)\n\n---\nupdated-dependencies:\n- dependency-name: github/codeql-action/analyze\n  dependency-version: 02c5e83432fe5497fd85b873b6c9f16a8578e1d9\n  dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "5b22935e4466ea5852892f9d0b55ae95dffeb1dd",
      "tree": "d4e69ddf13700792cb021620057d010462b2ec42",
      "parents": [
        "547e783793c3033047665195b2a99593f1f2a0b7"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Jul 17 04:22:40 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 17 04:22:40 2026 +0000"
      },
      "message": "build(deps): bump github/codeql-action/init\n\nBumps [github/codeql-action/init](https://github.com/github/codeql-action) from e5d2f324924c57b6cabef9bdd7a1c85d62a89be2 to 02c5e83432fe5497fd85b873b6c9f16a8578e1d9.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/e5d2f324924c57b6cabef9bdd7a1c85d62a89be2...02c5e83432fe5497fd85b873b6c9f16a8578e1d9)\n\n---\nupdated-dependencies:\n- dependency-name: github/codeql-action/init\n  dependency-version: 02c5e83432fe5497fd85b873b6c9f16a8578e1d9\n  dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "547e783793c3033047665195b2a99593f1f2a0b7",
      "tree": "47776c0d9162ee000ca186b3a019b88e88458e69",
      "parents": [
        "16737e3df51f1a444f105a8ad021d3e9f5460b51"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 16 18:01:36 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 16 18:01:36 2026 -0400"
      },
      "message": "TODO-238: Apply juneau-marshall quality-registry pilot fixes (BUG-02/07/09/15, IDIOM-02)\n\nShortlist from the codebase-quality-registry pilot across juneau-commons and\njuneau-marshall:\n\n- BUG-02: copy MsgPack serializer settings in Builder copy-constructors so\n  configuration isn\u0027t lost on copy.\n- BUG-07: parse/match casing folded through Locale.ROOT (boolean/float/duration/\n  enum/prototext/toml token parsing) to avoid locale-sensitive parsing.\n- BUG-09: getters return defensive/unmodifiable copies (MarshalledFilter property\n  sets, SearchArgs.getSearch, HoconConcat.getParts, CBOR/MsgPack getBinary clone).\n- BUG-15: null-argument guards via assertArgNotNull (PojoWalker.walk, EnumFormat.parse).\n- IDIOM-02: throw via Shorts exception factories (ioex/iaex) instead of direct\n  constructors with string concatenation.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "16737e3df51f1a444f105a8ad021d3e9f5460b51",
      "tree": "be42818f9cbec0542b85524ddd13c5512299e319",
      "parents": [
        "c429f3388964cfee9a65a2c6d4e7f58eaf7ef3cc"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 16 14:08:36 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 16 14:08:36 2026 -0400"
      },
      "message": "TODO-251: Remove dead fileCharset(...) serializer/parser builder API\n\nFollow-up to TODO-248 (stream-only marshaller I/O). Now that serialize/parse\noperate on streams only, the fileCharset(...) builder methods, getFileCharset()\ngetters, PROP_fileCharset keys, backing plumbing, and the @SerializerConfig /\n@ParserConfig fileCharset attributes are dead code with no remaining callers.\n\nRemoves the fileCharset surface from:\n- WriterSerializer / WriterSerializerSession / SerializerConfig / SerializerConfigAnnotation\n- ReaderParser / ReaderParserSession / ParserConfig / ParserConfigAnnotation\n- Marshaller\n\nUpdates affected tests (ContextSession_Test, ParserConfigAnnotationTest,\nSerializerConfigAnnotation_Test, RdfParser_Test, RdfSerializer_Test).\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "c429f3388964cfee9a65a2c6d4e7f58eaf7ef3cc",
      "tree": "bf460e81fb930a0d887f752d7033c122d92b7399",
      "parents": [
        "7fab53f1e852844c6e1776e81a0425942a3bcac5"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 16 13:27:52 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 16 13:27:52 2026 -0400"
      },
      "message": "TODO-249/250: Add marshaller stream static shortcuts + Json5R/IniR/HjsonC variant classes\n\nFeature A (TODO-249): Add Reader/Writer static shortcuts to all 21 char\nfacades and InputStream/OutputStream shortcuts to all 5 stream facades\n(26 facades total). Each static delegates to the DEFAULT instance and\ncatches IOException, rethrowing as unchecked ParseException/SerializeException\n(new ...Exception(e), matching StreamMarshaller) so the statics stay\nchecked-exception-free. No File overloads. Adds a presence-guard test\n(right-family trio present, wrong-family trio absent) and round-trip +\nIOException-wrapping behavior tests.\n\nFeature B (TODO-250): Split the three dual-DEFAULT facades into variant\nclasses -- Json5R (Json5Serializer.DEFAULT_READABLE), IniR\n(IniSerializer.DEFAULT_READABLE), HjsonC (HjsonSerializer.DEFAULT_COMPACT) --\neach a subclass of its format facade with its own DEFAULT, no-arg\nconstructor, and full redeclared static surface (statics are hidden, not\ninherited, so must be redeclared; enforced by the drift/presence test).\nRemoves Json5.DEFAULT_READABLE / Ini.DEFAULT_READABLE / Hjson.DEFAULT_COMPACT\nand migrates the 3 in-reactor references (BasicSwaggerProviderSession,\nBasicOpenApiProviderSession -\u003e Json5R.of(...); AtomJsonExample -\u003e Json5R.DEFAULT).\nBreaking change for 10.0.0. Full reactor green.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "7fab53f1e852844c6e1776e81a0425942a3bcac5",
      "tree": "553c6c616931c59cf43063a03f255fe31215f8d7",
      "parents": [
        "6f10116cbadb252f40e1e5fadbd391ddf6b835e6"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 16 10:14:32 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 16 10:14:32 2026 -0400"
      },
      "message": "TODO-248: Narrow marshaller serialize/parse I/O to streams only (drop File/StringBuilder)\n\nUniformly stream-only I/O at the 10.0.0 boundary (Option B):\n- Thin (not delete) SerializerPipe/ParserPipe: remove dead File/StringBuilder\n  instanceof branches, fileCharset/isFile params, and the always-false autoClose\n  field; retain close/flush lifecycle, charset decoding, debug capture, and\n  ParserReader position tracking.\n- Token streaming goes stream-only across classic + token surfaces; parseTokens\n  methods drop the getFileCharset() argument.\n- Delete CBOR/MsgPack TokenWriter.forOutput factories (thin OutputStream aliases);\n  sessions now call constructors directly. JSON/JSONL forOutput kept (dual\n  Writer/OutputStream). Refresh stale TokenWritable/TokenReadable Javadoc.\n- Migrate classic callers (MenuItemWidget StringBuilder -\u003e StringBuilderWriter)\n  and ~16 token/record/marshaller test suites (StringBuilder -\u003e StringWriter).\n- Fix SerializedRequestAttrVar ($SA) arg-swap bug.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "6f10116cbadb252f40e1e5fadbd391ddf6b835e6",
      "tree": "7508350f3b607aa9191855e1b7c5b583b6d6c61b",
      "parents": [
        "6613eee170305dc39706c77422fa583ae15b8a56"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 16 08:30:04 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 16 08:30:04 2026 -0400"
      },
      "message": "Printf-only f()/fs() migration + mf()/mfs() split (10.0.0 breaking change)\n\nCut StringFormat over to printf-only semantics and split the message-format\nvariants into dedicated mf()/mfs() helpers:\n\n- StringFormat: collapse to printf-only formatting; f()/fs() now delegate to\n  String.format-style semantics, with mf()/mfs() carrying the legacy\n  MessageFormat ({0}) behavior.\n- Convert {0}-\u003e%s across exception factories, assertions/verify helpers,\n  Console, LinkString, and VarTemplateCompiler call sites.\n- Flip Logger/LogRecord onto printf-style formatting to match the new default.\n- TODO-246 marshaller-adoption sweep: replace *Serializer.DEFAULT usages with\n  the instance-based marshaller API (Json5.of(...), etc.) reactor-wide.\n\nBREAKING CHANGE: f()/fs() now use printf (%s) semantics instead of\nMessageFormat ({0}). Callers relying on the old behavior must switch to\nmf()/mfs().\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "6613eee170305dc39706c77422fa583ae15b8a56",
      "tree": "5374f21f52001a58d6ff3f4d5db294df9f02179c",
      "parents": [
        "a295bde5846f05de594395ff553ca5d58f4e512e"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Wed Jul 15 12:14:51 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Wed Jul 15 12:14:51 2026 -0400"
      },
      "message": "TODO-242: Add petstore @Remote typed-client demo + Config/SVL showcase.\n\nPhase 9 - PetStoreClient @Remote interface (juneau-petstore-core) mirroring\nPetStoreResource\u0027s pet CRUD surface, plus a client-consuming Jetty container\ntest driving a genuine HTTP round-trip via RestClient.remote(PetStoreClient).\nPhase 10 - [Petstore] cfg section + $C{} SVL substitution in the root\nrouter\u0027s @HtmlDocConfig header.\n\nAlso resolves 3 Eclipse warnings surfaced along the way: a resource-suppression\nidiom on the client test\u0027s try-with-resources, {@code} demotion of an\noff-classpath javadoc @link, and an unused import in PetHtmlResource.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "a295bde5846f05de594395ff553ca5d58f4e512e",
      "tree": "3cb5cfa23011fd5fe55bda070a2dfe8f0fc1f7f6",
      "parents": [
        "f7e9b9afb61a38f63500ed5a3aed6cdc8a1cb3be"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Wed Jul 15 09:07:49 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Wed Jul 15 09:07:49 2026 -0400"
      },
      "message": "TODO-239: Port utility-beans/HTML5/image demos into petstore; drop ATOM/JSON-Schema/SSE.\n\n3 ported into petstore-core with tests + both deployments wired: utility-beans\n(PetInfoResource), HTML5 bean-builder (PetHtmlResource), and image upload/serve\n(PetPhotoSerializer/PetPhotoParser, now using Pet.photo). 3 consciously dropped\n(ATOM-feed, JSON-Schema, SSE) — no petstore-domain tie-in, coverage preserved\nelsewhere. Closes the TODO-86 acceptance gap left open by TODO-112.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "f7e9b9afb61a38f63500ed5a3aed6cdc8a1cb3be",
      "tree": "74623f5628f4bc2cec5f148a8807ea482cde59a4",
      "parents": [
        "1264c20c69fc24e56af84ea8ee2c5d9e67e9fd57"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 14 20:41:25 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 14 20:41:25 2026 -0400"
      },
      "message": "TODO-187: Remove dead ClassMeta.Category.BEAN constant and adopt isBeanMap() at equivalent serializer sites\n\nCategory.BEAN was declared but never set (isBean() is computed separately via\ngetBeanMeta() !\u003d null) and never read anywhere; its bit position is explicitly\nassigned (not ordinal-derived), so removal doesn\u0027t shift other bits.\n\nAlso swapped `o instanceof BeanMap` for the already-resolved `sType.isBeanMap()`\nat 13 serializer-session sites where sType is provably derived from o\u0027s actual\nruntime type (no delegate/wType indirection). Left ~13 other instanceof BeanMap\nsites unconverted where sType/cMeta reflects a declared/wrapped type rather than\nthe object being tested (HTML/XML/RDF delegate paths, Hocon property/map paths,\nParquet row dispatch, ObjectSearcher, MarkdownSerializerSession, and the generic\nMarshallingSession.toBeanMap utility).\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "1264c20c69fc24e56af84ea8ee2c5d9e67e9fd57",
      "tree": "262fc43bb0e22753ce9986d93a0a5b4bc1c7eb5a",
      "parents": [
        "e4dec4d4676b3748c55862759cd61097da5f4186"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 14 17:31:31 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 14 17:31:31 2026 -0400"
      },
      "message": "TODO-240: Add CodeQL barrierModel for FileUtils.resolveSafely path-injection sanitizer\n\nTeaches CodeQL\u0027s java/path-injection query that FileUtils.resolveSafely(...)\nand FileUtils.resolveVirtualPathSafely(...) are genuine cross-method\nsanitizers, so their return values (and, for the Optional-returning\noverload, the unwrapped element) are treated as boundary-checked rather\nthan re-flagged at every call site (see FINISHED-235 alerts #91, #93,\n#321-#328, and the TODO-236 relocation re-spawn of #322-#328).\n\nAlso bumps github/codeql-action/init and .../analyze from 3.29.5 to 3.37.0\n(CodeQL CLI 2.26.0), since barrierModel support requires CodeQL \u003e\u003d 2.25.2,\nand wires the new local model pack into the analyze step via\nCODEQL_ACTION_EXTRA_OPTIONS (--additional-packs / --extension-packs),\nsince unpublished local packs can\u0027t be loaded through codeql-config.yml\u0027s\npacks: field.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "e4dec4d4676b3748c55862759cd61097da5f4186",
      "tree": "ef2e786837a7bbde71173be27c710b57a7e98967",
      "parents": [
        "e773e0d68061000fdf167a990241abfffea6591f"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 14 13:53:52 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 14 13:53:52 2026 -0400"
      },
      "message": "Adopt Shorts helpers (h/eq/o) reactor-wide (TODO-241)\n\nReplace verbose JDK forms (Objects.hash, Objects.equals, Optional.ofNullable)\nwith the equivalent Shorts shortcuts across 13 files (main + test), 15 call\nsites; drop now-dead imports left behind by the substitutions.\n\nSerializerSession.defaultEquals and the Object-typed AssertionPredicates.eq/ne\noverloads are intentionally left un-migrated — their Object-typed args risk\nsilently swapping identity-based JDK array equality for Shorts.eq\u0027s\ndeep-content array equality. No applicable Optional.empty()-\u003eoe() sites exist\nreactor-wide.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "e773e0d68061000fdf167a990241abfffea6591f",
      "tree": "7f34a2179ef425c89efd57bce76d67f5e977fe4d",
      "parents": [
        "52a7dd40a7fa3aa6d3d6dc125de2a10fe20ef947"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 14 11:36:25 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 14 11:36:25 2026 -0400"
      },
      "message": "Relocate microservice demo resources to new juneau-microservice-examples module (TODO-236)\n\nMove the demo/low-value @Rest resources (LogsResource, LogParser, DirectoryResource,\nShutdownResource, SampleRootResource, ConfigResource, and the jetty DebugResource) out of the\nshipping juneau-microservice{,-jetty} modules into a new, unpublished juneau-microservice-examples\nmodule (package org.apache.juneau.microservice.examples) — slimming the framework\u0027s public API and\nsecurity footprint while preserving them as reference samples. The security-hardening (path-traversal\n/ ReDoS) that landed with the CodeQL sweep travels with the moved classes and their tests.\n\nRelocate the genuinely-framework LogEntryFormatter + TraceContext from the vacated ...resources\npackage to ...microservice.logging (still in core), and rewire juneau-petstore-jetty to depend on the\nnew module for its admin trio. Breaking FQCN change targeted at the 10.0.0 pre-release window.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "52a7dd40a7fa3aa6d3d6dc125de2a10fe20ef947",
      "tree": "c75c5c8aa046b9e451169393a75389173ec3d5dd",
      "parents": [
        "9a56dc951a881cfb6b81ce087f1554648177fec0"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 14 11:02:50 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 14 11:02:50 2026 -0400"
      },
      "message": "Resolve CodeQL code-scanning alerts: path-traversal, ReDoS, XXE, info-exposure hardening (TODO-235)\n\n- Path-injection: route juneau-sc GetConfiguration config lookups through FileUtils.resolveSafely and\n  map traversal escape to 403 in LoadConfigResource; add PARSE-method traversal regression test for\n  LogsResource.\n- ReDoS: fix polynomial-time regex in UrlPathMatcher, bound regex-validation input length in\n  HttpPartSchema, and properly escape literal fragments in LogEntryFormatter\u0027s date/format templates.\n- XXE: disable DTD processing on XmlReader\u0027s non-validating path and harden the integration-test\n  XmlValidatorParser; add XXE regression test.\n- Info exposure: AuthFilter returns a generic Unauthorized body (detail logged server-side);\n  PlainTextPojoProcessor emits generic status text for Throwables in production (gated by\n  renderResponseStackTraces).\n- Correctness: explicit narrowing cast in CharSequenceReader.\n\nAlso dismissed 22 by-design/false-positive alerts (SSRF client transports, MsgPack spec narrowing,\nutility-level XSS/error-exposure FPs, and already-mitigated log-resource path-injection) with\nper-alert rationale recorded on GitHub.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "9a56dc951a881cfb6b81ce087f1554648177fec0",
      "tree": "c3b2689b7ddcaba5faf6bd1fe1d6464281aa7737",
      "parents": [
        "93016a04730b90edb4226f68705da733401f3089"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 14 09:24:11 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jul 14 09:24:11 2026 -0400"
      },
      "message": "Route production system-property access through Settings abstraction (TODO-234)\n\nMigrate production System.getProperty reads onto the Settings lookup chain so\nthey are test-overridable via Settings.setLocal/setGlobal, and document the\nraw-access sites that must intentionally stay unabstracted (SVL $S{...} which\nreads System.getProperty directly, jetty/tomcat bound-port publication consumed\nby jetty.xml, and external logging adapters).\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "93016a04730b90edb4226f68705da733401f3089",
      "tree": "92d6a9b3784c2a607665ac688869c8eb23ace8b8",
      "parents": [
        "f6c95f55bb35ce85ab097ecf9b39262256322d6f"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Mon Jul 13 17:46:16 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Mon Jul 13 17:46:16 2026 -0400"
      },
      "message": "Enable process-level test parallelism on integration-tests core; add @ResourceLock guards (TODO-231 Ph1-2)\n\n- Phase 1: added @ResourceLock(SYSTEM_PROPERTIES) to the 47 system-property-mutating\n  test classes. Behavior-preserving prerequisite for future in-JVM concurrency.\n- Phase 2: enabled Surefire forkCount\u003d4/reuseForks on the integration-tests core\n  execution (~20% suite wall-clock reduction, verified green over 3 repeated full runs).\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "f6c95f55bb35ce85ab097ecf9b39262256322d6f",
      "tree": "7e46724552236b0531243a6aa6cf8ff13cd01fed",
      "parents": [
        "4956fedc37ad306347985693fe726700cb5442eb"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Mon Jul 13 16:21:06 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Mon Jul 13 16:21:06 2026 -0400"
      },
      "message": "Quiet-by-default test logging, SLF4J binding hygiene, thread-teardown + bnd fixes, perf re-baseline\n\n- TODO-227: fix juneau-config bnd _fixupmessages to suppress spurious OSGi warnings\n- TODO-230: clean thread teardown in FileStore and Microservice (no leaked watchers/executors)\n- TODO-228/229: inject quiet-by-default test logging via root-pom Surefire config; consolidate to a single SLF4J binding at the reactor root\n- TODO-232: refresh perf-baseline after the above changes\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "4956fedc37ad306347985693fe726700cb5442eb",
      "tree": "4f9bc0dd4ffd6b6a0b687b31794fb4d93e6a686c",
      "parents": [
        "ffc0ecdd8271caefd361957bbf9077b42bef6293"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Mon Jul 13 14:58:20 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Mon Jul 13 14:58:20 2026 -0400"
      },
      "message": "Remove debug System.out leftovers and dedupe maven-jar-plugin (test-output audit cleanups)\n\nFlagged by the TODO-219 mvn-test-output audit.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "ffc0ecdd8271caefd361957bbf9077b42bef6293",
      "tree": "1a227c6a8579a171243323e5cf9d74ef56390efc",
      "parents": [
        "d06566072ceac9c469d248477a4526c0a61f4c1c"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Mon Jul 13 13:54:07 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Mon Jul 13 13:54:07 2026 -0400"
      },
      "message": "Remove leftover Shorts-migration OpenRewrite recipe (rewrite.yml)\n\nCampaign scratch tooling referencing the deleted Utils class; matches the earlier removal of the META-INF/rewrite/shorts-*.yml recipe files.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "d06566072ceac9c469d248477a4526c0a61f4c1c",
      "tree": "3a26bdf1d2b06d77784c7754ca33ef3c69079b71",
      "parents": [
        "d43ac4180dbefceb30101f732b9ed33d3a24450e"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Mon Jul 13 13:45:39 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Mon Jul 13 13:45:39 2026 -0400"
      },
      "message": "Complete marshaller read/write instance-API refactor + reintroduce static of/to shortcuts\n\nFinishes the marshaller read/write instance-API refactor and reintroduces\nstatic of/to shortcuts on the concrete marshaller classes, with follow-on\ncleanup:\n\n- Add @Owning/resource SonarLint suppressions on the marshaller classes.\n- Convert instance-access-of-static (.DEFAULT.of/.to) usages to plain static\n  access across main and test code.\n- Rename Marshaller base-class methods and drop unnecessary throws Exception.\n- Add private static toX/fromX FQCN-wrapper helpers in the same-package\n  marshaller test files to avoid name collisions.\n- Add stream-shortcut drift tests for marshall and marshall-rdf modules.\n"
    },
    {
      "commit": "d43ac4180dbefceb30101f732b9ed33d3a24450e",
      "tree": "5e084806b99011befe7870b72b5c12d518a17c97",
      "parents": [
        "1d117afe381a998d7b17077949e753a9876cd218"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Mon Jul 13 12:10:38 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Mon Jul 13 12:10:38 2026 -0400"
      },
      "message": "Replace unnecessary fully-qualified class names with imports + simple names\n\nApplies the repo\u0027s imports/FQCN convention across 474 files in juneau-core,\njuneau-rest, juneau-integration-tests, juneau-bean, and juneau-microservice:\nfields, params, casts, generics, and Javadoc {@link}/{@see} references now use\nsimple names backed by imports instead of fully-qualified class names.\n\nGenuine collision cases are intentionally left as FQCN, including java.sql.Date\nvs java.util.Date, javax.xml.datatype.Duration vs java.time.Duration,\njava.util.logging.Logger vs the Juneau Logger, java.beans.BeanInfo vs Juneau\u0027s,\nclassic vs non-classic REST types, Spring @Bean vs Juneau @Bean, and the\nsame-package marker @interface declarations (Hjson/Prototext/Hocon/Markdown/\nProtobuf) that shadow the marshaller classes per JLS. Javadoc import-statement\nexamples remain fully qualified.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "1d117afe381a998d7b17077949e753a9876cd218",
      "tree": "4b3920d681c135778871e074619c6707db550747",
      "parents": [
        "9998b7f4c42b248dce4d179719b338e657c1c2a8"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sun Jul 12 21:43:28 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sun Jul 12 21:43:28 2026 -0400"
      },
      "message": "Clarify Shorts.java class Javadoc re: exception-factory exception\n\nDocument that the terse exception factories (rex/brex/iaex/isex/uoex/\nuoroex/ioex/exex) are self-contained rather than pure delegations to a\ndomain class, and are the only methods in the class with no @see tag.\nThis keeps the disjointness-invariant explanation accurate as part of\nthe TODO-222 Shorts Phase 8 documentation pass.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "9998b7f4c42b248dce4d179719b338e657c1c2a8",
      "tree": "84d677aa235d48c292e630fdbd3c95f6ce7f5b05",
      "parents": [
        "66675b3e493ebdc289f79f5226318ca84e1d4ab4"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sun Jul 12 21:23:11 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sun Jul 12 21:23:11 2026 -0400"
      },
      "message": "Consolidate remaining duplicate test utilities (TODO-191)\n\nReconcile and consolidate SamlTestSupport: the integration-tests copy had\ndrifted from the owner (juneau-rest-server-auth-saml) by ~207 additive\nlines of newer builder helpers, never back-ported. The owner\u0027s version is\ncanonical; publish it via a maven-jar-plugin test-jar execution restricted\nto just SamlTestSupport (and nested types), consumed by juneau-integration-\ntests as a test-jar dependency, and delete the local duplicate.\n\nConsolidate the org.apache.juneau.testing.{SpringbootTest,\nJettyMicroserviceTest,TomcatMicroserviceTest} @Tag marker annotations,\nfound byte-identical (MD5-verified) across 7 modules rather than the 3\noriginally flagged. Canonical copies now live in the marshall-free\njuneau-test-utils module (already a test dependency of every consumer),\nconsumed from its plain jar rather than another test-jar to avoid\nre-triggering the FQN-collision class of issue these markers were\npreviously implicated in. Duplicates removed from all other modules.\n\nFull reactor `mvn clean install`: BUILD SUCCESS, 135,088 tests, 0 failures,\n0 errors.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "66675b3e493ebdc289f79f5226318ca84e1d4ab4",
      "tree": "22d7c47584111f20926cdf12b1b47a9124a693cf",
      "parents": [
        "a8d18b2e125e710114f2a713d979107b19204790"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sun Jul 12 21:04:17 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sun Jul 12 21:04:17 2026 -0400"
      },
      "message": "Fix TestUtils base class regression (extends Shorts -\u003e extends BasicTestUtils)\n\nSeveral module-local TestUtils.java test-utility classes were left extending\nthe Shorts static-import facade instead of BasicTestUtils, the intended test\ninfrastructure base class (which itself extends Shorts, so no functionality\nis lost). Restores the correct class hierarchy in 8 files across\njuneau-bean-atom, juneau-bean-common, juneau-bean-hal, juneau-bean-html5,\njuneau-bean-jsonapi, juneau-bean-jsonpatch, juneau-bean-jsonschema, and\njuneau-marshall-rdf.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "a8d18b2e125e710114f2a713d979107b19204790",
      "tree": "c843a8e0ba351881b7b821837964352a479a0be9",
      "parents": [
        "6bc3e08208a5dacdb5f8ae46a8f989437e8f38a9"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sun Jul 12 20:52:48 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sun Jul 12 20:52:48 2026 -0400"
      },
      "message": "Shorts utility refactor + commons cleanup\n\nReplace the Utils god-class with a thin Shorts terse-alias layer over the\ndomain utility classes and land the Shorts API refinement campaign.\n\n- Retire Utils/firstNonNull; canonical logic lives in domain *Utils classes\n  (CollectionUtils, StringUtils, ObjectUtils, ThrowableUtils, etc.), with\n  Shorts holding only terse aliases (disjointness invariant).\n- Shorts API refinement: prune low-value aliases, reclaim terse names onto\n  domain classes, add real Javadocs, and define self-contained terse\n  exception factories (rex/iaex/isex/uoex/uoroex/...).\n- Collection-factory naming redesign: modifiable-by-default factories;\n  listBuilder/mapBuilder/setBuilder + lb/mb/stb aliases; drop\n  CollectionUtils.emptyX (use java.util.Collections); *OfType renames.\n- New package-private commons.utils.Exceptions helper so domain utils carry\n  zero Shorts dependency.\n- SonarLint: suppress S107/S3776 where intentional; harden the email regex\n  against ReDoS (S8786) with a possessive, overlap-free form.\n- Restore test imports removed by IDE organize-imports; migrate builder call\n  sites to Shorts aliases.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "6bc3e08208a5dacdb5f8ae46a8f989437e8f38a9",
      "tree": "fb02233c3cf0ad39f8d6bf7ffa0d8097b8ea630a",
      "parents": [
        "9d230c23ee1686cd3db6c4f83979bc9f4b301330"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 02 15:44:54 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 02 15:44:54 2026 -0400"
      },
      "message": "Docs module-based restructure, DependencyInfo component, javadoc package links + descriptions, key-features sync\n"
    },
    {
      "commit": "9d230c23ee1686cd3db6c4f83979bc9f4b301330",
      "tree": "d7718d6ff2868dde68439bb558c0f425e48fdd9f",
      "parents": [
        "3726d9fddde4b70dd4ac341a41e426cbdff58c5b",
        "0de4f343c6326da7bbb79fc36823bd6084188881"
      ],
      "author": {
        "name": "James Bognar",
        "email": "james.bognar@salesforce.com",
        "time": "Thu Jul 02 13:01:06 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 02 13:01:06 2026 -0400"
      },
      "message": "Merge pull request #356 from apupier/restrictTriggerPushForGihubWorkflow\n\nRestrict trigger push branch for GitHub Workflow"
    },
    {
      "commit": "3726d9fddde4b70dd4ac341a41e426cbdff58c5b",
      "tree": "e8ef05b20d58664e8e26e285999d2412ed84e163",
      "parents": [
        "205977fa8c46f231111b888ae9e5a342aab2a460"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 02 08:18:44 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Thu Jul 02 08:18:44 2026 -0400"
      },
      "message": "fix: update container-tag guard to recognize flattened org.apache.juneau.testing.* marker FQNs\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "0de4f343c6326da7bbb79fc36823bd6084188881",
      "tree": "0cf1e8fc6545b726dc45bb84cee5b4811ee6152b",
      "parents": [
        "205977fa8c46f231111b888ae9e5a342aab2a460"
      ],
      "author": {
        "name": "Aurélien Pupier",
        "email": "apupier@ibm.com",
        "time": "Thu Jul 02 10:44:42 2026 +0200"
      },
      "committer": {
        "name": "Aurélien Pupier",
        "email": "apupier@ibm.com",
        "time": "Thu Jul 02 10:44:42 2026 +0200"
      },
      "message": "Restrict trigger push branch for GitHub Workflow\n\nFeature branches rarely need their own CI runs: the code is already\ntested when a pull request is opened against a release branch. If the\npush trigger has no branch restriction and pull_request is also\nconfigured, every push to a branch with an open PR runs the workflow\ntwice: once for the push and once for the PR synchronisation.\n\nAlways give the push trigger an explicit list of branches: this stops\nbranches created from a release branch from inheriting its workflow\nruns.\n\nsee https://cwiki.apache.org/confluence/pages/viewpage.action?pageId\u003d430408443#GitHubActionsRecommendedPractices-Restrictthepushtriggertospecificbranches\n\nSigned-off-by: Aurélien Pupier \u003capupier@ibm.com\u003e"
    },
    {
      "commit": "205977fa8c46f231111b888ae9e5a342aab2a460",
      "tree": "b3ca98784401b96de823c3dfa3d9ab4823234bb3",
      "parents": [
        "4e30e94e75355ea10fc443f6bdbee549b78c1adf"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Wed Jul 01 20:35:40 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Wed Jul 01 20:35:40 2026 -0400"
      },
      "message": "refactor: consolidate duplicate test-utility code — new juneau-test-marshall-utils module, BasicTestUtils base, owning-module test-jars\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "4e30e94e75355ea10fc443f6bdbee549b78c1adf",
      "tree": "4f903838b4bf94fdbb217a179f61a1d5e386757b",
      "parents": [
        "f925cfecd6ad9e4fbcb5677a839302fdac3550bc"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Wed Jul 01 13:41:21 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Wed Jul 01 13:41:21 2026 -0400"
      },
      "message": "Merge juneau-assertions/juneau-bct/juneau-junit5 into a single juneau-test module\n\nConsolidate the three testing modules into a new juneau-core/juneau-test\nmodule (juneau-commons-only; no juneau-marshall dependency). Old modules\nremoved; BOM, distrib, and shaded-core updated; ~40 consumer POMs and ~590\nsources migrated.\n\nPackage namespace unified under org.apache.juneau.test.*:\n- assertions        -\u003e org.apache.juneau.test.assertions\n- junit5            -\u003e org.apache.juneau.test.junit\n- junit.bct         -\u003e org.apache.juneau.test.bct  (annotations subpackage folded into parent)\n- testing.annotations -\u003e org.apache.juneau.testing\n\nAPI changes:\n- FluentObjectAssertion decoupled from juneau-marshall: removed\n  asJson()/asJsonSorted()/isJson(String)/isSameJsonAs()/isSameSortedJsonAs()/\n  asString(WriterSerializer)/isSameSerializedAs(Object,WriterSerializer);\n  asString(...) retyped to ThrowingFunction; added\n  isSameSerializedAs(Object, ThrowingFunction).\n- WriterSerializer implements ThrowingFunction\u003cObject,String\u003e and\n  OutputStreamSerializer implements ThrowingFunction\u003cObject,byte[]\u003e directly;\n  the interim asFunction() bridge was removed. Serializers can now be passed\n  directly to asString(...).\n- Self-contained Messages + BasicAssertionError helpers added to juneau-test.\n\nAlso: minor SonarQube fixes in juneau-microservice-test (RestResponse\ntry-with-resources; java:S3011 accessibility suppressions).\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "f925cfecd6ad9e4fbcb5677a839302fdac3550bc",
      "tree": "12d8f16f0a50acf5b6888fa27b836c054e3d8357",
      "parents": [
        "ecd9319a1925c3d82c4e1eaaf0c5e221c857029e"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jun 30 21:47:53 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jun 30 21:47:53 2026 -0400"
      },
      "message": "Add resource-level RestAuthenticator; SonarQube, regex, and TestUtils cleanup\n\n- Add RestAuthenticator SPI and @Rest(authenticator) with AuthResult merge modes (ADD/REPLACE), docs, and full test coverage.\n- Consolidate duplicated TestUtils helpers into a shared XmlTestUtils and remove dead helper methods across modules.\n- Fix or suppress a large batch of SonarQube issues across core, rest, microservice, and bean modules.\n- Replace backtracking regexes with linear state machines in Iso8601Utils (parseDuration/parsePeriod), HttpPartSchema validators, DurationFormat, and Hjson/Hocon/Ini number parsing; cache compiled SVL Patterns.\n- Fix MockRestClient default parser gap, EphemeralJettyServerConfig stop timeout, and update perf baselines.\n- Documentation cleanup (Marshalling overview, SVL variables, sidebar ordering).\n"
    },
    {
      "commit": "ecd9319a1925c3d82c4e1eaaf0c5e221c857029e",
      "tree": "59c29e65eac7acd613c47547655ee61adf0772b2",
      "parents": [
        "13b6182e70837f87a6d8c8d7838945e5c527fbca"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Mon Jun 29 08:00:17 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Mon Jun 29 08:00:17 2026 -0400"
      },
      "message": "Add Optional-returning accessors to SerializerSet/ParserSet; opt/opte cleanup; harden petstore Spring Boot test\n\n- TODO-190: SerializerSet/ParserSet and RestClient expose Optional-based\n  getSerializerMatch/getParserMatch accessors.\n- Convert remaining Optional.empty()/Optional.ofNullable(...) to opte()/opt() helpers.\n- Add cold-start warm-up + generous timeouts to PetstoreSpringboot_Test to fix CI flake.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "13b6182e70837f87a6d8c8d7838945e5c527fbca",
      "tree": "b6b18ae91f01a312c701751d06de7f353e8480a2",
      "parents": [
        "cc6bc3fc603851754f6a9de61e460788d87deebc"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sat Jun 27 20:39:20 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sat Jun 27 20:39:20 2026 -0400"
      },
      "message": "Add RestAuthenticator SPI, Authenticator interface, AuthResult enhancements, opt/opte refactor, and SonarLint fixes\n\n- New RestAuthenticator SPI for resource-level authentication (@Rest(authenticator\u003d...),\n  AuthResultAccumulator, RestContext authentication chain, RestRequest.setAuthResult)\n- New Authenticator shared interface; AuthFilter updated to implement it\n- AuthResult enhancements: MergeMode, ofRoles(), replacing() factory methods\n- New unit tests: AuthResultAccumulator_Test, AuthResult_Test, Authenticator_Test,\n  RestAuthenticator_Test, and AuthFilterChain_Test additions\n- New integration tests: RestAuthenticatorE2E_Test, RestContextAuthenticator_Test,\n  RestRequestAuthResult_Test\n- Docusaurus doc: 10.42.01.RestServerAuthenticator.md, sidebar update, release notes\n- Codebase-wide opt/opte refactor (~244 replacements across ~58 files)\n- SonarLint suppressions: AuthResult (S1192), ParquetParserSession (S107x3),\n  RestRequest client (S3776), ProtobufParser (S115)\n- SonarLint fixes: FluentStringAssertion regex (S5852), RrpcInterfaceMethodMeta\n  array equals/hashCode/toString (S6218), ParquetParserSession computeIfAbsent (S3047)\n- TODO comment removals: YamlParserSession, ParquetParserSession\n- Utils_Test null-cast fix for generic type inference\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n"
    },
    {
      "commit": "cc6bc3fc603851754f6a9de61e460788d87deebc",
      "tree": "90fb5bf118df83082cc71b62f11f08519c0aac36",
      "parents": [
        "40725147f391d7c759dde2504381084a68414373"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jun 26 08:49:10 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jun 26 08:49:10 2026 -0400"
      },
      "message": "feat: declarative next-gen @Remote/@RemoteOp features (constant parts, call policy, @Url/baseUrl, @Multipart, format selection, streaming)\n\nNext-gen REST client (RestClient.remote) only; classic engine unchanged.\n- Constant interface/method headers, queryData, formData; @Content(def) defaults.\n- Per-part serializer via @HttpPartMarshalling.\n- Annotation call policy: interceptors, timeout, safe idempotent-only retries, throwOnError.\n- Dynamic @Url parameter + declarative baseUrl with http/https SSRF guard.\n- Declarative @Multipart/@Part with streaming part sources.\n- Per-method accept/contentType marshaller selection.\n- Streaming request/response bodies (SerializerBody, ReaderBody) + response stream lifecycle fix.\n- fix: explicit jakarta.servlet.http.Part import in RequestFormParamList to resolve @Part name collision.\n- test: context-scoped ReadinessState in HealthServlet_Test for reused-JVM isolation.\n- docs: NextGenRestClient/Interceptors/RequestParts pages + 10.0.0 release notes.\n"
    },
    {
      "commit": "fe8ea3d62f96adca334a00bf08441e38af55dee3",
      "tree": "a54dfa946a3acc6748600b74b70c5322b951812a",
      "parents": [
        "40725147f391d7c759dde2504381084a68414373"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Jun 26 04:22:24 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jun 26 04:22:24 2026 +0000"
      },
      "message": "build(deps): bump actions/cache from 5 to 6\n\nBumps [actions/cache](https://github.com/actions/cache) from 5 to 6.\n- [Release notes](https://github.com/actions/cache/releases)\n- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)\n- [Commits](https://github.com/actions/cache/compare/v5...v6)\n\n---\nupdated-dependencies:\n- dependency-name: actions/cache\n  dependency-version: \u00276\u0027\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "40725147f391d7c759dde2504381084a68414373",
      "tree": "48098b2a0758e9045ec3f1f92f5843f58e74e9e4",
      "parents": [
        "e86ac4410aef02dca687f10ab26d985e3a7b80d1"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Wed Jun 24 09:00:22 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Wed Jun 24 09:00:22 2026 -0400"
      },
      "message": "Fix stale Javadoc example in RecordReader (parseRecords → fromRecords)\n"
    },
    {
      "commit": "e86ac4410aef02dca687f10ab26d985e3a7b80d1",
      "tree": "8dab7281f233234664f2bdf5b893d254682560fb",
      "parents": [
        "c9e25049069a542ccbd04c8e4f60a72d67214504"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jun 23 11:01:15 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jun 23 11:01:15 2026 -0400"
      },
      "message": "refactor: Marshaller API cleanup — rename read/write to to/of, streaming methods to from*/to* (TODO-188)\n"
    },
    {
      "commit": "c9e25049069a542ccbd04c8e4f60a72d67214504",
      "tree": "7eb3ec039143b68ef287baad9dec9642e314c25d",
      "parents": [
        "2eb170474cd9e0012b342f3a73990d21d1505406"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jun 23 10:15:33 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Tue Jun 23 10:15:33 2026 -0400"
      },
      "message": "TODO-185b/c/d/e: Coverage fill, production fixes, and lint/warning cleanup\n\nNew tests: Parquet (ParquetColumnWriter, RleBitPacking, ThriftCompactEncoder/Decoder), HTML (HtmlParserSession), XML (XmlSerializerSession_BranchCoverage), Markdown, Prototext (PrototextParserSession), RDF/Jena (RdfApplyAnnotation, round-trips), rest-server (RestArgResolvers, HealthProbeSettings, BasicRestResourceGroup, RestServerVars), rest-client (RemoteClient, ResponseAssertion, transport adapters), rfc7807 (Problem, ProblemMapperList), DateUtils, HttpCsvArrayPart\n\nProduction fixes: dead-code branches removed from RestRequestArgs and arg resolvers; unused imports cleaned from all marshaller classes; ParquetSerializerSession/ParquetParserSession/RleBitPackingEncoder/RleBitPackingDecoder refactored\n\nLint/warning fixes: FluentStringAssertion regex (S5852); FluentDateAssertion suppression (S6350); TestUtils S5852 suppression; ParquetSerializerSession default switch case; RestServerVars_Test raw-type/resource-leak/doReturn fixes; HtmlSerializerSessionCoverage_Test ClassMeta rawtypes; BeanPropApplyAnnotation_Test added assertion; UonParserSession_Test S125 comment rephrase; RdfSerializer_Test/RdfParser_Test removed redundant suppressions\n"
    },
    {
      "commit": "2eb170474cd9e0012b342f3a73990d21d1505406",
      "tree": "2fcc4a96b1de1704c007c4147284e284c980d6f0",
      "parents": [
        "c385b80eda79b688365dc8f7c4d98245e3a96aad"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sat Jun 20 12:28:24 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sat Jun 20 12:28:24 2026 -0400"
      },
      "message": "refactor: rename Marshaller read/write to to/of, streaming methods, remove redundant statics (TODO-188)\n"
    },
    {
      "commit": "c385b80eda79b688365dc8f7c4d98245e3a96aad",
      "tree": "44f5dd3416b7028629e770732ec13e033e13a1ad",
      "parents": [
        "b26108eabd43fee28f7970ae24059a4356cc78d3"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sat Jun 20 09:58:31 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sat Jun 20 09:58:31 2026 -0400"
      },
      "message": "test: raise branch coverage in juneau-marshall, auth modules, and reactive (TODO-185a/185b)\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n"
    },
    {
      "commit": "b26108eabd43fee28f7970ae24059a4356cc78d3",
      "tree": "d9a3fd0579850b41544fe21766a692d3401d33f2",
      "parents": [
        "05a3a1ce930a1d3fd315393eed1236f12b114b45"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sat Jun 20 09:26:38 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Sat Jun 20 09:26:38 2026 -0400"
      },
      "message": "test: raise branch coverage in juneau-marshall (TODO-185b)\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n"
    },
    {
      "commit": "05a3a1ce930a1d3fd315393eed1236f12b114b45",
      "tree": "f4b0b747ab454573e7192a6544b4292bd347a34e",
      "parents": [
        "b04abf00929726cf859a62e4b4bb2dc1fe9439df"
      ],
      "author": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jun 19 10:31:36 2026 -0400"
      },
      "committer": {
        "name": "James Bognar",
        "email": "jamesbognar@apache.org",
        "time": "Fri Jun 19 10:31:36 2026 -0400"
      },
      "message": "feat: pluggable /loggers backends (Logback + Log4j2 adapters via LogBackend SPI)\n"
    }
  ],
  "next": "b04abf00929726cf859a62e4b4bb2dc1fe9439df"
}