The integration of shim java 8 and 10 breaks by with Maven Enforcer Plugin to verify java 8

Hi, I ipdate your lib today an now our builds fail to to strictly fail if any lib uses java code greater java 8. this is done to ensure no lib makes it through the build to be includes in our releases as we rely on java 8.

I could fix it using "ignoreClass", so I will close this one and leave the solution here as help for others.

<rules>
  <enforceBytecodeVersion>
    <maxJdkVersion>1.8</maxJdkVersion>
		<ignoredScopes>test,provided</ignoredScopes>
		<ignoreClasses>
      <ignoreClass>org.owasp.shim.ForJava10AndLater</ignoreClass>
      <ignoreClass>org.owasp.shim.Notice</ignoreClass>
    </ignoreClasses>
  </enforceBytecodeVersion>
</rules>

I am keeping this open and will fix it natively in the next release somehow!

I would also love feedback on how this new release otherwise works for you. It was 100+ commits.

Thanks for the report, and for posting the workaround. It is safe in the meantime: on Java 8 the ignored classes are never loaded, and the shim falls back to its Java 8 implementation.

The cause: 20260921.1 bundled the shims into the main jar, which put a Java 10 class (and an empty Notice class) at the jar's root. #516 moves the Java 10 shim under META-INF/versions/10/ of the jar, which is already multi-release. enforceBytecodeVersion accepts that in its default mode. #516 also drops Notice. Which shim each Java version uses is unchanged. The build now fails if any class outside META-INF/versions/ is newer than Java 8, and CI runs the packaged jar on Java 8.

The fix will ship in the next release, which we are preparing now. Once it is out you can remove the two ignoreClasses entries. If you get a chance to try it, feedback is very welcome.

Nice work. Will test it once release.

🎉 This issue has been resolved in release-20261011.1 (Release Notes)

This is now released as 20261011.1 and is on Maven Central:

<dependency>
    <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
    <artifactId>owasp-java-html-sanitizer</artifactId>
    <version>20261011.1</version>
</dependency>

With this version you can remove the ignoreClasses entries for org.owasp.shim.ForJava10AndLater and org.owasp.shim.Notice. enforceBytecodeVersion with maxJdkVersion 1.8 passes against this jar without them. Thanks again for reporting it.

Ship the Java 10 shim in META-INF/versions/10

works, no more issue with Enforcer Plugin to verify java 8

Navigation Menu

Repository navigation

The integration of shim java 8 and 10 breaks by with Maven Enforcer Plugin to verify java 8 #515

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

The integration of shim java 8 and 10 breaks by with Maven Enforcer Plugin to verify java 8 #515

Description

Activity

benzman81 commented on Oct 6, 2026

jmanico commented on Oct 6, 2026

jmanico commented on Oct 11, 2026

benzman81 commented on Oct 11, 2026

github-actions commented on Oct 11, 2026

jmanico commented on Oct 11, 2026

benzman81 commented on Oct 15, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions