Skip to content

GraphCompose 2.0

v1.6.1 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 2mo Build & Package
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

business-documents cv-templates declarative-api document-generation invoice-template java
+12 more
java-17 layout-engine maven pagination pdf pdf-generator pdf-lib pdf-library pdfbox3 report-generation snapshot-testing template-engine

Affected surfaces

deps

Summary

AI summary

Updates Verified, Links, and Toolchain across a mixed release.

Full changelog

For users

GraphCompose v1.6.1 is a maintenance + compatibility patch. Drops the Java 21 source/target baseline to Java 17+ so the library can ship into older enterprise stacks without a fork, and refreshes test/build dependencies (incl. CVE pass + ByteBuddy/Mockito update so Mockito works on JDK 25).

No public API change — engine, DSL, themes, templates, and backend records all stay source-compatible with v1.6.0; existing v1.6.0 callers compile and behave unchanged.

Co-developed with external contributor @jottinger (#8, #10).

Toolchain

  • Java 17 baseline. <maven.compiler.release> flips from 21 to 17 across pom.xml, examples/pom.xml, and benchmarks/pom.xml. Engine source loses the Java 21–only constructs (switch-with-type-patterns, switch-with-deconstruction, List.getFirst(), Thread.threadId()) in favour of Java 17–compatible forms. CI runs against Temurin JDK 17 / 21 / 25 in matrix.
  • Dependency refresh + CVE pass. Bumps Jackson 2.20.1 → 2.21.3, Logback 1.5.18 → 1.5.32, Lombok 1.18.38 → 1.18.46, POI 5.4.0 → 5.5.1, SnakeYAML 2.4 → 2.6, AssertJ 3.27.3 → 3.27.6, JUnit 5.12.2 → 5.14.4, Mockito 5.20.0 → 5.23.0. Adds explicit ByteBuddy 1.18.7 so Mockito works on the Java 25+ access rules. Maven plugin bumps: maven-compiler-plugin 3.13 → 3.15, maven-surefire-plugin 3.2.5 → 3.5.5, exec-maven-plugin 3.5 → 3.6.2.

Verified

  • CI green on Temurin JDK 17 / 21 / 25 in parallel matrix.
  • 819 / 0 / 0 / 0 canonical test suite green on every JDK.
  • 26 runnable examples regenerate cleanly.
  • Engine source has zero remaining Java 21–only constructs (getFirst, getLast, threadId, switch type patterns, switch deconstruction).

Quick start

Maven:

<repositories>
    <repository><id>jitpack.io</id><url>https://jitpack.io</url></repository>
</repositories>

<dependency>
    <groupId>com.github.DemchaAV</groupId>
    <artifactId>GraphCompose</artifactId>
    <version>v1.6.1</version>
</dependency>

Gradle (Kotlin DSL):

repositories { maven("https://jitpack.io") }
dependencies { implementation("com.github.demchaav:GraphCompose:v1.6.1") }

Looking ahead

Maven Central distribution (#7) remains queued for the upcoming v1.7.0, alongside the JMH benchmark migration. v1.6.1 stays on JitPack.

Links


Author intent, not coordinates.

Security Fixes

  • Dependency refresh includes CVE‑pass updates (Jackson 2.21.3, Logback 1.5.32, Lombok 1.18.46, POI 5.5.1, SnakeYAML 2.6, AssertJ 3.27.6, JUnit 5.14.4, Mockito 5.23.0) and adds ByteBuddy 1.18.7 for JDK 25 compatibility

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track GraphCompose 2.0

Get notified when new releases ship.

Sign up free

About GraphCompose 2.0

All releases →

Related context

Related tools

Earlier breaking changes

  • v2.0.0 Package rename: layered template packages dropped `.v2` suffix; update imports.
  • v2.0.0 Removed dormant ECS engine internals (EntityManager, SystemECS, Entity components, render pipeline).
  • v2.0.0 Removed linkOptions() accessor; use linkTarget() and ExternalLinkTarget.options().
  • v2.0.0 Removed PDF‑typed document‑chrome overloads on DocumentSession; use backend‑neutral metadata/watermark/protect/header/footer.
  • v2.0.0 Removed DSL name-aliases DocumentSession.builder() and DocumentDsl.text(); use builder() and paragraph().

Beta — feedback welcome: [email protected]