This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+12 more
Affected surfaces
Summary
AI summaryUpdates Verified, Links, and Toolchain across a mixed release.
Full changelog
For users
GraphCompose v1.6.1 is a maintenance + compatibility patch. Drops the Java 21 source/target baseline to Java 17+ so the library can ship into older enterprise stacks without a fork, and refreshes test/build dependencies (incl. CVE pass + ByteBuddy/Mockito update so Mockito works on JDK 25).
No public API change — engine, DSL, themes, templates, and backend records all stay source-compatible with v1.6.0; existing v1.6.0 callers compile and behave unchanged.
Co-developed with external contributor @jottinger (#8, #10).
Toolchain
- Java 17 baseline.
<maven.compiler.release>flips from21to17acrosspom.xml,examples/pom.xml, andbenchmarks/pom.xml. Engine source loses the Java 21–only constructs (switch-with-type-patterns, switch-with-deconstruction,List.getFirst(),Thread.threadId()) in favour of Java 17–compatible forms. CI runs against Temurin JDK 17 / 21 / 25 in matrix. - Dependency refresh + CVE pass. Bumps Jackson
2.20.1 → 2.21.3, Logback1.5.18 → 1.5.32, Lombok1.18.38 → 1.18.46, POI5.4.0 → 5.5.1, SnakeYAML2.4 → 2.6, AssertJ3.27.3 → 3.27.6, JUnit5.12.2 → 5.14.4, Mockito5.20.0 → 5.23.0. Adds explicit ByteBuddy1.18.7so Mockito works on the Java 25+ access rules. Maven plugin bumps:maven-compiler-plugin 3.13 → 3.15,maven-surefire-plugin 3.2.5 → 3.5.5,exec-maven-plugin 3.5 → 3.6.2.
Verified
- CI green on Temurin JDK 17 / 21 / 25 in parallel matrix.
- 819 / 0 / 0 / 0 canonical test suite green on every JDK.
- 26 runnable examples regenerate cleanly.
- Engine source has zero remaining Java 21–only constructs (
getFirst,getLast,threadId, switch type patterns, switch deconstruction).
Quick start
Maven:
<repositories>
<repository><id>jitpack.io</id><url>https://jitpack.io</url></repository>
</repositories>
<dependency>
<groupId>com.github.DemchaAV</groupId>
<artifactId>GraphCompose</artifactId>
<version>v1.6.1</version>
</dependency>
Gradle (Kotlin DSL):
repositories { maven("https://jitpack.io") }
dependencies { implementation("com.github.demchaav:GraphCompose:v1.6.1") }
Looking ahead
Maven Central distribution (#7) remains queued for the upcoming v1.7.0, alongside the JMH benchmark migration. v1.6.1 stays on JitPack.
Links
- Live showcase — install snippet, every example with a generated PDF preview, template gallery, feature examples.
- Templates v2 landing — 14 CV + 14 paired cover-letter presets.
- Migration v1.5 → v1.6 — for callers still on v1.5 (engine source-compatible to v1.6.x).
- CHANGELOG.md — full technical changelog.
Author intent, not coordinates.
Security Fixes
- Dependency refresh includes CVE‑pass updates (Jackson 2.21.3, Logback 1.5.32, Lombok 1.18.46, POI 5.5.1, SnakeYAML 2.6, AssertJ 3.27.6, JUnit 5.14.4, Mockito 5.23.0) and adds ByteBuddy 1.18.7 for JDK 25 compatibility
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About GraphCompose 2.0
All releases →Related context
Related tools
Earlier breaking changes
- v2.0.0 Package rename: layered template packages dropped `.v2` suffix; update imports.
- v2.0.0 Removed dormant ECS engine internals (EntityManager, SystemECS, Entity components, render pipeline).
- v2.0.0 Removed linkOptions() accessor; use linkTarget() and ExternalLinkTarget.options().
- v2.0.0 Removed PDF‑typed document‑chrome overloads on DocumentSession; use backend‑neutral metadata/watermark/protect/header/footer.
- v2.0.0 Removed DSL name-aliases DocumentSession.builder() and DocumentDsl.text(); use builder() and paragraph().
Beta — feedback welcome: [email protected]