From b7a869e5131e23262e85e6fc8f7ea5ca1f3d0faa Mon Sep 17 00:00:00 2001
From: Alessandro Ruzzon <alessandro.ruzzon@dynatrace.com>
Date: Thu, 23 Apr 2026 21:55:31 +0200
Subject: [PATCH 1/3] Bundle java8-shim and java10-shim into the main JAR to
 fix JPMS split-package error

---
 .gitignore                        |  2 ++
 change_log.md                     |  5 ++++
 docs/maven.md                     |  6 ++++-
 owasp-java-html-sanitizer/pom.xml | 44 +++++++++++++++++++++++++++++++
 pom.xml                           |  5 ++++
 5 files changed, 61 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 8a3318b3..849f6e14 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,3 +6,5 @@ target
 .settings
 .idea
 out
+PLAN.md
+dependency-reduced-pom.xml
diff --git a/change_log.md b/change_log.md
index 8768a95c..676e7d34 100644
--- a/change_log.md
+++ b/change_log.md
@@ -1,6 +1,11 @@
 # OWASP Java HTML Sanitizer Change Log
 
 Most recent at top.
+  * Next release
+    * Fix: `java8-shim` and `java10-shim` are now bundled inside the main JAR,
+      resolving the JPMS split-package error on the module path. Consumers no
+      longer need to declare the shim artifacts as direct dependencies. Both
+      shim JARs remain published on Maven Central for backwards compatibility.
   * Release 20240325.1
     * Remove dependency on Guava
     * Raise minimum supported JVM release to 8
diff --git a/docs/maven.md b/docs/maven.md
index afc82bb6..a0d9d74e 100644
--- a/docs/maven.md
+++ b/docs/maven.md
@@ -9,12 +9,16 @@ Including among your POMs `<dependencies>` this snippet of XML...
 <dependency>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>owasp-java-html-sanitizer</artifactId>
-    <version>20180219.1</version>
+    <version>20240325.1</version>
 </dependency>
 ```
 
 ...will make the sanitizer available.
 
+The sanitizer JAR is self-contained: the `java8-shim` and `java10-shim` artifacts
+are bundled inside it and do **not** need to be declared as separate dependencies,
+including when using the JPMS module path.
+
 Be sure to change the
 [version](https://cwiki.apache.org/confluence/display/MAVENOLD/Dependency+Mediation+and+Conflict+Resolution#DependencyMediationandConflictResolution-DependencyVersionRanges)
 to a range suitable to your project.  There are no unstable releases
diff --git a/owasp-java-html-sanitizer/pom.xml b/owasp-java-html-sanitizer/pom.xml
index c4597c03..8f264395 100644
--- a/owasp-java-html-sanitizer/pom.xml
+++ b/owasp-java-html-sanitizer/pom.xml
@@ -67,6 +67,10 @@
         <configuration>
           <instructions>
             <Export-Package>org.owasp.html</Export-Package>
+            <!-- Explicit JPMS automatic module name so consumers using the
+                 module path can require this module by a stable name that
+                 is independent of the JAR filename. -->
+            <Automatic-Module-Name>owasp.java.html.sanitizer</Automatic-Module-Name>
           </instructions>
         </configuration>
       </plugin>
@@ -86,6 +90,44 @@
           </execution>
         </executions>
       </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-shade-plugin</artifactId>
+        <executions>
+          <execution>
+            <phase>package</phase>
+            <goals><goal>shade</goal></goals>
+            <configuration>
+              <!-- Inline java8-shim and java10-shim into this JAR so that
+                   consumers using the JPMS module path do not encounter a
+                   split-package error from org.owasp.shim appearing in
+                   multiple JARs. See https://github.com/OWASP/java-html-sanitizer/issues/341 -->
+              <artifactSet>
+                <includes>
+                  <include>com.googlecode.owasp-java-html-sanitizer:java8-shim</include>
+                  <include>com.googlecode.owasp-java-html-sanitizer:java10-shim</include>
+                </includes>
+              </artifactSet>
+              <filters>
+                <filter>
+                  <artifact>*:*</artifact>
+                  <excludes>
+                    <!-- Exclude shim Maven metadata to avoid duplicate
+                         pom.properties / pom.xml entries in the JAR -->
+                    <exclude>META-INF/maven/com.googlecode.owasp-java-html-sanitizer/java*/**</exclude>
+                  </excludes>
+                </filter>
+              </filters>
+              <!-- Replace the original JAR with the shaded one as the
+                   main artifact; do not attach a separate shaded artifact -->
+              <shadedArtifactAttached>false</shadedArtifactAttached>
+              <!-- Generate a reduced POM that omits the now-inlined shim
+                   dependencies, keeping the published POM accurate -->
+              <createDependencyReducedPom>true</createDependencyReducedPom>
+            </configuration>
+          </execution>
+        </executions>
+      </plugin>
     </plugins>
   </build>
 
@@ -93,10 +135,12 @@
     <dependency>
       <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
       <artifactId>java8-shim</artifactId>
+      <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
       <artifactId>java10-shim</artifactId>
+      <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>commons-codec</groupId>
diff --git a/pom.xml b/pom.xml
index 6d9896d4..12f20876 100644
--- a/pom.xml
+++ b/pom.xml
@@ -196,6 +196,11 @@ application while protecting against XSS.
             <artifactId>maven-verifier-plugin</artifactId>
             <version>1.1</version>
           </plugin>
+          <plugin>
+            <groupId>org.apache.maven.plugins</groupId>
+            <artifactId>maven-shade-plugin</artifactId>
+            <version>3.6.0</version>
+          </plugin>
       </plugins>
     </pluginManagement>
     <plugins>

From 01652ceb7bc3ddc0ffeb3c66c945a23b2f2fb905 Mon Sep 17 00:00:00 2001
From: Jim Manico <jim@manico.net>
Date: Mon, 7 Sep 2026 13:02:16 -1000
Subject: [PATCH 2/3] Do not publish the shim artifacts separately once bundled

Addresses review feedback on #379: with java8-shim and java10-shim inlined
into the main JAR, publishing them separately only invites consumers to
add them back and recreate the split package. Also drops a stray local
file from .gitignore and refreshes the version in docs/maven.md.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SKUuD1GhUfpvrDvJen6r91
---
 .gitignore          | 1 -
 change_log.md       | 6 +++---
 docs/maven.md       | 2 +-
 java10-shim/pom.xml | 5 +++++
 java8-shim/pom.xml  | 5 +++++
 5 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/.gitignore b/.gitignore
index 849f6e14..bb1b1c49 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,5 +6,4 @@ target
 .settings
 .idea
 out
-PLAN.md
 dependency-reduced-pom.xml
diff --git a/change_log.md b/change_log.md
index 676e7d34..97ef314e 100644
--- a/change_log.md
+++ b/change_log.md
@@ -3,9 +3,9 @@
 Most recent at top.
   * Next release
     * Fix: `java8-shim` and `java10-shim` are now bundled inside the main JAR,
-      resolving the JPMS split-package error on the module path. Consumers no
-      longer need to declare the shim artifacts as direct dependencies. Both
-      shim JARs remain published on Maven Central for backwards compatibility.
+      resolving the JPMS split-package error on the module path. The shim
+      artifacts are no longer published separately. If you added an explicit
+      dependency on `java8-shim` or `java10-shim` as a workaround, remove it.
   * Release 20240325.1
     * Remove dependency on Guava
     * Raise minimum supported JVM release to 8
diff --git a/docs/maven.md b/docs/maven.md
index a0d9d74e..203d9838 100644
--- a/docs/maven.md
+++ b/docs/maven.md
@@ -9,7 +9,7 @@ Including among your POMs `<dependencies>` this snippet of XML...
 <dependency>
     <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
     <artifactId>owasp-java-html-sanitizer</artifactId>
-    <version>20240325.1</version>
+    <version>20260313.1</version>
 </dependency>
 ```
 
diff --git a/java10-shim/pom.xml b/java10-shim/pom.xml
index 080a7119..bf6c984a 100644
--- a/java10-shim/pom.xml
+++ b/java10-shim/pom.xml
@@ -10,6 +10,11 @@
 
   <name>Java 10 Shim</name>
   <url>https://github.com/OWASP/java-html-sanitizer</url>
+
+  <properties>
+    <!-- Bundled into owasp-java-html-sanitizer.jar; not published on its own. -->
+    <maven.deploy.skip>true</maven.deploy.skip>
+  </properties>
   <description>
     Provides an implementation of java8-shim that interoperates with
     Java &gt;= 10 idioms for immutable collections.
diff --git a/java8-shim/pom.xml b/java8-shim/pom.xml
index 47614e61..a2651c15 100644
--- a/java8-shim/pom.xml
+++ b/java8-shim/pom.xml
@@ -10,6 +10,11 @@
 
   <name>Java 8 Shim</name>
   <url>https://github.com/OWASP/java-html-sanitizer</url>
+
+  <properties>
+    <!-- Bundled into owasp-java-html-sanitizer.jar; not published on its own. -->
+    <maven.deploy.skip>true</maven.deploy.skip>
+  </properties>
   <description>
     Backports @since Java 9 collection factories like List.of onto
     Java8 in a way that uses the real ones where available, falls back

From a218b95c0820b75756260a391b3c814609ad7d21 Mon Sep 17 00:00:00 2001
From: Jim Manico <jim@manico.net>
Date: Mon, 7 Sep 2026 13:07:49 -1000
Subject: [PATCH 3/3] Fold maven.deploy.skip into the existing java10-shim
 properties block

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SKUuD1GhUfpvrDvJen6r91
---
 java10-shim/pom.xml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/java10-shim/pom.xml b/java10-shim/pom.xml
index bf6c984a..13b4f090 100644
--- a/java10-shim/pom.xml
+++ b/java10-shim/pom.xml
@@ -11,10 +11,6 @@
   <name>Java 10 Shim</name>
   <url>https://github.com/OWASP/java-html-sanitizer</url>
 
-  <properties>
-    <!-- Bundled into owasp-java-html-sanitizer.jar; not published on its own. -->
-    <maven.deploy.skip>true</maven.deploy.skip>
-  </properties>
   <description>
     Provides an implementation of java8-shim that interoperates with
     Java &gt;= 10 idioms for immutable collections.
@@ -22,6 +18,8 @@
 
   <properties>
     <maven.compiler.release>10</maven.compiler.release>
+    <!-- Bundled into owasp-java-html-sanitizer.jar; not published on its own. -->
+    <maven.deploy.skip>true</maven.deploy.skip>
   </properties>
 
   <build>