Release notes - Version 6.5.1

This is a hotfix release, aiming to address issues identified in CB-AdES creation for certain configurations, see below.

The release also includes update of dependencies, therefore it is still advisable to update to the newer version even if not concerned by the listed issues.

🆕 New features

• [DSS-4001] DSS Demos : add a property to skip UTCTime encoding validation

🐞 Bug fixes / Issues

• [DSS-3985] CB-AdES sigD.mId and some other elements miss a tag #6.32(tstr)
• [DSS-3996] CB-AdES x5ts protected header is created for a single certificate in the chain
• [DSS-3999] CB-AdES counter signatures shall be untagged

🧩 Dependencies

DSS core:

• Bouncy Castle: 1.85 → 1.86
• jose4j: 0.9.6 → 0.9.7
• VeraPDF: 1.30.2 → 1.30.3
• Apache HttpClient 5: 5.6.4 → 5.6.5
• json-sKema: 0.31.0 → 0.32.0
• Apache Commons Lang: 3.20.0 → 3.21.0
• Google Guava: 33.6.0-jre → 33.7.2-jre
• SLF4J: 2.0.18 → 2.0.20
• Jackson: 2.22.2 → 2.22.3
• additional test and build dependency updates

DSS demonstrations:

• Spring Boot: 4.0.8 → 4.1.1
• Apache CXF: 4.2.3 → 4.2.4
• Swagger UI: 5.32.14 → 5.33.1
• Jackson Jakarta RS JSON Provider: 3.2.2 → 3.2.3
• Apache FreeMarker: 2.3.34 → 2.3.35
• Apache Groovy: 4.0.32 → 4.0.33
• SLF4J: 2.0.18 → 2.0.20
• Logback: 1.6.3 → 1.6.5
• Kotlin Standard Library: bumped to 2.4.21 to address vulnerability
• additional test and build dependency updates

DSS bundles:

• Eclipse Temurin JRE 26: 26.0.2+10 → 26.0.2.1+1 (Windows and Linux packages)
• Apache Tomcat: 11.0.25 → 11.0.27

🔄 Migration

For information about code changes and migration process, please refer to the Migration Guide in documentation.