Project Roller

The Apache Roller project is pleased to announce the availability of Roller 6.1.5, a release focused on a security fix in session handling, plus a batch of dependency updates and a couple of small bug fixes.

If you run a multi-user Roller site, you should upgrade: this release fixes CVE-2025-24859, a session-management issue where a user's existing sessions stayed active after their password was changed, whether the change was made by the user or by an administrator. That meant changing a compromised password did not actually cut off an attacker who already had a live session. 6.1.5 fixes this with a new RollerLoginSessionManager that tracks each user's logged-in sessions and invalidates them centrally whenever the password changes or the account is disabled. Credit to Haining Meng for finding and reporting the issue.

https://www.apache.org/dyn/closer.cgi/roller/roller-6.1/v6.1.5

This release also includes a round of point-release dependency updates (Log4j2, Lucene, Spring Security, and others), Java 23 added to the test matrix, new SVG favicons in place of the old favicon.ico, and a fix for a bug where CSRF-salt validation could incorrectly reject legitimate multi-part form submissions such as file uploads.

You can find more details in the release announcement thread here: https://lists.apache.org/thread/vxv52vdr8nhtjlj6v02w43fdvo0cxw23

Thanks to all who helped out with this release!