build(deps): bump org.sitemesh:sitemesh from 3.2.3 to 3.3.0

[dependabot]

Bumps org.sitemesh:sitemesh from 3.2.3 to 3.3.0.

Release notes

Sourced from org.sitemesh:sitemesh's releases.

3.3.0

SiteMesh 3.3.0 — Java 17+, Jakarta EE 11 (Servlet 6.1), Jetty 12, Tomcat 11, and Spring Boot 4.x.

Available on Maven Central:

runtimeOnly 'org.sitemesh:sitemesh-webfilter:3.3.0'            // servlet apps: registers the filter itself, no web.xml
runtimeOnly 'org.sitemesh:spring-boot-starter-sitemesh:3.3.0'  // Spring Boot

The core org.sitemesh:sitemesh artifact on its own registers no filter; use it when you declare the filter in web.xml, subclass ConfigurableSiteMeshFilter, or run SiteMesh offline.

Upgrading from 3.2.x

• The Spring Boot starter now decorates through Spring MVC's view resolution by default, not the servlet filter. A single non-invasive delegating resolver (sitemesh.viewResolver.wrapMode=delegate) decorates what your ViewResolver beans resolve. This avoids response buffering and the forward() problems of filter-based decoration on Tomcat 11+, and makes SiteMesh work with frameworks such as Grails. If your app relied on the filter, for example to decorate static .html files or other non-MVC content, set sitemesh.integration=filter. See CONFIGURATION.md.
• sitemesh.* properties are bound through a typed SiteMeshProperties class. sitemesh.integration, sitemesh.dispatchMode and sitemesh.viewResolver.wrapMode are enums, so an unrecognised value fails startup instead of being silently ignored.
• Byte-written content without a declared charset is decoded as UTF-8, not the platform default, and the decorated result is written back in that charset. On Tomcat, decorated static pages are now served as UTF-8 rather than ISO-8859-1. A declared charset still wins.
• Offline mode reads and writes files as UTF-8 (FileSystemDirectory, InMemoryDirectory, the CLI and Ant), unless a charset is passed explicitly.
• setTagRuleBundles(...) replaces the default bundles, as its javadoc always said, instead of adding to them.
• <mapping decorator="a.html, b.html"> in XML is a chain of two decorators, as it already was with the meta tag and the Spring Boot properties.
• Replacing the decorator selector keeps mappings configured before it.
• Auto-reload checks sitemesh3.xml at most once a second instead of on every request.
• If you tried a milestone: the wrapMode=all mode from 3.3.0-M1 was removed in favour of delegate, and setting it now fails startup.

What's new

Containers

• Jakarta EE 11 / Servlet 6.1 support on Tomcat 11 and Jetty 12. The response wrappers handle ServletOutputStream.write(ByteBuffer) and setContentLengthLong(long), which newer containers use and which otherwise bypassed SiteMesh's buffer.
• Configurable dispatch to the decorator: include, forward or detect (the default, which uses include() on Tomcat 11+ and forward() elsewhere). Set it with SiteMeshFilterBuilder.setDispatchMode(...), <dispatch-mode>, dispatchMode or sitemesh.dispatchMode.

Spring Boot 4 starter

• View-resolver integration with three wrap modes (delegate, bean-definition, bean-instance). Decorators named without a leading / render through the ViewResolver chain, with no RequestDispatcher involved.
• Multi-engine apps (Thymeleaf, FreeMarker, JSP side by side) are decorated correctly, including JSP on Tomcat 11, and only HTML is ever decorated.
• Decorator chaining in Spring Boot decorator mappings.
• Configuration metadata for IDE auto-completion, and public @ConditionalOnSiteMeshIntegration / @ConditionalOnSiteMeshWrapMode annotations so framework integrations can share the starter's conditions.

Performance

• Writing the output no longer makes an intermediate String copy: allocation per decorated request is down 34% (ASCII) to 47% (non-Latin-1).
• Byte-written content (static files) is copied in bulk and decoded once, in place: write plus decode of a 16 KB page went from 18.3 to 2.35 µs.
• Render buffers are sized from what earlier renders of the same view measured.

Fixes

• java -jar sitemesh.jar works again, and offline mode honours <decorator-prefix> and <decorator-selector>.
• XML configuration: multi-path exclude mappings, pretty-printed values, and absolute configFile paths on Tomcat.
• Case conversions no longer depend on the JVM locale, a byte-written response larger than 16 MB no longer overflows the buffer, and the startup log reports the real SiteMesh version.
• sitemesh3.xsd is rewritten to match what SiteMesh reads.

The RC1, RC2 and RC3 notes list every change in detail.

Examples and build

... (truncated)

Commits

• e2b7ddd build(release): 3.3.0
• 94ad04e Point the README and QUICKSTART at the 3.3.0 release
• efa5891 Update Struts and Micronaut in the examples
• 5fbf204 build(release): start 3.3.0-SNAPSHOT
• 51c7b40 build(release): 3.3.0-RC3
• 295bcf2 Update Micronaut example platform to 5.2.0
• 0f93b41 Publish only after every CI test job has passed
• 1e3ad57 Read and write offline files as UTF-8, not the platform default
• 4608fba Expose the starter's integration and wrap-mode conditions as annotations
• 1e4de75 Point the README and QUICKSTART at the 3.3.0-RC2 release
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)