Release version 5.5.3

Author: namedgraph

CHANGELOG.md

@@ -1,3 +1,10 @@
+## [5.5.3] - 2026-06-09
+### Changed
+- Dependency hygiene: exclude duplicate `jakarta.json` from `jena-arq`, align `slf4j-reload4j` to 2.0.17, drop unused `tomcat-coyote`
+
+### Fixed
+- `JSONGRDDLFilter` response-side gate scoped per subclass (instance-level property key) with defensive `isApplicable` re-check; prevents cross-fire when multiple subclasses share the client filter chain
+
 ## [5.5.2] - 2026-06-09
 ### Changed
 - Left sidebar moved to CSR: `ldh:LeftSidebar` emits its own `left-sidebar` wrapper and is injected via `ixsl:append-content`; SSR `bs2:DocumentTree` placeholder dropped

pom.xml

@@ -3,7 +3,7 @@
 
     <groupId>com.atomgraph</groupId>
     <artifactId>linkeddatahub</artifactId>
-    <version>5.5.2</version>
+    <version>5.5.3</version>
     <packaging>${packaging.type}</packaging>
 
     <name>AtomGraph LinkedDataHub</name>
@@ -46,7 +46,7 @@
         <url>https://github.com/AtomGraph/LinkedDataHub</url>
         <connection>scm:git:git://github.com/AtomGraph/LinkedDataHub.git</connection>
         <developerConnection>scm:git:git@github.com:AtomGraph/LinkedDataHub.git</developerConnection>
-        <tag>linkeddatahub-5.5.2</tag>
+        <tag>linkeddatahub-5.5.3</tag>
     </scm>
 
     <repositories>
@@ -135,11 +135,30 @@
             <groupId>org.apache.jena</groupId>
             <artifactId>jena-arq</artifactId>
             <version>6.1.0</version>
+            <exclusions>
+                <!-- exclude Glassfish JSON-P bundle (jakarta.json-api 2.0 + impl); Parsson 1.1 (jakarta.json-api 2.1) from jersey-media-json-processing covers Jena's JSON-LD too -->
+                <exclusion>
+                    <groupId>org.glassfish</groupId>
+                    <artifactId>jakarta.json</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>${project.groupId}</groupId>
             <artifactId>twirl</artifactId>
             <version>1.1.0</version>
+            <exclusions>
+                <!-- exclude slf4j-reload4j 1.7.x binding; replaced below with 2.0.x matching slf4j-api from Jena -->
+                <exclusion>
+                    <groupId>org.slf4j</groupId>
+                    <artifactId>slf4j-reload4j</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-reload4j</artifactId>
+            <version>2.0.17</version>
         </dependency>
         <dependency>
             <groupId>${project.groupId}</groupId>
@@ -168,13 +187,6 @@
             <artifactId>jsoup</artifactId>
             <version>1.22.1</version>
         </dependency>
-        <dependency>
-            <!-- comes with atomgraph/letsencrypt-tomcat -->
-            <groupId>org.apache.tomcat</groupId>
-            <artifactId>tomcat-coyote</artifactId>
-            <version>10.1.52</version>
-            <type>jar</type>
-        </dependency>
         <dependency>
             <groupId>org.junit.jupiter</groupId>
             <artifactId>junit-jupiter</artifactId>

src/main/java/com/atomgraph/linkeddatahub/client/filter/JSONGRDDLFilter.java

@@ -76,41 +76,45 @@ public JSONGRDDLFilter(XsltCompiler xsltCompiler, String stylesheetPath) throws
         if (log.isDebugEnabled()) log.debug("Compiled GRDDL stylesheet from {} for {}", stylesheetPath, getClass().getSimpleName());
     }
 
-    private static final String ORIGINAL_URI_PROPERTY = "com.atomgraph.linkeddatahub.originalRequestURI";
-    
+    private final String originalURIProperty = "com.atomgraph.linkeddatahub.originalRequestURI." + getClass().getName();
+
     @Override
     public void filter(ClientRequestContext requestContext) throws IOException
     {
         URI requestURI = requestContext.getUri();
-        
+
         // Check if this request should be processed by the GRDDL filter
         if (!isApplicable(requestURI))
             return;
-            
+
         // Get the JSON API endpoint URL
         URI jsonURI = getJSONURI(requestURI);
         if (jsonURI == null)
             return;
-            
+
         // Store original URI in request context for thread-safe response processing
-        requestContext.setProperty(ORIGINAL_URI_PROPERTY, requestURI);
-        
+        requestContext.setProperty(originalURIProperty, requestURI);
+
         // Redirect request to JSON API endpoint
         requestContext.setUri(jsonURI);
-        
+
         if (log.isDebugEnabled()) log.debug("Redirecting request from {} to {}", requestURI, jsonURI);
     }
-    
+
     @Override
     public void filter(ClientRequestContext requestContext, ClientResponseContext responseContext) throws IOException
     {
         // Get the original URI from request context
-        URI originalRequestURI = (URI) requestContext.getProperty(ORIGINAL_URI_PROPERTY);
-        
+        URI originalRequestURI = (URI) requestContext.getProperty(originalURIProperty);
+
         // Only process responses if we redirected the original request
         if (originalRequestURI == null)
             return;
-            
+
+        // Defensive re-check: same subclass registered twice, or future subclass with shared key
+        if (!isApplicable(originalRequestURI))
+            return;
+
         // Check if response is JSON
         MediaType contentType = responseContext.getMediaType();
         if (contentType == null || !MediaType.APPLICATION_JSON_TYPE.isCompatible(contentType))