lucee
diff --git a/‎CHANGELOG.md‎
Lines changed: 4 additions & 0 deletions b/‎CHANGELOG.md‎
Lines changed: 4 additions & 0 deletions
diff --git a/‎pom.xml‎
Lines changed: 1 addition & 1 deletion b/‎pom.xml‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎source/java/libs/org.apache.commons.commons-io-2.11.0.jar‎
-319 KB b/‎source/java/libs/org.apache.commons.commons-io-2.11.0.jar‎
-319 KB
diff --git a/‎source/java/libs/org.apiguardian.api-1.1.2.jar‎
-6.65 KB b/‎source/java/libs/org.apiguardian.api-1.1.2.jar‎
-6.65 KB
diff --git a/‎source/java/libs/org.hamcrest-2.2.jar‎
-120 KB b/‎source/java/libs/org.hamcrest-2.2.jar‎
-120 KB
diff --git a/‎source/java/libs/org.lucee.xmpcore-6.1.11.jar‎
-142 KB b/‎source/java/libs/org.lucee.xmpcore-6.1.11.jar‎
-142 KB
diff --git a/‎source/java/libs/org.opentest4j-1.2.0.jar‎
-7.47 KB b/‎source/java/libs/org.opentest4j-1.2.0.jar‎
-7.47 KB
@@ -1,5 +1,9 @@
 # Changelog
 
+## 3.0.1.2 (2026-03-26)
+
+- [LDEV-5129](https://luceeserver.atlassian.net/browse/LDEV-5129) remove unused bundled jars: commons-io (CVE-2024-47554), xmpcore, apiguardian, hamcrest, opentest4j
+
 ## 3.0.1.1 (2026-03-19)
 
 - [LDEV-6157](https://luceeserver.atlassian.net/browse/LDEV-6157) fix jakarta/javax compat — `<cfimage action="writeToBrowser">` threw `NoSuchMethodError` on Lucee 6 because `touchDestination()` bytecode was bound to jakarta servlet API. Use `eng.getClassUtil().callMethod()` reflection instead.
 
@@ -4,7 +4,7 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>org.lucee</groupId>
     <artifactId>image-extension</artifactId>
-    <version>3.0.1.1</version>
+    <version>3.0.1.2-SNAPSHOT</version>
     <packaging>pom</packaging>
     <name>Image Extension</name>