Fix GitHub issues #55, #70, #71: Add security policy, code formatting, and automated updates

Fixes #70: Add .editorconfig for consistent code formatting
- Created .editorconfig with rules for Java, XML, YAML, Markdown, Shell, and Properties files
- Ensures consistent indentation (4 spaces for Java/XML, 2 for YAML/Shell)
- UTF-8 charset and LF line endings across all files
- Max line length of 120 for Java files
- Works automatically in VS Code, IntelliJ IDEA, Eclipse, Vim, and other editors

Fixes #71: Add Dependabot configuration for automated dependency updates
- Created .github/dependabot.yml for Maven and GitHub Actions dependencies
- Weekly updates on Mondays with max 5 open PRs for Maven, 3 for Actions
- Grouped updates:
  - Apache CXF dependencies grouped together
  - Test dependencies (JUnit, Mockito) grouped together
  - Logging dependencies (SLF4J, Logback) grouped together
- Auto-labels PRs with "dependencies" and appropriate category tags
- Provides security alerts, changelogs, and automated updates

Fixes #55: Add SECURITY.md with vulnerability reporting process
- Created SECURITY.md with clear vulnerability disclosure guidelines
- Preferred method: GitHub Security Advisories
- Alternate method: Email to sfloess@gmail.com
- Documents expected response times and coordinated disclosure process
- Lists known security concerns (Java serialization, file operations)
- Documents security best practices and update process
- Updated README.md to link to SECURITY.md in Security Considerations section
- Added note about ObjectInputFilter protection in v1.30

Benefits:
- Improved security posture with clear vulnerability reporting
- Automated dependency updates reduce maintenance burden
- Consistent code formatting across all contributors
- Better security researcher engagement

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: Flossy

.editorconfig

@@ -0,0 +1,42 @@
+# EditorConfig: https://EditorConfig.org
+# Ensures consistent code formatting across different editors and IDEs
+
+root = true
+
+# All files
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+# Java files
+[*.java]
+indent_style = space
+indent_size = 4
+max_line_length = 120
+
+# XML files (pom.xml, etc.)
+[*.xml]
+indent_style = space
+indent_size = 4
+
+# YAML files (GitHub Actions, etc.)
+[*.{yml,yaml}]
+indent_style = space
+indent_size = 2
+
+# Markdown files
+[*.md]
+trim_trailing_whitespace = false
+max_line_length = off
+
+# Shell scripts
+[*.sh]
+indent_style = space
+indent_size = 2
+
+# Properties files
+[*.properties]
+indent_style = space
+indent_size = 2

.github/dependabot.yml

@@ -0,0 +1,38 @@
+version: 2
+updates:
+  # Maven dependencies
+  - package-ecosystem: "maven"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    groups:
+      # Group Apache CXF updates together
+      apache-cxf:
+        patterns:
+          - "org.apache.cxf:*"
+      # Group test dependencies together
+      test-dependencies:
+        patterns:
+          - "org.junit.jupiter:*"
+          - "org.mockito:*"
+      # Group logging dependencies together
+      logging:
+        patterns:
+          - "org.slf4j:*"
+          - "ch.qos.logback:*"
+    labels:
+      - "dependencies"
+      - "automated"
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    labels:
+      - "dependencies"
+      - "ci/cd"

README.md

@@ -174,12 +174,15 @@ This library sits at the foundation of the Solenopsis stack:
 
 ## Security Considerations
 
+**For security vulnerability reporting, see [SECURITY.md](SECURITY.md).**
+
 ### Java Serialization
 The serialization methods in `StringUtil` are **for internal use only**:
 - **WARNING**: Java deserialization of untrusted data is a security risk
 - Only deserialize data from trusted sources
 - Consider using JSON or XML for external data
 - These methods are used internally for session caching
+- **ObjectInputFilter** protection added in v1.30 to restrict deserialization to trusted packages
 
 ## Contributing
 

SECURITY.md

@@ -0,0 +1,73 @@
+# Security Policy
+
+## Supported Versions
+
+Currently supported versions of jcommons:
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 1.x     | :white_check_mark: |
+| < 1.0   | :x:                |
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues.**
+
+Instead, please report them via one of the following methods:
+
+### Option 1: GitHub Security Advisories (Preferred)
+1. Go to https://github.com/FlossWare/jcommons/security/advisories
+2. Click "New draft security advisory"
+3. Fill in the details
+
+### Option 2: Email
+Send an email to: **sfloess@gmail.com**
+
+Please include:
+- Type of vulnerability
+- Full paths of source file(s) related to the vulnerability
+- Location of the affected source code (tag/branch/commit)
+- Step-by-step instructions to reproduce the issue
+- Proof-of-concept or exploit code (if possible)
+- Impact of the issue, including how an attacker might exploit it
+
+### What to Expect
+- **Acknowledgment**: Within 48 hours
+- **Initial assessment**: Within 1 week
+- **Fix timeline**: Depends on severity (critical: days, high: weeks, medium/low: next release)
+- **Disclosure**: We follow coordinated disclosure - public disclosure after fix is available
+
+## Security Considerations in jcommons
+
+### Known Security Concerns
+1. **Java Serialization** (`StringUtil.fromString`, `StringUtil.fromCompressedString`)
+   - Deprecated since v1.22, planned for removal in v2.0
+   - **Never use with untrusted data**
+   - Only for internal, trusted sources
+   - Consider using JSON libraries instead
+   - **ObjectInputFilter** protection has been added as of v1.30 to restrict deserialization to trusted packages
+
+2. **File Operations** (`FileUtil`)
+   - Validate file paths to prevent directory traversal
+   - Be cautious with user-supplied file paths
+
+### Best Practices
+- Always use the latest version of jcommons
+- Review CHANGELOG.md for security-related updates
+- Enable OWASP dependency checking in your builds
+- Subscribe to GitHub security advisories for this repository
+
+## Security Update Process
+1. Security patch is developed and tested
+2. CVE is requested (if applicable)
+3. Version is released with security notes in CHANGELOG.md
+4. GitHub Security Advisory is published
+5. Users are notified via release notes
+
+## Attribution
+We appreciate the security research community and will credit researchers (with permission) in:
+- CHANGELOG.md
+- GitHub Security Advisory
+- Release notes
+
+Thank you for helping keep jcommons and its users safe!