fix(deps): update uportal-libs.version to v5.17.5

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.jasig.portal:uPortal-spring	5.17.3 → 5.17.5
org.jasig.portal:uPortal-api-search	5.17.3 → 5.17.5

---

Release Notes

uPortal-Project/uPortal (org.jasig.portal:uPortal-spring)

v5.17.5: uPortal v5.17.5

Compare Source

Single-fix patch on top of v5.17.4.

Fixes

• Drop duplicate Bootstrap 5 includes from the respondr skin (#​2980)

  respondr/common/common_skin.xml declared the Bootstrap 5 CSS bundle and the JS bundle three times each: a <… included=\"plain\"> variant, a <… included=\"aggregated\"> variant, and a third unqualified entry that matched both render modes. The unqualified entry caused bootstrap.bundle.min.js to load twice in the browser, attaching two delegated click handlers per dropdown toggle. A single user click on a portlet's Options menu toggled the menu open then immediately back to closed, so every UX flow gated on opening that menu — favorites add/remove, rate-this-portlet, edit-mode entry, return-to-dashboard from a maximized portlet — appeared silently broken across the welcome page and every other dashboard.

  The fix is the deletion of the two unqualified entries; the included=\"plain\" / included=\"aggregated\" pair already covers every render mode.

  The duplication originally landed during the Bootstrap 5 migration when two contributors added the same asset from different mental models — unconditional include and mode-qualified include. Both were applied; neither was removed.

Upgrade notes

No configuration or deployment changes required. Drop-in replacement for v5.17.4.

v5.17.4: uPortal 5.17.4

Compare Source

Patch release on top of v5.17.3.

Fix

The obsolete ch.qos.logback.classic.selector.servlet.ContextDetachingSCL listener has been removed from uPortal-webapp/src/main/webapp/WEB-INF/web.xml (PR #​2976). The class was part of Logback's J2EE selector machinery and was removed in Logback 1.3.x.

Unlike NotificationPortlet (which still bundles Logback 1.1.11), uPortal core itself bundles Logback 1.5.32 today — so this listener was an active bug, not a latent one. It was a known tripwire across the fleet during the 2026-05 wave: every portlet that bumped Logback to 1.3+ via uportal-portlet-parent v51 hit ClassNotFoundException at context startup with this exact listener. The same fix landed across the fleet (Announcements 2.5.3, Calendar 2.7.2, JasigWidget 2.4.2, NewsReader 5.1.4, SimpleContent 3.4.2, Notification 4.8.3).

The listener also has no functional value here — Logback's modern auto-cleanup handles classloader GC and JMX deregistration without needing this hook.

Dependency bumps

Routine Renovate-driven patch bumps in established libraries:

• commons-cli → 1.11.0 (#​2967)
• commons-codec → 1.22.0 (#​2968)
• commons-io → 2.22.0 (#​2971)
• commons-pool2 → 2.13.1 (#​2974)
• tika-core → 3.3.0 (#​2975)
• jsoup → 1.22.2 (#​2978)
• easymock → 5.6.0 (#​2977)

Docs

• Drop the Docker demo publish step from RELEASE.md (#​2970).
• Backfill v5.17.2 + v5.17.3 in CHANGES and HISTORY.md (#​2969).

Compatibility

• Drop-in upgrade for any deployment running v5.17.3.
• No schema changes, no API contract changes.
• Java 11, Tomcat 8.5/9.x as before.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.