This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/commons-secure-xml.git
The following commit(s) were added to refs/heads/main by this push:
new 15e2597 Prepare for the release candidate
15e2597 is described below
commit 15e2597e680004c7a5ab09dd9c336b2cde4ba74b
Author: Gary Gregory <[email protected]>
AuthorDate: Wed Sep 2 22:09:20 2026 +0000
Prepare for the release candidate
---
RELEASE-NOTES.txt | 3 +++
src/changes/changes.xml | 2 +-
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/RELEASE-NOTES.txt b/RELEASE-NOTES.txt
index 05a9326..8eca34d 100644
--- a/RELEASE-NOTES.txt
+++ b/RELEASE-NOTES.txt
@@ -46,6 +46,8 @@ Fixed Bugs
* Parse a Source opted in by a caller-supplied URIResolver
using a secure parser. Thanks to Piotr P. Karwasz, Gary Gregory.
* Secure the document parse behind the InputSource-taking
XPath evaluation entry points. Thanks to Piotr P. Karwasz, Gary Gregory.
* Fall back to the standard factory lookup in the DOM, SAX
and schema newDefaultInstance methods on Android. Thanks to Piotr P. Karwasz,
Gary Gregory.
+* Delegate the XPathFactory setProperty and getProperty
methods introduced in Java 18, so the implementation's properties stay
reachable on a secure factory. Thanks to Piotr P. Karwasz, Gary Gregory.
+* Bound the content model a schema expands into, so a compact
schema with a large maxOccurs cannot exhaust memory or CPU during validation.
Thanks to Piotr P. Karwasz, Gary Gregory.
Changes
-------
@@ -54,6 +56,7 @@ Changes
* COMMONSXML-4: Define a consistent contract for denied external fetches:
unresolved external references resolve to empty content on every
implementation, unless the org.apache.commons.xml.secure.throwOnUnresolved
system property requests rejection. Thanks to Piotr P. Karwasz, Gary Gregory.
* COMMONSXML-3: Reduce the shaded footprint by splitting the secure classes
and resolver floors into independent entry points. Thanks to Piotr P. Karwasz,
Gary Gregory.
* Allow the JAXP 1.5 accessExternal properties to be modified
on secured factories. Thanks to Piotr P. Karwasz, Gary Gregory.
+* Clean up the code and documentation after a review. Thanks
to Elliotte Rusty Harold, Piotr P. Karwasz.
Removed
-------
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index 0161bb3..bc6f8e1 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -31,7 +31,7 @@ The <action> type attribute can be add, update, fix, or
remove.
<title>Apache Commons Secure XML Changes</title>
</properties>
<body>
- <release version="1.0.0" date="2026-08-31" description="First release,
requires Java 8 or above.">
+ <release version="1.0.0" date="2026-09-02" description="First release,
requires Java 8 or above.">
<!-- SPECIAL -->
<action type="add" dev="ggregory" due-to="Piotr P. Karwasz, Gary
Gregory">This is the first release of Apache Commons Secure XML.</action>
<!-- ADD -->
