Author: ggregory
Date: Sun Sep 6 12:25:10 2026
New Revision: 87293
Log:
Publish commons-secure-xml 1.0.0 Release
Added:
release/commons/secure-xml/RELEASE-NOTES.txt
- copied unchanged from r87292,
dev/commons/secure-xml/1.0.0-RC2/RELEASE-NOTES.txt
release/commons/secure-xml/binaries/commons-secure-xml-1.0.0-bin.tar.gz
- copied unchanged from r87292,
dev/commons/secure-xml/1.0.0-RC2/binaries/commons-secure-xml-1.0.0-bin.tar.gz
release/commons/secure-xml/binaries/commons-secure-xml-1.0.0-bin.tar.gz.asc
- copied unchanged from r87292,
dev/commons/secure-xml/1.0.0-RC2/binaries/commons-secure-xml-1.0.0-bin.tar.gz.asc
release/commons/secure-xml/binaries/commons-secure-xml-1.0.0-bin.tar.gz.sha512
- copied unchanged from r87292,
dev/commons/secure-xml/1.0.0-RC2/binaries/commons-secure-xml-1.0.0-bin.tar.gz.sha512
release/commons/secure-xml/binaries/commons-secure-xml-1.0.0-bin.zip
- copied unchanged from r87292,
dev/commons/secure-xml/1.0.0-RC2/binaries/commons-secure-xml-1.0.0-bin.zip
release/commons/secure-xml/binaries/commons-secure-xml-1.0.0-bin.zip.asc
- copied unchanged from r87292,
dev/commons/secure-xml/1.0.0-RC2/binaries/commons-secure-xml-1.0.0-bin.zip.asc
release/commons/secure-xml/binaries/commons-secure-xml-1.0.0-bin.zip.sha512
- copied unchanged from r87292,
dev/commons/secure-xml/1.0.0-RC2/binaries/commons-secure-xml-1.0.0-bin.zip.sha512
release/commons/secure-xml/source/commons-secure-xml-1.0.0-src.tar.gz
- copied unchanged from r87292,
dev/commons/secure-xml/1.0.0-RC2/source/commons-secure-xml-1.0.0-src.tar.gz
release/commons/secure-xml/source/commons-secure-xml-1.0.0-src.tar.gz.asc
- copied unchanged from r87292,
dev/commons/secure-xml/1.0.0-RC2/source/commons-secure-xml-1.0.0-src.tar.gz.asc
release/commons/secure-xml/source/commons-secure-xml-1.0.0-src.tar.gz.sha512
- copied unchanged from r87292,
dev/commons/secure-xml/1.0.0-RC2/source/commons-secure-xml-1.0.0-src.tar.gz.sha512
release/commons/secure-xml/source/commons-secure-xml-1.0.0-src.zip
- copied unchanged from r87292,
dev/commons/secure-xml/1.0.0-RC2/source/commons-secure-xml-1.0.0-src.zip
release/commons/secure-xml/source/commons-secure-xml-1.0.0-src.zip.asc
- copied unchanged from r87292,
dev/commons/secure-xml/1.0.0-RC2/source/commons-secure-xml-1.0.0-src.zip.asc
release/commons/secure-xml/source/commons-secure-xml-1.0.0-src.zip.sha512
- copied unchanged from r87292,
dev/commons/secure-xml/1.0.0-RC2/source/commons-secure-xml-1.0.0-src.zip.sha512
Deleted:
dev/commons/secure-xml/1.0.0-RC2/RELEASE-NOTES.txt
dev/commons/secure-xml/1.0.0-RC2/binaries/commons-secure-xml-1.0.0-bin.tar.gz
dev/commons/secure-xml/1.0.0-RC2/binaries/commons-secure-xml-1.0.0-bin.tar.gz.asc
dev/commons/secure-xml/1.0.0-RC2/binaries/commons-secure-xml-1.0.0-bin.tar.gz.sha512
dev/commons/secure-xml/1.0.0-RC2/binaries/commons-secure-xml-1.0.0-bin.zip
dev/commons/secure-xml/1.0.0-RC2/binaries/commons-secure-xml-1.0.0-bin.zip.asc
dev/commons/secure-xml/1.0.0-RC2/binaries/commons-secure-xml-1.0.0-bin.zip.sha512
dev/commons/secure-xml/1.0.0-RC2/source/commons-secure-xml-1.0.0-src.tar.gz
dev/commons/secure-xml/1.0.0-RC2/source/commons-secure-xml-1.0.0-src.tar.gz.asc
dev/commons/secure-xml/1.0.0-RC2/source/commons-secure-xml-1.0.0-src.tar.gz.sha512
dev/commons/secure-xml/1.0.0-RC2/source/commons-secure-xml-1.0.0-src.zip
dev/commons/secure-xml/1.0.0-RC2/source/commons-secure-xml-1.0.0-src.zip.asc
dev/commons/secure-xml/1.0.0-RC2/source/commons-secure-xml-1.0.0-src.zip.sha512
Copied: release/commons/secure-xml/RELEASE-NOTES.txt (from r87292,
dev/commons/secure-xml/1.0.0-RC2/RELEASE-NOTES.txt)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ release/commons/secure-xml/RELEASE-NOTES.txt Sun Sep 6 12:25:10
2026 (r87293, copy of r87292,
dev/commons/secure-xml/1.0.0-RC2/RELEASE-NOTES.txt)
@@ -0,0 +1,78 @@
+
+Licensed to the Apache Software Foundation (ASF) under one or more
+contributor license agreements. See the NOTICE file distributed with
+this work for additional information regarding copyright ownership.
+The ASF licenses this file to You under the Apache License, Version 2.0
+(the "License"); you may not use this file except in compliance with
+the License. You may obtain a copy of the License at
+
+https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+Apache Commons Secure XML 1.0.0 Release Notes
+---------------------------------------------
+
+The Apache Commons Secure XML team is pleased to announce the release of
Apache Commons Secure XML 1.0.0.
+
+Apache Commons Secure XML provides secure-by-default JAXP factory creation,
abstracting over
+implementation-specific XXE securing differences between the stock JDK and
external JAXP implementations
+(Android, Apache Xalan, Apache Xerces, Woodstox, Saxon-HE).
+
+First release, requires Java 8 or above.
+
+
+New features
+------------
+
+* This is the first release of Apache Commons Secure XML.
Thanks to Piotr P. Karwasz, Gary Gregory.
+* Add secure-by-default JAXP factory creation via
org.apache.commons.xml.secure, donated from the copernik-xml-factory project
(https://github.com/copernik-eu/copernik-xml-factory) and covering the stock
JDK, Android, Apache Xalan, Apache Xerces, Woodstox, and Saxon-HE. Thanks to
Piotr P. Karwasz, Gary Gregory.
+* COMMONSXML-9: Install a non-removable resolver floor on every resolver
channel (EntityResolver, LSResourceResolver, URIResolver, and XMLResolver),
routing caller-supplied resolvers through it as allow-lists. Thanks to Piotr P.
Karwasz, Gary Gregory.
+* Secure the SAXTransformerFactory extension surface
(TransformerHandler, TemplatesHandler, and XMLFilter) and
TransformerFactory.getAssociatedStylesheet. Thanks to Piotr P. Karwasz, Gary
Gregory.
+* Document the threat model on the project site, including
the denied-fetch contract and the supported runtime floor (OpenJDK 8 and
Android API 33 or later). Thanks to Piotr P. Karwasz, Jarek Potiuk, Gary
Gregory.
+* COMMONSXML-11: Add GitHub CI builds for Java 26 and 27-EA. Thanks to Gary
Gregory, Piotr P. Karwasz.
+* Mirror on each factory class every JAXP static factory
method, including the Java 9 newDefaultInstance and Java 13 newNSInstance
families, all usable on Java 8. Thanks to Piotr P. Karwasz, Gary Gregory.
+
+Fixed Bugs
+----------
+
+* COMMONSXML-10: Block XInclude (xi:include) href resolution by default,
since the JAXP external-access properties do not govern it. Thanks to Ta Duc
Thien, Piotr P. Karwasz, Gary Gregory.
+* Honor jdk.xml.overrideDefaultParser on TrAX, XPath and
schema factories that recognize it. Thanks to Piotr P. Karwasz, Gary Gregory.
+* Restore the secure configuration when a factory or parser
is reset() instead of reverting to the implementation defaults. Thanks to Piotr
P. Karwasz, Gary Gregory.
+* Parse a Source opted in by a caller-supplied URIResolver
using a secure parser. Thanks to Piotr P. Karwasz, Gary Gregory.
+* Secure the document parse behind the InputSource-taking
XPath evaluation entry points. Thanks to Piotr P. Karwasz, Gary Gregory.
+* Fall back to the standard factory lookup in the DOM, SAX
and schema newDefaultInstance methods on Android. Thanks to Piotr P. Karwasz,
Gary Gregory.
+* Delegate the XPathFactory setProperty and getProperty
methods introduced in Java 18, so the implementation's properties stay
reachable on a secure factory. Thanks to Piotr P. Karwasz, Gary Gregory.
+* Bound the content model a schema expands into, so a compact
schema with a large maxOccurs cannot exhaust memory or CPU during validation.
Thanks to Piotr P. Karwasz, Gary Gregory.
+
+Changes
+-------
+
+* COMMONSXML-1,COMMONSXML-5,COMMONSXML-6,COMMONSXML-7,COMMONSXML-8: Recognize
XML implementations by the JAXP features and properties they support instead of
by their implementation class name, extending the securing to any compliant
implementation. Thanks to Piotr P. Karwasz, Gary Gregory.
+* COMMONSXML-4: Define a consistent contract for denied external fetches:
unresolved external references resolve to empty content on every
implementation, unless the org.apache.commons.xml.secure.throwOnUnresolved
system property requests rejection. Thanks to Piotr P. Karwasz, Gary Gregory.
+* COMMONSXML-3: Reduce the shaded footprint by splitting the secure classes
and resolver floors into independent entry points. Thanks to Piotr P. Karwasz,
Gary Gregory.
+* Allow the JAXP 1.5 accessExternal properties to be modified
on secured factories. Thanks to Piotr P. Karwasz, Gary Gregory.
+* Clean up the code and documentation after a review. Thanks
to Elliotte Rusty Harold, Piotr P. Karwasz.
+
+Removed
+-------
+
+* COMMONSXML-2: Remove the Limits class that applied uniform processing
limits across implementations. Thanks to Piotr P. Karwasz, Gary Gregory.
+
+Historical list of changes:
https://commons.apache.org/proper/commons-secure-xml//changes.html
+
+For complete information on Apache Commons Secure XML, including instructions
on how to submit bug reports,
+patches, or suggestions for improvement, see the Apache Commons Secure XML
website:
+
+https://commons.apache.org/proper/commons-secure-xml/
+
+Download page:
https://commons.apache.org/proper/commons-secure-xml//download_text.cgi
+
+Have fun!
+-Apache Commons Team
+
+-----------------------------------------------------------------------------
Copied: release/commons/secure-xml/binaries/commons-secure-xml-1.0.0-bin.tar.gz
(from r87292,
dev/commons/secure-xml/1.0.0-RC2/binaries/commons-secure-xml-1.0.0-bin.tar.gz)
==============================================================================
Binary file (source and/or target). No diff available.
Copied:
release/commons/secure-xml/binaries/commons-secure-xml-1.0.0-bin.tar.gz.asc
(from r87292,
dev/commons/secure-xml/1.0.0-RC2/binaries/commons-secure-xml-1.0.0-bin.tar.gz.asc)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ release/commons/secure-xml/binaries/commons-secure-xml-1.0.0-bin.tar.gz.asc
Sun Sep 6 12:25:10 2026 (r87293, copy of r87292,
dev/commons/secure-xml/1.0.0-RC2/binaries/commons-secure-xml-1.0.0-bin.tar.gz.asc)
@@ -0,0 +1,8 @@
+-----BEGIN PGP SIGNATURE-----
+
+iJEEABYKADkWIQT03VnJAUi9xSvrkKRTCqXyXCUBHwUCapifbBsUgAAAAAAEAA5t
+YW51MiwyLjUrMS4xMiwwLDMACgkQUwql8lwlAR9exwD9EQCqLJF1TNqTuOOZAEQh
+xvu+QvQ4qJ0+8AopZuRc0VkA/0xZBkEwGFeINqW2+OOSOHfq0uQGqGYWqMRqp3uH
+fEMC
+=tXpE
+-----END PGP SIGNATURE-----
Copied:
release/commons/secure-xml/binaries/commons-secure-xml-1.0.0-bin.tar.gz.sha512
(from r87292,
dev/commons/secure-xml/1.0.0-RC2/binaries/commons-secure-xml-1.0.0-bin.tar.gz.sha512)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++
release/commons/secure-xml/binaries/commons-secure-xml-1.0.0-bin.tar.gz.sha512
Sun Sep 6 12:25:10 2026 (r87293, copy of r87292,
dev/commons/secure-xml/1.0.0-RC2/binaries/commons-secure-xml-1.0.0-bin.tar.gz.sha512)
@@ -0,0 +1 @@
+aceca3c825554fb396f254684080f01c772fd22f4b014fcbedb89cdc4b85bd53bfdd3c7f889170ea8c93e9ddb7d291b70abbe780aca0284f86e292761fe24031
Copied: release/commons/secure-xml/binaries/commons-secure-xml-1.0.0-bin.zip
(from r87292,
dev/commons/secure-xml/1.0.0-RC2/binaries/commons-secure-xml-1.0.0-bin.zip)
==============================================================================
Binary file (source and/or target). No diff available.
Copied:
release/commons/secure-xml/binaries/commons-secure-xml-1.0.0-bin.zip.asc (from
r87292,
dev/commons/secure-xml/1.0.0-RC2/binaries/commons-secure-xml-1.0.0-bin.zip.asc)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ release/commons/secure-xml/binaries/commons-secure-xml-1.0.0-bin.zip.asc
Sun Sep 6 12:25:10 2026 (r87293, copy of r87292,
dev/commons/secure-xml/1.0.0-RC2/binaries/commons-secure-xml-1.0.0-bin.zip.asc)
@@ -0,0 +1,8 @@
+-----BEGIN PGP SIGNATURE-----
+
+iJEEABYKADkWIQT03VnJAUi9xSvrkKRTCqXyXCUBHwUCapifbBsUgAAAAAAEAA5t
+YW51MiwyLjUrMS4xMiwwLDMACgkQUwql8lwlAR+9NAEA4yLxsRMxl6mUKLzwZfSQ
+l63rJKx5SXs4NUs4HIsxkMEBALFmPfd7igK5v0p0d25tpVdCrLQxK7KUTbcG5XWX
+sF0I
+=1egj
+-----END PGP SIGNATURE-----
Copied:
release/commons/secure-xml/binaries/commons-secure-xml-1.0.0-bin.zip.sha512
(from r87292,
dev/commons/secure-xml/1.0.0-RC2/binaries/commons-secure-xml-1.0.0-bin.zip.sha512)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ release/commons/secure-xml/binaries/commons-secure-xml-1.0.0-bin.zip.sha512
Sun Sep 6 12:25:10 2026 (r87293, copy of r87292,
dev/commons/secure-xml/1.0.0-RC2/binaries/commons-secure-xml-1.0.0-bin.zip.sha512)
@@ -0,0 +1 @@
+3a84df97a21f610ef485cc393fed601ceff709f1f315ef68ebcf3ae822c20f70e186c5c9f900f9d9fc7e228718a1b3dca0164dd8365178f506f17ea653ed5e18
Copied: release/commons/secure-xml/source/commons-secure-xml-1.0.0-src.tar.gz
(from r87292,
dev/commons/secure-xml/1.0.0-RC2/source/commons-secure-xml-1.0.0-src.tar.gz)
==============================================================================
Binary file (source and/or target). No diff available.
Copied:
release/commons/secure-xml/source/commons-secure-xml-1.0.0-src.tar.gz.asc (from
r87292,
dev/commons/secure-xml/1.0.0-RC2/source/commons-secure-xml-1.0.0-src.tar.gz.asc)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ release/commons/secure-xml/source/commons-secure-xml-1.0.0-src.tar.gz.asc
Sun Sep 6 12:25:10 2026 (r87293, copy of r87292,
dev/commons/secure-xml/1.0.0-RC2/source/commons-secure-xml-1.0.0-src.tar.gz.asc)
@@ -0,0 +1,8 @@
+-----BEGIN PGP SIGNATURE-----
+
+iJEEABYKADkWIQT03VnJAUi9xSvrkKRTCqXyXCUBHwUCapifbBsUgAAAAAAEAA5t
+YW51MiwyLjUrMS4xMiwwLDMACgkQUwql8lwlAR86qAD9EDWEQSmVc4AHPdVcysX8
+1h2ODFauJJrGlHDhSVdXdyQBALr99YV/M7l22PpaW6Z5agMaaTo2XupwVr6JTrks
+PeQE
+=qyoJ
+-----END PGP SIGNATURE-----
Copied:
release/commons/secure-xml/source/commons-secure-xml-1.0.0-src.tar.gz.sha512
(from r87292,
dev/commons/secure-xml/1.0.0-RC2/source/commons-secure-xml-1.0.0-src.tar.gz.sha512)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++
release/commons/secure-xml/source/commons-secure-xml-1.0.0-src.tar.gz.sha512
Sun Sep 6 12:25:10 2026 (r87293, copy of r87292,
dev/commons/secure-xml/1.0.0-RC2/source/commons-secure-xml-1.0.0-src.tar.gz.sha512)
@@ -0,0 +1 @@
+544c31c4c276287fd312eef07829ed7cf0ce88c7e296e4ee2a1b3b2ee185a711ee8be7479bd060b095c8cab9b4a23a7a2bbca0a040e30715154dc2788eb958e2
Copied: release/commons/secure-xml/source/commons-secure-xml-1.0.0-src.zip
(from r87292,
dev/commons/secure-xml/1.0.0-RC2/source/commons-secure-xml-1.0.0-src.zip)
==============================================================================
Binary file (source and/or target). No diff available.
Copied: release/commons/secure-xml/source/commons-secure-xml-1.0.0-src.zip.asc
(from r87292,
dev/commons/secure-xml/1.0.0-RC2/source/commons-secure-xml-1.0.0-src.zip.asc)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ release/commons/secure-xml/source/commons-secure-xml-1.0.0-src.zip.asc
Sun Sep 6 12:25:10 2026 (r87293, copy of r87292,
dev/commons/secure-xml/1.0.0-RC2/source/commons-secure-xml-1.0.0-src.zip.asc)
@@ -0,0 +1,8 @@
+-----BEGIN PGP SIGNATURE-----
+
+iJEEABYKADkWIQT03VnJAUi9xSvrkKRTCqXyXCUBHwUCapifbBsUgAAAAAAEAA5t
+YW51MiwyLjUrMS4xMiwwLDMACgkQUwql8lwlAR9R5AEA4ISwTdJiekcjOSh0Xg1P
+hekeNsu8Hu0DBXCzK1BRq0UA/i2L0zPYHZIDNajW8ByMzxaPGWpVu/035u+zzlVA
+Tt8I
+=xHoU
+-----END PGP SIGNATURE-----
Copied:
release/commons/secure-xml/source/commons-secure-xml-1.0.0-src.zip.sha512 (from
r87292,
dev/commons/secure-xml/1.0.0-RC2/source/commons-secure-xml-1.0.0-src.zip.sha512)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ release/commons/secure-xml/source/commons-secure-xml-1.0.0-src.zip.sha512
Sun Sep 6 12:25:10 2026 (r87293, copy of r87292,
dev/commons/secure-xml/1.0.0-RC2/source/commons-secure-xml-1.0.0-src.zip.sha512)
@@ -0,0 +1 @@
+c41883f7cbb76983726f8d1e86aa00365a3e8151ed7bd20e9d6e7dae3af2f483118fd58ae2363939225f2d47ebe53c02e90f20dbda6b266c67632d110cb03afc
