This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/commons-secure-xml.git
The following commit(s) were added to refs/heads/main by this push:
new e4193cf Prepare for the release candidate
e4193cf is described below
commit e4193cf8896d5527a9293ce1a7992b58fe1e1c95
Author: Gary Gregory <[email protected]>
AuthorDate: Sat Oct 3 02:19:30 2026 +0000
Prepare for the release candidate
---
CONTRIBUTING.md | 8 ++---
README.md | 6 ++--
RELEASE-NOTES.txt | 55 +++++++++++++++++++++++++++++++++++
src/changes/changes.xml | 2 +-
src/site/xdoc/download_secure-xml.xml | 26 ++++++++---------
5 files changed, 76 insertions(+), 21 deletions(-)
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 9016a98..6d52e1a 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -48,13 +48,13 @@ Getting Started
---------------
+ Make sure you have a [JIRA account](https://issues.apache.org/jira/).
-+ Make sure you have a [GitHub account](https://github.com/signup/free). This
is not essential, but it makes providing patches much easier.
++ Make sure you have a [GitHub account](https://github.com/signup). This is
not essential, but it makes providing patches much easier.
+ If you're planning to implement a new feature, it makes sense to discuss
your changes on the [dev list](https://commons.apache.org/mail-lists.html)
first. This way you can make sure you're not wasting your time on something
that isn't considered to be in Apache Commons Secure XML's scope.
+ Submit a [Jira Ticket][jira] for your issue, assuming one does not already
exist.
+ Clearly describe the issue, including steps to reproduce it if it is a bug.
+ Make sure you fill in the earliest version that you know has the issue.
+ Find the corresponding [repository on
GitHub](https://github.com/apache/?query=commons-),
-[fork](https://help.github.com/articles/fork-a-repo/) and check out your
forked repository. If you don't have a GitHub account, you can still clone the
Commons repository.
+[fork](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/fork-a-repo)
and check out your forked repository. If you don't have a GitHub account, you
can still clone the Commons repository.
Making Changes
--------------
@@ -108,8 +108,8 @@ Additional Resources
+ [Contributing patches](https://commons.apache.org/patches.html)
+ [Apache Commons Secure XML JIRA project page][jira]
+ [Contributor License Agreement][cla]
-+ [General GitHub documentation](https://help.github.com/)
-+ [GitHub pull request
documentation](https://help.github.com/articles/creating-a-pull-request/)
++ [General GitHub documentation](https://docs.github.com/)
++ [GitHub pull request
documentation](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request)
[cla]:https://www.apache.org/licenses/#clas
[jira]:https://issues.apache.org/jira/browse/COMMONSXML
diff --git a/README.md b/README.md
index 3d1bcb5..398ba22 100644
--- a/README.md
+++ b/README.md
@@ -45,9 +45,9 @@ Apache Commons Secure XML
[](https://github.com/apache/commons-secure-xml/actions/workflows/maven.yml)
[](https://search.maven.org/artifact/org.apache.commons/commons-secure-xml)
-[](https://javadoc.io/doc/org.apache.commons/commons-secure-xml/1.0.0)
+[](https://javadoc.io/doc/org.apache.commons/commons-secure-xml/1.1.0)
[](https://github.com/apache/commons-secure-xml/actions/workflows/codeql-analysis.yml)
-[](https://api.securityscorecards.dev/projects/github.com/apache/commons-secure-xml)
+[](https://scorecard.dev/viewer/?uri=github.com/apache/commons-secure-xml)
Apache Commons Secure XML provides secure-by-default JAXP factory creation,
abstracting over
implementation-specific XXE securing differences between the stock JDK and
external JAXP implementations
@@ -70,7 +70,7 @@ Alternatively, you can pull it from the central Maven
repositories:
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-secure-xml</artifactId>
- <version>1.0.0</version>
+ <version>1.1.0</version>
</dependency>
```
diff --git a/RELEASE-NOTES.txt b/RELEASE-NOTES.txt
index e930fb0..190ff55 100644
--- a/RELEASE-NOTES.txt
+++ b/RELEASE-NOTES.txt
@@ -14,6 +14,61 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
or implied.
See the License for the specific language governing permissions and
limitations under the License.
+Apache Commons Secure XML 1.1.0 Release Notes
+---------------------------------------------
+
+The Apache Commons Secure XML team is pleased to announce the release of
Apache Commons Secure XML 1.1.0.
+
+Apache Commons Secure XML provides secure-by-default JAXP factory creation,
abstracting over
+implementation-specific XXE securing differences between the stock JDK and
external JAXP implementations
+(Android, Apache Xalan, Apache Xerces, Woodstox, Saxon-HE).
+
+Second release. Requires Java 8 or later.
+
+
+New features
+------------
+
+* COMMONSXML-18: Add helpers that return a secure, namespace-aware
DocumentBuilder, SAXParser or XMLReader directly, without the factory. Thanks
to Piotr P. Karwasz, Gary Gregory.
+
+Fixed Bugs
+----------
+
+* Fix the OpenRewrite migration recipe to target static
method calls instead of class references. Thanks to Gary Gregory.
+* Fix the OpenRewrite migration recipe to add a dependency on
org.apache.commons:commons-secure-xml:1.0.0. Thanks to Gary Gregory.
+* Fix rejection behavior of foreign Templates in
SAXTransformerFactory.newTransformerHandler. Thanks to Piotr P. Karwasz, Gary
Gregory.
+* Fix a NullPointerException when an XMLFilter with a
self-driven parent reader is parsed with a null InputSource. #86 Thanks to
Piotr P. Karwasz, Gary Gregory.
+* COMMONSXML-17: Keep a URIResolver already set on a Transformer when it is
wrapped, instead of replacing it with the resolver floor. Thanks to Piotr P.
Karwasz, Gary Gregory.
+* Create the Transformer of an XMLFilter eagerly and reuse it
for every parse. Thanks to Piotr P. Karwasz, Gary Gregory.
+* Report a stylesheet that produces no XMLFilter as a
TransformerConfigurationException instead of returning null. Thanks to Piotr P.
Karwasz, Gary Gregory.
+* General Javadoc and site documentation improvements. Thanks
to Gary Gregory.
+
+Changes
+-------
+
+* Bump org.apache.commons:commons-parent from 104 to 105.
Thanks to Gary Gregory.
+* Bump com.android.library from 8.6.1 to 9.4.0 in
/android-tests. Thanks to Piotr P. Karwasz, Gary Gregory.
+* Bump commons.graalvm.buildtools.version from 1.1.12 to
1.1.14 (#102). Thanks to Gary Gregory, Dependabot.
+* Bump androidx.test:runner from 1.5.2 to 1.7.0 in
/android-tests (#106). Thanks to Gary Gregory, Dependabot.
+* Bump com.android.library from 9.4.0 to 9.4.1 in
/android-tests (#107). Thanks to Gary Gregory, Dependabot.
+* Bump gradle-wrapper from 9.7.1 to 9.8.0 in /android-tests
(#108). Thanks to Gary Gregory, Dependabot.
+* Bump org.junit.jupiter:junit-jupiter-api from 5.10.2 to
5.14.4 on Android (#111). Thanks to Gary Gregory, Dependabot.
+
+
+Historical list of changes:
https://commons.apache.org/proper/commons-secure-xml//changes.html
+
+For complete information on Apache Commons Secure XML, including instructions
on how to submit bug reports,
+patches, or suggestions for improvement, see the Apache Commons Secure XML
website:
+
+https://commons.apache.org/proper/commons-secure-xml/
+
+Download page:
https://commons.apache.org/proper/commons-secure-xml//download_secure-xml.cgi
+
+Have fun!
+-Apache Commons Team
+
+-----------------------------------------------------------------------------
+
Apache Commons Secure XML 1.0.0 Release Notes
---------------------------------------------
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index 06b7b80..d0a475d 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -31,7 +31,7 @@ The <action> type attribute can be add, update, fix, or
remove.
<title>Apache Commons Secure XML Changes</title>
</properties>
<body>
- <release version="1.1.0" date="YYYY-MM-DD" description="Second release.
Requires Java 8 or later.">
+ <release version="1.1.0" date="2026-10-03" description="Second release.
Requires Java 8 or later.">
<!-- FIX -->
<action type="fix" dev="ggregory" due-to="Gary Gregory">Fix the
OpenRewrite migration recipe to target static method calls instead of class
references.</action>
<action type="fix" dev="ggregory" due-to="Gary Gregory">Fix the
OpenRewrite migration recipe to add a dependency on
org.apache.commons:commons-secure-xml:1.0.0.</action>
diff --git a/src/site/xdoc/download_secure-xml.xml
b/src/site/xdoc/download_secure-xml.xml
index 776bc79..6f3c723 100644
--- a/src/site/xdoc/download_secure-xml.xml
+++ b/src/site/xdoc/download_secure-xml.xml
@@ -115,32 +115,32 @@ limitations under the License.
</p>
</subsection>
</section>
- <section name="Apache Commons Secure XML 1.0.0 (Java 8+)">
+ <section name="Apache Commons Secure XML 1.1.0 (Java 8+)">
<subsection name="Binaries">
<table>
<tr>
- <td><a
href="[preferred]/commons/secure-xml/binaries/commons-secure-xml-1.0.0-bin.tar.gz">commons-secure-xml-1.0.0-bin.tar.gz</a></td>
- <td><a
href="https://downloads.apache.org/commons/secure-xml/binaries/commons-secure-xml-1.0.0-bin.tar.gz.sha512";>sha512</a></td>
- <td><a
href="https://downloads.apache.org/commons/secure-xml/binaries/commons-secure-xml-1.0.0-bin.tar.gz.asc";>pgp</a></td>
+ <td><a
href="[preferred]/commons/secure-xml/binaries/commons-secure-xml-1.1.0-bin.tar.gz">commons-secure-xml-1.1.0-bin.tar.gz</a></td>
+ <td><a
href="https://downloads.apache.org/commons/secure-xml/binaries/commons-secure-xml-1.1.0-bin.tar.gz.sha512";>sha512</a></td>
+ <td><a
href="https://downloads.apache.org/commons/secure-xml/binaries/commons-secure-xml-1.1.0-bin.tar.gz.asc";>pgp</a></td>
</tr>
<tr>
- <td><a
href="[preferred]/commons/secure-xml/binaries/commons-secure-xml-1.0.0-bin.zip">commons-secure-xml-1.0.0-bin.zip</a></td>
- <td><a
href="https://downloads.apache.org/commons/secure-xml/binaries/commons-secure-xml-1.0.0-bin.zip.sha512";>sha512</a></td>
- <td><a
href="https://downloads.apache.org/commons/secure-xml/binaries/commons-secure-xml-1.0.0-bin.zip.asc";>pgp</a></td>
+ <td><a
href="[preferred]/commons/secure-xml/binaries/commons-secure-xml-1.1.0-bin.zip">commons-secure-xml-1.1.0-bin.zip</a></td>
+ <td><a
href="https://downloads.apache.org/commons/secure-xml/binaries/commons-secure-xml-1.1.0-bin.zip.sha512";>sha512</a></td>
+ <td><a
href="https://downloads.apache.org/commons/secure-xml/binaries/commons-secure-xml-1.1.0-bin.zip.asc";>pgp</a></td>
</tr>
</table>
</subsection>
<subsection name="Source">
<table>
<tr>
- <td><a
href="[preferred]/commons/secure-xml/source/commons-secure-xml-1.0.0-src.tar.gz">commons-secure-xml-1.0.0-src.tar.gz</a></td>
- <td><a
href="https://downloads.apache.org/commons/secure-xml/source/commons-secure-xml-1.0.0-src.tar.gz.sha512";>sha512</a></td>
- <td><a
href="https://downloads.apache.org/commons/secure-xml/source/commons-secure-xml-1.0.0-src.tar.gz.asc";>pgp</a></td>
+ <td><a
href="[preferred]/commons/secure-xml/source/commons-secure-xml-1.1.0-src.tar.gz">commons-secure-xml-1.1.0-src.tar.gz</a></td>
+ <td><a
href="https://downloads.apache.org/commons/secure-xml/source/commons-secure-xml-1.1.0-src.tar.gz.sha512";>sha512</a></td>
+ <td><a
href="https://downloads.apache.org/commons/secure-xml/source/commons-secure-xml-1.1.0-src.tar.gz.asc";>pgp</a></td>
</tr>
<tr>
- <td><a
href="[preferred]/commons/secure-xml/source/commons-secure-xml-1.0.0-src.zip">commons-secure-xml-1.0.0-src.zip</a></td>
- <td><a
href="https://downloads.apache.org/commons/secure-xml/source/commons-secure-xml-1.0.0-src.zip.sha512";>sha512</a></td>
- <td><a
href="https://downloads.apache.org/commons/secure-xml/source/commons-secure-xml-1.0.0-src.zip.asc";>pgp</a></td>
+ <td><a
href="[preferred]/commons/secure-xml/source/commons-secure-xml-1.1.0-src.zip">commons-secure-xml-1.1.0-src.zip</a></td>
+ <td><a
href="https://downloads.apache.org/commons/secure-xml/source/commons-secure-xml-1.1.0-src.zip.sha512";>sha512</a></td>
+ <td><a
href="https://downloads.apache.org/commons/secure-xml/source/commons-secure-xml-1.1.0-src.zip.asc";>pgp</a></td>
</tr>
</table>
</subsection>
