This is an automated email from the ASF dual-hosted git repository. robertlazarski pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/axis-axis2-java-core.git
commit ee2c45639f7f40a5f54683ee28aab9c430249f1f Author: Robert Lazarski <[email protected]> AuthorDate: Mon Sep 7 03:53:48 2026 -1000 Add an upgrade checklist to the 2.0.2 release notes The notes described each changed default where it was made, which is the right place for the reasoning but not for someone upgrading a working 2.0.1 install. Collects every behaviour change up front with its one-line opt-out: the three refusing defaults (AXIS2-6108 for the WS-Addressing one), the new request-size ceilings, the Spring/JMS/mail packaging changes, the withdrawn jibx codegen option, and the wider exposeServiceMetadata enforcement. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> --- src/site/markdown/release-notes/2.0.2.md | 50 ++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/src/site/markdown/release-notes/2.0.2.md b/src/site/markdown/release-notes/2.0.2.md index 648d38cb80..94eb6217ce 100644 --- a/src/site/markdown/release-notes/2.0.2.md +++ b/src/site/markdown/release-notes/2.0.2.md @@ -3,6 +3,56 @@ Apache Axis2 2.0.2 Release Notes (Unreleased) +## Upgrading from 2.0.1 + +Everything a working 2.0.1 deployment may have to change, in one place. The +reasoning for each is further down; this is the checklist. + +**Defaults that now refuse what they previously allowed.** Each is a one-line +opt-out in `axis2.xml` if a deployment genuinely needs the old behaviour. + +| Change | Restore the old behaviour with | +|---|---| +| Decoupled WS-Addressing responses are refused (AXIS2-6108) | `<parameter name="allowNonAnonymousResponseEndpoints">true</parameter>` | +| Service dispatch from the SOAP body namespace is off | `<parameter name="allowContentBasedServiceDispatch">true</parameter>` | +| Admin console ships with empty credentials, so it is disabled | set `userName` and `password` in your own `axis2.xml` | + +The WS-Addressing change is the one most likely to be felt: any client using a +non-anonymous `ReplyTo` or `FaultTo` stops working until the parameter is set. +Deployments that re-enable it should also set `httpFrontendHostUrl`, because the +generated reply address otherwise defaults to the local machine's IP. In this +project's own test suite the change touched 17 of 244 integration tests, all +decoupled-response cases, and opting those in *was* the migration -- expect the +same shape of work. + +**New ceilings.** Requests larger than these are now rejected rather than +allocated. Raise them if a deployment legitimately handles bigger messages: +`multipartMaxRequestSize`, `multipartMaxFileSize`, `formUrlEncodedMaxRequestSize`, +`mtomMaxRequestSize`, `soapMaxRequestSize`, and for multiref +`org.apache.axis2.databinding.multiref.maxDepth`. + +**Classpath and packaging changes.** These affect builds and WAR deployments +rather than configuration: + +- `axis2-spring` no longer brings Spring with it. Applications that inherit + `spring-boot-starter-parent` or import `spring-boot-dependencies` are + unaffected -- their dependency management already decided the Spring version. + Anyone depending on `axis2-spring` **without** Spring Boot's dependency + management must now declare `spring-core`, `spring-beans`, `spring-context` and + `spring-web` themselves. +- The JMS and mail transports are no longer bundled in `axis2.war`. Both remain in + `lib/` of the binary distribution, so a standalone server is unaffected; a WAR + deployment that uses either now adds the transport jar to `WEB-INF/lib`. +- `jibx` is no longer a valid `-d` value for `wsdl2java`. JiBX was removed in + 2.0.1; the option had survived in the tool's help text without a backing + implementation. + +**Metadata exposure.** `exposeServiceMetadata` is now honoured on every anonymous +metadata route rather than only the `?wsdl`/`?xsd` queries, and a service with it +disabled is answered as though it were not deployed. If you relied on WS-MEX, the +`/services/` listing, the ping module or the `.xsd`/`.wsdl` file routes reaching a +service that had metadata exposure turned off, they no longer will. + ## Distribution Changes - **`axis2-spring` no longer exports Spring to its consumers.** Its `spring-core`,
