This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/commons-xml.git
The following commit(s) were added to refs/heads/main by this push:
new e5495c3 Rename artifactId from commons-xml to commons-secure-xml
e5495c3 is described below
commit e5495c3854ca2c4149f38d080c3574a1ef714dd9
Author: Gary Gregory <[email protected]>
AuthorDate: Sun Aug 30 17:12:39 2026 -0400
Rename artifactId from commons-xml to commons-secure-xml
---
.asf.yaml | 2 +-
README.md | 14 ++++++-------
RELEASE-NOTES.txt | 16 ++++++++-------
android-tests/build.gradle.kts | 2 +-
android-tests/settings.gradle.kts | 2 +-
pom.xml | 8 ++++----
src/changes/release-notes.vm | 2 +-
src/site/markdown/shading.md | 10 ++++-----
src/site/markdown/threat_model.md | 2 +-
src/site/site.xml | 4 ++--
src/site/xdoc/download_xml.xml | 24 +++++++++++-----------
.../apache/commons/xml/SecureXMLReaderTest.java | 2 +-
12 files changed, 45 insertions(+), 43 deletions(-)
diff --git a/.asf.yaml b/.asf.yaml
index 82dc397..dc18aa4 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -27,7 +27,7 @@ notifications:
github:
description: "Apache Commons Secure XML"
- homepage: https://commons.apache.org/proper/commons-xml/
+ homepage: https://commons.apache.org/proper/commons-secure-xml/
pull_requests:
# allow auto-merge
diff --git a/README.md b/README.md
index 94a39e5..a78f442 100644
--- a/README.md
+++ b/README.md
@@ -44,10 +44,10 @@ Apache Commons Secure XML
===================
[](https://github.com/apache/commons-xml/actions/workflows/maven.yml)
-[](https://search.maven.org/artifact/org.apache.commons/commons-xml)
-[](https://javadoc.io/doc/org.apache.commons/commons-xml/1.0.0)
+[](https://search.maven.org/artifact/org.apache.commons/commons-secure-xml)
+[](https://javadoc.io/doc/org.apache.commons/commons-secure-xml/1.0.0)
[](https://github.com/apache/commons-xml/actions/workflows/codeql-analysis.yml)
-[](https://api.securityscorecards.dev/projects/github.com/apache/commons-xml)
+[](https://api.securityscorecards.dev/projects/github.com/apache/commons-xml)
Apache Commons Secure XML provides secure-by-default JAXP factory creation,
abstracting over
implementation-specific XXE securing differences between the stock JDK and
external JAXP implementations
@@ -56,20 +56,20 @@ Apache Commons Secure XML provides secure-by-default JAXP
factory creation, abst
Documentation
-------------
-More information can be found on the [Apache Commons Secure XML
homepage](https://commons.apache.org/proper/commons-xml).
-The [Javadoc](https://commons.apache.org/proper/commons-xml/apidocs) can be
browsed.
+More information can be found on the [Apache Commons Secure XML
homepage](https://commons.apache.org/proper/commons-secure-xml).
+The [Javadoc](https://commons.apache.org/proper/commons-secure-xml/apidocs)
can be browsed.
Questions related to the usage of Apache Commons Secure XML should be posted
to the [user mailing list](https://commons.apache.org/mail-lists.html).
Getting the latest release
--------------------------
-You can download source and binaries from our [download
page](https://commons.apache.org/proper/commons-xml/download_xml.cgi).
+You can download source and binaries from our [download
page](https://commons.apache.org/proper/commons-secure-xml/download_xml.cgi).
Alternatively, you can pull it from the central Maven repositories:
```xml
<dependency>
<groupId>org.apache.commons</groupId>
- <artifactId>commons-xml</artifactId>
+ <artifactId>commons-secure-xml</artifactId>
<version>1.0.0</version>
</dependency>
```
diff --git a/RELEASE-NOTES.txt b/RELEASE-NOTES.txt
index 0d3d724..2170cae 100644
--- a/RELEASE-NOTES.txt
+++ b/RELEASE-NOTES.txt
@@ -15,7 +15,7 @@ See the License for the specific language governing
permissions and
limitations under the License.
Apache Commons Secure XML 1.0.0 Release Notes
---------------------------------------
+---------------------------------------------
The Apache Commons Secure XML team is pleased to announce the release of
Apache Commons Secure XML 1.0.0.
@@ -35,14 +35,17 @@ New features
* Secure the SAXTransformerFactory extension surface
(TransformerHandler, TemplatesHandler, and XMLFilter) and
TransformerFactory.getAssociatedStylesheet. Thanks to Piotr P. Karwasz, Gary
Gregory.
* Document the threat model on the project site, including
the denied-fetch contract and the supported runtime floor (OpenJDK 8 and
Android API 33 or later). Thanks to Piotr P. Karwasz, Jarek Potiuk, Gary
Gregory.
* COMMONSXML-11: Add GitHub CI builds for Java 26 and 27-EA. Thanks to Gary
Gregory, Piotr P. Karwasz.
+* Mirror on each factory class every JAXP static factory
method, including the Java 9 newDefaultInstance and Java 13 newNSInstance
families, all usable on Java 8. Thanks to Piotr P. Karwasz, Gary Gregory.
Fixed Bugs
----------
* COMMONSXML-10: Block XInclude (xi:include) href resolution by default,
since the JAXP external-access properties do not govern it. Thanks to Ta Duc
Thien, Piotr P. Karwasz, Gary Gregory.
-* Restore the secured configuration when a factory or parser
is reset() instead of reverting to the implementation defaults. Thanks to Piotr
P. Karwasz, Gary Gregory.
-* Parse a Source opted in by a caller-supplied URIResolver
using a secured parser. Thanks to Piotr P. Karwasz, Gary Gregory.
+* Honor jdk.xml.overrideDefaultParser on TrAX, XPath and
schema factories that recognize it. Thanks to Piotr P. Karwasz, Gary Gregory.
+* Restore the secure configuration when a factory or parser
is reset() instead of reverting to the implementation defaults. Thanks to Piotr
P. Karwasz, Gary Gregory.
+* Parse a Source opted in by a caller-supplied URIResolver
using a secure parser. Thanks to Piotr P. Karwasz, Gary Gregory.
* Secure the document parse behind the InputSource-taking
XPath evaluation entry points. Thanks to Piotr P. Karwasz, Gary Gregory.
+* Fall back to the standard factory lookup in the DOM, SAX
and schema newDefaultInstance methods on Android. Thanks to Piotr P. Karwasz,
Gary Gregory.
Changes
-------
@@ -56,17 +59,16 @@ Removed
* COMMONSXML-2: Remove the Limits class that applied uniform processing
limits across implementations. Thanks to Piotr P. Karwasz, Gary Gregory.
-Historical list of changes:
https://commons.apache.org/proper/commons-xml//changes.html
+Historical list of changes:
https://commons.apache.org/proper/commons-secure-xml//changes.html
For complete information on Apache Commons Secure XML, including instructions
on how to submit bug reports,
patches, or suggestions for improvement, see the Apache Commons Secure XML
website:
-https://commons.apache.org/proper/commons-xml/
+https://commons.apache.org/proper/commons-secure-xml/
-Download page: https://commons.apache.org/proper/commons-xml//download_text.cgi
+Download page:
https://commons.apache.org/proper/commons-secure-xml//download_text.cgi
Have fun!
-Apache Commons Team
-----------------------------------------------------------------------------
-
diff --git a/android-tests/build.gradle.kts b/android-tests/build.gradle.kts
index a5b7562..61dbe2f 100644
--- a/android-tests/build.gradle.kts
+++ b/android-tests/build.gradle.kts
@@ -24,7 +24,7 @@ plugins {
}
val libraryVersion = "1.0.0-SNAPSHOT"
-val libraryJar =
rootProject.file("../target/commons-xml-${libraryVersion}.jar")
+val libraryJar =
rootProject.file("../target/commons-secure-xml-${libraryVersion}.jar")
android {
namespace = "org.apache.commons.xml.androidtests"
diff --git a/android-tests/settings.gradle.kts
b/android-tests/settings.gradle.kts
index b3bef23..09b16d7 100644
--- a/android-tests/settings.gradle.kts
+++ b/android-tests/settings.gradle.kts
@@ -31,4 +31,4 @@ dependencyResolutionManagement {
}
}
-rootProject.name = "commons-xml-android-tests"
+rootProject.name = "commons-secure-xml-android-tests"
diff --git a/pom.xml b/pom.xml
index 84d50f0..c6f10d1 100644
--- a/pom.xml
+++ b/pom.xml
@@ -23,10 +23,10 @@ limitations under the License.
<artifactId>commons-parent</artifactId>
<version>104</version>
</parent>
- <artifactId>commons-xml</artifactId>
+ <artifactId>commons-secure-xml</artifactId>
<version>1.0.0-SNAPSHOT</version>
<name>Apache Commons Secure XML</name>
- <url>https://commons.apache.org/proper/commons-xml/</url>
+ <url>https://commons.apache.org/proper/commons-secure-xml/</url>
<inceptionYear>2026</inceptionYear>
<description>Apache Commons Secure XML provides secure-by-default JAXP
factory creation, abstracting over
implementation-specific XXE securing differences between the stock JDK and
external JAXP implementations
@@ -35,7 +35,7 @@ limitations under the License.
<connection>scm:git:https://gitbox.apache.org/repos/asf/commons-xml.git</connection>
<developerConnection>scm:git:https://gitbox.apache.org/repos/asf/commons-xml.git</developerConnection>
<url>https://gitbox.apache.org/repos/asf?p=commons-xml.git</url>
- <tag>rel/commons-xml-${project.version}</tag>
+ <tag>rel/commons-secure-xml-${project.version}</tag>
</scm>
<properties>
<!-- Release-related properties -->
@@ -50,7 +50,7 @@ limitations under the License.
<commons.packageId>xml</commons.packageId>
<commons.module.name>org.apache.commons.xml</commons.module.name>
<commons.jira.id>COMMONSXML</commons.jira.id>
-
<commons.scmPubUrl>https://svn.apache.org/repos/infra/websites/production/commons/content/proper/commons-xml</commons.scmPubUrl>
+
<commons.scmPubUrl>https://svn.apache.org/repos/infra/websites/production/commons/content/proper/commons-secure-xml</commons.scmPubUrl>
<!-- OSGi bundle metadata: override commons-parent's org.apache.commons.*
defaults. -->
<commons.osgi.symbolicName>org.apache.commons.xml</commons.osgi.symbolicName>
<commons.osgi.export>org.apache.commons.xml.*;version=${project.version};-noimport:=true</commons.osgi.export>
diff --git a/src/changes/release-notes.vm b/src/changes/release-notes.vm
index b50d932..9ad433a 100644
--- a/src/changes/release-notes.vm
+++ b/src/changes/release-notes.vm
@@ -32,7 +32,7 @@ See the License for the specific language governing
permissions and
limitations under the License.
${project.name} ${version} Release Notes
---------------------------------------
+---------------------------------------------
The ${developmentTeam} is pleased to announce the release of ${project.name}
${version}.
diff --git a/src/site/markdown/shading.md b/src/site/markdown/shading.md
index eff311c..2f8cbeb 100644
--- a/src/site/markdown/shading.md
+++ b/src/site/markdown/shading.md
@@ -65,7 +65,7 @@ What shading does preserve is the upgrade path:
every rebuild against a newer release of the library
picks up its securing recipes and fixes automatically,
and the relocated copy cannot conflict with
-another version of `commons-xml` on the application's classpath.
+another version of `commons-secure-xml` on the application's classpath.
### Vendored Code and Copy-Pasted Recipes
@@ -89,7 +89,7 @@ If you maintain such code anyway, two changes give the most
protection:
## Relocating with the Maven Shade Plugin
-The configuration below shades and relocates `commons-xml` alone,
+The configuration below shades and relocates `commons-secure-xml` alone,
while every other dependency of your project stays an ordinary external
dependency:
```xml
@@ -106,7 +106,7 @@ while every other dependency of your project stays an
ordinary external dependen
<minimizeJar>true</minimizeJar>
<artifactSet>
<includes>
- <include>org.apache.commons:commons-xml</include>
+ <include>org.apache.commons:commons-secure-xml</include>
</includes>
</artifactSet>
<relocations>
@@ -117,7 +117,7 @@ while every other dependency of your project stays an
ordinary external dependen
</relocations>
<filters>
<filter>
- <artifact>org.apache.commons:commons-xml</artifact>
+ <artifact>org.apache.commons:commons-secure-xml</artifact>
<excludes>
<exclude>META-INF/versions/9/module-info.class</exclude>
</excludes>
@@ -133,7 +133,7 @@ A few notes on the configuration:
- Replace `com.example.app.internal.xml` with a package of your own,
outside your public API.
-- The `<artifactSet>` restricts shading to `commons-xml`;
+- The `<artifactSet>` restricts shading to `commons-secure-xml`;
the plugin removes it from the dependency-reduced POM,
so downstream consumers never see it.
- The `<filter>` drops the library's multi-release module descriptor,
diff --git a/src/site/markdown/threat_model.md
b/src/site/markdown/threat_model.md
index aa6acca..1e7d992 100644
--- a/src/site/markdown/threat_model.md
+++ b/src/site/markdown/threat_model.md
@@ -45,7 +45,7 @@ new, secured factory whose parsers reject the common XML
attacks (external entit
external references, and entity-expansion denial of service such as Billion
Laughs). The exact guarantee each factory
makes is documented in the Javadoc:
-https://commons.apache.org/index/commons-xml/apidocs/org/apache/commons/xml/package-summary.html
+https://commons.apache.org/index/commons-secure-xml/apidocs/org/apache/commons/xml/package-summary.html
Thesecuring applies to the factory and to the parsers, readers, transformers,
validators, schemas and XPath objects it produces.
It governs what those objects read;
diff --git a/src/site/site.xml b/src/site/site.xml
index fb1b3fd..d6ca7ac 100644
--- a/src/site/site.xml
+++ b/src/site/site.xml
@@ -38,10 +38,10 @@
</item>
<item name="License" href="https://www.apache.org/licenses/LICENSE-2.0";
/>
<item name="Code of Conduct"
href="https://www.apache.org/foundation/policies/conduct.html"; />
- <item name="Download"
href="https://commons.apache.org/proper/commons-xml/download_xml.cgi"; />
+ <item name="Download"
href="https://commons.apache.org/proper/commons-secure-xml/download_xml.cgi"; />
<item name="Javadoc">
<item name="Javadoc Current" href="apidocs/index.html" />
- <item name="Javadoc Archive"
href="https://javadoc.io/doc/org.apache.commons/commons-xml/"; />
+ <item name="Javadoc Archive"
href="https://javadoc.io/doc/org.apache.commons/commons-secure-xml/"; />
</item>
<item name="Shading" href="shading.html" />
<!-- End: For all components. -->
diff --git a/src/site/xdoc/download_xml.xml b/src/site/xdoc/download_xml.xml
index ad1e161..6ebad03 100644
--- a/src/site/xdoc/download_xml.xml
+++ b/src/site/xdoc/download_xml.xml
@@ -119,28 +119,28 @@ limitations under the License.
<subsection name="Binaries">
<table>
<tr>
- <td><a
href="[preferred]/commons/xml/binaries/commons-xml-1.0.0-bin.tar.gz">commons-xml-1.0.0-bin.tar.gz</a></td>
- <td><a
href="https://downloads.apache.org/commons/xml/binaries/commons-xml-1.0.0-bin.tar.gz.sha512";>sha512</a></td>
- <td><a
href="https://downloads.apache.org/commons/xml/binaries/commons-xml-1.0.0-bin.tar.gz.asc";>pgp</a></td>
+ <td><a
href="[preferred]/commons/xml/binaries/commons-secure-xml-1.0.0-bin.tar.gz">commons-secure-xml-1.0.0-bin.tar.gz</a></td>
+ <td><a
href="https://downloads.apache.org/commons/xml/binaries/commons-secure-xml-1.0.0-bin.tar.gz.sha512";>sha512</a></td>
+ <td><a
href="https://downloads.apache.org/commons/xml/binaries/commons-secure-xml-1.0.0-bin.tar.gz.asc";>pgp</a></td>
</tr>
<tr>
- <td><a
href="[preferred]/commons/xml/binaries/commons-xml-1.0.0-bin.zip">commons-xml-1.0.0-bin.zip</a></td>
- <td><a
href="https://downloads.apache.org/commons/xml/binaries/commons-xml-1.0.0-bin.zip.sha512";>sha512</a></td>
- <td><a
href="https://downloads.apache.org/commons/xml/binaries/commons-xml-1.0.0-bin.zip.asc";>pgp</a></td>
+ <td><a
href="[preferred]/commons/xml/binaries/commons-secure-xml-1.0.0-bin.zip">commons-secure-xml-1.0.0-bin.zip</a></td>
+ <td><a
href="https://downloads.apache.org/commons/xml/binaries/commons-secure-xml-1.0.0-bin.zip.sha512";>sha512</a></td>
+ <td><a
href="https://downloads.apache.org/commons/xml/binaries/commons-secure-xml-1.0.0-bin.zip.asc";>pgp</a></td>
</tr>
</table>
</subsection>
<subsection name="Source">
<table>
<tr>
- <td><a
href="[preferred]/commons/xml/source/commons-xml-1.0.0-src.tar.gz">commons-xml-1.0.0-src.tar.gz</a></td>
- <td><a
href="https://downloads.apache.org/commons/xml/source/commons-xml-1.0.0-src.tar.gz.sha512";>sha512</a></td>
- <td><a
href="https://downloads.apache.org/commons/xml/source/commons-xml-1.0.0-src.tar.gz.asc";>pgp</a></td>
+ <td><a
href="[preferred]/commons/xml/source/commons-secure-xml-1.0.0-src.tar.gz">commons-secure-xml-1.0.0-src.tar.gz</a></td>
+ <td><a
href="https://downloads.apache.org/commons/xml/source/commons-secure-xml-1.0.0-src.tar.gz.sha512";>sha512</a></td>
+ <td><a
href="https://downloads.apache.org/commons/xml/source/commons-secure-xml-1.0.0-src.tar.gz.asc";>pgp</a></td>
</tr>
<tr>
- <td><a
href="[preferred]/commons/xml/source/commons-xml-1.0.0-src.zip">commons-xml-1.0.0-src.zip</a></td>
- <td><a
href="https://downloads.apache.org/commons/xml/source/commons-xml-1.0.0-src.zip.sha512";>sha512</a></td>
- <td><a
href="https://downloads.apache.org/commons/xml/source/commons-xml-1.0.0-src.zip.asc";>pgp</a></td>
+ <td><a
href="[preferred]/commons/xml/source/commons-secure-xml-1.0.0-src.zip">commons-secure-xml-1.0.0-src.zip</a></td>
+ <td><a
href="https://downloads.apache.org/commons/xml/source/commons-secure-xml-1.0.0-src.zip.sha512";>sha512</a></td>
+ <td><a
href="https://downloads.apache.org/commons/xml/source/commons-secure-xml-1.0.0-src.zip.asc";>pgp</a></td>
</tr>
</table>
</subsection>
diff --git a/src/test/java/org/apache/commons/xml/SecureXMLReaderTest.java
b/src/test/java/org/apache/commons/xml/SecureXMLReaderTest.java
index 56659ff..19591cd 100644
--- a/src/test/java/org/apache/commons/xml/SecureXMLReaderTest.java
+++ b/src/test/java/org/apache/commons/xml/SecureXMLReaderTest.java
@@ -74,6 +74,6 @@ void forwardsReaderConfigurationAndParse() throws Exception {
reader.getErrorHandler();
reader.getEntityResolver();
reader.parse(new InputSource(new StringReader("<root/>")));
- assertThrows(IOException.class, () ->
reader.parse("file:/definitely-not-present-commons-xml-test.xml"));
+ assertThrows(IOException.class, () ->
reader.parse("file:/definitely-not-present-commons-secure-xml-test.xml"));
}
}
