This is an automated email from the ASF dual-hosted git repository.
ffang pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cxf.git
The following commit(s) were added to refs/heads/main by this push:
new 6512e0a4b53 update CXF 4.2.3 release notes
6512e0a4b53 is described below
commit 6512e0a4b53bcbf21e1bdbf339683308e2b3166a
Author: Freeman Fang <[email protected]>
AuthorDate: Thu Jul 30 09:01:21 2026 -0400
update CXF 4.2.3 release notes
---
distribution/src/main/release/release_notes.txt | 28 ++++++++++++++-----------
1 file changed, 16 insertions(+), 12 deletions(-)
diff --git a/distribution/src/main/release/release_notes.txt
b/distribution/src/main/release/release_notes.txt
index 28cf22e5f2f..01abe24bdbe 100644
--- a/distribution/src/main/release/release_notes.txt
+++ b/distribution/src/main/release/release_notes.txt
@@ -1,4 +1,4 @@
-Apache CXF 4.2.2 Release Notes
+Apache CXF 4.2.3 Release Notes
1. Overview
@@ -36,7 +36,7 @@ for further information and requirements for upgrading from
earlier
versions of CXF.
-4.2.2 fixes over 5 JIRA issues reported by users and the community.
+4.2.3 fixes over 10 JIRA issues reported by users and the community.
2. Installation Prerequisites
@@ -78,16 +78,20 @@ for caveats when upgrading.
7. Specific issues, features, and improvements fixed in this version
-** Bug
- * [CXF-9129] - Chunked attachment streaming not working when using
ws-security
-
-
+** Sub-task
+ * [CXF-9229] - Prove that CXF can support Post-Quantum Cryptography TLS
using the X25519MLKEM768 hybrid key-encapsulation mechanism (KEM).
-** Improvement
- * [CXF-9213] - RetryStrategy is a stateful class whose objects shouldn't
be reused
- * [CXF-9214] - WSDLs and XSDs cannot be loaded from class path on GraalVM
- * [CXF-9216] - Switch default OAuth2 code verifier to Digest
- * [CXF-9218] - Respect configured ProxySelector instead of hard-wiring
system proxy properties
-
+** Bug
+ * [CXF-9161] - Some of the OIDCFlowTest fail with timeout (JPA only) when
HttpClient instance is shared
+ * [CXF-9219] - cxf-bom manages dependencies for 4.x that no longer exist
or are not published
+ * [CXF-9221] - JCache providers use inverted isExpired() logic causing
expired tokens/codes to never be evicted
+ * [CXF-9222] - partialMatchScopeValidation allows prefix-based scope
escalation (e.g., read grants readwrite)
+ * [CXF-9223] - completeAudienceMatch=false defaults to prefix matching for
audience validation, widening resource access
+ * [CXF-9225] - OIDC RP does not enforce nonce validation for
Implicit/Hybrid flows
+ * [CXF-9226] - Proxy authentication fails with IllegalStateException
instead of HTTPException (407)
+ * [CXF-9227] - CXF 4.1.7 regression: more SecurityManager permission
requirements
+
+** Task
+ * [CXF-9230] - Update to Spring Boot 4.1 release line
