Hi Fabio, Thanks for raising your concern, and please see my comment in https://issues.apache.org/jira/browse/CXF-9253
I don't think this should block the release: Updating a dependency in a patch release is normal for CXF, and it's expected that downstream projects upgrade it along with CXF. In many cases we release CXF in order to pick up the fixes from dependencies. Back to your concern here, the two changes(from WSS4J and CXF) are two halves of one hardening fix and only work together. Hope this helps. Best Regards Freeman On Fri, Oct 2, 2026 at 11:33 AM Fabio Burzigotti via dev <[email protected]> wrote: > Hi, > We've been running JBossWS CXF tests and logged > https://issues.apache.org/jira/browse/CXF-9253. > I'd cast a -1, at least it would be good to discuss about the reported bug. > > Cheers, > Fabio. > ________________________________ > From: Freeman Fang <[email protected]> > Sent: Thursday, October 1, 2026 9:32 PM > To: CXF DEV <[email protected]> > Subject: [EXTERNAL] [VOTE] Release Apache CXF 4.2.4, 4.1.9 and 3.6.13 > > Hi, > > > It’s been a while since last releases and many issues have been addressed, > so here is the VOTE to release CXF 4.2.4, 4.1.9 and 3.6.13 > > > Staging areas: > > > https://urldefense.proofpoint.com/v2/url?u=https-3A__repository.apache.org_content_repositories_orgapachecxf-2D1301&d=DwIFaQ&c=BSDicqBQBDjDI9RkVyTcHQ&r=6DfnpHA4c8_1RRukaC5NgaPkggwObJL3tohfoe-PGLI&m=u8dm96TQMtFeHsbRUIZ6Ma2_cUOJxeWyLMr52Qhn9mL_-c55Fm1QPlYIliTE9dS2&s=41K-EYRQoN9XnpGa5dGQzHt6VLx4uxgVWgFDK1z5pjA&e= > > > https://urldefense.proofpoint.com/v2/url?u=https-3A__repository.apache.org_content_repositories_orgapachecxf-2D1303&d=DwIFaQ&c=BSDicqBQBDjDI9RkVyTcHQ&r=6DfnpHA4c8_1RRukaC5NgaPkggwObJL3tohfoe-PGLI&m=u8dm96TQMtFeHsbRUIZ6Ma2_cUOJxeWyLMr52Qhn9mL_-c55Fm1QPlYIliTE9dS2&s=g5ZOEyZEoNICNQVajin5fW6p5aEXEIjh6cGn1OKGjII&e= > > > https://urldefense.proofpoint.com/v2/url?u=https-3A__repository.apache.org_content_repositories_orgapachecxf-2D1304&d=DwIFaQ&c=BSDicqBQBDjDI9RkVyTcHQ&r=6DfnpHA4c8_1RRukaC5NgaPkggwObJL3tohfoe-PGLI&m=u8dm96TQMtFeHsbRUIZ6Ma2_cUOJxeWyLMr52Qhn9mL_-c55Fm1QPlYIliTE9dS2&s=r0uj2lzCcOcjt1JhBrPCS_6hEU7EgWyf37Cn4QvkEtc&e= > > > Tags: > > > https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_apache_cxf_commit_5e324f121104cc76af1b8f3ec0d1a20ef9e98c3b&d=DwIFaQ&c=BSDicqBQBDjDI9RkVyTcHQ&r=6DfnpHA4c8_1RRukaC5NgaPkggwObJL3tohfoe-PGLI&m=u8dm96TQMtFeHsbRUIZ6Ma2_cUOJxeWyLMr52Qhn9mL_-c55Fm1QPlYIliTE9dS2&s=13e4JG1bNA-lZ5Lv8u0ooMk8JrHXEbqOAFX9_J9zUyI&e= > > > https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_apache_cxf_commit_043829b193a6ead389864e636a07ddf6bfa2ca8a&d=DwIFaQ&c=BSDicqBQBDjDI9RkVyTcHQ&r=6DfnpHA4c8_1RRukaC5NgaPkggwObJL3tohfoe-PGLI&m=u8dm96TQMtFeHsbRUIZ6Ma2_cUOJxeWyLMr52Qhn9mL_-c55Fm1QPlYIliTE9dS2&s=QYFP-gFR8mFHaOIG3IBuzNvAj0ZItiBL1H3rW5YQtsk&e= > > > https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_apache_cxf_commit_8999af05d26ef2e63dc4c77a798595e2a53435ad&d=DwIFaQ&c=BSDicqBQBDjDI9RkVyTcHQ&r=6DfnpHA4c8_1RRukaC5NgaPkggwObJL3tohfoe-PGLI&m=u8dm96TQMtFeHsbRUIZ6Ma2_cUOJxeWyLMr52Qhn9mL_-c55Fm1QPlYIliTE9dS2&s=dVS-0AACqDCe4LTcx9RvxP1ed7_4jlPP00D3q3I43sY&e= > > > I will keep the vote open for at least 72 hours. > > Happy VOTE! > > > Cheers > > > Freeman > > Unless otherwise stated above: > > IBM Italia S.p.A. > Sede Legale: Circonvallazione Idroscalo - 20054 Segrate (MI) > Cap. Soc. euro 247.656.998.20 > C. F. e Reg. Imprese MI 01442240030 - Partita IVA 10914660153 > Società con unico azionista > Società soggetta all'attività di direzione e coordinamento di > International Business Machines Corporation >
