This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/commons-xml.git
The following commit(s) were added to refs/heads/main by this push:
new ba7369f Bump from sandbox to proper.
ba7369f is described below
commit ba7369fa59a05b9e7664acc05301877c0a963fed
Author: Gary Gregory <[email protected]>
AuthorDate: Thu Aug 27 20:49:51 2026 -0400
Bump from sandbox to proper.
---
.asf.yaml | 2 +-
README.md | 6 +++---
RELEASE-NOTES.txt | 34 ++++++++++++++++++++++++++++------
pom.xml | 5 ++---
src/site/markdown/index.md | 5 ++---
src/site/markdown/threat_model.md | 2 +-
src/site/site.xml | 4 ++--
7 files changed, 39 insertions(+), 19 deletions(-)
diff --git a/.asf.yaml b/.asf.yaml
index 0860010..0d634d3 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -27,7 +27,7 @@ notifications:
github:
description: "Apache Commons XML"
- homepage: https://commons.apache.org/sandbox/commons-xml/
+ homepage: https://commons.apache.org/proper/commons-xml/
pull_requests:
# allow auto-merge
diff --git a/README.md b/README.md
index ec15fe6..b090935 100644
--- a/README.md
+++ b/README.md
@@ -56,13 +56,13 @@ Apache Commons XML provides secure-by-default JAXP factory
creation, abstracting
Documentation
-------------
-More information can be found on the [Apache Commons XML
homepage](https://commons.apache.org/sandbox/commons-xml/).
-The [Javadoc](https://commons.apache.org/sandbox/commons-xml/apidocs) can be
browsed.
+More information can be found on the [Apache Commons XML
homepage](https://commons.apache.org/proper/commons-xml).
+The [Javadoc](https://commons.apache.org/proper/commons-xml/apidocs) can be
browsed.
Questions related to the usage of Apache Commons XML should be posted to the
[user mailing list](https://commons.apache.org/mail-lists.html).
Getting the latest release
--------------------------
-You can download source and binaries from our [download
page](https://commons.apache.org/sandbox/commons-xml/download_xml.cgi).
+You can download source and binaries from our [download
page](https://commons.apache.org/proper/commons-xml/download_xml.cgi).
Alternatively, you can pull it from the central Maven repositories:
diff --git a/RELEASE-NOTES.txt b/RELEASE-NOTES.txt
index 16be4d5..5ee2c2b 100644
--- a/RELEASE-NOTES.txt
+++ b/RELEASE-NOTES.txt
@@ -23,28 +23,50 @@ Apache Commons XML provides secure-by-default JAXP factory
creation, abstracting
implementation-specific XXE hardening differences between the stock JDK and
external JAXP implementations
(Android, Apache Xalan, Apache Xerces, Woodstox, Saxon-HE).
-First release.
+First release, requires Java 8 or above.
New features
------------
-* Secure-by-default JAXP factory creation via
org.apache.commons.xml, with implementation-specific hardening recipes for the
- stock JDK, Android, Apache Xalan, Apache Xerces, Woodstox,
and Saxon-HE.
+* This is the first release of Apache Commons XML. Thanks to
Piotr P. Karwasz, Gary Gregory.
+* Add secure-by-default JAXP factory creation via
org.apache.commons.xml, donated from the copernik-xml-factory project
(https://github.com/copernik-eu/copernik-xml-factory) and covering the stock
JDK, Android, Apache Xalan, Apache Xerces, Woodstox, and Saxon-HE. Thanks to
Piotr P. Karwasz, Gary Gregory.
+* COMMONSXML-9: Install a non-removable resolver floor on every resolver
channel (EntityResolver, LSResourceResolver, URIResolver, and XMLResolver),
routing caller-supplied resolvers through it as allow-lists. Thanks to Piotr P.
Karwasz, Gary Gregory.
+* Harden the SAXTransformerFactory extension surface
(TransformerHandler, TemplatesHandler, and XMLFilter) and
TransformerFactory.getAssociatedStylesheet. Thanks to Piotr P. Karwasz, Gary
Gregory.
+* Document the threat model on the project site, including
the denied-fetch contract and the supported runtime floor (OpenJDK 8 and
Android API 33 or later). Thanks to Piotr P. Karwasz, Jarek Potiuk, Gary
Gregory.
+* COMMONSXML-11: Add GitHub CI builds for Java 26 and 27-EA. Thanks to Gary
Gregory, Piotr P. Karwasz.
+Fixed Bugs
+----------
+* COMMONSXML-10: Block XInclude (xi:include) href resolution by default,
since the JAXP external-access properties do not govern it. Thanks to Ta Duc
Thien, Piotr P. Karwasz, Gary Gregory.
+* Restore the hardened configuration when a factory or parser
is reset() instead of reverting to the implementation defaults. Thanks to Piotr
P. Karwasz, Gary Gregory.
+* Parse a Source opted in by a caller-supplied URIResolver
using a hardened parser. Thanks to Piotr P. Karwasz, Gary Gregory.
+* Harden the document parse behind the InputSource-taking
XPath evaluation entry points. Thanks to Piotr P. Karwasz, Gary Gregory.
+Changes
+-------
-Historical list of changes:
https://commons.apache.org/sandbox/commons-xml//changes.html
+* COMMONSXML-1,COMMONSXML-5,COMMONSXML-6,COMMONSXML-7,COMMONSXML-8: Recognize
XML implementations by the JAXP features and properties they support instead of
by their implementation class name, extending the hardening to any compliant
implementation. Thanks to Piotr P. Karwasz, Gary Gregory.
+* COMMONSXML-4: Define a consistent contract for denied external fetches:
unresolved external references resolve to empty content on every
implementation, unless the org.apache.commons.xml.throwOnUnresolved system
property requests rejection. Thanks to Piotr P. Karwasz, Gary Gregory.
+* COMMONSXML-3: Reduce the shaded footprint by splitting the hardeners and
resolver floors into independent entry points. Thanks to Piotr P. Karwasz, Gary
Gregory.
+
+Removed
+-------
+
+* COMMONSXML-2: Remove the Limits class that applied uniform processing
limits across implementations. Thanks to Piotr P. Karwasz, Gary Gregory.
+
+Historical list of changes:
https://commons.apache.org/proper/commons-xml//changes.html
For complete information on Apache Commons XML, including instructions on how
to submit bug reports,
patches, or suggestions for improvement, see the Apache Commons XML website:
-https://commons.apache.org/sandbox/commons-xml/
+https://commons.apache.org/proper/commons-xml/
-Download page:
https://commons.apache.org/sandbox/commons-xml//download_text.cgi
+Download page: https://commons.apache.org/proper/commons-xml//download_text.cgi
Have fun!
-Apache Commons Team
-----------------------------------------------------------------------------
+
diff --git a/pom.xml b/pom.xml
index d9fdfc7..2999a19 100644
--- a/pom.xml
+++ b/pom.xml
@@ -26,7 +26,7 @@ limitations under the License.
<artifactId>commons-xml</artifactId>
<version>1.0.0-SNAPSHOT</version>
<name>Apache Commons XML</name>
- <url>https://commons.apache.org/sandbox/commons-xml/</url>
+ <url>https://commons.apache.org/proper/commons-xml/</url>
<inceptionYear>2026</inceptionYear>
<description>Apache Commons XML provides secure-by-default JAXP factory
creation, abstracting over
implementation-specific XXE hardening differences between the stock JDK
and external JAXP implementations
@@ -50,8 +50,7 @@ limitations under the License.
<commons.packageId>xml</commons.packageId>
<commons.module.name>org.apache.commons.xml</commons.module.name>
<commons.jira.id>COMMONSXML</commons.jira.id>
- <!-- Sandbox component: publish the site under the sandbox tree (the
parent defaults to proper/). -->
-
<commons.scmPubUrl>https://svn.apache.org/repos/infra/websites/production/commons/content/sandbox/commons-xml</commons.scmPubUrl>
+
<commons.scmPubUrl>https://svn.apache.org/repos/infra/websites/production/commons/content/proper/commons-xml</commons.scmPubUrl>
<!-- OSGi bundle metadata: override commons-parent's org.apache.commons.*
defaults. -->
<commons.osgi.symbolicName>org.apache.commons.xml</commons.osgi.symbolicName>
<commons.osgi.export>org.apache.commons.xml.*;version=${project.version};-noimport:=true</commons.osgi.export>
diff --git a/src/site/markdown/index.md b/src/site/markdown/index.md
index 1ccb8f4..67b95b0 100644
--- a/src/site/markdown/index.md
+++ b/src/site/markdown/index.md
@@ -17,9 +17,8 @@ limitations under the License.
# Apache Commons XML
-**Sandbox component.** Apache Commons XML is part of the
-[Apache Commons Sandbox](https://commons.apache.org/sandbox/). It is a work in
progress, has not been formally
-released, and its API, coordinates, and behavior may change without notice. Do
not rely on it in production.
+Apache Commons XML is part of the
+[Apache Commons](https://commons.apache.org/index.html) project.
Apache Commons XML provides secure-by-default JAXP factory creation,
abstracting over implementation-specific XXE hardening differences between the
diff --git a/src/site/markdown/threat_model.md
b/src/site/markdown/threat_model.md
index 0a350bd..1532cbf 100644
--- a/src/site/markdown/threat_model.md
+++ b/src/site/markdown/threat_model.md
@@ -45,7 +45,7 @@ new, hardened factory whose parsers reject the common XML
attacks (external enti
external references, and entity-expansion denial of service such as Billion
Laughs). The exact guarantee each factory
makes is documented in the Javadoc:
-https://commons.apache.org/sandbox/commons-xml/apidocs/org/apache/commons/xml/package-summary.html
+https://commons.apache.org/index/commons-xml/apidocs/org/apache/commons/xml/package-summary.html
The hardening applies to the factory and to the parsers, readers,
transformers, validators, schemas and XPath objects it produces.
It governs what those objects read;
diff --git a/src/site/site.xml b/src/site/site.xml
index 425f326..e703559 100644
--- a/src/site/site.xml
+++ b/src/site/site.xml
@@ -37,10 +37,10 @@
</item>
<item name="License" href="https://www.apache.org/licenses/LICENSE-2.0";
/>
<item name="Code of Conduct"
href="https://www.apache.org/foundation/policies/conduct.html"; />
-<!-- TODO <item name="Download"
href="https://commons.apache.org/sandbox/commons-xml/download_xml.cgi"; />-->
+ <item name="Download"
href="https://commons.apache.org/proper/commons-xml/download_xml.cgi"; />
<item name="Javadoc">
<item name="Javadoc Current" href="apidocs/index.html" />
-<!-- TODO <item name="Javadoc Archive"
href="https://javadoc.io/doc/org.apache.commons/commons-xml/"; />-->
+ <item name="Javadoc Archive"
href="https://javadoc.io/doc/org.apache.commons/commons-xml/"; />
</item>
<!-- End: For all components. -->
</menu>
