This is an automated email from the ASF dual-hosted git repository. garydgregory pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/commons-secure-xml.git
commit b56d718bdc8000effa5d1b0f5e7297c5a41984a8 Author: Gary Gregory <[email protected]> AuthorDate: Mon Sep 14 17:16:15 2026 -0700 Site documentation. --- README.md | 4 ++-- RELEASE-NOTES.txt | 4 ++-- SECURITY.md | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 3536f0a..3d1bcb5 100644 --- a/README.md +++ b/README.md @@ -85,11 +85,11 @@ From a command shell, run `mvn` without arguments to invoke the default Maven go Contributing ------------ -We accept Pull Requests via GitHub. The [developer mailing list](https://commons.apache.org/mail-lists.html) is the main channel of communication for contributors. +We accept pull requests via GitHub. The [developer mailing list](https://commons.apache.org/mail-lists.html) is the main channel of communication for contributors. There are some guidelines which will make applying PRs easier for us: + No tabs! Please use spaces for indentation. + Respect the existing code style for each file. -+ Create minimal diffs - disable on save actions like reformat source code or organize imports. If you feel the source code should be reformatted create a separate PR for this change. ++ Create minimal diffs: disable on-save actions like reformatting source code or organizing imports. If you feel the source code should be reformatted, create a separate PR for this change. + Provide JUnit tests for your changes and make sure your changes don't break any existing tests by running `mvn`. + Before you push a PR, run `mvn` (without arguments). This runs the default goal which contains all build checks. + To see the code coverage report, regardless of coverage failures, run `mvn clean site -Dcommons.jacoco.haltOnFailure=false -Pjacoco` diff --git a/RELEASE-NOTES.txt b/RELEASE-NOTES.txt index 791ee22..e930fb0 100644 --- a/RELEASE-NOTES.txt +++ b/RELEASE-NOTES.txt @@ -23,7 +23,7 @@ Apache Commons Secure XML provides secure-by-default JAXP factory creation, abst implementation-specific XXE securing differences between the stock JDK and external JAXP implementations (Android, Apache Xalan, Apache Xerces, Woodstox, Saxon-HE). -First release, requires Java 8 or above. +First release. Requires Java 8 or later. New features @@ -42,7 +42,7 @@ Fixed Bugs * COMMONSXML-10: Block XInclude (xi:include) href resolution by default, since the JAXP external-access properties do not govern it. Thanks to Ta Duc Thien, Piotr P. Karwasz, Gary Gregory. * Honor jdk.xml.overrideDefaultParser on TrAX, XPath and schema factories that recognize it. Thanks to Piotr P. Karwasz, Gary Gregory. -* Restore the secure configuration when a factory or parser is reset() instead of reverting to the implementation defaults. Thanks to Piotr P. Karwasz, Gary Gregory. +* Restore the secure configuration when reset() is called on a factory or parser instead of reverting to the implementation defaults. Thanks to Piotr P. Karwasz, Gary Gregory. * Parse a Source opted in by a caller-supplied URIResolver using a secure parser. Thanks to Piotr P. Karwasz, Gary Gregory. * Secure the document parse behind the InputSource-taking XPath evaluation entry points. Thanks to Piotr P. Karwasz, Gary Gregory. * Fall back to the standard factory lookup in the DOM, SAX and schema newDefaultInstance methods on Android. Thanks to Piotr P. Karwasz, Gary Gregory. diff --git a/SECURITY.md b/SECURITY.md index 370dcf0..ab15842 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -41,7 +41,7 @@ The workflows in this repository rest on the following trust assumptions: under the same governance and access controls as this repository. - **The risk of trusting `actions/*` and `github/*` is judged acceptable.** These are owned by GitHub, - the organisation that already runs the workflows and holds our secrets, + the organization that already runs the workflows and holds our secrets, so trusting its actions adds no party that could not compromise the workflows anyway. A workflow reference into any of these, by branch or tag instead of a pinned commit,
