This is an automated email from the ASF dual-hosted git repository.
ffang pushed a commit to branch 4.1.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
The following commit(s) were added to refs/heads/4.1.x-fixes by this push:
new 5671d90da0e update CXF 4.1.9 release notes
5671d90da0e is described below
commit 5671d90da0efc5424a2284c859f9d1d735f9e30a
Author: Freeman Fang <[email protected]>
AuthorDate: Thu Oct 1 12:52:55 2026 -0400
update CXF 4.1.9 release notes
---
distribution/src/main/release/release_notes.txt | 23 +++++++++++++++--------
1 file changed, 15 insertions(+), 8 deletions(-)
diff --git a/distribution/src/main/release/release_notes.txt
b/distribution/src/main/release/release_notes.txt
index 94eb06b6fed..f77ae81b595 100644
--- a/distribution/src/main/release/release_notes.txt
+++ b/distribution/src/main/release/release_notes.txt
@@ -1,4 +1,4 @@
-Apache CXF 4.1.8 Release Notes
+Apache CXF 4.1.9 Release Notes
1. Overview
@@ -27,7 +27,7 @@ for further information and requirements for upgrading from
earlier
versions of CXF.
-4.1.8 fixes over 6 JIRA issues reported by users and the community.
+4.1.9 fixes over 8 JIRA issues reported by users and the community.
2. Installation Prerequisites
@@ -70,11 +70,18 @@ for caveats when upgrading.
7. Specific issues, features, and improvements fixed in this version
** Bug
- * [CXF-9219] - cxf-bom manages dependencies for 4.x that no longer exist
or are not published
- * [CXF-9221] - JCache providers use inverted isExpired() logic causing
expired tokens/codes to never be evicted
- * [CXF-9223] - completeAudienceMatch=false defaults to prefix matching for
audience validation, widening resource access
- * [CXF-9225] - OIDC RP does not enforce nonce validation for
Implicit/Hybrid flows
- * [CXF-9226] - Proxy authentication fails with IllegalStateException
instead of HTTPException (407)
- * [CXF-9227] - CXF 4.1.7 regression: more SecurityManager permission
requirements
+ * [CXF-9032] - JWK keystore type is not getting loaded if JWT contains x5t
header
+ * [CXF-9234] - Concurrent DynamicClientFactory.createClient for the same
WSDL url corrupts the cached schema DOM and spins forever at 100% CPU
+ * [CXF-9235] - Invocation.Builder.property() settings ignored by HTTP
transport for set.content.type.for.empty.request
+ * [CXF-9240] - OAuthJSONProvider.appendJsonPair() does not escape JSON
string values — output injection / malformed JSON in introspect & token
responses
+ * [CXF-9241] - ImplicitConfidentialGrantService violates RFC 6749 §4.2.2
by issuing Refresh Tokens in the Implicit Flow
+ * [CXF-9245] - Race Condition in ServerLifeCycleManagerImpl#stopServer()
+ * [CXF-9250] - HttpClientHTTPConduit: failed exchange without request body
is re-sent endlessly from the exceptionally callback (e.g. remote WSDL fetch)
+
+
+
+
+** Improvement
+ * [CXF-9233] - AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in
the message properties, so RESP_OUT log is disable :(
