I would like to release Apache Commons Secure XML 1.0.0, a new component:
Apache Commons Secure XML provides secure-by-default JAXP factory
creation, abstracting over implementation-specific XXE securing
differences between the stock JDK and external JAXP implementations
(Android, Apache Xalan, Apache Xerces, Woodstox, Saxon-HE).
Apache Commons Secure XML 1.0.0 RC1 is available for review here:
https://dist.apache.org/repos/dist/dev/commons/secure-xml/1.0.0-RC1
(svn revision 87101)
The Git tag commons-secure-xml-1.0.0-RC1 commit for this RC is
157f41ee804b01c3e437fca2cd7a9bfa62f02a8d, which you can browse here:
https://gitbox.apache.org/repos/asf?p=commons-secure-xml.git;a=commit;h=157f41ee804b01c3e437fca2cd7a9bfa62f02a8d
You may checkout this tag using:
git clone https://gitbox.apache.org/repos/asf/commons-secure-xml.git
--branch commons-secure-xml-1.0.0-RC1 commons-secure-xml-1.0.0-RC1
Maven artifacts are here:
https://repository.apache.org/content/repositories/orgapachecommons-1961/org/apache/commons/commons-secure-xml/1.0.0/
These are the artifacts and their hashes:
#Release SHA-512s
#Mon Aug 31 21:59:01 UTC 2026
commons-secure-xml-1.0.0-bom.json=8d847f4dc0a2875dac35513f5b4636bd5dafa6038d1acd8fcaaa6d9e15ef6ee2f2756b90377e0acf4129ffd18e6898d9d3a95ce932137815f0d3606648a9506c
commons-secure-xml-1.0.0-bom.xml=a1ac8cd4bfd88a103acc2218cf49350aa7aebf1ec95e9366792e784b6f7c771e501bfefe5672eee25ebf18fdc1ea5b10fce695d5988295bc589b50ff5cf0a69b
commons-secure-xml-1.0.0-javadoc.jar=b86867f2cc26c8e6f027d82aff0eac14b6bd65212ec0d19c520dc26ad7231bf2907e8fbfac66796313af7d8b60f2c916af484197443d3af989c02cbdb0f6ebba
commons-secure-xml-1.0.0-sources.jar=6552f46047e2c2b462b15e4a9987db11d654d8b30b0a9fd414024591c5be27302fd95b1a86a930e2eebfbce87f7e6395afbffea5cb1c2d839e3e7baa9e246776
commons-secure-xml-1.0.0-src.tar.gz=a47f0a5def8b639bc8ae4408f9a7f32746118c0657737dc61f89fe283a98ec8d41865c5a9d41c7d3c776751ae8e3597d05c513da0621b6f920d7085cc1b88272
commons-secure-xml-1.0.0-src.zip=bd896de93593b1f16a0d53a5ce8670ed422220b4b010ec0d56f7a94f6520b83fb77a7b61ed7483c226ed9b93681db06a45db7b0c4f9634fdd968f3908248de27
commons-secure-xml-1.0.0-test-sources.jar=78ac43c9bd542602248713e4a81a69ea29f03a77e23dd771513f1042681fb0170c8a92ea51fb18b3b013b84fe8375d182570ca9a4cc14993788a8a98594a0384
org.apache.commons_commons-secure-xml-1.0.0.spdx.json=b9a176a91f4508ca2d6b9e3487dd92b2b306e378101f9c9ded68a80a9f26c278b362189ad658a4ad82b588287d1b9e09c556a12bff65402fd1928c613a35cefe
I have tested this with 'mvn' and 'mvn clean install site' using:
openjdk version "21.0.12.1" 2026-08-18
OpenJDK Runtime Environment Homebrew (build 21.0.12.1)
OpenJDK 64-Bit Server VM Homebrew (build 21.0.12.1, mixed mode, sharing)
Apache Maven 3.9.16 (2bdd9fddda4b155ebf8000e807eb73fd829a51d5)
Maven home: /opt/homebrew/Cellar/maven/3.9.16/libexec
Java version: 21.0.12.1, vendor: Homebrew, runtime:
/opt/homebrew/Cellar/openjdk@21/21.0.12.1/libexec/openjdk.jdk/Contents/Home
Default locale: en_US, platform encoding: UTF-8
OS name: "mac os x", version: "26.6.2", arch: "aarch64", family: "mac"
Darwin ****.local 25.6.0 Darwin Kernel Version 25.6.0: Fri Jul 31
19:17:26 PDT 2026; root:xnu-12377.161.14~5/RELEASE_ARM64_T6041 arm64
Docker version 29.7.2, build a7dcaa6
Details of changes since 103 are in the release notes:
https://dist.apache.org/repos/dist/dev/commons/secure-xml/1.0.0-RC1/RELEASE-NOTES.txt
https://dist.apache.org/repos/dist/dev/commons/secure-xml/1.0.0-RC1/site/changes.html
Site:
https://dist.apache.org/repos/dist/dev/commons/secure-xml/1.0.0-RC1/site/index.html
(Note some *relative* links are broken and the 1.0.0 directories
are not yet created - these will be OK once the site is deployed.)
JApiCmp Report: None, this is the first release.
RAT Report:
https://dist.apache.org/repos/dist/dev/commons/secure-xml/1.0.0-RC1/site/rat-report.html
KEYS:
https://downloads.apache.org/commons/KEYS
Please review the release candidate and vote.
This vote will close no sooner than 72 hours from now.
[ ] +1 Release these artifacts
[ ] +0 OK, but...
[ ] -0 OK, but really should fix...
[ ] -1 I oppose this release because...
Thank you,
Gary Gregory,
Release Manager (using key 530AA5F25C25011F)
The following is intended as a helper and refresher for reviewers.
Validating a release candidate
==============================
These guidelines are NOT complete.
Requirements: Git, Java, and Maven.
You can validate a release from a release candidate (RC) tag as follows.
1a) Download and decompress the source archive from:
https://dist.apache.org/repos/dist/dev/commons/secure-xml/1.0.0-RC1/source
1b) Check out the RC tag from git (optional)
This is optional, as a reviewer must at least check source distributions.
git clone https://gitbox.apache.org/repos/asf/commons-secure-xml.git
--branch commons-secure-xml-1.0.0-RC1 commons-secure-xml-1.0.0-RC1
cd commons-secure-xml-1.0.0-RC1
2) Checking the build
All components should include a default Maven goal, such that you can
run 'mvn' from the command line by itself.
2) Check Apache licenses
This step is not required if the site includes a RAT report page,
which you then must check.
This check should be included in the default Maven build, but you can
check it with:
mvn apache-rat:check
3) Check binary compatibility
This step is not required if the site includes a JApiCmp report page,
which you then must check.
This check should be included in the default Maven build, but you can
check it with:
mvn verify -DskipTests -P japicmp japicmp:cmp
4) Build the package
This check should be included in the default Maven build, but you can
check it with:
mvn -V clean package
You can record the Maven and Java version produced by -V in your VOTE reply.
To gather OS information from a command line:
Windows: ver
Linux: uname -a
4b) Check reproducibility
To check that a build is reproducible, run:
mvn clean verify artifact:compare -DskipTests
-Dreference.repo=https://repository.apache.org/content/repositories/staging/
'-Dbuildinfo.ignore=*/*.spdx.json'
Note that this excludes SPDX files from the check.
5) Build the site for a single module project
Note: Some plugins require the components to be installed instead of packaged.
mvn site
Check the site reports in:
- Windows: target\site\index.html
- Linux: target/site/index.html
-the end-
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
