I don't see anything seriously wrong yet, but there are a lot of nits in this project that can be noticed by a good static analyzer that should be cleaned up before 1.0. At least one of them is API level. I'll see if I can send some PRs or file issue.
On Mon, Aug 31, 2026 at 10:18 PM Gary Gregory <[email protected]> wrote: > > I would like to release Apache Commons Secure XML 1.0.0, a new component: > > Apache Commons Secure XML provides secure-by-default JAXP factory > creation, abstracting over implementation-specific XXE securing > differences between the stock JDK and external JAXP implementations > (Android, Apache Xalan, Apache Xerces, Woodstox, Saxon-HE). > > Apache Commons Secure XML 1.0.0 RC1 is available for review here: > https://dist.apache.org/repos/dist/dev/commons/secure-xml/1.0.0-RC1 > (svn revision 87101) > > The Git tag commons-secure-xml-1.0.0-RC1 commit for this RC is > 157f41ee804b01c3e437fca2cd7a9bfa62f02a8d, which you can browse here: > > https://gitbox.apache.org/repos/asf?p=commons-secure-xml.git;a=commit;h=157f41ee804b01c3e437fca2cd7a9bfa62f02a8d > You may checkout this tag using: > git clone https://gitbox.apache.org/repos/asf/commons-secure-xml.git > --branch commons-secure-xml-1.0.0-RC1 commons-secure-xml-1.0.0-RC1 > > Maven artifacts are here: > > https://repository.apache.org/content/repositories/orgapachecommons-1961/org/apache/commons/commons-secure-xml/1.0.0/ > > These are the artifacts and their hashes: > > #Release SHA-512s > #Mon Aug 31 21:59:01 UTC 2026 > commons-secure-xml-1.0.0-bom.json=8d847f4dc0a2875dac35513f5b4636bd5dafa6038d1acd8fcaaa6d9e15ef6ee2f2756b90377e0acf4129ffd18e6898d9d3a95ce932137815f0d3606648a9506c > commons-secure-xml-1.0.0-bom.xml=a1ac8cd4bfd88a103acc2218cf49350aa7aebf1ec95e9366792e784b6f7c771e501bfefe5672eee25ebf18fdc1ea5b10fce695d5988295bc589b50ff5cf0a69b > commons-secure-xml-1.0.0-javadoc.jar=b86867f2cc26c8e6f027d82aff0eac14b6bd65212ec0d19c520dc26ad7231bf2907e8fbfac66796313af7d8b60f2c916af484197443d3af989c02cbdb0f6ebba > commons-secure-xml-1.0.0-sources.jar=6552f46047e2c2b462b15e4a9987db11d654d8b30b0a9fd414024591c5be27302fd95b1a86a930e2eebfbce87f7e6395afbffea5cb1c2d839e3e7baa9e246776 > commons-secure-xml-1.0.0-src.tar.gz=a47f0a5def8b639bc8ae4408f9a7f32746118c0657737dc61f89fe283a98ec8d41865c5a9d41c7d3c776751ae8e3597d05c513da0621b6f920d7085cc1b88272 > commons-secure-xml-1.0.0-src.zip=bd896de93593b1f16a0d53a5ce8670ed422220b4b010ec0d56f7a94f6520b83fb77a7b61ed7483c226ed9b93681db06a45db7b0c4f9634fdd968f3908248de27 > commons-secure-xml-1.0.0-test-sources.jar=78ac43c9bd542602248713e4a81a69ea29f03a77e23dd771513f1042681fb0170c8a92ea51fb18b3b013b84fe8375d182570ca9a4cc14993788a8a98594a0384 > org.apache.commons_commons-secure-xml-1.0.0.spdx.json=b9a176a91f4508ca2d6b9e3487dd92b2b306e378101f9c9ded68a80a9f26c278b362189ad658a4ad82b588287d1b9e09c556a12bff65402fd1928c613a35cefe > > > I have tested this with 'mvn' and 'mvn clean install site' using: > > openjdk version "21.0.12.1" 2026-08-18 > OpenJDK Runtime Environment Homebrew (build 21.0.12.1) > OpenJDK 64-Bit Server VM Homebrew (build 21.0.12.1, mixed mode, sharing) > > Apache Maven 3.9.16 (2bdd9fddda4b155ebf8000e807eb73fd829a51d5) > Maven home: /opt/homebrew/Cellar/maven/3.9.16/libexec > Java version: 21.0.12.1, vendor: Homebrew, runtime: > /opt/homebrew/Cellar/openjdk@21/21.0.12.1/libexec/openjdk.jdk/Contents/Home > Default locale: en_US, platform encoding: UTF-8 > OS name: "mac os x", version: "26.6.2", arch: "aarch64", family: "mac" > > Darwin ****.local 25.6.0 Darwin Kernel Version 25.6.0: Fri Jul 31 > 19:17:26 PDT 2026; root:xnu-12377.161.14~5/RELEASE_ARM64_T6041 arm64 > > Docker version 29.7.2, build a7dcaa6 > > > Details of changes since 103 are in the release notes: > > https://dist.apache.org/repos/dist/dev/commons/secure-xml/1.0.0-RC1/RELEASE-NOTES.txt > > https://dist.apache.org/repos/dist/dev/commons/secure-xml/1.0.0-RC1/site/changes.html > > Site: > > https://dist.apache.org/repos/dist/dev/commons/secure-xml/1.0.0-RC1/site/index.html > (Note some *relative* links are broken and the 1.0.0 directories > are not yet created - these will be OK once the site is deployed.) > > JApiCmp Report: None, this is the first release. > > RAT Report: > > https://dist.apache.org/repos/dist/dev/commons/secure-xml/1.0.0-RC1/site/rat-report.html > > KEYS: > https://downloads.apache.org/commons/KEYS > > Please review the release candidate and vote. > This vote will close no sooner than 72 hours from now. > > [ ] +1 Release these artifacts > [ ] +0 OK, but... > [ ] -0 OK, but really should fix... > [ ] -1 I oppose this release because... > > Thank you, > > Gary Gregory, > Release Manager (using key 530AA5F25C25011F) > > The following is intended as a helper and refresher for reviewers. > > Validating a release candidate > ============================== > > These guidelines are NOT complete. > > Requirements: Git, Java, and Maven. > > You can validate a release from a release candidate (RC) tag as follows. > > 1a) Download and decompress the source archive from: > > https://dist.apache.org/repos/dist/dev/commons/secure-xml/1.0.0-RC1/source > > 1b) Check out the RC tag from git (optional) > > This is optional, as a reviewer must at least check source distributions. > > git clone https://gitbox.apache.org/repos/asf/commons-secure-xml.git > --branch commons-secure-xml-1.0.0-RC1 commons-secure-xml-1.0.0-RC1 > cd commons-secure-xml-1.0.0-RC1 > > 2) Checking the build > > All components should include a default Maven goal, such that you can > run 'mvn' from the command line by itself. > > 2) Check Apache licenses > > This step is not required if the site includes a RAT report page, > which you then must check. > This check should be included in the default Maven build, but you can > check it with: > > mvn apache-rat:check > > 3) Check binary compatibility > > This step is not required if the site includes a JApiCmp report page, > which you then must check. > This check should be included in the default Maven build, but you can > check it with: > > mvn verify -DskipTests -P japicmp japicmp:cmp > > 4) Build the package > > This check should be included in the default Maven build, but you can > check it with: > > mvn -V clean package > > You can record the Maven and Java version produced by -V in your VOTE reply. > To gather OS information from a command line: > Windows: ver > Linux: uname -a > > 4b) Check reproducibility > > To check that a build is reproducible, run: > > mvn clean verify artifact:compare -DskipTests > -Dreference.repo=https://repository.apache.org/content/repositories/staging/ > '-Dbuildinfo.ignore=*/*.spdx.json' > > Note that this excludes SPDX files from the check. > > 5) Build the site for a single module project > > Note: Some plugins require the components to be installed instead of packaged. > > mvn site > Check the site reports in: > - Windows: target\site\index.html > - Linux: target/site/index.html > > -the end- > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > -- Elliotte Rusty Harold [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
