On Fri, Sep 4, 2026 at 8:32 AM Piotr P. Karwasz <[email protected]> wrote: > > Hi Gary, > > On 4.09.2026 14:26, Gary Gregory wrote: > > We have fixed a few bugs and added enhancements since the release of > > Apache Commons Parent 104, so I would like to release Apache Commons > > Parent 105. > > > Since we are releasing anyway, why don't we add a Forbidden API Checker > execution that forbids projects from calling > DocumentBuilderFactory.newInstance and other JAXP factory constructors? > Projects would obviously be able to override those.
Good idea. Components can do that today with Checkstyle, PMD, and/or SpotBugs. All can be configured with different levels of ease and complexity. The simplest in order of simple to complex are IMO: Checkstyle, PMD, and then SpotBugs. SpotBugs requires code and not just a config file. I don't want to hold up 105 for this new feature. We can do this for 106 after Secure XML is out. Gary > > Piotr > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
