Dave Fisher's (e) seems like the best fix to me. Not everyone needs the XMLBeans fixes, so we shouldn't force it on them in order to update to the latest version of POI.
Changing the java package name from org.apache.xmlbeans would break compatibility with XMLBeans 2.3.0 and 2.6.0, as well as any private forks people maintain that use the org.apache.xmlbeans package namespace. If the board is open to it, the least effort solution is to commit the changes to XMLBeans's repo l, make a release, and update the website without pulling it out of the Attic. If we can't get around the Apache's policies requiring non-Attic status to commit or release, then we could pull XMLBeans out of the Attic just long enough to form a PMC, commit, release, vote, and update website, then put it back into the attic. I don't see the changes we need to make to XMLBeans as specific to POI--the same bugs would affect other projects running on Android. We aren't aware of what those other projects might be. I don't think that's enough reason to make a POI-specific XMLBeans release or to copy the source tree inside of POI. I haven't had any issues using POI with XMLBeans for my applications, so my opinions probably don't hold as much weight as those who have been affected by the bugs. On Nov 9, 2017 15:43, "Andreas Beeker" <[email protected]> wrote: Hi, I would prefer c) but keeping the package names and only change the artifact groupid, to keep it's proprietary usage for POI. So we don't need to care to build up a xmlbeans community again. I think d) is a longterm goal - to simulate xmlbeans xml infoset preservation plus support various ECMA versions plus handling alternate content blocks correctly will be a challenge in a brown field context. Therefore we should first fix xmlbeans. Andi On 11/9/17 10:01 PM, Dominik Stadler wrote: Hi, the initial discussion showed a few possible routes. I would like to discuss the options a bit more, probably followed by a vote to see which option has the majority. I currently see the following possibilities: a) Fork XMLBeans with a different name outside of Apache and upload a fixed version, just like PJ already did, only some more renaming would probably be necessary b) Include the source of XMLBeans with POI and release fixes from there c) As b), but change the code so different package names and jar-names are used to avoid colliding with the "official" version d) Do nothing with XMLBeans and invest all the time for replacing XMLBeans soon Any thoughts? Other options? Thanks... Dominik.
