dev  

Messages by Thread

• [PR] WSS-727 - Minor cleanup [ws-wss4j] via GitHub
  • Re: [PR] WSS-727 - Minor cleanup [ws-wss4j] via GitHub
• [PR] Fixing AKI bug [ws-wss4j] via GitHub
  • Re: [PR] Fixing AKI bug [ws-wss4j] via GitHub
• [jira] [Work started] (WSS-727) SignatureProcessor retains the entire attachment in heap when verifying an SwA signed attachment (cacheReference) Colm O hEigeartaigh (Jira)
• [PR] Finishing DER work [ws-wss4j] via GitHub
  • Re: [PR] Finishing DER work [ws-wss4j] via GitHub
  • Re: [PR] Finishing DER work [ws-wss4j] via GitHub
• [jira] [Closed] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) Colm O hEigeartaigh (Jira)
• [jira] [Updated] (WSS-713) Support SubjectConfirmationData for SAML-SV v1 Colm O hEigeartaigh (Jira)
• [jira] [Updated] (WSS-721) Merlin Trust Optimization Request Colm O hEigeartaigh (Jira)
• [jira] [Updated] (WSS-416) Update ConditionsBean to support additional conditions such as Delegate Colm O hEigeartaigh (Jira)
  • [jira] [Updated] (WSS-416) Update ConditionsBean to support additional conditions such as Delegate Colm O hEigeartaigh (Jira)
• [PR] Bump org.xmlunit:xmlunit-assertj3 from 2.13.0 to 2.14.0 [ws-axiom] via GitHub
  • Re: [PR] Bump org.xmlunit:xmlunit-assertj3 from 2.13.0 to 2.14.0 [ws-axiom] via GitHub
• [PR] Update certs that are failing with the Bouncycastle update [ws-wss4j] via GitHub
  • Re: [PR] Update certs that are failing with the Bouncycastle update [ws-wss4j] via GitHub
• [PR] Follow-on from last DER patch [ws-wss4j] via GitHub
  • Re: [PR] Follow-on from last DER patch [ws-wss4j] via GitHub
  • Re: [PR] Follow-on from last DER patch [ws-wss4j] via GitHub
  • Re: [PR] Follow-on from last DER patch [ws-wss4j] via GitHub
• [PR] Fix timestamp parsing [ws-wss4j] via GitHub
  • Re: [PR] Fix timestamp parsing [ws-wss4j] via GitHub
• [PR] Fix SenderVouches EncryptedKey case [ws-wss4j] via GitHub
  • Re: [PR] Fix SenderVouches EncryptedKey case [ws-wss4j] via GitHub
• [PR] Bump org.apache.felix:maven-bundle-plugin from 6.1.2 to 6.2.0 [ws-wss4j] via GitHub
  • Re: [PR] Bump org.apache.felix:maven-bundle-plugin from 6.1.2 to 6.2.0 [ws-wss4j] via GitHub
• [PR] Switch to use BASE-64 encoding rather than 32 bit hash values for sig… [ws-wss4j] via GitHub
  • Re: [PR] Switch to use BASE-64 encoding rather than 32 bit hash values for sig… [ws-wss4j] via GitHub
• [PR] Align StaX sender vouches with DOM layer [ws-wss4j] via GitHub
  • Re: [PR] Align StaX sender vouches with DOM layer [ws-wss4j] via GitHub
• [PR] Fix SAML Conditions parsing [ws-wss4j] via GitHub
  • Re: [PR] Fix SAML Conditions parsing [ws-wss4j] via GitHub
• [PR] StAX SAML subject confirmation skipped for an empty SOAP Body [ws-wss4j] via GitHub
  • Re: [PR] StAX SAML subject confirmation skipped for an empty SOAP Body [ws-wss4j] via GitHub
• [PR] Extend the EncryptedKey random-key fallback beyond decryptDataRef [ws-wss4j] via GitHub
  • Re: [PR] Extend the EncryptedKey random-key fallback beyond decryptDataRef [ws-wss4j] via GitHub
• [PR] Properly wire UsernameToken + RSA15 flags for the streaming layer [ws-wss4j] via GitHub
  • Re: [PR] Properly wire UsernameToken + RSA15 flags for the streaming layer [ws-wss4j] via GitHub
• [PR] Stricter policy enforcement [ws-wss4j] via GitHub
  • Re: [PR] Stricter policy enforcement [ws-wss4j] via GitHub
• [PR] Bound the encrypted data nesting depth [ws-wss4j] via GitHub
  • Re: [PR] Bound the encrypted data nesting depth [ws-wss4j] via GitHub
  • Re: [PR] Bound the encrypted data nesting depth [ws-wss4j] via GitHub
• [PR] Document streaming policy enforcement [ws-wss4j] via GitHub
  • Re: [PR] Document streaming policy enforcement [ws-wss4j] via GitHub
• [PR] Bump org.apache.felix:maven-bundle-plugin from 6.1.2 to 6.2.0 [ws-axiom] via GitHub
  • Re: [PR] Bump org.apache.felix:maven-bundle-plugin from 6.1.2 to 6.2.0 [ws-axiom] via GitHub
• [PR] Bump org.bouncycastle:bcprov-jdk18on from 1.84 to 1.85 in /parent [ws-wss4j] via GitHub
  • Re: [PR] Bump org.bouncycastle:bcprov-jdk18on from 1.84 to 1.85 in /parent [ws-wss4j] via GitHub
  • Re: [PR] Bump org.bouncycastle:bcprov-jdk18on from 1.84 to 1.85 in /parent [ws-wss4j] via GitHub
  • Re: [PR] Bump org.bouncycastle:bcprov-jdk18on from 1.84 to 1.85 in /parent [ws-wss4j] via GitHub
• [PR] Redact passwords from UsernameToken toString [ws-wss4j] via GitHub
  • Re: [PR] Redact passwords from UsernameToken toString [ws-wss4j] via GitHub
• CVE-2026-91867: Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely Colm O hEigeartaigh
• CVE-2026-91866: Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service Colm O hEigeartaigh
• CVE-2026-91865: Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service Colm O hEigeartaigh
• CVE-2026-91864: Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion Colm O hEigeartaigh
• CVE-2026-91863: Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service Colm O hEigeartaigh
• [PR] Updating Neethi to 3.2.4 [ws-wss4j] via GitHub
  • Re: [PR] Updating Neethi to 3.2.4 [ws-wss4j] via GitHub
• [PR] Additional Bleichenbacher fix [ws-wss4j] via GitHub
  • Re: [PR] Additional Bleichenbacher fix [ws-wss4j] via GitHub
  • Re: [PR] Additional Bleichenbacher fix [ws-wss4j] via GitHub
• [PR] Set trust when there is no KeyInfo and the certificate comes from a l… [ws-wss4j] via GitHub
  • Re: [PR] Set trust when there is no KeyInfo and the certificate comes from a l… [ws-wss4j] via GitHub
• [PR] Putting max on UsernameToken stax iterations [ws-wss4j] via GitHub
  • Re: [PR] Putting max on UsernameToken stax iterations [ws-wss4j] via GitHub
• [PR] Adding docs about trust credentials for BST [ws-wss4j] via GitHub
  • Re: [PR] Adding docs about trust credentials for BST [ws-wss4j] via GitHub
• [PR] Only set trust validation for Signature when we have a trusted source [ws-wss4j] via GitHub
  • Re: [PR] Only set trust validation for Signature when we have a trusted source [ws-wss4j] via GitHub
• [PR] Add a new property to disable reading local files [ws-xmlschema] via GitHub
  • Re: [PR] Add a new property to disable reading local files [ws-xmlschema] via GitHub
• [PR] Add a switch to allow network resolution to be turned off [ws-xmlschema] via GitHub
  • Re: [PR] Add a switch to allow network resolution to be turned off [ws-xmlschema] via GitHub
• [PR] Stop capturing foreign children of the document element [ws-xmlschema] via GitHub
  • Re: [PR] Stop capturing foreign children of the document element [ws-xmlschema] via GitHub
• [PR] Serialize notation as well and fix some NPEs [ws-xmlschema] via GitHub
  • Re: [PR] Serialize notation as well and fix some NPEs [ws-xmlschema] via GitHub
• [PR] Fix nonce encoding issue [ws-wss4j] via GitHub
  • Re: [PR] Fix nonce encoding issue [ws-wss4j] via GitHub
• [PR] Fix signature replay caching [ws-wss4j] via GitHub
  • Re: [PR] Fix signature replay caching [ws-wss4j] via GitHub
• [PR] Report unresolvable and complex-where-simple type references as XmlSc… [ws-xmlschema] via GitHub
  • Re: [PR] Report unresolvable and complex-where-simple type references as XmlSc… [ws-xmlschema] via GitHub
• [PR] Keep document-walk failures distinguishable [ws-xmlschema] via GitHub
  • Re: [PR] Keep document-walk failures distinguishable [ws-xmlschema] via GitHub
• [PR] Fix StAX replaycache tests [ws-wss4j] via GitHub
  • Re: [PR] Fix StAX replaycache tests [ws-wss4j] via GitHub
• [PR] Bump org.apache:apache from 37 to 39 [ws-wss4j] via GitHub
  • Re: [PR] Bump org.apache:apache from 37 to 39 [ws-wss4j] via GitHub
• [PR] Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.6 to 3.6.0 [ws-wss4j] via GitHub
  • Re: [PR] Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.6 to 3.6.0 [ws-wss4j] via GitHub
• [PR] Bump org.cyclonedx:cyclonedx-maven-plugin from 2.9.2 to 2.9.3 [ws-wss4j] via GitHub
  • Re: [PR] Bump org.cyclonedx:cyclonedx-maven-plugin from 2.9.2 to 2.9.3 [ws-wss4j] via GitHub
• [PR] Fix scchema resolution budget bug [ws-xmlschema] via GitHub
  • Re: [PR] Fix scchema resolution budget bug [ws-xmlschema] via GitHub
• [PR] Place default limits on read timeouts + size on remote schemas [ws-xmlschema] via GitHub
  • Re: [PR] Place default limits on read timeouts + size on remote schemas [ws-xmlschema] via GitHub
• Build failed in Jenkins: webservices » Apache WSS4J - 2.3.x-fixes JDK 8 #42 Apache Jenkins Server
• [PR] Fix some potential NPEs [ws-xmlschema] via GitHub
  • Re: [PR] Fix some potential NPEs [ws-xmlschema] via GitHub
• [PR] Exclude a few other things by default in DefaultURIResolver [ws-xmlschema] via GitHub
  • Re: [PR] Exclude a few other things by default in DefaultURIResolver [ws-xmlschema] via GitHub
• [PR] Updating docs for remote URI dereferencing [ws-xmlschema] via GitHub
  • Re: [PR] Updating docs for remote URI dereferencing [ws-xmlschema] via GitHub
• [PR] Restrict default protocols allowed by the DefaultURIResolver [ws-xmlschema] via GitHub
  • Re: [PR] Restrict default protocols allowed by the DefaultURIResolver [ws-xmlschema] via GitHub
• [PR] Fix up DTD handling [ws-xmlschema] via GitHub
  • Re: [PR] Fix up DTD handling [ws-xmlschema] via GitHub
• [PR] Bump the codeql-action group with 3 updates [ws-wss4j] via GitHub
  • Re: [PR] Bump the codeql-action group with 3 updates [ws-wss4j] via GitHub
  • [PR] Bump the codeql-action group with 3 updates [ws-wss4j] via GitHub
  • Re: [PR] Bump the codeql-action group with 3 updates [ws-wss4j] via GitHub
  • [PR] Bump the codeql-action group with 3 updates [ws-wss4j] via GitHub
  • Re: [PR] Bump the codeql-action group with 3 updates [ws-wss4j] via GitHub
• [PR] Bump actions/setup-java from 6.0.0 to 6.0.1 [ws-wss4j] via GitHub
  • Re: [PR] Bump actions/setup-java from 6.0.0 to 6.0.1 [ws-wss4j] via GitHub
• [PR] Bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 [ws-wss4j] via GitHub
  • Re: [PR] Bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 [ws-wss4j] via GitHub
  • Re: [PR] Bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 [ws-wss4j] via GitHub
• [PR] Bump com.google.guava:guava from 33.6.0-jre to 33.7.1-jre [ws-wss4j] via GitHub
  • Re: [PR] Bump com.google.guava:guava from 33.6.0-jre to 33.7.1-jre [ws-wss4j] via GitHub
• [PR] Bump org.apache.felix:maven-bundle-plugin from 6.1.0 to 6.1.2 [ws-wss4j] via GitHub
  • Re: [PR] Bump org.apache.felix:maven-bundle-plugin from 6.1.0 to 6.1.2 [ws-wss4j] via GitHub
• [PR] Bump bcprov.version from 1.84 to 1.86 [ws-wss4j] via GitHub
  • Re: [PR] Bump bcprov.version from 1.84 to 1.86 [ws-wss4j] via GitHub
  • Re: [PR] Bump bcprov.version from 1.84 to 1.86 [ws-wss4j] via GitHub
  • Re: [PR] Bump bcprov.version from 1.84 to 1.86 [ws-wss4j] via GitHub
• [PR] Bump slf4j.version from 2.0.18 to 2.0.19 [ws-wss4j] via GitHub
  • Re: [PR] Bump slf4j.version from 2.0.18 to 2.0.19 [ws-wss4j] via GitHub
• [PR] Bump org.apache.maven.plugins:maven-install-plugin from 3.1.4 to 3.2.0 [ws-axiom] via GitHub
  • Re: [PR] Bump org.apache.maven.plugins:maven-install-plugin from 3.1.4 to 3.2.0 [ws-axiom] via GitHub
• [PR] Fix bug with signature policy validation for STR Transform [ws-wss4j] via GitHub
  • Re: [PR] Fix bug with signature policy validation for STR Transform [ws-wss4j] via GitHub
• [VOTE] - Release Apache Neethi 3.2.4 Colm O hEigeartaigh
  • Re: [VOTE] - Release Apache Neethi 3.2.4 Daniel Kulp
  • Re: [VOTE] - Release Apache Neethi 3.2.4 robertlazarski
  • Re: [VOTE] - Release Apache Neethi 3.2.4 Colm O hEigeartaigh
  • Re: [VOTE] - Release Apache Neethi 3.2.4 robertlazarski
  • Re: [VOTE] - Release Apache Neethi 3.2.4 Colm O hEigeartaigh
• [PR] Bump org.codehaus.mojo:build-helper-maven-plugin from 3.6.1 to 3.6.2 [ws-axiom] via GitHub
  • Re: [PR] Bump org.codehaus.mojo:build-helper-maven-plugin from 3.6.1 to 3.6.2 [ws-axiom] via GitHub
• [PR] Bump org.codehaus.mojo:tidy-maven-plugin from 1.4.0 to 1.4.1 [ws-axiom] via GitHub
  • Re: [PR] Bump org.codehaus.mojo:tidy-maven-plugin from 1.4.0 to 1.4.1 [ws-axiom] via GitHub
• [PR] Bump actions/setup-java from 6.0.0 to 6.0.1 [ws-xmlschema] via GitHub
  • Re: [PR] Bump actions/setup-java from 6.0.0 to 6.0.1 [ws-xmlschema] via GitHub
• [PR] Bump the codeql-action group with 2 updates [ws-xmlschema] via GitHub
  • Re: [PR] Bump the codeql-action group with 2 updates [ws-xmlschema] via GitHub
  • [PR] Bump the codeql-action group with 2 updates [ws-xmlschema] via GitHub
  • Re: [PR] Bump the codeql-action group with 2 updates [ws-xmlschema] via GitHub
  • [PR] Bump the codeql-action group with 2 updates [ws-xmlschema] via GitHub
  • Re: [PR] Bump the codeql-action group with 2 updates [ws-xmlschema] via GitHub
• [PR] Bump actions/setup-java from 6.0.0 to 6.0.1 [ws-neethi] via GitHub
  • Re: [PR] Bump actions/setup-java from 6.0.0 to 6.0.1 [ws-neethi] via GitHub
• [PR] Bump the codeql-action group with 2 updates [ws-neethi] via GitHub
  • Re: [PR] Bump the codeql-action group with 2 updates [ws-neethi] via GitHub
  • [PR] Bump the codeql-action group with 2 updates [ws-neethi] via GitHub
  • Re: [PR] Bump the codeql-action group with 2 updates [ws-neethi] via GitHub
  • [PR] Bump the codeql-action group with 2 updates [ws-neethi] via GitHub
  • Re: [PR] Bump the codeql-action group with 2 updates [ws-neethi] via GitHub
• [PR] Improving docs for subject cert constraint [ws-wss4j] via GitHub
  • Re: [PR] Improving docs for subject cert constraint [ws-wss4j] via GitHub
• [PR] Harden Loader to only load from file + jar by default [ws-wss4j] via GitHub
  • Re: [PR] Harden Loader to only load from file + jar by default [ws-wss4j] via GitHub
  • Re: [PR] Harden Loader to only load from file + jar by default [ws-wss4j] via GitHub
• [PR] Make sure for Attachment-Complete the mime type is read from the encr… [ws-wss4j] via GitHub
  • Re: [PR] Make sure for Attachment-Complete the mime type is read from the encr… [ws-wss4j] via GitHub
• [PR] Bump maven-plugin-tools.version from 3.15.2 to 3.16.0 [ws-axiom] via GitHub
  • Re: [PR] Bump maven-plugin-tools.version from 3.15.2 to 3.16.0 [ws-axiom] via GitHub
• [PR] Bump org.eclipse.platform:org.eclipse.osgi from 3.24.200 to 3.24.300 [ws-axiom] via GitHub
  • Re: [PR] Bump org.eclipse.platform:org.eclipse.osgi from 3.24.200 to 3.24.300 [ws-axiom] via GitHub
• [PR] Bump mime4j.version from 0.8.14 to 0.8.15 [ws-axiom] via GitHub
  • Re: [PR] Bump mime4j.version from 0.8.14 to 0.8.15 [ws-axiom] via GitHub
• [jira] [Commented] (AXIOM-530) Detect the StAX dialect from factory properties instead of the factory class ASF GitHub Bot (Jira)
• [PR] AXIOM-530: Detect the StAX dialect from factory properties [ws-axiom] via GitHub
• [jira] [Created] (AXIOM-530) Detect the StAX dialect from factory properties instead of the factory class Piotr Karwasz (Jira)
• [PR] EncryptedHeader child confusion causing wrong protected-header selection [ws-wss4j] via GitHub
  • Re: [PR] EncryptedHeader child confusion causing wrong protected-header selection [ws-wss4j] via GitHub
• [PR] Make sure we can't register a fake SOAP Body for lookup [ws-wss4j] via GitHub
  • Re: [PR] Make sure we can't register a fake SOAP Body for lookup [ws-wss4j] via GitHub
• [PR] Fix sender-vouches signature referencing [ws-wss4j] via GitHub
  • Re: [PR] Fix sender-vouches signature referencing [ws-wss4j] via GitHub
• [PR] Reject duplicate C14N settings + Detect unknown top-level policy asse… [ws-wss4j] via GitHub
  • Re: [PR] Reject duplicate C14N settings + Detect unknown top-level policy asse… [ws-wss4j] via GitHub
• [jira] [Resolved] (WSS-729) Switch default JasyptPasswordEncryptor algorithm to something secure Colm O hEigeartaigh (Jira)
• [PR] Bump slf4j.version from 2.0.18 to 2.0.19 [ws-xmlschema] via GitHub
  • Re: [PR] Bump slf4j.version from 2.0.18 to 2.0.19 [ws-xmlschema] via GitHub
• [PR] WSS-729 Switch default JasyptPasswordEncryptor algorithm to PBEWithHm… [ws-wss4j] via GitHub
  • Re: [PR] WSS-729 Switch default JasyptPasswordEncryptor algorithm to PBEWithHm… [ws-wss4j] via GitHub
• [PR] Correct XOP javadoc [ws-wss4j] via GitHub
  • Re: [PR] Correct XOP javadoc [ws-wss4j] via GitHub
• [jira] [Created] (WSS-729) Switch default JasyptPasswordEncryptor algorithm to something secure Colm O hEigeartaigh (Jira)
• [PR] Fix issues with SignedElements / EncryptedElements [ws-wss4j] via GitHub
  • Re: [PR] Fix issues with SignedElements / EncryptedElements [ws-wss4j] via GitHub
• [PR] Bump com.puppycrawl.tools:checkstyle from 12.3.1 to 14.1.0 [ws-wss4j] via GitHub
  • Re: [PR] Bump com.puppycrawl.tools:checkstyle from 12.3.1 to 14.1.0 [ws-wss4j] via GitHub
  • Re: [PR] Bump com.puppycrawl.tools:checkstyle from 12.3.1 to 14.1.0 [ws-wss4j] via GitHub

• Earlier messages
• Later messages