This is an automated email from the ASF dual-hosted git repository. robertlazarski pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/axis-axis2-java-core.git
commit d3bc95176b757920cde82b562b4a5857ee549419 Author: Robert Lazarski <[email protected]> AuthorDate: Mon Sep 7 16:44:03 2026 -1000 Target the mail transport removal at 2.0.3 The next release is 2.0.3, not 2.1.0, so the deprecation notice, the WAR exclusion comment and the upgrade guidance all name it. Removal stays a release-note commitment with no Jira behind it. Also records that AXIS2-6107 is closed as Won't Do rather than merely not done, since the point of that note is to answer a scan finding without re-arguing it. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> --- SECURITY.md | 2 +- modules/webapp/scripts/build.xml | 2 +- src/site/markdown/release-notes/2.0.2.md | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index d49379573b..bea9d04b79 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -324,7 +324,7 @@ migration from `commons-fileupload` 1.x to `commons-fileupload2` in **Why the machinery is not simply deleted.** Clustering was the reason it was written and clustering is gone (item 5), so removing it is the obvious next question and scanners will keep asking it. It was scoped in - AXIS2-6107 and deliberately not done, for three reasons that are worth + AXIS2-6107 and closed as Won't Do, for three reasons that are worth recording so the question does not need re-answering: - `SessionContext` is stored as an `HttpSession` attribute diff --git a/modules/webapp/scripts/build.xml b/modules/webapp/scripts/build.xml index 155da5f707..7fa5098093 100644 --- a/modules/webapp/scripts/build.xml +++ b/modules/webapp/scripts/build.xml @@ -82,7 +82,7 @@ no default axis2.xml enables a JMS listener or sender, and jakarta.jms-api is an API with no provider, so a WAR that wanted JMS always had to add a broker client anyway. --> - <!-- Deprecated for removal in 2.1.0 and enabled by no default + <!-- Deprecated for removal in 2.0.3 and enabled by no default axis2.xml. angus-mail and jakarta.mail-api stay: JAX-WS attachment handling needs them, not the transport. --> <exclude name="axis2-transport-mail-*.jar" /> diff --git a/src/site/markdown/release-notes/2.0.2.md b/src/site/markdown/release-notes/2.0.2.md index 36a6adb567..3b789d4d61 100644 --- a/src/site/markdown/release-notes/2.0.2.md +++ b/src/site/markdown/release-notes/2.0.2.md @@ -90,7 +90,7 @@ service that had metadata exposure turned off, they no longer will. - **The mail transport is no longer bundled in `axis2.war` either.** Same reasoning as JMS: no default `axis2.xml` enables a `mailto` listener or sender, and the module - is deprecated for removal in 2.1.0. It remains in `lib/` of the binary distribution. + is deprecated for removal in 2.0.3. It remains in `lib/` of the binary distribution. Note that `angus-mail` and `jakarta.mail-api` stay in the WAR and are **not** mail transport baggage: `jakarta.mail-api` carries the `MimeBodyPart`, `MimePartDataSource`, `InternetHeaders` and `ByteArrayDataSource` classes that @@ -111,7 +111,7 @@ service that had metadata exposure turned off, they no longer will. ## Deprecated for Removal - **The mail transport (`axis2-transport-mail`) is deprecated and is planned for - removal in 2.1.0.** SOAP over SMTP was specified and profiled, but a request/response + removal in 2.0.3.** SOAP over SMTP was specified and profiled, but a request/response exchange that blocks a caller thread on a mailbox poll saw very little use even when SOAP was at its most popular, and it shows: no functional change has been made to this module in over a decade, and every commit touching it since 2015 is either a @@ -127,7 +127,7 @@ service that had metadata exposure turned off, they no longer will. sits. If you use the mail transport, please say so on the dev list -- concrete usage is - what would keep it. Otherwise plan to move to an HTTP transport before 2.1.0. Nothing + what would keep it. Otherwise plan to move to an HTTP transport before 2.0.3. Nothing is removed in 2.0.2 and the module continues to work in this release. ## Security Hardening
