PJ Fanning created RAMPART-451:
----------------------------------
Summary: remove xalan dependency due to it being end of life
Key: RAMPART-451
URL: https://issues.apache.org/jira/browse/RAMPART-451
Project: Rampart
Issue Type: Improvement
Reporter: PJ Fanning
Xalan is no longer supported.
https://lists.apache.org/thread/s8kjny5270ssfcp46v0fl39lk98987w7
Is Rampart still supported? It's been a while (2017) since last release - but
this release has a dependency on xalan - see
https://mvnrepository.com/artifact/org.apache.rampart/rampart-core/1.7.1
There are a number of other dependencies that have CVEs too.
It is better to use JAXP TransformerFactory than using xalan directly. If you
add xalan dependency just to ensure that you have a JAXP compliant transformer
on the classpath, this is unnecessary - the Java runtime has a built-in
implementation.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: java-dev-unsubscr...@axis.apache.org
For additional commands, e-mail: java-dev-h...@axis.apache.org
