[
https://issues.apache.org/jira/browse/RAMPART-451?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17569613#comment-17569613
]
Robert Lazarski commented on RAMPART-451:
-----------------------------------------
Rampart is still supported as we are planning a release soon - since Axis2 and
Axiom has had recent releases the focus is now on Rampart.
The biggest problem facing Rampart is that it is a sub project of Axis and
AFAIK there are no Axis committers that currently use Rampart.
Concerning Xalan, thanks for letting us know.
We are all volunteers so any patches for this issue and any others will speed
up the release though as volunteers we cannot give an accurate ETA.
> remove xalan dependency due to it being end of life
> ---------------------------------------------------
>
> Key: RAMPART-451
> URL: https://issues.apache.org/jira/browse/RAMPART-451
> Project: Rampart
> Issue Type: Improvement
> Reporter: PJ Fanning
> Priority: Major
>
> Xalan is no longer supported.
> https://lists.apache.org/thread/s8kjny5270ssfcp46v0fl39lk98987w7
> Is Rampart still supported? It's been a while (2017) since last release - but
> this release has a dependency on xalan - see
> https://mvnrepository.com/artifact/org.apache.rampart/rampart-core/1.7.1
> There are a number of other dependencies that have CVEs too.
> It is better to use JAXP TransformerFactory than using xalan directly. If you
> add xalan dependency just to ensure that you have a JAXP compliant
> transformer on the classpath, this is unnecessary - the Java runtime has a
> built-in implementation.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: java-dev-unsubscr...@axis.apache.org
For additional commands, e-mail: java-dev-h...@axis.apache.org
