[ANNOUNCE] Apache Jackrabbit Oak 1.62.0 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit Oak 1.62.0. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit Oak -- Version 1.62.0

Introduction


Jackrabbit Oak is a scalable, high-performance hierarchical content
repository designed for use as the foundation of modern world-class
web sites and other demanding content applications.

Apache Jackrabbit Oak 1.62.0 is an incremental feature release based
on and compatible with earlier stable Jackrabbit Oak 1.x
releases. This release is considered stable and targeted for
production use.

While Oak 1.62.0 compiles and tests successfully on Java 17, Javadocs
generation fails on Java 17 (but works as expected on Java 11).

The Oak effort is a part of the Apache Jackrabbit project.
Apache Jackrabbit is a project of the Apache Software Foundation.

Changes in Oak 1.62.0
-

Technical task

[OAK-6765] - Convert oak-jcr to OSGi R7 annotations
[OAK-6769] - Convert oak-search-mt to OSGi R7 annotations
[OAK-10623] - oak-core: log a warning when it needs to remap/add a 
namespace
[OAK-10673] - DocumentStore: add test for checking of removal on 
non-existing map entries
[OAK-10708] - DocumentNodeStore: error-log failures to update the 
journal

[OAK-10709] - Deprecate oak-search-mt

Bug

[OAK-10500] - javadoc:aggregate build fails again
[OAK-10544] - oak-jcr: remapping a namespace prefix leaves 
namespace resolver in broken state
[OAK-10551] - o.a.j.o.jcr.osgi.RepositoryManager declares OSGi 
properties that are not used at all
[OAK-10576] - oak-search-elastic: dynamicBoost should match only on 
full text queries on all fields (* or .)
[OAK-10590] - Indexing job downloads and creates FFS with full node 
store if includedPaths is specified as a string instead of array of strings
[OAK-10595] - Cached data before a collision rollback can be read 
as committed
[OAK-10611] - o.a.j.o.namepath.JcrPathParser does not handle 
invalid characters correctly
[OAK-10617] - oak-search-elastic: potential deadlock with 
includePathRestrictions=false and multiple filtered results
[OAK-10636] - Tar recovery unsuccessful in oak-segment-tar during 
initialisation of FileStore

[OAK-10638] - Build fails on Java 17 due to JAR size limit
[OAK-10650] - MongoDocumentStore.findDocuments can fail with BSON 
exception
[OAK-10652] - Repository writes in SegmentStoreMigrator blocked 
when migrating to Azure segment store
[OAK-10653] - BasicDocumentStoreTest: handle DocumentStoreException 
on ds.create

[OAK-10717] - oak-pojosr should be updated to o.a.felix.connect-0.2.0
[OAK-10735] - Binary data in logs related to the haystack property

Story

[OAK-10573] - Make distinction for azure timeout settings between 
write and read operations

[OAK-10604] - Azure Service Principal Support in oak-segment-azure
[OAK-10615] - Azure Service Principal Support in oak-run 
segment-copy, compact, console


Improvement

[OAK-10424] - Allow Fast Query Size and Insecure Facets to be 
selectively enabled with query options for permitted principals

[OAK-10438] - Remove MULTTHREADED_TRAVERSE_WITH_SORT download strategy
[OAK-10571] - Names of metrics exported by indexing logic are 
inconsistent

[OAK-10577] - Advanced repository statistics
[OAK-10580] - Indexing job: improve regex path filtering, support 
multiple includedPaths
[OAK-10589] - Improve regex path filtering to also handle cases 
where excludedPaths are defined
[OAK-10592] - [Indexing job] Add a regex filter to exclude matching 
entries from being downloaded from Mongo

[OAK-10607] - Rename Maven property "java.version"
[OAK-10608] - [Indexing job] Improve regex expression used to 
download from Mongo to make better used of Mongo indexes

[OAK-10620] - Print summary at the end of the indexing job
[OAK-10635] - BundledTypeRegistry's use of shaded Guava problematic 
when used outside Oak
[OAK-10637] - Indexing job/regex path filtering - when / is the 
only included path, do not add an explicit filter

[OAK-10640] - docs: fix external link on lucene multi words synonyms
[OAK-10643] - MongoDocumentStore: improve diagnostics for too large 
docs

[OAK-10649] - MemoryDS: add toggle to limit document size
[OAK-10655] - Improve warning emitted for Unexpected changes 
performed on a non-default mount
[OAK-10656] - MongoDocumentStore: keep metrics about document size 
related exceptions
[OAK-10660] - DocumentNodeStore: avoid repeated commits of 
:childOrder in branch commits
[OAK-10661] - oak-search-elastic: remove workaround for 
elastic/elasticsearch-java/issues/404

[OAK-10670] - Azure service principal support in oak-upgrade
[OAK-10671] - [Indexing job] - Improve Mongo regex 

[RESULT] [VOTE] Release Apache Jackrabbit Oak 1.62.0

[Julian Reschke]

On 03.04.2024 22:57, Julian Reschke wrote:

...


Hi there,

The vote passes as follows:

+1 Angela Schreiber 
+1 Julian Reschke 
+1 Manfred Baedke 
+1 Woonsan Ko 

Thanks for voting. I'll push the release out.

Best regards, Julian

Re: [VOTE] Release Apache Jackrabbit Oak 1.62.0

[Julian Reschke]

On 05.04.2024 01:59, Woonsan Ko wrote:

The build is failing on my machine due to a unit test failure:

---
Test set: org.apache.jackrabbit.oak.segment.ReadOnlyStoreBlobReferencesTest
---
Tests run: 2, Failures: 1, Errors: 0, Skipped: 0, Time elapsed: 0.686
s <<< FAILURE! - in
org.apache.jackrabbit.oak.segment.ReadOnlyStoreBlobReferencesTest
collectReferencesAfterGC(org.apache.jackrabbit.oak.segment.ReadOnlyStoreBlobReferencesTest)
  Time elapsed: 0.504 s  <<< FAILURE!
java.lang.AssertionError: Read only store visible references different
expected:<0> but was:<1>
 at org.junit.Assert.fail(Assert.java:89)
 at org.junit.Assert.failNotEquals(Assert.java:835)
 at org.junit.Assert.assertEquals(Assert.java:647)
 at 
org.apache.jackrabbit.oak.segment.ReadOnlyStoreBlobReferencesTest.assertReferences(ReadOnlyStoreBlobReferencesTest.java:140)
 at 
org.apache.jackrabbit.oak.segment.ReadOnlyStoreBlobReferencesTest.collectReferencesAfterGC(ReadOnlyStoreBlobReferencesTest.java:98)
...

My env:
$ mvn -v
Apache Maven 3.9.6 (bc0240f3c744dd6b6ec2920b3cd08dcc295161ae)
Maven home: C:\Users\woonsan\apache-maven-3.9.6
Java version: 11.0.2, vendor: Oracle Corporation, runtime: C:\Java\jdk-11.0.2
Default locale: ko_KR, platform encoding: MS949
OS name: "windows 10", version: "10.0", arch: "amd64", family: "windows"

This might be an environment-specific issue. Any hint?

Thanks in advance,

Woonsan


Yep,

we've seen that before:

https://issues.apache.org/jira/browse/OAK-10422

Best regards, Julian

Re: [VOTE] Release Apache Jackrabbit Oak 1.62.0

[Julian Reschke]

On 03.04.2024 22:57, Julian Reschke wrote:

...


[X] +1 Release this package as Apache Jackrabbit Oak 1.62.0

...where...


[INFO] Apache Maven 3.6.3 (cecedd343002696d0abb50b32b541b8a6ba2883f)
[INFO] OS name: "windows 10", version: "10.0", arch: "amd64", family: "windows"
[INFO] Java version: 11.0.20, vendor: Oracle Corporation, runtime: 
C:\usr\local\jdk-11.0.20
[INFO] MAVEN_OPTS: -Xmx2g


Best regards, Julian

[VOTE] Release Apache Jackrabbit Oak 1.62.0

[Julian Reschke]

A candidate for the Jackrabbit Oak 1.62.0 release is available at:

https://dist.apache.org/repos/dist/dev/jackrabbit/oak/1.62.0/

The release candidate is a zip archive of the sources in:

 https://github.com/apache/jackrabbit-oak/tree/jackrabbit-oak-1.62.0/

The SHA1 checksum of the archive is
3238901fc55a55103ae487601e5cb81463d7c2c1.

A staged Maven repository is available for review at:

https://repository.apache.org/

The command for running automated checks against this release candidate is:

# run in SVN checkout of
https://dist.apache.org/repos/dist/dev/jackrabbit
$ sh check-release.sh oak 1.62.0
3238901fc55a55103ae487601e5cb81463d7c2c1

Please vote on releasing this package as Apache Jackrabbit Oak 1.62.0.
The vote is open for the next 72 hours and passes if a majority of at
least three +1 Jackrabbit PMC votes are cast.

[ ] +1 Release this package as Apache Jackrabbit Oak 1.62.0
[ ] -1 Do not release this package because...

Best regards, Julian

Jackrabbit Oak 1.62.0 Release Plan

[Julian Reschke]

Hi,

I'm planning to cut Jackrabbit Oak 1.62.0 tomorrow.

The list of open issues scheduled for 1.62.0 is empty:

https://issues.apache.org/jira/issues/?jql=fixVersion%20%3D%201.62.0%20AND%20project%20%3D%20OAK%20AND%20resolution%20%3D%20Unresolved%20ORDER%20BY%20priority%20DESC

The CI tests are (mostly) passing:

https://ci-builds.apache.org/job/Jackrabbit/job/jackrabbit-oak-trunk/

(some of the time - we absolutely need to work on unreliable and
long-running tests)

The candidate release notes are here:

https://github.com/apache/jackrabbit-oak/blob/trunk/RELEASE-NOTES.txt

If there are any objections please let me know.

Best regards, Julian

[ANNOUNCE] Apache Jackrabbit 2.21.26-beta released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit 2.21.26-beta. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit -- Version 2.21.26

Introduction


This is Apache Jackrabbit(TM) 2.21.26, a fully compliant implementation 
of the

Content Repository for Java(TM) Technology API, version 2.0 (JCR 2.0) as
specified in the Java Specification Request 283 (JSR 283).

Apache Jackrabbit 2.21.26 is an unstable release cut directly from
Jackrabbit trunk, with a focus on new features and other
improvements. For production use we recommend the latest stable 2.20.x
release.

Changes in Jackrabbit 2.21.26
-

Bug

[JCR-5041] - Javadoc build is broken due to JCR 2.0 API docs being 
unavailable


Task

[JCR-4902] - Update mockito dependency to 5.11.0
[JCR-4977] - use 'beta' identifier for releases in unstable branch
[JCR-5026] - standalone: remove remote repository support (RMI and 
JNDI)

[JCR-5027] - jackrabbit-webapp: remove RMI support
[JCR-5032] - jackrabbit-jcr-servlet: deprecate RMI support
[JCR-5034] - set baseline comparisonVersion to latest stable (2.20.15)
[JCR-5035] - Update tomcat dependency to 9.0.86
[JCR-5037] - update aws java sdk version to 1.12.678
[JCR-5038] - Update spotbugs-maven-plugin to 4.8.3.1
[JCR-5039] - Update oak-jackrabbit-api.version.used in trunk and 
2.20 to Oak 1.22.19

[JCR-5040] - Update javacc-maven-plugin to version 3.1.0

For more detailed information about all the changes in this and other
Jackrabbit releases, please see the Jackrabbit issue tracker at

https://issues.apache.org/jira/browse/JCR

Release Contents


This release consists of a single source archive packaged as a zip file.
The archive can be unpacked with the jar tool from your JDK installation.
See the README.txt file for instructions on how to build this release.

The source archive is accompanied by an SHA512 checksum and a
PGP signature that you can use to verify the authenticity of your
download. The public key used for the PGP signature can be found at
https://www.apache.org/dist/jackrabbit/KEYS.

About Apache Jackrabbit
---

Apache Jackrabbit is a fully conforming implementation of the Content
Repository for Java Technology API (JCR). A content repository is a
hierarchical content store with support for structured and unstructured
content, full text search, versioning, transactions, observation, and
more.

For more information, visit http://jackrabbit.apache.org/

About The Apache Software Foundation


Established in 1999, The Apache Software Foundation provides organizational,
legal, and financial support for more than 140 freely-available,
collaboratively-developed Open Source projects. The pragmatic Apache License
enables individual and commercial users to easily deploy Apache software;
the Foundation's intellectual property framework limits the legal exposure
of its 3,800+ contributors.

For more information, visit http://www.apache.org/

Trademarks
--

Apache Jackrabbit, Jackrabbit, Apache, the Apache feather logo, and the 
Apache

Jackrabbit project logo are trademarks of The Apache Software Foundation.

[ANNOUNCE] Apache Jackrabbit Oak 1.22.19 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit Oak 1.22.19. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit Oak -- Version 1.22.19

Introduction


Jackrabbit Oak is a scalable, high-performance hierarchical content
repository designed for use as the foundation of modern world-class
web sites and other demanding content applications.

Jackrabbit Oak 1.22.19 is a patch release that contains fixes and
improvements over Oak 1.22. Jackrabbit Oak 1.22.x releases are
considered stable and targeted for production use.

The Oak effort is a part of the Apache Jackrabbit project.
Apache Jackrabbit is a project of the Apache Software Foundation.


Changes in Oak 1.22.19
--

Technical task

[OAK-10524] - SameNameSiblingTest: add (failing) test for getName() 
semantics


Bug

[OAK-9459] - ConstraintViolationException in 
VersionManagerImplRestore when target node has a property definition 
unknown by the frozen node
[OAK-10462] - o.a.j.o.plugins.version.VersionEditor#propertyAdded() 
may mistakenly assume an ongoing restore operation

[OAK-10680] - tests failures with com.arakelian/docker-junit-rule

Task

[OAK-10426] - oak-segment-azure: enable baseline check
[OAK-10439] - Update Oak trunk and Oak 1.22 to Jackrabbit 2.20.12
[OAK-10446] - Upgrade jackson-databind dependency to 2.15.2
[OAK-10537] - Update Oak trunk and Oak 1.22 to Jackrabbit 2.20.13
[OAK-10566] - Bump up minimal warning level for deprecated uses of 
java.security.Group to ERROR

[OAK-10591] - Bump netty dependency from 4.1.96.Final to 4.1.104.Final


In addition to the above-mentioned changes, this release contains
all changes included up to the previous Apache Jackrabbit Oak 1.22.x 
release.


For more detailed information about all the changes in this and other
Oak releases, please see the Oak issue tracker at

  https://issues.apache.org/jira/browse/OAK

Release Contents


This release consists of a single source archive packaged as a zip file.
The archive can be unpacked with the jar tool from your JDK installation.
See the README.md file for instructions on how to build this release.

The source archive is accompanied by a SHA512 checksums and a PGP
signature that you can use to verify the authenticity of your
download. The public key used for the PGP signature can be found at
https://www.apache.org/dist/jackrabbit/KEYS.

About Apache Jackrabbit Oak
---

Jackrabbit Oak is a scalable, high-performance hierarchical content
repository designed for use as the foundation of modern world-class
web sites and other demanding content applications.

The Oak effort is a part of the Apache Jackrabbit project.
Apache Jackrabbit is a project of the Apache Software Foundation.

For more information, visit http://jackrabbit.apache.org/oak

About The Apache Software Foundation


Established in 1999, The Apache Software Foundation provides organizational,
legal, and financial support for more than 140 freely-available,
collaboratively-developed Open Source projects. The pragmatic Apache License
enables individual and commercial users to easily deploy Apache software;
the Foundation's intellectual property framework limits the legal exposure
of its 3,800+ contributors.

For more information, visit http://www.apache.org/

[RESULT] [VOTE] Release Apache Jackrabbit Oak 1.22.19

[Julian Reschke]

On 08.03.2024 19:44, Julian Reschke wrote:

...


Hi there,

The vote passes as follows:

+1 Jörg Hoh 
+1 Julian Reschke 
+1 Manfred Baedke 
+1 Nitin Gupta 
+1 Woonsan Ko 

Thanks for voting. I'll push the release out.

Best regards, Julian

Re: [VOTE] Release Apache Jackrabbit Oak 1.22.19

[Julian Reschke]

On 08.03.2024 19:44, Julian Reschke wrote:

...


[X] +1 Release this package as Apache Jackrabbit Oak 1.22.19

...where...


[INFO] Apache Maven 3.6.3 (cecedd343002696d0abb50b32b541b8a6ba2883f)
[INFO] OS name: "windows 10", version: "10.0", arch: "amd64", family: "windows"
[INFO] Java version: 11.0.20, vendor: Oracle Corporation, runtime: 
C:\usr\local\jdk-11.0.20
[INFO] MAVEN_OPTS: -Xmx2g


Best regards, Julian

[VOTE] Release Apache Jackrabbit Oak 1.22.19

[Julian Reschke]

A candidate for the Jackrabbit Oak 1.22.19 release is available at:

https://dist.apache.org/repos/dist/dev/jackrabbit/oak/1.22.19/

The release candidate is a zip archive of the sources in:

 https://github.com/apache/jackrabbit-oak/tree/jackrabbit-oak-1.22.19/

The SHA1 checksum of the archive is 
53ef6669cc0f96eef68a51258663b8a55bd7f8d4.


A staged Maven repository is available for review at:

https://repository.apache.org/

The command for running automated checks against this release candidate is:

# run in SVN checkout of 
https://dist.apache.org/repos/dist/dev/jackrabbit
$ sh check-release.sh oak 1.22.19 
53ef6669cc0f96eef68a51258663b8a55bd7f8d4


Please vote on releasing this package as Apache Jackrabbit Oak 1.22.19.
The vote is open for the next 72 hours and passes if a majority of at
least three +1 Jackrabbit PMC votes are cast.

[ ] +1 Release this package as Apache Jackrabbit Oak 1.22.19
[ ] -1 Do not release this package because...

Re: ANNOUNCE] Apache Jackrabbit 2.21.25 released

[Julian Reschke]

On 07.03.2024 09:43, Julian Reschke wrote:

...


Please ignore: this was a copy of an old release announcement.

Sorry for the noise.

Best regards, Julian

ANNOUNCE] Apache Jackrabbit 2.21.25 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit 2.21.25. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit -- Version 2.21.25

Introduction


This is Apache Jackrabbit(TM) 2.21.25, a fully compliant implementation 
of the

Content Repository for Java(TM) Technology API, version 2.0 (JCR 2.0) as
specified in the Java Specification Request 283 (JSR 283).

Apache Jackrabbit 2.21.25 is an unstable release cut directly from
Jackrabbit trunk, with a focus on new features and other
improvements. For production use we recommend the latest stable 2.20.x
release.

Changes in Jackrabbit 2.21.25
-

Bug

[JCR-5024] - webapp: un-deprecate BootstrapConfig.getJndiConfig and 
RepositoryAccessServlet.getRepositoryByJNDI


Task

[JCR-5025] - standalone: deprecate remote repository support (RMI 
and JNDI)

[JCR-5029] - update aws java sdk version to 1.12.659


For more detailed information about all the changes in this and other
Jackrabbit releases, please see the Jackrabbit issue tracker at

https://issues.apache.org/jira/browse/JCR

Release Contents


This release consists of a single source archive packaged as a zip file.
The archive can be unpacked with the jar tool from your JDK installation.
See the README.txt file for instructions on how to build this release.

The source archive is accompanied by an SHA512 checksum and a
PGP signature that you can use to verify the authenticity of your
download. The public key used for the PGP signature can be found at
https://www.apache.org/dist/jackrabbit/KEYS.

About Apache Jackrabbit
---

Apache Jackrabbit is a fully conforming implementation of the Content
Repository for Java Technology API (JCR). A content repository is a
hierarchical content store with support for structured and unstructured
content, full text search, versioning, transactions, observation, and
more.

For more information, visit http://jackrabbit.apache.org/

About The Apache Software Foundation


Established in 1999, The Apache Software Foundation provides organizational,
legal, and financial support for more than 140 freely-available,
collaboratively-developed Open Source projects. The pragmatic Apache License
enables individual and commercial users to easily deploy Apache software;
the Foundation's intellectual property framework limits the legal exposure
of its 3,800+ contributors.

For more information, visit http://www.apache.org/

Trademarks
--

Apache Jackrabbit, Jackrabbit, Apache, the Apache feather logo, and the 
Apache

Jackrabbit project logo are trademarks of The Apache Software Foundation.

Jackrabbit Oak 1.22.19 Release Plan

[Julian Reschke]

Hi,

I'm planning to cut Jackrabbit Oak 1.22.19 on Monday.

The list of open issues scheduled for 1.22.19 is empty:

https://issues.apache.org/jira/issues/?jql=fixVersion%20%3D%201.22.19%20AND%20project%20%3D%20OAK%20AND%20resolution%20%3D%20Unresolved%20ORDER%20BY%20priority%20DESC

The CI tests are passing:

https://ci-builds.apache.org/job/Jackrabbit/job/jackrabbit-oak-1.22/

(most of the time; will need to investigate CI flakiness...)

The candidate release notes are here:

https://github.com/apache/jackrabbit-oak/blob/1.22/RELEASE-NOTES.txt

If there are any objections please let me know.

Best regards, Julian

[ANNOUNCE] Apache Jackrabbit 2.21.25 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit 2.21.25. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit -- Version 2.21.25

Introduction


This is Apache Jackrabbit(TM) 2.21.25, a fully compliant implementation 
of the

Content Repository for Java(TM) Technology API, version 2.0 (JCR 2.0) as
specified in the Java Specification Request 283 (JSR 283).

Apache Jackrabbit 2.21.25 is an unstable release cut directly from
Jackrabbit trunk, with a focus on new features and other
improvements. For production use we recommend the latest stable 2.20.x
release.

Changes in Jackrabbit 2.21.25
-

Bug

[JCR-5024] - webapp: un-deprecate BootstrapConfig.getJndiConfig and 
RepositoryAccessServlet.getRepositoryByJNDI


Task

[JCR-5025] - standalone: deprecate remote repository support (RMI 
and JNDI)

[JCR-5029] - update aws java sdk version to 1.12.659


For more detailed information about all the changes in this and other
Jackrabbit releases, please see the Jackrabbit issue tracker at

https://issues.apache.org/jira/browse/JCR

Release Contents


This release consists of a single source archive packaged as a zip file.
The archive can be unpacked with the jar tool from your JDK installation.
See the README.txt file for instructions on how to build this release.

The source archive is accompanied by an SHA512 checksum and a
PGP signature that you can use to verify the authenticity of your
download. The public key used for the PGP signature can be found at
https://www.apache.org/dist/jackrabbit/KEYS.

About Apache Jackrabbit
---

Apache Jackrabbit is a fully conforming implementation of the Content
Repository for Java Technology API (JCR). A content repository is a
hierarchical content store with support for structured and unstructured
content, full text search, versioning, transactions, observation, and
more.

For more information, visit http://jackrabbit.apache.org/

About The Apache Software Foundation


Established in 1999, The Apache Software Foundation provides organizational,
legal, and financial support for more than 140 freely-available,
collaboratively-developed Open Source projects. The pragmatic Apache License
enables individual and commercial users to easily deploy Apache software;
the Foundation's intellectual property framework limits the legal exposure
of its 3,800+ contributors.

For more information, visit http://www.apache.org/

Trademarks
--

Apache Jackrabbit, Jackrabbit, Apache, the Apache feather logo, and the 
Apache

Jackrabbit project logo are trademarks of The Apache Software Foundation.

[ANNOUNCE] Apache Jackrabbit 2.21.23 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit 2.21.23. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit -- Version 2.21.23

Introduction


This is Apache Jackrabbit(TM) 2.21.23, a fully compliant implementation 
of the

Content Repository for Java(TM) Technology API, version 2.0 (JCR 2.0) as
specified in the Java Specification Request 283 (JSR 283).

Apache Jackrabbit 2.21.23 is an unstable release cut directly from
Jackrabbit trunk, with a focus on new features and other
improvements. For production use we recommend the latest stable 2.20.x
release.

Changes in Jackrabbit 2.21.23
-

Improvement

[JCR-5011] - Restore SCM information in parent POM

Task

[JCR-4914] - Update oak-jackrabbit-api.version.implemented in trunk 
to Oak 1.60.0

[JCR-5012] - set baseline comparisonVersion to latest stable (2.20.14)
[JCR-5013] - Update commons-io dependency to 2.15.1
[JCR-5014] - Update tomcat dependency to 9.0.85
[JCR-5015] - update aws java sdk version to 1.12.635
[JCR-5016] - standalone-components: remove unused jcr-rmi dependency
[JCR-5017] - Update spotbugs-maven-plugin to 4.8.2.0
[JCR-5018] - Bump up minimal Java version to 11
[JCR-5019] - Update build-helper-maven-plugin to version 3.5.0
[JCR-5020] - jackrabbit-webapp: deprecate RMI support "for removal"
[JCR-5021] - jackrabbit-jcr-rmi: deprecate RMI support "for removal"
[JCR-5022] - Update derby dependency to 10.15.2.0


For more detailed information about all the changes in this and other
Jackrabbit releases, please see the Jackrabbit issue tracker at

https://issues.apache.org/jira/browse/JCR

Release Contents


This release consists of a single source archive packaged as a zip file.
The archive can be unpacked with the jar tool from your JDK installation.
See the README.txt file for instructions on how to build this release.

The source archive is accompanied by an SHA512 checksum and a
PGP signature that you can use to verify the authenticity of your
download. The public key used for the PGP signature can be found at
https://www.apache.org/dist/jackrabbit/KEYS.

About Apache Jackrabbit
---

Apache Jackrabbit is a fully conforming implementation of the Content
Repository for Java Technology API (JCR). A content repository is a
hierarchical content store with support for structured and unstructured
content, full text search, versioning, transactions, observation, and
more.

For more information, visit http://jackrabbit.apache.org/

About The Apache Software Foundation


Established in 1999, The Apache Software Foundation provides organizational,
legal, and financial support for more than 140 freely-available,
collaboratively-developed Open Source projects. The pragmatic Apache License
enables individual and commercial users to easily deploy Apache software;
the Foundation's intellectual property framework limits the legal exposure
of its 3,800+ contributors.

For more information, visit http://www.apache.org/

Trademarks
--

Apache Jackrabbit, Jackrabbit, Apache, the Apache feather logo, and the 
Apache

Jackrabbit project logo are trademarks of The Apache Software Foundation.

[ANNOUNCE] Apache Jackrabbit 2.20.14 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit 2.20.14. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit -- Version 2.20.14

Introduction


This is Apache Jackrabbit(TM) 2.20.14, a fully compliant implementation 
of the

Content Repository for Java(TM) Technology API, version 2.0 (JCR 2.0) as
specified in the Java Specification Request 283 (JSR 283).

Apache Jackrabbit 2.20.14 is an incremental feature release based on
and compatible with earlier stable Jackrabbit 2.x releases. Jackrabbit
2.20.x releases are considered stable and targeted for production use.

The minimum Java version for this release is Java 8. See

  http://jackrabbit.apache.org/jcr/downloads.html

for maintenance versions that support earlier Java versions.


Changes in Jackrabbit 2.20.14
-

Bug

[JCR-4570] - WebdavRequestImpl does not check ETags if there is no 
resource or no exclusive write lock
[JCR-4571] - WebdavRequestImpl stores If-Header values using either 
absolute URIs or absolute paths, but both may be used for lookup


Improvement

[JCR-4979] - Migrate from Subversion to Git
[JCR-4980] - make webapp build reproducible
[JCR-5011] - Restore SCM information in parent POM

Test

[JCR-4967] - test coverage for modification of non-versioned node 
with jcr:isCheckedOut==false property
[JCR-4990] - add test for observing effect of remapping a namespace 
prefix to a different namespace name


Task

[JCR-4956] - Replace deprecated Surefire fork options
[JCR-4959] - update Apache parent pom to version 30
[JCR-4981] - jackrabbit-webapp: deprecate RMI support
[JCR-4982] - jackrabbit-spi-commons: update Javadoc for 
IllegalNameException
[JCR-4983] - jackrabbit-spi-commons: improve diagnostics for 
invalid names

[JCR-4986] - update Jetty to 9.4.53.v20231009
[JCR-4987] - Update to jacoco version 0.8.11
[JCR-4992] - Update animal-sniffer plugin dependency to 1.23
[JCR-4993] - Update war-plugin dependency to 3.4.0
[JCR-4994] - Update build-helper-maven-plugin to version 3.4.0
[JCR-4995] - Update pmd-plugin dependency to 3.21.2
[JCR-4996] - update checkstyle-plugin dependency to 3.3.1
[JCR-4997] - Update spotbugs-maven-plugin to 4.8.1.0
[JCR-4998] - Update commons-io dependency to 2.15.0
[JCR-4999] - Update commons-cli dependency to 1.6.0
[JCR-5001] - Update tomcat dependency to 9.0.83
[JCR-5002] - update aws java sdk version to 1.12.591
[JCR-5003] - Update h2db dependency to 2.2.224
[JCR-5004] - jcr-commons: get rid of cglib test dependency 
(unmaintained)
[JCR-5005] - Update oak-jackrabbit-api.version.used in trunk and 
2.20 to Oak 1.22.18



For more detailed information about all the changes in this and other
Jackrabbit releases, please see the Jackrabbit issue tracker at

https://issues.apache.org/jira/browse/JCR

Release Contents


This release consists of a single source archive packaged as a zip file.
The archive can be unpacked with the jar tool from your JDK installation.
See the README.txt file for instructions on how to build this release.

The source archive is accompanied by an SHA512 checksum and a
PGP signature that you can use to verify the authenticity of your
download. The public key used for the PGP signature can be found at
https://www.apache.org/dist/jackrabbit/KEYS.

About Apache Jackrabbit
---

Apache Jackrabbit is a fully conforming implementation of the Content
Repository for Java Technology API (JCR). A content repository is a
hierarchical content store with support for structured and unstructured
content, full text search, versioning, transactions, observation, and
more.

For more information, visit http://jackrabbit.apache.org/

About The Apache Software Foundation


Established in 1999, The Apache Software Foundation provides organizational,
legal, and financial support for more than 140 freely-available,
collaboratively-developed Open Source projects. The pragmatic Apache License
enables individual and commercial users to easily deploy Apache software;
the Foundation's intellectual property framework limits the legal exposure
of its 3,800+ contributors.

For more information, visit http://www.apache.org/

Trademarks
--

Apache Jackrabbit, Jackrabbit, Apache, the Apache feather logo, and the 
Apache

Jackrabbit project logo are trademarks of The Apache Software Foundation.

[ANNOUNCE] Apache Jackrabbit 2.21.22 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit 2.21.22. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit -- Version 2.21.22

Introduction


This is Apache Jackrabbit(TM) 2.21.22, a fully compliant implementation 
of the

Content Repository for Java(TM) Technology API, version 2.0 (JCR 2.0) as
specified in the Java Specification Request 283 (JSR 283).

Apache Jackrabbit 2.21.22 is an unstable release cut directly from
Jackrabbit trunk, with a focus on new features and other
improvements. For production use we recommend the latest stable 2.20.x
release.

Changes in Jackrabbit 2.21.22
-

Improvement

[JCR-4979] - Migrate from Subversion to Git

Test

[JCR-4967] - test coverage for modification of non-versioned node 
with jcr:isCheckedOut==false property


Task

[JCR-4987] - Update to jacoco version 0.8.11
[JCR-5004] - jcr-commons: get rid of cglib test dependency 
(unmaintained)



For more detailed information about all the changes in this and other
Jackrabbit releases, please see the Jackrabbit issue tracker at

https://issues.apache.org/jira/browse/JCR

Release Contents


This release consists of a single source archive packaged as a zip file.
The archive can be unpacked with the jar tool from your JDK installation.
See the README.txt file for instructions on how to build this release.

The source archive is accompanied by an SHA512 checksum and a
PGP signature that you can use to verify the authenticity of your
download. The public key used for the PGP signature can be found at
https://www.apache.org/dist/jackrabbit/KEYS.

About Apache Jackrabbit
---

Apache Jackrabbit is a fully conforming implementation of the Content
Repository for Java Technology API (JCR). A content repository is a
hierarchical content store with support for structured and unstructured
content, full text search, versioning, transactions, observation, and
more.

For more information, visit http://jackrabbit.apache.org/

About The Apache Software Foundation


Established in 1999, The Apache Software Foundation provides organizational,
legal, and financial support for more than 140 freely-available,
collaboratively-developed Open Source projects. The pragmatic Apache License
enables individual and commercial users to easily deploy Apache software;
the Foundation's intellectual property framework limits the legal exposure
of its 3,800+ contributors.

For more information, visit http://www.apache.org/

Trademarks
--

Apache Jackrabbit, Jackrabbit, Apache, the Apache feather logo, and the 
Apache

Jackrabbit project logo are trademarks of The Apache Software Foundation.

[ANNOUNCE] Apache Jackrabbit 2.21.21 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit 2.21.21. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit -- Version 2.21.21

Introduction


This is Apache Jackrabbit(TM) 2.21.21, a fully compliant implementation 
of the

Content Repository for Java(TM) Technology API, version 2.0 (JCR 2.0) as
specified in the Java Specification Request 283 (JSR 283).

Apache Jackrabbit 2.21.21 is an unstable release cut directly from
Jackrabbit trunk, with a focus on new features and other
improvements. For production use we recommend the latest stable 2.20.x
release.

NOTE: this release disables RMI access in the standalone and webapp 
projects.

See https://issues.apache.org/jira/browse/JCR-4960 for more information.


Changes in Jackrabbit 2.21.21
-

Bug

[JCR-4570] - WebdavRequestImpl does not check ETags if there is no 
resource or no exclusive write lock
[JCR-4571] - WebdavRequestImpl stores If-Header values using either 
absolute URIs or absolute paths, but both may be used for lookup


Improvement

[JCR-4980] - make webapp build reproducible

Test

[JCR-4990] - add test for observing effect of remapping a namespace 
prefix to a different namespace name


Task

[JCR-4956] - Replace deprecated Surefire fork options
[JCR-4981] - jackrabbit-webapp: deprecate RMI support
[JCR-4982] - jackrabbit-spi-commons: update Javadoc for 
IllegalNameException
[JCR-4983] - jackrabbit-spi-commons: improve diagnostics for 
invalid names

[JCR-4986] - update Jetty to 9.4.53.v20231009
[JCR-4989] - set baseline comparisonVersion to latest stable (2.20.13)
[JCR-4991] - Update to maven bundle plugin to 5.1.9
[JCR-4992] - Update animal-sniffer plugin dependency to 1.23
[JCR-4993] - Update war-plugin dependency to 3.4.0
[JCR-4994] - Update build-helper-maven-plugin to version 3.4.0
[JCR-4995] - Update pmd-plugin dependency to 3.21.2
[JCR-4996] - update checkstyle-plugin dependency to 3.3.1
[JCR-4997] - Update spotbugs-maven-plugin to 4.8.1.0
[JCR-4998] - Update commons-io dependency to 2.15.0
[JCR-4999] - Update commons-cli dependency to 1.6.0
[JCR-5000] - update Apache parent pom to version 31
[JCR-5001] - Update tomcat dependency to 9.0.83
[JCR-5002] - update aws java sdk version to 1.12.591
[JCR-5003] - Update h2db dependency to 2.2.224
[JCR-5005] - Update oak-jackrabbit-api.version.used in trunk and 
2.20 to Oak 1.22.18



For more detailed information about all the changes in this and other
Jackrabbit releases, please see the Jackrabbit issue tracker at

https://issues.apache.org/jira/browse/JCR

Release Contents


This release consists of a single source archive packaged as a zip file.
The archive can be unpacked with the jar tool from your JDK installation.
See the README.txt file for instructions on how to build this release.

The source archive is accompanied by an SHA512 checksum and a
PGP signature that you can use to verify the authenticity of your
download. The public key used for the PGP signature can be found at
https://www.apache.org/dist/jackrabbit/KEYS.

About Apache Jackrabbit
---

Apache Jackrabbit is a fully conforming implementation of the Content
Repository for Java Technology API (JCR). A content repository is a
hierarchical content store with support for structured and unstructured
content, full text search, versioning, transactions, observation, and
more.

For more information, visit http://jackrabbit.apache.org/

About The Apache Software Foundation


Established in 1999, The Apache Software Foundation provides organizational,
legal, and financial support for more than 140 freely-available,
collaboratively-developed Open Source projects. The pragmatic Apache License
enables individual and commercial users to easily deploy Apache software;
the Foundation's intellectual property framework limits the legal exposure
of its 3,800+ contributors.

For more information, visit http://www.apache.org/

Trademarks
--

Apache Jackrabbit, Jackrabbit, Apache, the Apache feather logo, and the 
Apache

Jackrabbit project logo are trademarks of The Apache Software Foundation.

[ANNOUNCE] Apache Jackrabbit Oak 1.60.0 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit Oak 1.60.0. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit Oak -- Version 1.60.0

Introduction


Jackrabbit Oak is a scalable, high-performance hierarchical content
repository designed for use as the foundation of modern world-class
web sites and other demanding content applications.

Apache Jackrabbit Oak 1.60.0 is an incremental feature release based
on and compatible with earlier stable Jackrabbit Oak 1.x
releases. This release is considered stable and targeted for
production use.

While Oak 1.60.0 compiles and tests successfully on Java 17, Javadocs
generation fails on Java 17 (but works as expected on Java 11).

The Oak effort is a part of the Apache Jackrabbit project.
Apache Jackrabbit is a project of the Apache Software Foundation.

Changes in Oak 1.60.0
-

Sub-task

[OAK-10488] - Benchmark results
[OAK-10522] - 
o.a.j.o.index.ReindexIT#reindexIgnoreMissingTikaDepThrow() fails with 
Java 21


Technical task

[OAK-6757] - Convert oak-auth-ldap to OSGi R7 annotations
[OAK-6760] - Convert oak-blob-cloud to OSGi R7 annotations
[OAK-10478] - Update Mockito dependency to 5.x
[OAK-10502] - oak-segment-azure/oak-blob-cloud-azure: update 
embedded Guava to 31.0
[OAK-10507] - oak-segment-azure/oak-blob-cloud-azure: update 
embedded Guava to 31.1
[OAK-10508] - oak-segment-azure/oak-blob-cloud-azure: update 
embedded Guava to 32.0.0
[OAK-10510] - oak-segment-azure/oak-blob-cloud-azure: update 
embedded Guava to 32.0.1
[OAK-10512] - oak-segment-azure/oak-blob-cloud-azure: update 
embedded Guava to 32.1.0
[OAK-10513] - oak-segment-azure/oak-blob-cloud-azure: update 
embedded Guava to 32.1.1
[OAK-10515] - oak-segment-azure/oak-blob-cloud-azure: update 
embedded Guava to 32.1.2
[OAK-10516] - oak-segment-azure/oak-blob-cloud-azure: update 
embedded Guava to 32.1.3

[OAK-10521] - Update Easymock dependency to 5.2
[OAK-10524] - SameNameSiblingTest: add (failing) test for getName() 
semantics
[OAK-10545] - oak-jcr: add test for observing effect of remapping a 
namespace prefix to a different namespace name


Bug

[OAK-9459] - ConstraintViolationException in 
VersionManagerImplRestore when target node has a property definition 
unknown by the frozen node
[OAK-9705] - Explain Query tool doesn't show the correct ES query 
when suggest queries are made
[OAK-10006] - AzurePersistence can still write segments after 
having lost lease to another instance
[OAK-10460] - PIPELINED strategy fails with OOME during final merge 
phase for very large repositories
[OAK-10462] - o.a.j.o.plugins.version.VersionEditor#propertyAdded() 
may mistakenly assume an ongoing restore operation

[OAK-10471] - Implement ConflictHandler for UserPrincipalProvider Cache
[OAK-10486] - Resolution of inherited groups may terminate 
pre-maturely for external users

[OAK-10495] - Ignore DocumentStoreIndexerIT#parallelReindex* tests
[OAK-10517] - Consistently clean membership when switch between 
default and dynamic sync
[OAK-10525] - DefaultSyncContext.createValues : return value should 
be annotated with @NotNull
[OAK-10526] - split doc can contain still referenced revisions 
without _sdMaxRevTime indicating so
[OAK-10542] - resolution of _deleted value ignores split docs in 
certain cases
[OAK-10547] - Indexing job fails at the end of reindexing if it 
took more than 24h to run
[OAK-10565] - document-store: VersionGarbageCollectorIT does not 
stop background threads


Story

[OAK-10311] - Optimize SegmentBlob#equals for segment blobs that 
originate from the same blob store


Improvement

[OAK-9796] - oak-segment-remote and oak-segment-aws Redis tests 
fail with ARM processor (Apple M1)

[OAK-9949] - Enable offline tail compaction
[OAK-10420] - Tool to compare Lucene index content
[OAK-10437] - Deprecate all download strategies except PIPELINED
[OAK-10487] - oak-search-elastic should perform a count request for 
fastQuerySize
[OAK-10490] - Suggest queries return duplicate entries if prefetch 
is enabled
[OAK-10491] - Indexing: pass a MongoDatabase instance instead of 
MongoConnection to indexing logic

[OAK-10504] - Add indexing job total duration log message
[OAK-10505] - Make PIPELINED the default download strategy in the 
indexing job

[OAK-10511] - Get blobId without additional network roundtrip
[OAK-10518] - IndexInfo should have a isActive() method
[OAK-10519] - Export metrics from indexing job
[OAK-10527] - Improve readability of the explain query output
[OAK-10538] - Pipeline strategy: eliminate unnecessary intermediate 
copy of entries in transform stage
[OAK-10541] - Pipelined strategy: improve 

[RESULT] [VOTE] Release Apache Jackrabbit Oak 1.60.0

[Julian Reschke]

On 01.12.2023 19:34, Julian Reschke wrote:

...


Hi there,

The vote passes as follows:

+1 Julian Reschke 
+1 Manfred Baedke 
+1 Woonsan Ko 

Thanks for voting. I'll push the release out.

Best regards, Julian

Re: [VOTE] Release Apache Jackrabbit Oak 1.60.0

[Julian Reschke]

On 01.12.2023 19:34, Julian Reschke wrote:

...


[X] +1 Release this package as Apache Jackrabbit Oak 1.60.0

...where...


[INFO] Apache Maven 3.6.3 (cecedd343002696d0abb50b32b541b8a6ba2883f)
[INFO] OS name: "windows 11", version: "10.0", arch: "amd64", family: "windows"
[INFO] Java version: 11.0.20, vendor: Oracle Corporation, runtime: 
C:\usr\local\jdk-11.0.20


Best regards, Julian

[VOTE] Release Apache Jackrabbit Oak 1.60.0

[Julian Reschke]

A candidate for the Jackrabbit Oak 1.60.0 release is available at:

https://dist.apache.org/repos/dist/dev/jackrabbit/oak/1.60.0/

The release candidate is a zip archive of the sources in:

 https://github.com/apache/jackrabbit-oak/tree/jackrabbit-oak-1.60.0/

The SHA1 checksum of the archive is 
c7446fb0432490521bae957f031954d968c12440.


A staged Maven repository is available for review at:

https://repository.apache.org/

The command for running automated checks against this release candidate is:

# run in SVN checkout of 
https://dist.apache.org/repos/dist/dev/jackrabbit
$ sh check-release.sh oak 1.60.0 
c7446fb0432490521bae957f031954d968c12440


Please vote on releasing this package as Apache Jackrabbit Oak 1.60.0.
The vote is open for the next 72 hours and passes if a majority of at
least three +1 Jackrabbit PMC votes are cast.

[ ] +1 Release this package as Apache Jackrabbit Oak 1.60.0
[ ] -1 Do not release this package because...

Best regards, Julian

[ANNOUNCE] Apache Jackrabbit Oak 1.22.18 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit Oak 1.22.18. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit Oak -- Version 1.22.18

Introduction


Jackrabbit Oak is a scalable, high-performance hierarchical content
repository designed for use as the foundation of modern world-class
web sites and other demanding content applications.

Jackrabbit Oak 1.22.18 is a patch release that contains fixes and
improvements over Oak 1.22. Jackrabbit Oak 1.22.x releases are
considered stable and targeted for production use.

The Oak effort is a part of the Apache Jackrabbit project.
Apache Jackrabbit is a project of the Apache Software Foundation.


Changes in Oak 1.22.18
--

Bug

[OAK-8885] - Test failure: NPE in MongoFixture.createDocumentStore()
[OAK-8889] - NPE in the oak-run console az:*
[OAK-10465] - Embed netty-transport-native-unix-common dependency 
in oak-segment-tar


Improvement

[OAK-8901] - oak-run command checkpoints should support 
RDBDocumentStore


Task

[OAK-8892] - Add javadoc to package-info files
[OAK-10431] - Bump up minimal warning level for deprecated uses of 
java.security.Group to WARN



In addition to the above-mentioned changes, this release contains
all changes included up to the previous Apache Jackrabbit Oak 1.22.x 
release.


For more detailed information about all the changes in this and other
Oak releases, please see the Oak issue tracker at

  https://issues.apache.org/jira/browse/OAK

Release Contents


This release consists of a single source archive packaged as a zip file.
The archive can be unpacked with the jar tool from your JDK installation.
See the README.md file for instructions on how to build this release.

The source archive is accompanied by a SHA512 checksums and a PGP
signature that you can use to verify the authenticity of your
download. The public key used for the PGP signature can be found at
https://www.apache.org/dist/jackrabbit/KEYS.

About Apache Jackrabbit Oak
---

Jackrabbit Oak is a scalable, high-performance hierarchical content
repository designed for use as the foundation of modern world-class
web sites and other demanding content applications.

The Oak effort is a part of the Apache Jackrabbit project.
Apache Jackrabbit is a project of the Apache Software Foundation.

For more information, visit http://jackrabbit.apache.org/oak

About The Apache Software Foundation


Established in 1999, The Apache Software Foundation provides organizational,
legal, and financial support for more than 140 freely-available,
collaboratively-developed Open Source projects. The pragmatic Apache License
enables individual and commercial users to easily deploy Apache software;
the Foundation's intellectual property framework limits the legal exposure
of its 3,800+ contributors.

For more information, visit http://www.apache.org/

[RESULT] [VOTE] Release Apache Jackrabbit Oak 1.22.18

[Julian Reschke]

On 28.11.2023 14:19, Julian Reschke wrote:

...


Hi there,

The vote passes as follows:

+1 Jörg Hoh 
+1 Julian Reschke 
+1 Manfred Baedke 
+1 Woonsan Ko 

Thanks for voting. I'll push the release out.

Best regards, Julian

Jackrabbit Oak 1.60.0 Release Plan

[Julian Reschke]

Hi,

I'm planning to cut Jackrabbit Oak 1.60.0 tomorrow.

The list of open issues scheduled for 1.60.0 is empty:

https://issues.apache.org/jira/issues/?jql=fixVersion%20%3D%201.60.0%20AND%20project%20%3D%20OAK%20AND%20resolution%20%3D%20Unresolved%20ORDER%20BY%20priority%20DESC

The CI tests are (mostly) passing:

https://ci-builds.apache.org/job/Jackrabbit/job/jackrabbit-oak-trunk/

(some of the time - we absolutely need to work on unreliable and
long-running tests)

The candidate release notes are here:

https://github.com/apache/jackrabbit-oak/blob/OAK-10574/RELEASE-NOTES.txt

If there are any objections please let me know.

Best regards, Julian

Re: [VOTE] Release Apache Jackrabbit Oak 1.22.18

[Julian Reschke]

Am 28.11.2023 um 14:19 schrieb Julian Reschke:

...


[X] +1 Release this package as Apache Jackrabbit Oak 1.22.18

...where...


[INFO] Apache Maven 3.6.3 (cecedd343002696d0abb50b32b541b8a6ba2883f)
[INFO] OS name: "windows 11", version: "10.0", arch: "amd64", family: "windows"
[INFO] Java version: 1.8.0_341, vendor: Oracle Corporation, runtime: 
C:\usr\local\jdk18\jre
[INFO] MAVEN_OPTS: -Xmx2g


Best regards, Julian

[VOTE] Release Apache Jackrabbit Oak 1.22.18

[Julian Reschke]

A candidate for the Jackrabbit Oak 1.22.18 release is available at:

https://dist.apache.org/repos/dist/dev/jackrabbit/oak/1.22.18/

The release candidate is a zip archive of the sources in:

 https://github.com/apache/jackrabbit-oak/tree/jackrabbit-oak-1.22.18/

The SHA1 checksum of the archive is
f17dcf2fa7e24c77bfe9cae95ba4c710ce4763f6.

A staged Maven repository is available for review at:

https://repository.apache.org/

The command for running automated checks against this release candidate is:

# run in SVN checkout of
https://dist.apache.org/repos/dist/dev/jackrabbit
$ sh check-release.sh oak 1.22.18
f17dcf2fa7e24c77bfe9cae95ba4c710ce4763f6

Please vote on releasing this package as Apache Jackrabbit Oak 1.22.18.
The vote is open for the next 72 hours and passes if a majority of at
least three +1 Jackrabbit PMC votes are cast.

[ ] +1 Release this package as Apache Jackrabbit Oak 1.22.18
[ ] -1 Do not release this package because...

Best regards, Julian

Re: oak-segment-tar/pom.xml uses hard coded version oak-run:1.6.2

[Julian Reschke]

On 27.11.2023 17:37, michael.freri...@f-i.de.INVALID wrote:

Hi,

Hi,

1. When I try mvn clean install on trunk locally my sonatype IQ-Server prevents 
access to artifact

org.apache.jackrabbit:oak-run:1.6.2

referenced by
https://github.com/apache/jackrabbit-oak/blob/trunk/oak-segment-tar/pom.xml
...


As far as I understand, that is just a test dependency (for upgrade
integration tests). That said, I have no idea why it want's a version
that old.


3. Using oak-run:1.22.15 satisfies the sonatype IQ-Server
4. Is is necessary to use a hard coded version?
5. Should i create an jira issue?


Yes, please.

Best regards, Julian

Re: Jackrabbit Oak 1.22.18 Release Plan

[Julian Reschke]

On 27.11.2023 12:25, Julian Reschke wrote:

Hi,

I'm planning to cut Jackrabbit Oak 1.22.18 tomorrow.

The list of open issues scheduled for 1.22.19 is empty:
...


...1.22.18...

Sry, Julian

Jackrabbit Oak 1.22.18 Release Plan

[Julian Reschke]

Hi,

I'm planning to cut Jackrabbit Oak 1.22.18 tomorrow.

The list of open issues scheduled for 1.22.19 is empty:

https://issues.apache.org/jira/issues/?jql=fixVersion%20%3D%201.22.18%20AND%20project%20%3D%20OAK%20AND%20resolution%20%3D%20Unresolved%20ORDER%20BY%20priority%20DESC

The CI tests are passing:

https://ci-builds.apache.org/job/Jackrabbit/job/jackrabbit-oak-1.22/

(most of the time; will need to investigate CI flakiness...)

The candidate release notes are here:

https://github.com/apache/jackrabbit-oak/blob/1.22/RELEASE-NOTES.txt

If there are any objections please let me know.

Best regards, Julian

[ANNOUNCE] Apache Jackrabbit 2.20.13 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit 2.20.13. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit -- Version 2.20.13

Introduction


This is Apache Jackrabbit(TM) 2.20.13, a fully compliant implementation 
of the

Content Repository for Java(TM) Technology API, version 2.0 (JCR 2.0) as
specified in the Java Specification Request 283 (JSR 283).

Apache Jackrabbit 2.20.13 is an incremental feature release based on
and compatible with earlier stable Jackrabbit 2.x releases. Jackrabbit
2.20.x releases are considered stable and targeted for production use.

The minimum Java version for this release is Java 8. See

  http://jackrabbit.apache.org/jcr/downloads.html

for maintenance versions that support earlier Java versions.


Changes in Jackrabbit 2.20.13
-

Bug

[JCR-4940] - jackrabbit-jcr2spi is incompatible with Java 21

Task

[JCR-4951] - Update oak-jackrabbit-api.version.used in trunk and 
2.20 to Oak 1.22.16

[JCR-4970] - it-osgi: fix package name
[JCR-4971] - Update oak-jackrabbit-api.version.used in trunk and 
2.20 to Oak 1.22.17

[JCR-4973] - jackrabbit-jcr-rmi: deprecate RMI support
[JCR-4974] - Update easymock dependency to 5.2.0
[JCR-4975] - update aws java sdk version to 1.12.560
[JCR-4976] - Update tomcat dependency to 9.0.80


For more detailed information about all the changes in this and other
Jackrabbit releases, please see the Jackrabbit issue tracker at

https://issues.apache.org/jira/browse/JCR

Release Contents


This release consists of a single source archive packaged as a zip file.
The archive can be unpacked with the jar tool from your JDK installation.
See the README.txt file for instructions on how to build this release.

The source archive is accompanied by an SHA512 checksum and a
PGP signature that you can use to verify the authenticity of your
download. The public key used for the PGP signature can be found at
https://www.apache.org/dist/jackrabbit/KEYS.

About Apache Jackrabbit
---

Apache Jackrabbit is a fully conforming implementation of the Content
Repository for Java Technology API (JCR). A content repository is a
hierarchical content store with support for structured and unstructured
content, full text search, versioning, transactions, observation, and
more.

For more information, visit http://jackrabbit.apache.org/

About The Apache Software Foundation


Established in 1999, The Apache Software Foundation provides organizational,
legal, and financial support for more than 140 freely-available,
collaboratively-developed Open Source projects. The pragmatic Apache License
enables individual and commercial users to easily deploy Apache software;
the Foundation's intellectual property framework limits the legal exposure
of its 3,800+ contributors.

For more information, visit http://www.apache.org/

Trademarks
--

Apache Jackrabbit, Jackrabbit, Apache, the Apache feather logo, and the 
Apache

Jackrabbit project logo are trademarks of The Apache Software Foundation.

Re: Slow startup of Jackrabbit OAK

[Julian Reschke]

On 07.11.2023 11:57, Lasse Lindqvist wrote:

*documentNodeStore.dispose() *
is clearly called and does not throw any errors.
By the way, what is the purpose of JackrabbitRepository.shutdown, if the
dispose is needed in normal shutdown? Our code actually calls both, so
could the other one be causing problems?
...


Once again; check the system logs during startup. That should tell you
what's going on.

Best regards, Julian

Re: Slow startup of Jackrabbit OAK

[Julian Reschke]

On 07.11.2023 08:45, Lasse Lindqvist wrote:

Hi. I am experiencing slow startups of Jackrabbit OAK. It seems to scale
linearly with the amount of documents being stored and seems to "scan" all
of them when being started.

When the application starts, it calls


*RDBOptions options = new
RDBOptions().tablePrefix("somePrefix").dropTablesOnClose(false);
DocumentNodeStore ns = new RDBDocumentNodeStoreBuilder().setBlobStore(new
FileBlobStore("somePath")) .setRDBConnection(dataSource(),
options).build();*

When the application closes, it basically just calls


*documentNodeStore.dispose();*
Is there something simple I am missing that would make it skip this
expensive startup operation? Creating the DocumentNodeStore object seems to
take a long time.


Did you check the system logs? A wild guess is that it's doing a
recovery operation because it may not have shutdown properly.

Best regards, Julian

[ANNOUNCE] Apache Jackrabbit FileVault 3.7.2 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit FileVault 3.7.2. The release is available for download at:

http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:

Release Notes - Jackrabbit FileVault - Version 3.7.2
This version requires Java 8
The OSGi bundles depend on Jackrabbit 2.20.8+ (JCR Commons, SPI, SPI 
Commons), Oak JR API 1.22.4+, Commons IO 2.7+, Commons Collections 4.1+ 
and SLF4J 1.7+


Bug

* [JCRVLT-718] - DocumentViewXmlValidator.validateEnd(...) called with 
wrong nodePath

* [JCRVLT-721] - Importing content packages with minimum permissions fails
* [JCRVLT-722] - SyncLog: 
java.time.temporal.UnsupportedTemporalTypeException: Unsupported field: 
DayOfMonth
* [JCRVLT-725] - Exporting twice via vlt leads to 
java.nio.file.FileAlreadyExistsException

* [JCRVLT-727] - vlt-sync: Prune unused synced directories

Improvement

* [JCRVLT-469] - Validator for overlapping filter rules

Task

* [JCRVLT-724] - DocViewSaxFormatter: improve diagnostics when 
generating DocViewNode2 from JCR node



Release Contents


This release consists of a single source archive packaged as a zip file.
The archive can be unpacked with the jar tool from your JDK installation.
See the README.md file for instructions on how to build this release.

The source archive is accompanied by a SHA512 checksums and a PGP
signature that you can use to verify the authenticity of your
download. The public key used for the PGP signature can be found at
https://www.apache.org/dist/jackrabbit/KEYS.

About Apache Jackrabbit FileVault
---

The FileVault introduces a JCR repository to filesystem mapping. The mapping
is exposed by an API and used by the "FileVault Content Packages" which 
allow to

create portable packages of repository content.

The Vault Command Line Interface aka "vlt" provides a subversion like
utility to work and develop with repository content.

For more information, visit https://jackrabbit.apache.org/filevault

About The Apache Software Foundation


Established in 1999, The Apache Software Foundation provides organizational,
legal, and financial support for more than 140 freely-available,
collaboratively-developed Open Source projects. The pragmatic Apache License
enables individual and commercial users to easily deploy Apache software;
the Foundation's intellectual property framework limits the legal exposure
of its 3,800+ contributors.

For more information, visit http://www.apache.org/

Re: Javadoc API outdated again

[Julian Reschke]

On 15.10.2023 15:33, Julian Reschke wrote:

On 13.10.2023 11:33, Julian Reschke wrote:

...
I did some checks yesterday, and we have multiple problems here (I'll
try to summarize in a ticket).

On top of the shaded Guava issue (which we may be able to fix by
separating it from the main project), there are also issues caused by
the fact that we're trying to create aggregate docs for a large set of
projects which not always use the same version of dependencies (think
embedding Lucene), and there's no simple fix for that.
...


In the meantime, I managed to run the javadoc production for 1.46.0 and
1.48.0, so we are now two versions further.

1.50.0 fails for me; this is likely because it's on Java 11, whereas
1.48.0 was still Java 8. Creating the Javadocs for 1.48.0 with Java 11
fails as well.

Best regards, Julian


OK, I've been able to (mostly) update the docs to 1.58.0. The process
requires manual intervention and skips a few projects that pull in
incompatible versions of Lucene.

See https://issues.apache.org/jira/browse/OAK-10500 for details.

Best regards, Julian

[ANNOUNCE] Apache Jackrabbit Oak 1.58.0 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit Oak 1.58.0. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit Oak -- Version 1.58.0

Introduction


Jackrabbit Oak is a scalable, high-performance hierarchical content
repository designed for use as the foundation of modern world-class
web sites and other demanding content applications.

Apache Jackrabbit Oak 1.58.0 is an incremental feature release based
on and compatible with earlier stable Jackrabbit Oak 1.x
releases. This release is considered stable and targeted for
production use.

While Oak 1.58.0 compiles and tests successfully on Java 17, Javadocs
generation fails on Java 17 (but works as expected on Java 11).

The Oak effort is a part of the Apache Jackrabbit project.
Apache Jackrabbit is a project of the Apache Software Foundation.

Changes in Oak 1.58.0
-

Technical task

[OAK-6759] - Convert oak-blob-cloud-azure to OSGi R6 annotations

Bug

[OAK-10293] - AzureTarRevisionsTest fails occasionally
[OAK-10334] - Node.addMixin() may overwrite existing mixins
[OAK-10343] - 
AzureTarFilesTest.testCollectBlobReferencesWithGenerationFilter unreliable
[OAK-10359] - Unreliable test: 
TarFileTest.binaryReferencesIndexShouldBeTrimmedDownOnSweep
[OAK-10360] - unreliable test 
AzureTarFileTest.testWriteAndReadBinaryReferences
[OAK-10377] - Checked-out state of non-versionable nodes is not 
handled correctly

[OAK-10384] - Fix stripping of large indexed ordered properties
[OAK-10413] - DocumentStoreIndexerIT hanging
[OAK-10448] - org.apache.jackrabbit.api.security.user.Query must be 
a Consumer type
[OAK-10453] - Pipelined strategy: enforce size limit on memory 
taken by objects in the queue between download and transform thread
[OAK-10465] - Embed netty-transport-native-unix-common dependency 
in oak-segment-tar


Improvement

[OAK-9922] - segment-tar: parallel compaction
[OAK-10358] - Indexing job: push filtering of paths to MongoDB
[OAK-10399] - Automatically pick a merged index over multiple levels
[OAK-10423] - Improve logging of metrics in indexing job
[OAK-10427] - Clear cache on NodeDocumentCache close
[OAK-10429] - Implementation for IncrementalFFS
[OAK-10450] - Bump testcontainers dependency to v1.19.0
[OAK-10452] - Indexing job/regex filtering: getting ancestors nodes 
of filtered path incorrectly does a full col scan on Mongo

[OAK-10456] - oak-search-elastic: log index name when bulk update fails
[OAK-10458] - Indexing job: Make LZ4 the default compression 
algorithm in OAK
[OAK-10463] - Retrieve flatFileStore for indexing from 
baseFlatFileStore
[OAK-10475] - Expose the mongo connection in 
MongoDocumentNodeStoreBuilderBase


Task

[OAK-7182] - Make it possible to update Guava
[OAK-9491] - Address vulnerabilities found by dependency checker plugin
[OAK-10371] - oak-segment-azure/oak-blob-cloud-azure require 
provided Guava, embed it instead
[OAK-10374] - test coverage for modification of non-versioned node 
with jcr:isCheckedOut==false property

[OAK-10426] - oak-segment-azure: enable baseline check
[OAK-10430] - oak-*-azure: add to OSGi tests
[OAK-10433] - Throttle excessive warning log messages when 
reindexing environments with non-fatal issues in index definition
[OAK-10434] - oak-segment-azure/oak-blob-cloud-azure: update SDK 
dependencies

[OAK-10439] - Update Oak trunk and Oak 1.22 to Jackrabbit 2.20.12
[OAK-10441] - oak-search-elastic embeds vulnerable SnakeYAML
[OAK-10442] - Lucene Index - node type inheritance is not properly 
working for aggregation
[OAK-10443] - refactor AbstractDataStoreService so that it doesn't 
need the statisticsProvider OSGi reference

[OAK-10445] - Cleanup logging (AbstractSharedCachingDataStore)
[OAK-10446] - Upgrade jackson-databind dependency to 2.15.2
[OAK-10447] - update Tomcat JDBC dependency to 9.0.80
[OAK-10449] - oak-solr-osgi embeds vulnerable Zookeeper
[OAK-10461] - oak-search-elastic does not build under Java 17


In addition to the above-mentioned changes, this release contains all
changes up to the previous release.

For more detailed information about all the changes in this and other
Oak releases, please see the Oak issue tracker at

  https://issues.apache.org/jira/browse/OAK

Release Contents


This release consists of a single source archive packaged as a zip file.
The archive can be unpacked with the jar tool from your JDK installation.
See the README.md file for instructions on how to build this release.

The source archive is accompanied by SHA512 checksums and a
PGP signature that you can use to verify the authenticity of your
download. The public key used for the PGP signature can be found at

[RESULT] [VOTE] Release Apache Jackrabbit Oak 1.58.0

[Julian Reschke]

On 11.10.2023 06:01, Julian Reschke wrote:

...


Hi there,

The vote passes as follows:

+1 Angela Schreiber 
+1 Julian Reschke 
+1 Manfred Baedke 
+1 Woonsan Ko 

Thanks for voting. I'll push the release out.

Best regards, Julian

Re: Javadoc API outdated again

[Julian Reschke]

On 13.10.2023 11:33, Julian Reschke wrote:

...
I did some checks yesterday, and we have multiple problems here (I'll
try to summarize in a ticket).

On top of the shaded Guava issue (which we may be able to fix by
separating it from the main project), there are also issues caused by
the fact that we're trying to create aggregate docs for a large set of
projects which not always use the same version of dependencies (think
embedding Lucene), and there's no simple fix for that.
...


In the meantime, I managed to run the javadoc production for 1.46.0 and
1.48.0, so we are now two versions further.

1.50.0 fails for me; this is likely because it's on Java 11, whereas
1.48.0 was still Java 8. Creating the Javadocs for 1.48.0 with Java 11
fails as well.

Best regards, Julian

Re: Javadoc API outdated again

[Julian Reschke]

On 12.10.2023 11:46, Julian Reschke wrote:

On 12.10.2023 11:22, Julian Reschke wrote:

On 12.10.2023 09:59, Konrad Windszus wrote:

Hi,
The published javadoc at
https://jackrabbit.apache.org/oak/docs/apidocs/overview-summary.html
is again outdated. It is from Oak 1.44 while the latest release is
1.56.0.
Not sure if we need to rephrase point 9. from
https://jackrabbit.apache.org/jcr/creating-releases.html#part-ii-after-the-release-vote:

"consider updating the live site” feels too fuzzy. For me this is a
mandatory step for stable releases.
WDYT?
Konrad


Updating the site is not trivial as it requires a plugin that does not
exist for Windows...

Best regard, Julian


What's worse is that the introduction of shaded-guava seems to have
broken the project-wide Javadoc generation. Will need to investigate.

Best regards, Julian


I did some checks yesterday, and we have multiple problems here (I'll
try to summarize in a ticket).

On top of the shaded Guava issue (which we may be able to fix by
separating it from the main project), there are also issues caused by
the fact that we're trying to create aggregate docs for a large set of
projects which not always use the same version of dependencies (think
embedding Lucene), and there's no simple fix for that.

Best regards, Julian

Re: Javadoc API outdated again

[Julian Reschke]

Am 12.10.2023 um 13:01 schrieb Konrad Windszus:

Another option is to completely remove our hosted project-wide javadoc and just 
crosslink to an external service like 
https://javadoc.io/doc/org.apache.jackrabbit.


Yes.


But from my perspective we should strive for hosting the javadoc ourselves…


I agree, in particular as I don't want to break existing links.

Best regards, Julian

PS: currently checking what's broken; it probably has to do with the
fact that shaded-guava is part of the reactor but does not contain
actual source files; will have to investigate what the best fix for that is.

Re: Javadoc API outdated again

[Julian Reschke]

On 12.10.2023 11:22, Julian Reschke wrote:

On 12.10.2023 09:59, Konrad Windszus wrote:

Hi,
The published javadoc at
https://jackrabbit.apache.org/oak/docs/apidocs/overview-summary.html
is again outdated. It is from Oak 1.44 while the latest release is
1.56.0.
Not sure if we need to rephrase point 9. from
https://jackrabbit.apache.org/jcr/creating-releases.html#part-ii-after-the-release-vote:

"consider updating the live site” feels too fuzzy. For me this is a
mandatory step for stable releases.
WDYT?
Konrad


Updating the site is not trivial as it requires a plugin that does not
exist for Windows...

Best regard, Julian


What's worse is that the introduction of shaded-guava seems to have
broken the project-wide Javadoc generation. Will need to investigate.

Best regards, Julian

Re: Javadoc API outdated again

[Julian Reschke]

On 12.10.2023 09:59, Konrad Windszus wrote:

Hi,
The published javadoc at 
https://jackrabbit.apache.org/oak/docs/apidocs/overview-summary.html is again 
outdated. It is from Oak 1.44 while the latest release is 1.56.0.
Not sure if we need to rephrase point 9. from 
https://jackrabbit.apache.org/jcr/creating-releases.html#part-ii-after-the-release-vote:

"consider updating the live site” feels too fuzzy. For me this is a mandatory 
step for stable releases.
WDYT?
Konrad


Updating the site is not trivial as it requires a plugin that does not
exist for Windows...

Best regard, Julian

[ANNOUNCE] Apache Jackrabbit 2.21.20 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit 2.21.20. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit -- Version 2.21.20

Introduction


This is Apache Jackrabbit(TM) 2.21.20, a fully compliant implementation 
of the

Content Repository for Java(TM) Technology API, version 2.0 (JCR 2.0) as
specified in the Java Specification Request 283 (JSR 283).

Apache Jackrabbit 2.21.20 is an unstable release cut directly from
Jackrabbit trunk, with a focus on new features and other
improvements. For production use we recommend the latest stable 2.20.x
release.

NOTE: this release disables RMI access in the standalone and webapp 
projects.

See https://issues.apache.org/jira/browse/JCR-4960 for more information.


Changes in Jackrabbit 2.21.20
-

Bug

[JCR-4940] - jackrabbit-jcr2spi is incompatible with Java 21

Task

[JCR-4951] - Update oak-jackrabbit-api.version.used in trunk and 
2.20 to Oak 1.22.16

[JCR-4969] - set baseline comparisonVersion to latest stable (2.20.12)
[JCR-4970] - it-osgi: fix package name
[JCR-4971] - Update oak-jackrabbit-api.version.used in trunk and 
2.20 to Oak 1.22.17

[JCR-4973] - Deprecate RMI support
[JCR-4974] - Update easymock dependency to 5.2.0
[JCR-4975] - update aws java sdk version to 1.12.560
[JCR-4976] - Update tomcat dependency to 9.0.80


For more detailed information about all the changes in this and other
Jackrabbit releases, please see the Jackrabbit issue tracker at

https://issues.apache.org/jira/browse/JCR

Release Contents


This release consists of a single source archive packaged as a zip file.
The archive can be unpacked with the jar tool from your JDK installation.
See the README.txt file for instructions on how to build this release.

The source archive is accompanied by an SHA512 checksum and a
PGP signature that you can use to verify the authenticity of your
download. The public key used for the PGP signature can be found at
https://www.apache.org/dist/jackrabbit/KEYS.

About Apache Jackrabbit
---

Apache Jackrabbit is a fully conforming implementation of the Content
Repository for Java Technology API (JCR). A content repository is a
hierarchical content store with support for structured and unstructured
content, full text search, versioning, transactions, observation, and
more.

For more information, visit http://jackrabbit.apache.org/

About The Apache Software Foundation


Established in 1999, The Apache Software Foundation provides organizational,
legal, and financial support for more than 140 freely-available,
collaboratively-developed Open Source projects. The pragmatic Apache License
enables individual and commercial users to easily deploy Apache software;
the Foundation's intellectual property framework limits the legal exposure
of its 3,800+ contributors.

For more information, visit http://www.apache.org/

Trademarks
--

Apache Jackrabbit, Jackrabbit, Apache, the Apache feather logo, and the 
Apache

Jackrabbit project logo are trademarks of The Apache Software Foundation.

Re: [VOTE] Release Apache Jackrabbit Oak 1.58.0

[Julian Reschke]

On 11.10.2023 06:01, Julian Reschke wrote:

...


[X] +1 Release this package as Apache Jackrabbit Oak 1.58.0

...where...


[INFO] Apache Maven 3.6.3 (cecedd343002696d0abb50b32b541b8a6ba2883f)
[INFO] OS name: "windows 11", version: "10.0", arch: "amd64", family: "windows"
[INFO] Java version: 11.0.19, vendor: Oracle Corporation, runtime: 
C:\usr\local\jdk-11.0.19
[INFO] MAVEN_OPTS: -Xmx2g


Best regards, Julian

[VOTE] Release Apache Jackrabbit Oak 1.58.0

[Julian Reschke]

A candidate for the Jackrabbit Oak 1.58.0 release is available at:

https://dist.apache.org/repos/dist/dev/jackrabbit/oak/1.58.0/

The release candidate is a zip archive of the sources in:

 https://github.com/apache/jackrabbit-oak/tree/jackrabbit-oak-1.58.0/

The SHA1 checksum of the archive is 
da239d1b25ba60cb8d2d311c9bbb3ef86566a57e.


A staged Maven repository is available for review at:

https://repository.apache.org/

The command for running automated checks against this release candidate is:

# run in SVN checkout of 
https://dist.apache.org/repos/dist/dev/jackrabbit
$ sh check-release.sh oak 1.58.0 
da239d1b25ba60cb8d2d311c9bbb3ef86566a57e


Please vote on releasing this package as Apache Jackrabbit Oak 1.58.0.
The vote is open for the next 72 hours and passes if a majority of at
least three +1 Jackrabbit PMC votes are cast.

[ ] +1 Release this package as Apache Jackrabbit Oak 1.58.0
[ ] -1 Do not release this package because...

Best regards, Julian

Jackrabbit Oak 1.58.0 Release Plan

[Julian Reschke]

Hi,

I'm planning to cut Jackrabbit Oak 1.58.0 on Wednesday.

The list of open issues scheduled for 1.58.0 is empty:

https://issues.apache.org/jira/issues/?jql=fixVersion%20%3D%201.58.0%20AND%20project%20%3D%20OAK%20AND%20resolution%20%3D%20Unresolved%20ORDER%20BY%20priority%20DESC

(after re-scheduling or removing "fixVersion" for some unresolved issues)

The CI tests are (mostly) passing:

https://ci-builds.apache.org/job/Jackrabbit/job/jackrabbit-oak-trunk/

(some of the time - we absolutely need to work on unreliable and
long-running tests)

The candidate release notes are here:

https://github.com/apache/jackrabbit-oak/blob/OAK-10474/RELEASE-NOTES.txt

If there are any objections please let me know.

Best regards, Julian

[ANNOUNCE] Apache Jackrabbit Oak 1.22.17 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit Oak 1.22.17. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit Oak -- Version 1.22.17

Introduction


Jackrabbit Oak is a scalable, high-performance hierarchical content
repository designed for use as the foundation of modern world-class
web sites and other demanding content applications.

Jackrabbit Oak 1.22.17 is a patch release that contains fixes and
improvements over Oak 1.22. Jackrabbit Oak 1.22.x releases are
considered stable and targeted for production use.

The Oak effort is a part of the Apache Jackrabbit project.
Apache Jackrabbit is a project of the Apache Software Foundation.


Changes in Oak 1.22.17
--

Technical task

[OAK-10415] - AbstractTwoNodeTest: make teardown more robust
[OAK-10416] - AbstractTwoNodeTest: ensure RDB fixture uses empty DB

Bug

[OAK-8711] - Queries with facets should not use traversal
[OAK-8863] - Oak-doc should cover BinaryUploadOptions usage
[OAK-10405] - document-store: potential NPE in AbstractTwoNodeTest 
teardown


Improvement

[OAK-9567] - Avoid NullPointerException in 
ReadWriteVersionManager.removeVersion
[OAK-9966] - Internal code calls Node.isCheckedOut and 
VersionManager.isCheckedOut

[OAK-9970] - Internal code calls LockManager.isLocked(String)
[OAK-10003] - Upgrade tika to 1.28.5
[OAK-10225] - Utility to rate limit writes in case async indexing 
is delayed


Task

[OAK-8659] - Deprecate support for lucene custom scorer
[OAK-9669] - Update commons-io dependency to 2.11.0
[OAK-10154] - Guava deprecations: set minimal logging level to 'error'
[OAK-10201] - oak-blob-plugins: exported packages need to be marked 
@internal

[OAK-10304] - log registration of invalid namespace names
[OAK-10316] - Importer exception always should mention path
[OAK-10349] - Update Tomcat dependency to 9.0.78
[OAK-10366] - Update Oak trunk and Oak 1.22 to Jackrabbit 2.20.11
[OAK-10389] - remove commons-lang dependency
[OAK-10390] - Update commons-io dependency to 2.13.0
[OAK-10394] - Update commons-lang3 dependency to 3.13.0
[OAK-10395] - Update commons-codec dependency to 1.16.0
[OAK-10400] - auth-ldap/benchmarks: use default dependency for 
commons-lang3
[OAK-10401] - search-mt/solr-osgi: use default versions of 
commons-math3
[OAK-10402] - benchmarks: remove commons-math dependency (use math3 
instead)

[OAK-10403] - update Tomcat JDBC dependency to 8.5.92
[OAK-10404] - improve TarFilesTest.testCollectBlobReferences 
diagnostics

[OAK-10407] - run/lucene: update gson dependencies to 2.10.1
[OAK-10421] - Bump up minimal warning level for deprecated uses of 
java.security.Group to INFO



In addition to the above-mentioned changes, this release contains
all changes included up to the previous Apache Jackrabbit Oak 1.22.x 
release.


For more detailed information about all the changes in this and other
Oak releases, please see the Oak issue tracker at

  https://issues.apache.org/jira/browse/OAK

Release Contents


This release consists of a single source archive packaged as a zip file.
The archive can be unpacked with the jar tool from your JDK installation.
See the README.md file for instructions on how to build this release.

The source archive is accompanied by a SHA512 checksums and a PGP
signature that you can use to verify the authenticity of your
download. The public key used for the PGP signature can be found at
https://www.apache.org/dist/jackrabbit/KEYS.

About Apache Jackrabbit Oak
---

Jackrabbit Oak is a scalable, high-performance hierarchical content
repository designed for use as the foundation of modern world-class
web sites and other demanding content applications.

The Oak effort is a part of the Apache Jackrabbit project.
Apache Jackrabbit is a project of the Apache Software Foundation.

For more information, visit http://jackrabbit.apache.org/oak

About The Apache Software Foundation


Established in 1999, The Apache Software Foundation provides organizational,
legal, and financial support for more than 140 freely-available,
collaboratively-developed Open Source projects. The pragmatic Apache License
enables individual and commercial users to easily deploy Apache software;
the Foundation's intellectual property framework limits the legal exposure
of its 3,800+ contributors.

For more information, visit http://www.apache.org/

[RESULT] [VOTE] Release Apache Jackrabbit Oak 1.22.17

[Julian Reschke]

On 12.09.2023 08:37, Julian Reschke wrote:

...


Hi there,

The vote passes as follows:

+1 Julian Reschke 
+1 Manfred Baedke 
+1 Woonsan Ko 

Thanks for voting. I'll push the release out.

Best regards, Julian

Re: [VOTE] Release Apache Jackrabbit Oak 1.22.17

[Julian Reschke]

On 12.09.2023 08:37, Julian Reschke wrote:

...


[X] +1 Release this package as Apache Jackrabbit Oak 1.22.17

...where...


[INFO] Apache Maven 3.6.3 (cecedd343002696d0abb50b32b541b8a6ba2883f)
[INFO] OS name: "windows 11", version: "10.0", arch: "amd64", family: "windows"
[INFO] Java version: 1.8.0_341, vendor: Oracle Corporation, runtime: 
C:\usr\local\jdk18\jre
[INFO] MAVEN_OPTS: -Xmx2g


Best regards, Julian

[VOTE] Release Apache Jackrabbit Oak 1.22.17

[Julian Reschke]

A candidate for the Jackrabbit Oak 1.22.17 release is available at:

https://dist.apache.org/repos/dist/dev/jackrabbit/oak/1.22.17/

The release candidate is a zip archive of the sources in:

 https://github.com/apache/jackrabbit-oak/tree/jackrabbit-oak-1.22.17/

The SHA1 checksum of the archive is
e103d44a309e7352d97fe42bf4d6c353927f08b4.

A staged Maven repository is available for review at:

https://repository.apache.org/

The command for running automated checks against this release candidate is:

# run in SVN checkout of
https://dist.apache.org/repos/dist/dev/jackrabbit
$ sh check-release.sh oak 1.22.17
e103d44a309e7352d97fe42bf4d6c353927f08b4

Please vote on releasing this package as Apache Jackrabbit Oak 1.22.17.
The vote is open for the next 72 hours and passes if a majority of at
least three +1 Jackrabbit PMC votes are cast.

[ ] +1 Release this package as Apache Jackrabbit Oak 1.22.17
[ ] -1 Do not release this package because...

Best regards, Julian

[ANNOUNCE] Apache Jackrabbit 2.20.12 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit 2.20.12. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit -- Version 2.20.12

Introduction


This is Apache Jackrabbit(TM) 2.20.12, a fully compliant implementation 
of the

Content Repository for Java(TM) Technology API, version 2.0 (JCR 2.0) as
specified in the Java Specification Request 283 (JSR 283).

Apache Jackrabbit 2.20.12 is an incremental feature release based on
and compatible with earlier stable Jackrabbit 2.x releases. Jackrabbit
2.20.x releases are considered stable and targeted for production use.

The minimum Java version for this release is Java 8. See

  http://jackrabbit.apache.org/jcr/downloads.html

for maintenance versions that support earlier Java versions.


Changes in Jackrabbit 2.20.12
-

Bug

[JCR-4606] - standalone: logback log files created in wrong place
[JCR-4957] - jackrabbit-standalone: 2.21.18 breaks binary compatibility

Task

[JCR-4308] - update Jetty to 9.4.*
[JCR-4944] - upgrade to Tomcat 9.x
[JCR-4960] - Disable RMI by default
[JCR-4962] - Update h2db dependency to 2.2.220
[JCR-4963] - vfs-ext: update hadoop-hdfs-client dependency to 3.3.6
[JCR-4964] - update kotlin-stdlib dependency to 1.9.0
[JCR-4965] - webapp: remove Guava test dependency
[JCR-4966] - update aws java sdk version to 1.12.523


For more detailed information about all the changes in this and other
Jackrabbit releases, please see the Jackrabbit issue tracker at

https://issues.apache.org/jira/browse/JCR

Release Contents


This release consists of a single source archive packaged as a zip file.
The archive can be unpacked with the jar tool from your JDK installation.
See the README.txt file for instructions on how to build this release.

The source archive is accompanied by an SHA512 checksum and a
PGP signature that you can use to verify the authenticity of your
download. The public key used for the PGP signature can be found at
https://www.apache.org/dist/jackrabbit/KEYS.

About Apache Jackrabbit
---

Apache Jackrabbit is a fully conforming implementation of the Content
Repository for Java Technology API (JCR). A content repository is a
hierarchical content store with support for structured and unstructured
content, full text search, versioning, transactions, observation, and
more.

For more information, visit http://jackrabbit.apache.org/

About The Apache Software Foundation


Established in 1999, The Apache Software Foundation provides organizational,
legal, and financial support for more than 140 freely-available,
collaboratively-developed Open Source projects. The pragmatic Apache License
enables individual and commercial users to easily deploy Apache software;
the Foundation's intellectual property framework limits the legal exposure
of its 3,800+ contributors.

For more information, visit http://www.apache.org/

Trademarks
--

Apache Jackrabbit, Jackrabbit, Apache, the Apache feather logo, and the 
Apache

Jackrabbit project logo are trademarks of The Apache Software Foundation.

Jackrabbit Oak 1.22.17 Release Plan

[Julian Reschke]

Hi,

I'm planning to cut Jackrabbit Oak 1.22.17 next Tuesday.

The list of open issues scheduled for 1.22.17 is empty:

https://issues.apache.org/jira/issues/?jql=fixVersion%20%3D%201.22.17%20AND%20project%20%3D%20OAK%20AND%20resolution%20%3D%20Unresolved%20ORDER%20BY%20priority%20DESC

The CI tests are passing:

https://ci-builds.apache.org/job/Jackrabbit/job/jackrabbit-oak-1.22/

(most of the time; will need to investigate CI flakiness...)

The candidate release notes are here:

https://github.com/apache/jackrabbit-oak/blob/OAK-10440/RELEASE-NOTES.txt

If there are any objections please let me know.

Best regards, Julian

Re: Guava Migration (yes, a must read)

[Julian Reschke]

On 11.08.2023 11:39, Julian Reschke wrote:

...

Oak itself is now independent of native Guava, but we still use test
tooling that pulls it in (see OAK-10367). Depending on how we resolve
this, we could then remove the remains from config and POMs.


In the meantime, that was fixed by Manfred (thanks!).

However, we have an azure-sdk dependency that transitively pulls in
Guava (see https://issues.apache.org/jira/browse/OAK-10371).
Fortunately, there's a major update to the SDK which does not seem to
use Guava anymore.
...


So, with the release of 1.56.0 last week, this is the only remaining
issue that ties (parts of) Oak to Guava. I believe this should be fixed
in the next release (even if we take the simple way of just embedding it).

If have set the "fixVersion" for OAK-10371 to 1.58.0; can somebody from
the segment persistence experts please have a look ASAP?

Best regards, Julian

[ANNOUNCE] Apache Jackrabbit Oak 1.56.0 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit Oak 1.56.0. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit Oak -- Version 1.56.0

Introduction


Jackrabbit Oak is a scalable, high-performance hierarchical content
repository designed for use as the foundation of modern world-class
web sites and other demanding content applications.

Apache Jackrabbit Oak 1.56.0 is an incremental feature release based
on and compatible with earlier stable Jackrabbit Oak 1.x
releases. This release is considered stable and targeted for
production use.

While Oak 1.54.0 compiles and tests successfully on Java 17, Javadocs
generation fails on Java 17 (but works as expected on Java 11).

The Oak effort is a part of the Apache Jackrabbit project.
Apache Jackrabbit is a project of the Apache Software Foundation.

Changes in Oak 1.56.0
-

Sub-task

[OAK-10362] - Create benchmark test
[OAK-10363] - Benchmark results
[OAK-10364] - Consolidate inheritance related automembership tests

Technical task

[OAK-7542] - oak-blob-*'s use of Guava File.fileTreeTraverser
[OAK-7549] - commons: avoid use of Guava beta APIs in FileIOUtils
[OAK-8684] - oak-core-spi: remove uses of Guava from exported API
[OAK-8717] - Remove deprecated Guava-based APIs
[OAK-10274] - oak-core-spi: remove Guava from public API
[OAK-10322] - oak-core: remove Guava from public API
[OAK-10323] - remove all remaining references of native Guava
[OAK-10368] - convert groovy sources to shaded guava
[OAK-10412] - AbstractTwoNodeTest: check preconditions in setup
[OAK-10415] - AbstractTwoNodeTest: make teardown more robust
[OAK-10416] - AbstractTwoNodeTest: ensure RDB fixture uses empty DB

Bug

[OAK-10181] - Flaky test: DataStoreBlobStoreStatsTest
[OAK-10353] - Elastic custom analyzer should ignore unsupported 
properties (eg: hidden, arrays)
[OAK-10372] - oak-search-elastic: similarity queries produce no 
relevant results
[OAK-10379] - DynamicGroupsTest#testCrossIDPMembership() fails 
occasionally
[OAK-10405] - document-store: potential NPE in AbstractTwoNodeTest 
teardown


Improvement

[OAK-9837] - Reference individual OSGi dependencies in version 
shipped with R7

[OAK-10003] - Upgrade tika to 1.28.5
[OAK-10318] - Improve AutoMembershipPrincipals#isInheritedMember
[OAK-10333] - Improved logging for queries that that traverse more 
than 10'000 nodes

[OAK-10357] - Path option for documentstore-check
[OAK-10365] - introduce mapping version in oak-search-elastic
[OAK-10367] - update org.apache.sling.testing.osgi-mock dependency

Task

[OAK-10272] - Reverse #OAK-10022
[OAK-10347] - Small util class for exporting a tree as flat file
[OAK-10366] - Update Oak trunk and Oak 1.22 to Jackrabbit 2.20.11
[OAK-10369] - oak-segment-azure/oak-blob-cloud-azure leak Guava 
dependency

[OAK-10381] - DocumentStoreIndexerIT failures
[OAK-10385] - segment-azure: add javax.activation-api to test class 
path

[OAK-10386] - Bump netty dependency from 4.1.52.Final to 4.1.96.Final
[OAK-10389] - remove commons-lang dependency
[OAK-10390] - Update commons-io dependency to 2.13.0
[OAK-10391] - improve 
TarFilesTest.testCollectBlobReferencesWithGenerationFilter diagnostics

[OAK-10392] - Update (shaded) Guava to 32.1.2
[OAK-10394] - Update commons-lang3 dependency to 3.13.0
[OAK-10395] - Update commons-codec dependency to 1.16.0
[OAK-10396] - segment-aws: remove unused commons-lang3 dependency
[OAK-10397] - oak-benchmarks/oak-it-osgi: update commons-compress 
dependency to 1.23.0
[OAK-10400] - auth-ldap/benchmarks: use default dependency for 
commons-lang3
[OAK-10401] - search-mt/solr-osgi: use default versions of 
commons-math3
[OAK-10402] - benchmarks: remove commons-math dependency (use math3 
instead)

[OAK-10403] - update Tomcat JDBC dependency to 8.5.92
[OAK-10404] - improve TarFilesTest.testCollectBlobReferences 
diagnostics

[OAK-10407] - run/lucene: update gson dependencies to 2.10.1
[OAK-10414] - RDB*Store: update Derby dependency to 10.15.2.0


In addition to the above-mentioned changes, this release contains all
changes up to the previous release.

For more detailed information about all the changes in this and other
Oak releases, please see the Oak issue tracker at

  https://issues.apache.org/jira/browse/OAK

Release Contents


This release consists of a single source archive packaged as a zip file.
The archive can be unpacked with the jar tool from your JDK installation.
See the README.md file for instructions on how to build this release.

The source archive is accompanied by SHA512 checksums and a
PGP signature that you can use to verify the authenticity of your

[RESULT] [VOTE] Release Apache Jackrabbit Oak 1.56.0

[Julian Reschke]

On 29.08.2023 13:20, Julian Reschke wrote:

...


Hi there,

The vote passes as follows:

+1 Jörg Hoh 
+1 Julian Reschke 
+1 Manfred Baedke 
+1 Woonsan Ko 

Thanks for voting. I'll push the release out.

Best regards, Julian

Re: [VOTE] Release Apache Jackrabbit Oak 1.56.0

[Julian Reschke]

On 29.08.2023 13:20, Julian Reschke wrote:

...


[X] +1 Release this package as Apache Jackrabbit Oak 1.56.0

...where...


[INFO] Apache Maven 3.6.3 (cecedd343002696d0abb50b32b541b8a6ba2883f)
[INFO] OS name: "windows 11", version: "10.0", arch: "amd64", family: "windows"
[INFO] Java version: 11.0.19, vendor: Oracle Corporation, runtime: 
C:\usr\local\jdk-11.0.19
[INFO] MAVEN_OPTS: -Xmx2g


Best regards, Julian

[VOTE] Release Apache Jackrabbit Oak 1.56.0

[Julian Reschke]

A candidate for the Jackrabbit Oak 1.56.0 release is available at:

https://dist.apache.org/repos/dist/dev/jackrabbit/oak/1.56.0/

The release candidate is a zip archive of the sources in:

 https://github.com/apache/jackrabbit-oak/tree/jackrabbit-oak-1.56.0/

The SHA1 checksum of the archive is
ca6e15f54f946db689af700294e7e46c2bdf66b2.

A staged Maven repository is available for review at:

https://repository.apache.org/

The command for running automated checks against this release candidate is:

# run in SVN checkout of
https://dist.apache.org/repos/dist/dev/jackrabbit
$ sh check-release.sh oak 1.56.0
ca6e15f54f946db689af700294e7e46c2bdf66b2

Please vote on releasing this package as Apache Jackrabbit Oak 1.56.0.
The vote is open for the next 72 hours and passes if a majority of at
least three +1 Jackrabbit PMC votes are cast.

[ ] +1 Release this package as Apache Jackrabbit Oak 1.56.0
[ ] -1 Do not release this package because...

Best regards, Julian

Jackrabbit Oak 1.56.0 Release Plan

[Julian Reschke]

Hi,

I'm planning to cut Jackrabbit Oak 1.56.0 on Tuesday.

The list of open issues scheduled for 1.56.0 is empty:

https://issues.apache.org/jira/issues/?jql=fixVersion%20%3D%201.56.0%20AND%20project%20%3D%20OAK%20AND%20resolution%20%3D%20Unresolved%20ORDER%20BY%20priority%20DESC

(after re-scheduling or removing "fixVersion" for some unresolved issues)

The CI tests are (mostly) passing:

https://ci-builds.apache.org/job/Jackrabbit/job/jackrabbit-oak-trunk/

(some of the time - we absolutely need to work on unreliable and
long-running tests)

The candidate release notes are here:

https://github.com/apache/jackrabbit-oak/blob/OAK-10419/RELEASE-NOTES.txt

If there are any objections please let me know.

Best regards, Julian

Re: Guava Migration (yes, a must read)

[Julian Reschke]

On 26.07.2023 08:28, Julian Reschke wrote:

On 12.06.2023 15:50, Julian Reschke wrote:

...
We have made good progress, but as usual, things take longer than
expected.

We have a pending PR for fixing oak-commons
(https://issues.apache.org/jira/browse/OAK-10247), but I could not apply
it yet (due to the current status of a certain downstream project).

The current plan is to cut 1.54.0 once this has been done (early July),
and then do the remaining changes in 1.56.0.
...


Champagne (sort of).

Oak itself is now independent of native Guava, but we still use test
tooling that pulls it in (see OAK-10367). Depending on how we resolve
this, we could then remove the remains from config and POMs.


In the meantime, that was fixed by Manfred (thanks!).

However, we have an azure-sdk dependency that transitively pulls in
Guava (see https://issues.apache.org/jira/browse/OAK-10371).
Fortunately, there's a major update to the SDK which does not seem to
use Guava anymore.

Best regards, Julian

[ANNOUNCE] Apache Jackrabbit 2.21.19 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit 2.21.19. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit -- Version 2.21.19

Introduction


This is Apache Jackrabbit(TM) 2.21.19, a fully compliant implementation 
of the

Content Repository for Java(TM) Technology API, version 2.0 (JCR 2.0) as
specified in the Java Specification Request 283 (JSR 283).

Apache Jackrabbit 2.21.19 is an unstable release cut directly from
Jackrabbit trunk, with a focus on new features and other
improvements. For production use we recommend the latest stable 2.20.x
release.

NOTE: this release disables RMI access in the standalone and webapp 
projects.

See https://issues.apache.org/jira/browse/JCR-4960 for more information.


Changes in Jackrabbit 2.21.19
-

Bug

[JCR-4957] - jackrabbit-standalone: 2.21.18 breaks binary compatibility

Task

[JCR-4955] - set baseline comparisonVersion to latest stable (2.20.11)
[JCR-4959] - update Apache parent pom to version 30
[JCR-4960] - Disable RMI by default
[JCR-4962] - Update h2db dependency to 2.2.220
[JCR-4963] - vfs-ext: update hadoop-hdfs-client dependency to 3.3.6
[JCR-4964] - update kotlin-stdlib dependency to 1.9.0
[JCR-4965] - webapp: remove Guava test dependency
[JCR-4966] - update aws java sdk version to 1.12.523


For more detailed information about all the changes in this and other
Jackrabbit releases, please see the Jackrabbit issue tracker at

https://issues.apache.org/jira/browse/JCR

Release Contents


This release consists of a single source archive packaged as a zip file.
The archive can be unpacked with the jar tool from your JDK installation.
See the README.txt file for instructions on how to build this release.

The source archive is accompanied by an SHA512 checksum and a
PGP signature that you can use to verify the authenticity of your
download. The public key used for the PGP signature can be found at
https://www.apache.org/dist/jackrabbit/KEYS.

About Apache Jackrabbit
---

Apache Jackrabbit is a fully conforming implementation of the Content
Repository for Java Technology API (JCR). A content repository is a
hierarchical content store with support for structured and unstructured
content, full text search, versioning, transactions, observation, and
more.

For more information, visit http://jackrabbit.apache.org/

About The Apache Software Foundation


Established in 1999, The Apache Software Foundation provides organizational,
legal, and financial support for more than 140 freely-available,
collaboratively-developed Open Source projects. The pragmatic Apache License
enables individual and commercial users to easily deploy Apache software;
the Foundation's intellectual property framework limits the legal exposure
of its 3,800+ contributors.

For more information, visit http://www.apache.org/

Trademarks
--

Apache Jackrabbit, Jackrabbit, Apache, the Apache feather logo, and the 
Apache

Jackrabbit project logo are trademarks of The Apache Software Foundation.

Re: Guava Migration (yes, a must read)

[Julian Reschke]

On 12.06.2023 15:50, Julian Reschke wrote:

...
We have made good progress, but as usual, things take longer than expected.

We have a pending PR for fixing oak-commons
(https://issues.apache.org/jira/browse/OAK-10247), but I could not apply
it yet (due to the current status of a certain downstream project).

The current plan is to cut 1.54.0 once this has been done (early July),
and then do the remaining changes in 1.56.0.
...


Champagne (sort of).

Oak itself is now independent of native Guava, but we still use test
tooling that pulls it in (see OAK-10367). Depending on how we resolve
this, we could then remove the remains from config and POMs.

Best regards, Julian

CVE-2023-37895: Apache Jackrabbit RMI access can lead to RCE

[Julian Reschke]

Severity: critical

Affected versions:

- Apache Jackrabbit Webapp (jackrabbit-webapp) 2.21.0 before 2.21.18
- Apache Jackrabbit Webapp (jackrabbit-webapp) 1.0.0 before 2.20.11
- Apache Jackrabbit Standalone (jackrabbit-standalone and 
jackrabbit-standalone-components) 2.21.0 before 2.21.18
- Apache Jackrabbit Standalone (jackrabbit-standalone and 
jackrabbit-standalone-components) 1.0.0 before 2.20.11

Description:

Java object deserialization issue in Jackrabbit webapp/standalone on all 
platforms allows attacker to remotely execute code via RMIVersions up to 
(including) 2.20.10 (stable branch) and 2.21.17 (unstable branch) use the 
component "commons-beanutils", which contains a class that can be used for 
remote code execution over RMI.

Users are advised to immediately update to versions 2.20.11 or 2.21.18. Note 
that earlier stable branches (1.0.x .. 2.18.x) have been EOLd already and do 
not receive updates anymore.

In general, RMI support can expose vulnerabilities by the mere presence of an 
exploitable class on the classpath. Even if Jackrabbit itself does not contain 
any code known to be exploitable anymore, adding other components to your 
server can expose the same type of problem. We therefore recommend to disable 
RMI access altogether (see further below), and will discuss deprecating RMI 
support in future Jackrabbit releases.

How to check whether RMI support is enabledRMI support can be over an 
RMI-specific TCP port, and over an HTTP binding. Both are by default enabled in 
Jackrabbit webapp/standalone.

The native RMI protocol by default uses port 1099. To check whether it is 
enabled, tools like "netstat" can be used to check.

RMI-over-HTTP in Jackrabbit by default uses the path "/rmi". So when running 
standalone on port 8080, check whether an HTTP GET request on 
localhost:8080/rmi returns 404 (not enabled) or 200 (enabled). Note that the 
HTTP path may be different when the webapp is deployed in a container as 
non-root context, in which case the prefix is under the user's control.

Turning off RMIFind web.xml (either in JAR/WAR file or in unpacked web 
application folder), and remove the declaration and the mapping definition for 
the RemoteBindingServlet:

        
            RMI
            
org.apache.jackrabbit.servlet.remote.RemoteBindingServlet
        

        
            RMI
            /rmi
        

Find the bootstrap.properties file (in $REPOSITORY_HOME), and set

         rmi.enabled=false

    and also remove

         rmi.host
         rmi.port
         rmi.url-pattern

 If there is no file named bootstrap.properties in $REPOSITORY_HOME, it is 
located somewhere in the classpath. In this case, place a copy in 
$REPOSITORY_HOME and modify it as explained.

Credit:

Siebene@ (reporter)
Michael Dürig (other)
Manfred Baedke (other)

References:

https://lists.apache.org/list.html?us...@jackrabbit.apache.org
https://jackrabbit.apache.org/
https://www.cve.org/CVERecord?id=CVE-2023-37895

Timeline:

2023-06-30: Reported
2023-07-20: Release vote for unstable branch with fix
2023-07-20: Release vote for stable branch with fix
2023-07-24: unstable branch (2.21.18) released
2023-07-24: stable branch (2.20.11) released

[ANNOUNCE] Apache Jackrabbit Oak 1.54.0 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit Oak 1.54.0. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit Oak -- Version 1.54.0

Introduction


Jackrabbit Oak is a scalable, high-performance hierarchical content
repository designed for use as the foundation of modern world-class
web sites and other demanding content applications.

Apache Jackrabbit Oak 1.54.0 is an incremental feature release based
on and compatible with earlier stable Jackrabbit Oak 1.x
releases. This release is considered stable and targeted for
production use.

While Oak 1.54.0 compiles and tests successfully on Java 17, Javadocs
generation fails on Java 17 (but works as expected on Java 11).

The Oak effort is a part of the Apache Jackrabbit project.
Apache Jackrabbit is a project of the Apache Software Foundation.

Changes in Oak 1.54.0
-

Technical task

[OAK-10197] - switch oak-blob-plugins to shaded guava
[OAK-10204] - switch oak-blob to shaded guava
[OAK-10236] - Update oak-segment-remote modules with shaded guava
[OAK-10237] - Update oak-blob* modules with shaded guava
[OAK-10238] - switch oak-search to shaded guava
[OAK-10239] - Update oak-lucene with shaded guava
[OAK-10240] - switch oak-solr to shaded guava
[OAK-10242] - switch oak-search-elastic to shaded guava
[OAK-10244] - oak-solr-osgi: remove Guava import decl
[OAK-10245] - Document OAK-10173
[OAK-10246] - Minor cleanup of unused imports, indention and whitespace
[OAK-10247] - oak-commons: remove Guava from public API
[OAK-10270] - Document limitation
[OAK-10276] - switch oak-upgrade to shaded guava
[OAK-10278] - switch oak-run-elastic to shaded guava
[OAK-10282] - switch oak-it to shaded guava
[OAK-10283] - switch oak-examples to shaded guava
[OAK-10284] - switch oak-benchmarks to shaded guava
[OAK-10287] - switch oak-benchmarks-lucene to shaded guava
[OAK-10290] - switch oak-benchmarks-elastic to shaded guava
[OAK-10292] - switch oak-benchmarks-solr to shaded guava
[OAK-10307] - oak-shaded-guava leaks original guava as transitive 
dependency

[OAK-10330] - oak-it-osgi: temporarily introduce Guava dependency again

Bug

[OAK-9660] - NullPointerException When Moving Transient node
[OAK-10226] - Elasticsearch custom analyzers fail when the files 
contain comments

[OAK-10241] - NPE while trying to get the BinaryDownload URI
[OAK-10243] - Flaky test in oak-blob-cloud-azure and oak-run
[OAK-10257] - NodeCounterMetricTest does not release resources
[OAK-10259] - oak-core tests running out of memory
[OAK-10263] - Inconsistent state in TarWriter when close() fails to 
write to Azure
[OAK-10268] - oak-search-elastic: propertyIndex=false fields cannot 
be used for sorting

[OAK-10280] - Occasional failure to start docker container
[OAK-10305] - oak-core should changes scope of annotation 
dependencies to provided

[OAK-10306] - Incorrect dependency scope for commons-math3
[OAK-10308] - Tests using MongoUtils may skip even if Docker is 
available
[OAK-10324] - oak-search-elastic: IN queries on boolean fields 
should not fail when one of the value cannot be parsed
[OAK-10338] - PipelinedMergeSortTaskTest is failing on Windows due 
to line end issues

[OAK-10340] - Child order not updated on source after move

New Feature

[OAK-10093] - Oak Blob Store support for SSE-C for AWS

Story

[OAK-10173] - Allow configured principals to impersonate any user

Improvement

[OAK-10211] - Rectify documentation for hybrid indexes
[OAK-10213] - Add new api in DocumentStore to handle bulk 
findAndUpdate operations

[OAK-10250] - Configurable suspend timeout
[OAK-10252] - Distinguish in oak-jackrabbit-api between provider 
and consumer type interfaces
[OAK-10253] - Option to only collect references when calling 
checkConsistency

[OAK-10256] - Principal documentation does not mention GroupPrincipal
[OAK-10261] - Query with OR clause with COALESCE function 
incorrectly interpreted

[OAK-10262] - Document ASCIIFolder and OakAnalyzer
[OAK-10267] - oak-search-elastic: index should be more lenient when 
a field cannot be converted to the mapped type
[OAK-10273] - Index-definition json created during oak-run reindex 
should not serialise index data
[OAK-10285] - MembershipProvider change log level to ERROR for 
cyclic membership
[OAK-10286] - AutoMembershipPrincipals.isInheritedMember add check 
for cyclic membership
[OAK-10294] - Indexing job: add new Pipelined Strategy for dumping 
Mongo contents in preparation for reindexing
[OAK-10303] - oak-search-elastic: remove 
propertyIndex/nodeScopeIndex from dynamicBoost tests

[OAK-10310] - Bump testcontainers dependency to 

[RESULT] [VOTE] Release Apache Jackrabbit Oak 1.54.0

[Julian Reschke]

On 19.07.2023 18:56, Julian Reschke wrote:

...


Hi there,

The vote passes as follows:

+1 Angela Schreiber 
+1 Jörg Hoh 
+1 Julian Reschke 
+1 Konrad Windszus 
+1 Manfred Baedke 
+1 Woonsan Ko 

Thanks for voting. I'll push the release out.

Best regards, Julian

[ANNOUNCE] Apache Jackrabbit 2.20.11 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit 2.20.11. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit -- Version 2.20.11

Introduction


This is Apache Jackrabbit(TM) 2.20.11, a fully compliant implementation 
of the

Content Repository for Java(TM) Technology API, version 2.0 (JCR 2.0) as
specified in the Java Specification Request 283 (JSR 283).

Apache Jackrabbit 2.20.11 is an incremental feature release based on
and compatible with earlier stable Jackrabbit 2.x releases. Jackrabbit
2.20.x releases are considered stable and targeted for production use.

The minimum Java version for this release is Java 8. See

  http://jackrabbit.apache.org/jcr/downloads.html

for maintenance versions that support earlier Java versions.


Changes in Jackrabbit 2.20.11
-

Sub-task

[JCR-4948] - core: beanutils leaks dependency to 
commons-collections in oak-core tests


Bug

[JCR-4949] - get rid of beanutils dependency

Task

[JCR-4925] - Update oak-jackrabbit-api.version.used in trunk and 
2.20 to Oak 1.22.15

[JCR-4932] - Update commons-io dependency to 2.12.0
[JCR-4933] - Update tomcat dependency to 8.5.88
[JCR-4936] - Update tomcat dependency to 8.5.89
[JCR-4937] - jcr-tests: get rid of duplicate XMLChar class
[JCR-4939] - Update commons-io dependency to 2.13.0
[JCR-4941] - Update tomcat dependency to 8.5.90
[JCR-4942] - spi-commons: bump minor version number of 
o.a.j.spi.commons.conversion



For more detailed information about all the changes in this and other
Jackrabbit releases, please see the Jackrabbit issue tracker at

https://issues.apache.org/jira/browse/JCR

Release Contents


This release consists of a single source archive packaged as a zip file.
The archive can be unpacked with the jar tool from your JDK installation.
See the README.txt file for instructions on how to build this release.

The source archive is accompanied by an SHA512 checksum and a
PGP signature that you can use to verify the authenticity of your
download. The public key used for the PGP signature can be found at
https://www.apache.org/dist/jackrabbit/KEYS.

About Apache Jackrabbit
---

Apache Jackrabbit is a fully conforming implementation of the Content
Repository for Java Technology API (JCR). A content repository is a
hierarchical content store with support for structured and unstructured
content, full text search, versioning, transactions, observation, and
more.

For more information, visit http://jackrabbit.apache.org/

About The Apache Software Foundation


Established in 1999, The Apache Software Foundation provides organizational,
legal, and financial support for more than 140 freely-available,
collaboratively-developed Open Source projects. The pragmatic Apache License
enables individual and commercial users to easily deploy Apache software;
the Foundation's intellectual property framework limits the legal exposure
of its 3,800+ contributors.

For more information, visit http://www.apache.org/

Trademarks
--

Apache Jackrabbit, Jackrabbit, Apache, the Apache feather logo, and the 
Apache

Jackrabbit project logo are trademarks of The Apache Software Foundation.

[ANNOUNCE] Apache Jackrabbit 2.21.18 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit 2.21.18. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit -- Version 2.21.18

Introduction


This is Apache Jackrabbit(TM) 2.21.18, a fully compliant implementation 
of the

Content Repository for Java(TM) Technology API, version 2.0 (JCR 2.0) as
specified in the Java Specification Request 283 (JSR 283).

Apache Jackrabbit 2.21.18 is an unstable release cut directly from
Jackrabbit trunk, with a focus on new features and other
improvements. For production use we recommend the latest stable 2.20.x
release.

NOTE: 2.21.17 was released from an incorrect SVN tag and actually 
contains version

2.21.16. This release contains what was supposed to go into 2.21.17.

Changes in Jackrabbit 2.21.18
-

Sub-task

[JCR-4948] - core: beanutils leaks dependency to 
commons-collections in oak-core tests


Bug

[JCR-4606] - standalone: logback log files created in wrong place
[JCR-4949] - get rid of beanutils dependency

Task

[JCR-4308] - update Jetty to 9.4.*
[JCR-4352] - Update lucene-core dependency to 3.6.2
[JCR-4925] - Update oak-jackrabbit-api.version.used in trunk and 
2.20 to Oak 1.22.15

[JCR-4932] - Update commons-io dependency to 2.12.0
[JCR-4933] - Update tomcat dependency to 8.5.88
[JCR-4936] - Update tomcat dependency to 8.5.89
[JCR-4937] - jcr-tests: get rid of duplicate XMLChar class
[JCR-4938] - update remaining copies of XMLChar.java with latest 
version from Xerces

[JCR-4939] - Update commons-io dependency to 2.13.0
[JCR-4941] - Update tomcat dependency to 8.5.90
[JCR-4942] - spi-commons: bump minor version number of 
o.a.j.spi.commons.conversion

[JCR-4944] - upgrade to Tomcat 9.x


For more detailed information about all the changes in this and other
Jackrabbit releases, please see the Jackrabbit issue tracker at

https://issues.apache.org/jira/browse/JCR

Release Contents


This release consists of a single source archive packaged as a zip file.
The archive can be unpacked with the jar tool from your JDK installation.
See the README.txt file for instructions on how to build this release.

The source archive is accompanied by an SHA512 checksum and a
PGP signature that you can use to verify the authenticity of your
download. The public key used for the PGP signature can be found at
https://www.apache.org/dist/jackrabbit/KEYS.

About Apache Jackrabbit
---

Apache Jackrabbit is a fully conforming implementation of the Content
Repository for Java Technology API (JCR). A content repository is a
hierarchical content store with support for structured and unstructured
content, full text search, versioning, transactions, observation, and
more.

For more information, visit http://jackrabbit.apache.org/

About The Apache Software Foundation


Established in 1999, The Apache Software Foundation provides organizational,
legal, and financial support for more than 140 freely-available,
collaboratively-developed Open Source projects. The pragmatic Apache License
enables individual and commercial users to easily deploy Apache software;
the Foundation's intellectual property framework limits the legal exposure
of its 3,800+ contributors.

For more information, visit http://www.apache.org/

Trademarks
--

Apache Jackrabbit, Jackrabbit, Apache, the Apache feather logo, and the 
Apache

Jackrabbit project logo are trademarks of The Apache Software Foundation.

Re: [VOTE] Release Apache Jackrabbit Oak 1.54.0

[Julian Reschke]

On 19.07.2023 18:56, Julian Reschke wrote:

...


[X] +1 Release this package as Apache Jackrabbit Oak 1.54.0

...where...


[INFO] Apache Maven 3.6.3 (cecedd343002696d0abb50b32b541b8a6ba2883f)
[INFO] OS name: "windows 11", version: "10.0", arch: "amd64", family: "windows"
[INFO] Java version: 11.0.18, vendor: Oracle Corporation, runtime: 
C:\usr\local\jdk-11.0.18
[INFO] MAVEN_OPTS: -Xmx2g


Best regards, Julian

[VOTE] Release Apache Jackrabbit Oak 1.54.0

[Julian Reschke]

A candidate for the Jackrabbit Oak 1.54.0 release is available at:

https://dist.apache.org/repos/dist/dev/jackrabbit/oak/1.54.0/

The release candidate is a zip archive of the sources in:

 https://github.com/apache/jackrabbit-oak/tree/jackrabbit-oak-1.54.0/

The SHA1 checksum of the archive is
95f1b68153a1b3d3adf9e9d8aaac9c90325edbcb.

A staged Maven repository is available for review at:

https://repository.apache.org/

The command for running automated checks against this release candidate is:

# run in SVN checkout of
https://dist.apache.org/repos/dist/dev/jackrabbit
$ sh check-release.sh oak 1.54.0
95f1b68153a1b3d3adf9e9d8aaac9c90325edbcb

Please vote on releasing this package as Apache Jackrabbit Oak 1.54.0.
The vote is open for the next 72 hours and passes if a majority of at
least three +1 Jackrabbit PMC votes are cast.

[ ] +1 Release this package as Apache Jackrabbit Oak 1.54.0
[ ] -1 Do not release this package because...

Best regards, Julian

Jackrabbit Oak 1.54.0 Release Plan

[Julian Reschke]

(re-sent with correct subject line)

Hi,

I'm planning to cut Jackrabbit Oak 1.54.0 tomorrow.

The list of open issues scheduled for 1.54.0 is empty:

https://issues.apache.org/jira/issues/?jql=fixVersion%20%3D%201.54.0%20AND%20project%20%3D%20OAK%20AND%20resolution%20%3D%20Unresolved%20ORDER%20BY%20priority%20DESC

(after re-scheduling or removing "fixVersion" for some unresolved issues)

The CI tests are (mostly) passing:

https://ci-builds.apache.org/job/Jackrabbit/job/jackrabbit-oak-trunk/

(some of the time - we absolutely need to work on unreliable and
long-running tests)

The candidate release notes are here:

https://github.com/apache/jackrabbit-oak/blob/OAK-10354/RELEASE-NOTES.txt

If there are any objections please let me know.

Best regards, Julian

Jackrabbit Oak 1.52.0 Release Plan

[Julian Reschke]

Hi,

I'm planning to cut Jackrabbit Oak 1.54.0 tomorrow.

The list of open issues scheduled for 1.54.0 is empty:

https://issues.apache.org/jira/issues/?jql=fixVersion%20%3D%201.54.0%20AND%20project%20%3D%20OAK%20AND%20resolution%20%3D%20Unresolved%20ORDER%20BY%20priority%20DESC

(after re-scheduling or removing "fixVersion" for some unresolved issues)

The CI tests are (mostly) passing:

https://ci-builds.apache.org/job/Jackrabbit/job/jackrabbit-oak-trunk/

(some of the time - we absolutely need to work on unreliable and
long-running tests)

The candidate release notes are here:

https://github.com/apache/jackrabbit-oak/blob/OAK-10354/RELEASE-NOTES.txt

If there are any objections please let me know.

Best regards, Julian

[ANNOUNCE] Apache Jackrabbit Oak 1.22.16 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit Oak 1.22.16. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit Oak -- Version 1.22.16

Introduction


Jackrabbit Oak is a scalable, high-performance hierarchical content
repository designed for use as the foundation of modern world-class
web sites and other demanding content applications.

Jackrabbit Oak 1.22.16 is a patch release that contains fixes and
improvements over Oak 1.22. Jackrabbit Oak 1.22.x releases are
considered stable and targeted for production use.

The Oak effort is a part of the Apache Jackrabbit project.
Apache Jackrabbit is a project of the Apache Software Foundation.


Changes in Oak 1.22.16
--

Technical task

[OAK-10175] - Reduce currently supported Guava range to 15 - 19

Bug

[OAK-9660] - NullPointerException When Moving Transient node

New Feature

[OAK-10093] - Oak Blob Store support for SSE-C for AWS
[OAK-10184] - oak-commons: Support multiple Compression methods

Task

[OAK-10086] - oak-core: bump up logging for deprecated Guava based 
APIs to ERROR

[OAK-10106] - Guava deprecations: set minimal logging level to 'warn'
[OAK-10156] - update Tomcat JDBC dependency to 8.5.87
[OAK-10157] - examples: update Tomcat dependency to 8.5.87
[OAK-10159] - Upgrade jackson-databind dependency to 2.13.5
[OAK-10160] - Update commons-codec dependency to 1.15
[OAK-10207] - oak-jcr: remove unused test dependency zip4j
[OAK-10220] - Update Oak trunk and Oak 1.22 to Jackrabbit 2.20.10
[OAK-10275] - oak-upgrade: remove workaround for Java 1.6


In addition to the above-mentioned changes, this release contains
all changes included up to the previous Apache Jackrabbit Oak 1.22.x 
release.


For more detailed information about all the changes in this and other
Oak releases, please see the Oak issue tracker at

  https://issues.apache.org/jira/browse/OAK

Release Contents


This release consists of a single source archive packaged as a zip file.
The archive can be unpacked with the jar tool from your JDK installation.
See the README.md file for instructions on how to build this release.

The source archive is accompanied by a SHA512 checksums and a PGP
signature that you can use to verify the authenticity of your
download. The public key used for the PGP signature can be found at
https://www.apache.org/dist/jackrabbit/KEYS.

About Apache Jackrabbit Oak
---

Jackrabbit Oak is a scalable, high-performance hierarchical content
repository designed for use as the foundation of modern world-class
web sites and other demanding content applications.

The Oak effort is a part of the Apache Jackrabbit project.
Apache Jackrabbit is a project of the Apache Software Foundation.

For more information, visit http://jackrabbit.apache.org/oak

About The Apache Software Foundation


Established in 1999, The Apache Software Foundation provides organizational,
legal, and financial support for more than 140 freely-available,
collaboratively-developed Open Source projects. The pragmatic Apache License
enables individual and commercial users to easily deploy Apache software;
the Foundation's intellectual property framework limits the legal exposure
of its 3,800+ contributors.

For more information, visit http://www.apache.org/

[RESULT] [VOTE] Release Apache Jackrabbit Oak 1.22.16

[Julian Reschke]

On 14.07.2023 07:38, Julian Reschke wrote:

...


Hi there,

The vote passes as follows:

+1 Angela Schreiber 
+1 Julian Reschke 
+1 Manfred Baedke 
+1 Marcel Reutegger 
+1 Woonsan Ko 

Thanks for voting. I'll push the release out.

Best regards, Julian

Re: [VOTE] Release Apache Jackrabbit Oak 1.22.16

[Julian Reschke]

On 14.07.2023 07:38, Julian Reschke wrote:

...


[X] +1 Release this package as Apache Jackrabbit Oak 1.22.16

...where...


[INFO] Apache Maven 3.6.3 (cecedd343002696d0abb50b32b541b8a6ba2883f)
[INFO] OS name: "windows 11", version: "10.0", arch: "amd64", family: "windows"
[INFO] Java version: 1.8.0_341, vendor: Oracle Corporation, runtime: 
C:\usr\local\jdk18\jre
[INFO] MAVEN_OPTS: -Xmx2g


Best regards, Julian

[VOTE] Release Apache Jackrabbit Oak 1.22.16

[Julian Reschke]

A candidate for the Jackrabbit Oak 1.22.16 release is available at:

https://dist.apache.org/repos/dist/dev/jackrabbit/oak/1.22.16/

The release candidate is a zip archive of the sources in:

 https://github.com/apache/jackrabbit-oak/tree/jackrabbit-oak-1.22.16/

The SHA1 checksum of the archive is 
ae2700633ea1964c37aaa42a6072502e78d5c4d4.


A staged Maven repository is available for review at:

https://repository.apache.org/

The command for running automated checks against this release candidate is:

# run in SVN checkout of 
https://dist.apache.org/repos/dist/dev/jackrabbit
$ sh check-release.sh oak 1.22.16 
ae2700633ea1964c37aaa42a6072502e78d5c4d4


Please vote on releasing this package as Apache Jackrabbit Oak 1.22.16.
The vote is open for the next 72 hours and passes if a majority of at
least three +1 Jackrabbit PMC votes are cast.

[ ] +1 Release this package as Apache Jackrabbit Oak 1.22.16
[ ] -1 Do not release this package because...

Best regards, Julian

Jackrabbit Oak 1.22.16 Release Plan

[Julian Reschke]

Hi,

I'm planning to cut Jackrabbit Oak 1.22.16 on Friday.

The list of open issues scheduled for 1.22.16 is empty:

https://issues.apache.org/jira/issues/?jql=fixVersion%20%3D%201.22.16%20AND%20project%20%3D%20OAK%20AND%20resolution%20%3D%20Unresolved%20ORDER%20BY%20priority%20DESC

The CI tests are passing:

(most of the time; will need to investigate CI flakiness...)

The candidate release notes are here:

https://github.com/apache/jackrabbit-oak/blob/OAK-10346/RELEASE-NOTES.txt

If there are any objections please let me know.

Best regards, Julian

PS: I might cherry-pick a few more changes from 1.54.0-TO-BE before
Friday and in that case will update the release notes accordingly.

Re: Guava Migration (yes, a must read)

[Julian Reschke]

On 06.04.2023 13:56, Julian Reschke wrote:

Hi everybody,

as some have noticed, we have begun the migration away from Guava 15.0
to a *shaded* version of Guava (latest and greatest).

A new subproject has been added (oak-shaded-guava), which repackages
Guava 31 under the package name o.a.jackrabbit.guava. See
<https://issues.apache.org/jira/browse/OAK-9989> for details and
discussion.

If your IDE acts weird (be it Eclipse or IntelliJ), it's because it does
not understand the shaded subproject. Sorry for that. While there's no
fix for the IDEs, the workaround is to disable oak-shaded-guava
(Intellij) or remove it (Eclipse) - after having built it locally with
Maven.

We may decide at a later point to work around this by moving this out of
the reactor pom.

What's next?

1) We have a few sub projects that currently expose Guava in APIs; these
APIs have been deprecated for long, and I'll remove those APIs *after*
the next release (1.52.0).

2) In the meantime, everybody can help by converting "their" sub
projects. (If you do so, please add a sub-task to
<https://issues.apache.org/jira/browse/OAK-7182>). This usually means
adding the dependency to the POM, and rewriting import statements. I
usually just run:

~~~
#!/bin/bash

find . -name "*.java" -exec sed
"s/^import\scom\.google\.common\.\(.*;\)/import
org.apache.jackrabbit.guava.common.\1/g" -i {} ";"
find . -name "*.java" -exec sed
"s/^import\sstatic\scom\.google\.common\.\(.*;\)/import static
org.apache.jackrabbit.guava.common.\1/g" -i {} ";"
~~~

WARNING: this is destructive. Only run it on a Git checkout with no
local changes, and do not do it inside your project root. You have been
warned.

After running this, you may find that a Guava 15 method actually has
been removed. Usually googling for the method signature will tell you
what happened.

For the modules where I already did the conversion, I also took the
opportunity to convert things to standard JDK 11 lingo where simple.
https://issues.apache.org/jira/browse/OAK-10180 /
https://github.com/apache/jackrabbit-oak/pull/890 is a good example for
that.

The currently planned timeline is:

1.52.0 (May?): release with shaded guava subproject and as many
subprojects converted as possible

1.54.0 (July?): remove deprecated APIs exposing native Guava

1.56.0: completely get rid of our Guava 15 dependency, only use the
shaded variant.

Feedback either here or in
<https://issues.apache.org/jira/browse/OAK-7182> appreciated.


We have made good progress, but as usual, things take longer than expected.

We have a pending PR for fixing oak-commons
(https://issues.apache.org/jira/browse/OAK-10247), but I could not apply
it yet (due to the current status of a certain downstream project).

The current plan is to cut 1.54.0 once this has been done (early July),
and then do the remaining changes in 1.56.0.

Best regards, Julian

[ANNOUNCE] Apache Jackrabbit 2.16.x deprecated

[Julian Reschke]

Dear Jackrabbit developers and users,

the Apache Jackrabbit Team has decided to drop support and deprecate the 
2.16 branch of Apache Jackrabbit. Branch, tags and releases will still 
be available for future references, but will not show up on the download 
page anymore. Users are encouraged to upgrade to the latest stable versions.


See  for more information.

Best regards, Julian

[ANNOUNCE] Apache Jackrabbit 1.52.0 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit Oak 1.52.0. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit Oak -- Version 1.52.0

Introduction


Jackrabbit Oak is a scalable, high-performance hierarchical content
repository designed for use as the foundation of modern world-class
web sites and other demanding content applications.

Apache Jackrabbit Oak 1.52.0 is an incremental feature release based
on and compatible with earlier stable Jackrabbit Oak 1.x
releases. This release is considered stable and targeted for
production use.

While Oak 1.52.0 compiles and tests successfully on Java 17, Javadocs
generation fails on Java 17 (but works as expected on Java 11).

The Oak effort is a part of the Apache Jackrabbit project.
Apache Jackrabbit is a project of the Apache Software Foundation.

Changes in Oak 1.52.0
-

Technical task

[OAK-7541] - SegmentCompactionIT's use of 
com.google.common.util.concurrent.Futures.dereference

[OAK-9989] - introduce oak-shaded-guava project
[OAK-10164] - oak-commons: prepare for switch to shaded guava
[OAK-10169] - improve output of test-assertions
[OAK-10170] - simplify usage of authorizableiterator
[OAK-10175] - Reduce currently supported Guava range to 15 - 19
[OAK-10176] - oak-shaded-guava: switch to latest Guava version
[OAK-10177] - adjust OSGi ITs and size limits for shaded guava 
inclusion

[OAK-10179] - switch oak-commons to shaded guava
[OAK-10180] - switch oak-core-spi to shaded guava
[OAK-10185] - oak-blob-cloud-azure - relax Guava import range
[OAK-10186] - switch oak-store-spi to shaded guava
[OAK-10192] - switch oak-query-spi to shaded guava
[OAK-10194] - switch oak-security-spi to shaded guava
[OAK-10195] - switch oak-store-composite to shaded guava
[OAK-10196] - switch oak-store-document to shaded guava
[OAK-10198] - switch oak-core to shaded guava
[OAK-10205] - switch oak-http to shaded guava
[OAK-10208] - switch oak-run-commons to shaded guava
[OAK-10215] - switch oak-run to shaded guava
[OAK-10216] - switch oak-jcr to shaded guava
[OAK-10218] - oak-it-osgi: avoid Guava dependency
[OAK-10219] - switch oak-pojosr to shaded guava
[OAK-10221] - switch oak-auth-external to shaded guava
[OAK-10227] - switch oak-auth-ldap to shaded guava
[OAK-10229] - switch oak-authorization-cug to shaded guava
[OAK-10230] - switch oak-authorization-principalbased to shaded guava
[OAK-10231] - switch oak-exercise to shaded guava
[OAK-10234] - Update oak-segment-tar with shaded guava

Bug

[OAK-10146] - oak-search-elastic: similarity search does not work 
for some nodes

[OAK-10151] - oak-auth-external tests fail with Guava 20
[OAK-10162] - Fix Version copier with preserveOnTarget to ignore 
diverged history
[OAK-10182] - datastore-copy cmd: checksum option does not write 
the file entirely
[OAK-10190] - Reusing Azure segment container hangs when primary 
location is not available
[OAK-10191] - Reusing Azure blob container hangs when primary 
location is not available


New Feature

[OAK-10130] - Add API to retrieve effective policies for a set of 
principals for a given path


Improvement

[OAK-10050] - Enable access to the secondary Azure blobstore 
service endpoint in Oak segment node store
[OAK-10135] - 
JackrabbitAccessControlManager.getEffectivePolicies(Set principals) 
should include ReadPolicy
[OAK-10141] - oak-search-elastic: relevance on queries involving 
dynamic boost sometimes differ from lucene

[OAK-10149] - Rebase may be expensive with many siblings
[OAK-10167] - Elastic bulk processor should fail when intermediate 
bulks fail

[OAK-10168] - Bump and align testcontainers dependency to v1.17.6
[OAK-10171] - datastore-copy cmd: add checksum validation
[OAK-10183] - large Bulk size for BulkProcessor sometimes lead to 
SocketTimeoutException
[OAK-10200] - 
CompositeAccessControlManager.getEffectivePolicies(String) should filter 
duplicate policies

[OAK-10210] - Prefetch breaks Fast Result Size
[OAK-10212] - Binary references file in the newly created archive 
might be missing

[OAK-10214] - Expose node counter value as a metric in Oak
[OAK-10223] - Introduce constant for the 'do-create-token' marker value
[OAK-10225] - Utility to rate limit writes in case async indexing 
is delayed


Task

[OAK-10106] - Guava deprecations: set minimal logging level to 'warn'
[OAK-10150] - Add a test for index purge command where the latest 
OOB index is disabled and the queries are served by a lower versioned index

[OAK-10156] - update Tomcat JDBC dependency to 8.5.87
[OAK-10157] - examples: update Tomcat dependency to 8.5.87
[OAK-10159] - Upgrade 

[RESULT] [VOTE] Release Apache Jackrabbit Oak 1.52.0

[Julian Reschke]

On 10.05.2023 18:52, Julian Reschke wrote:

...


Hi there,

The vote passes as follows:

+1 Angela Schreiber 
+1 Julian Reschke 
+1 Woonsan Ko 

Thanks for voting. I'll push the release out.

Best regards, Julian

Re: [VOTE] Release Apache Jackrabbit Oak 1.52.0

[Julian Reschke]

On 10.05.2023 18:52, Julian Reschke wrote:

...


[X] +1 Release this package as Apache Jackrabbit Oak 1.52.0

...where...


[INFO] Apache Maven 3.6.3 (cecedd343002696d0abb50b32b541b8a6ba2883f)
[INFO] OS name: "windows 11", version: "10.0", arch: "amd64", family: "windows"
[INFO] Java version: 11.0.16.1, vendor: Oracle Corporation, runtime: 
C:\usr\local\jdk-11.0.16.1


Best regards, Julian

[VOTE] Release Apache Jackrabbit Oak 1.52.0

[Julian Reschke]

A candidate for the Jackrabbit Oak 1.52.0 release is available at:

https://dist.apache.org/repos/dist/dev/jackrabbit/oak/1.52.0/

The release candidate is a zip archive of the sources in:

 https://github.com/apache/jackrabbit-oak/tree/jackrabbit-oak-1.52.0/

The SHA1 checksum of the archive is 
9122bc1cba321049992ad5c915a7658cb43db0c5.


A staged Maven repository is available for review at:

https://repository.apache.org/

The command for running automated checks against this release candidate is:

# run in SVN checkout of 
https://dist.apache.org/repos/dist/dev/jackrabbit
$ sh check-release.sh oak 1.52.0 
9122bc1cba321049992ad5c915a7658cb43db0c5


Please vote on releasing this package as Apache Jackrabbit Oak 1.52.0.
The vote is open for the next 72 hours and passes if a majority of at
least three +1 Jackrabbit PMC votes are cast.

[ ] +1 Release this package as Apache Jackrabbit Oak 1.52.0
[ ] -1 Do not release this package because...

Best regards, Julian

[ANNOUNCE] Apache Jackrabbit Oak 1.8.x deprecated

[Julian Reschke]

Dear Jackrabbit developers and users,

the Apache Jackrabbit Team has decided to drop support and deprecate the 
1.8 branch of Apache Jackrabbit Oak.  Branch, tags and releases will 
still be available for future references, but will not show up on the 
download page anymore. Users are encouraged to upgrade to the latest 
stable versions (currently 1.50.0, or 1.22.* for Java 8).


See  for more information.

Best regards, Julian

[ANNOUNCE] Apache Jackrabbit 2.20.10 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit 2.20.10. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit -- Version 2.20.10

Introduction


This is Apache Jackrabbit(TM) 2.20.10, a fully compliant implementation 
of the

Content Repository for Java(TM) Technology API, version 2.0 (JCR 2.0) as
specified in the Java Specification Request 283 (JSR 283).

Apache Jackrabbit 2.20.10 is an incremental feature release based on
and compatible with earlier stable Jackrabbit 2.x releases. Jackrabbit
2.20.x releases are considered stable and targeted for production use.

The minimum Java version for this release is Java 8. See

  http://jackrabbit.apache.org/jcr/downloads.html

for maintenance versions that support earlier Java versions.


Changes in Jackrabbit 2.20.10
-

Sub-task

[JCR-4857] - jackrabbit-it-osgi: remove reference to 
commons-collections


Bug

[JCR-4917] - spi-commons: NameParser is too picky (allow non-ASCII 
whitespace)


Task

[JCR-4908] - Update commons file-upload dependency to 1.5
[JCR-4909] - specify maven-rar-plugin dependency
[JCR-4910] - Update tomcat dependency to 8.5.86
[JCR-4913] - spi-commons: improve error messages for 
org.apache.jackrabbit.spi.commons.conversion.NameParser.parse

[JCR-4918] - vfs-ext: update hadoop-hdfs-client dependency to 3.3.5
[JCR-4919] - Update tomcat dependency to 8.5.87
[JCR-4920] - Remove maven-assembly-plugin dependency (use the one 
provided by Apache parent pom)
[JCR-4921] - remove surefire/failsafe dependencies (use the ones 
provided by Apache parent pom)
[JCR-4922] - Remove javadoc-plugin dependency (use the one provided 
by Apache parent pom)
[JCR-4923] - Remove release-plugin dependency (use the one provided 
by Apache parent pom)



For more detailed information about all the changes in this and other
Jackrabbit releases, please see the Jackrabbit issue tracker at

https://issues.apache.org/jira/browse/JCR

Release Contents


This release consists of a single source archive packaged as a zip file.
The archive can be unpacked with the jar tool from your JDK installation.
See the README.txt file for instructions on how to build this release.

The source archive is accompanied by an SHA512 checksum and a
PGP signature that you can use to verify the authenticity of your
download. The public key used for the PGP signature can be found at
https://www.apache.org/dist/jackrabbit/KEYS.

About Apache Jackrabbit
---

Apache Jackrabbit is a fully conforming implementation of the Content
Repository for Java Technology API (JCR). A content repository is a
hierarchical content store with support for structured and unstructured
content, full text search, versioning, transactions, observation, and
more.

For more information, visit http://jackrabbit.apache.org/

About The Apache Software Foundation


Established in 1999, The Apache Software Foundation provides organizational,
legal, and financial support for more than 140 freely-available,
collaboratively-developed Open Source projects. The pragmatic Apache License
enables individual and commercial users to easily deploy Apache software;
the Foundation's intellectual property framework limits the legal exposure
of its 3,800+ contributors.

For more information, visit http://www.apache.org/

Trademarks
--

Apache Jackrabbit, Jackrabbit, Apache, the Apache feather logo, and the 
Apache

Jackrabbit project logo are trademarks of The Apache Software Foundation.

Jackrabbit Oak 1.52.0 Release Plan

[Julian Reschke]

Hi,

I'm planning to cut Jackrabbit Oak 1.52.0 this weekend.

The list of open issues scheduled for 1.52.0 is empty:

https://issues.apache.org/jira/issues/?jql=fixVersion%20%3D%201.52.0%20AND%20project%20%3D%20OAK%20AND%20resolution%20%3D%20Unresolved%20ORDER%20BY%20priority%20DESC

(after re-scheduling or removing "fixVersion" for some unresolved issues)

The CI tests are passing:

https://ci-builds.apache.org/job/Jackrabbit/job/jackrabbit-oak-trunk/

(some of the time - we absolutely need to work on unreliable and 
long-running tests)


The candidate release notes are here:

https://github.com/apache/jackrabbit-oak/blob/OAK-10235/RELEASE-NOTES.txt

If there are any objections please let me know.

Best regards, Julian

Re: Plan: Deprecation of Jackrabbit Oak 1.8.x

[Julian Reschke]

On 20.04.2023 15:32, Julian Reschke wrote:

Hi there,

I'm planning to officially end-of-life Jackrabbit Oak 1.8 in two weeks
(see <https://issues.apache.org/jira/browse/OAK-10075>):

Users of Oak 1.8.* need to switch to a platform compatible with Java 8
(or newer) - the latest stable release is 1.50.0 (requiring Java 11);
the latest maintenance branch supporting Java 8 (essentially
feature-frozen) is 1.22, with the current release being 1.22.15.

What it'll mean in actual actions:

     links will be removed from the download page

     news will be posted on the homepage

     [announce] will be sent to jr-user, jr-dev, oak-dev

     branch and tags WILL stay there

     label "candidate_oak_1_8" will be removed

See also http://jackrabbit.apache.org/oak/docs/roadmap.html

If you have any concerns speak out before May 9.

Best regards, Julian


Assuming lazy consensus, I'm planning to do this on Wednesday.

Best regards, Julian

failing CI builds

[Julian Reschke]

Hi there,

recently, many oak-trunk builds have been failing as terminated after 
210 minutes.


I just increased the timeout to 300 minutes, in order to get some results.

That said, we really need to figure out what's going on, and fix this.

Best regards, Julian

Re: Guava Migration (yes, a must read)

[Julian Reschke]

On 06.04.2023 13:56, Julian Reschke wrote:

Hi everybody,

as some have noticed, we have begun the migration away from Guava 15.0
to a *shaded* version of Guava (latest and greatest).

A new subproject has been added (oak-shaded-guava), which repackages
Guava 31 under the package name o.a.jackrabbit.guava. See
<https://issues.apache.org/jira/browse/OAK-9989> for details and
discussion.

If your IDE acts weird (be it Eclipse or IntelliJ), it's because it does
not understand the shaded subproject. Sorry for that. While there's no
fix for the IDEs, the workaround is to disable oak-shaded-guava
(Intellij) or remove it (Eclipse) - after having built it locally with
Maven.

We may decide at a later point to work around this by moving this out of
the reactor pom.

What's next?

1) We have a few sub projects that currently expose Guava in APIs; these
APIs have been deprecated for long, and I'll remove those APIs *after*
the next release (1.52.0).

2) In the meantime, everybody can help by converting "their" sub
projects. (If you do so, please add a sub-task to
<https://issues.apache.org/jira/browse/OAK-7182>). This usually means
adding the dependency to the POM, and rewriting import statements. I
usually just run:

~~~
#!/bin/bash

find . -name "*.java" -exec sed
"s/^import\scom\.google\.common\.\(.*;\)/import
org.apache.jackrabbit.guava.common.\1/g" -i {} ";"
find . -name "*.java" -exec sed
"s/^import\sstatic\scom\.google\.common\.\(.*;\)/import static
org.apache.jackrabbit.guava.common.\1/g" -i {} ";"
~~~

WARNING: this is destructive. Only run it on a Git checkout with no
local changes, and do not do it inside your project root. You have been
warned.

After running this, you may find that a Guava 15 method actually has
been removed. Usually googling for the method signature will tell you
what happened.
...


In the meantime, I have converted a good number of modules.

Namely missing are components from blobs, lucene, and sement storage,
where I would *really* appreciate that developers closer to that code
than me would step in.

For next week I'm planning to cut Oak 1.52.0. The plan is to remove
public APIs using native Guava by 1.54.0, and completely switch to
shaded Guava for internal use by 1.56.0.

Best regards, Julian

Plan: Deprecation of Jackrabbit Oak 1.8.x

[Julian Reschke]

Hi there,

I'm planning to officially end-of-life Jackrabbit Oak 1.8 in two weeks
(see ):

Users of Oak 1.8.* need to switch to a platform compatible with Java 8
(or newer) - the latest stable release is 1.50.0 (requiring Java 11);
the latest maintenance branch supporting Java 8 (essentially
feature-frozen) is 1.22, with the current release being 1.22.15.

What it'll mean in actual actions:

links will be removed from the download page

news will be posted on the homepage

[announce] will be sent to jr-user, jr-dev, oak-dev

branch and tags WILL stay there

label "candidate_oak_1_8" will be removed

See also http://jackrabbit.apache.org/oak/docs/roadmap.html

If you have any concerns speak out before May 9.

Best regards, Julian

Re: Guava Migration (yes, a must read)

[Julian Reschke]

On 06.04.2023 13:56, Julian Reschke wrote:

Hi everybody,

as some have noticed, we have begun the migration away from Guava 15.0
to a *shaded* version of Guava (latest and greatest).

A new subproject has been added (oak-shaded-guava), which repackages
Guava 31 under the package name o.a.jackrabbit.guava. See
<https://issues.apache.org/jira/browse/OAK-9989> for details and
discussion.

If your IDE acts weird (be it Eclipse or IntelliJ), it's because it does
not understand the shaded subproject. Sorry for that. While there's no
fix for the IDEs, the workaround is to disable oak-shaded-guava
(Intellij) or remove it (Eclipse) - after having built it locally with
Maven.


As noticed by Angela, for IntelliJ this requires a relatively recent
version. The context menu item is in the "maven" view, BTW.


We may decide at a later point to work around this by moving this out of
the reactor pom.

What's next?

1) We have a few sub projects that currently expose Guava in APIs; these
APIs have been deprecated for long, and I'll remove those APIs *after*
the next release (1.52.0).

2) In the meantime, everybody can help by converting "their" sub
projects. (If you do so, please add a sub-task to
<https://issues.apache.org/jira/browse/OAK-7182>). This usually means
adding the dependency to the POM, and rewriting import statements. I
usually just run:

~~~
#!/bin/bash

find . -name "*.java" -exec sed
"s/^import\scom\.google\.common\.\(.*;\)/import
org.apache.jackrabbit.guava.common.\1/g" -i {} ";"
find . -name "*.java" -exec sed
"s/^import\sstatic\scom\.google\.common\.\(.*;\)/import static
org.apache.jackrabbit.guava.common.\1/g" -i {} ";"
~~~

WARNING: this is destructive. Only run it on a Git checkout with no
local changes, and do not do it inside your project root. You have been
warned.

After running this, you may find that a Guava 15 method actually has
been removed. Usually googling for the method signature will tell you
what happened.

For the modules where I already did the conversion, I also took the
opportunity to convert things to standard JDK 11 lingo where simple.
https://issues.apache.org/jira/browse/OAK-10180 /
https://github.com/apache/jackrabbit-oak/pull/890 is a good example for
that.


In the meantime, I changed my mind on this. I only do the minimal
changes needed; everything else should be done as a separate activity.

While continuing this work, I encountered cases where code uses methods
that have been removed or renamed in Guava. I'm not going to work on
these subprojects; instead I will open tickets and try to assign them to
people who are more familiar with that part of the code base (see
https://issues.apache.org/jira/browse/OAK-10197 for instance).


The currently planned timeline is:

1.52.0 (May?): release with shaded guava subproject and as many
subprojects converted as possible

1.54.0 (July?): remove deprecated APIs exposing native Guava

1.56.0: completely get rid of our Guava 15 dependency, only use the
shaded variant.

Feedback either here or in
<https://issues.apache.org/jira/browse/OAK-7182> appreciated.

Julian


Best regards, Julian

[ANNOUNCE] Apache Jackrabbit Oak 1.22.15 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit Oak 1.22.15. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit Oak -- Version 1.22.15

Introduction


Jackrabbit Oak is a scalable, high-performance hierarchical content
repository designed for use as the foundation of modern world-class
web sites and other demanding content applications.

Jackrabbit Oak 1.22.15 is a patch release that contains fixes and
improvements over Oak 1.22. Jackrabbit Oak 1.22.x releases are
considered stable and targeted for production use.

The Oak effort is a part of the Apache Jackrabbit project.
Apache Jackrabbit is a project of the Apache Software Foundation.


Changes in Oak 1.22.15
--

Technical task

[OAK-10084] - oak-commons: bump up logging for deprecated Guava 
based APIs to ERROR
[OAK-10085] - oak-core-spi: bump up logging for deprecated Guava 
based APIs to ERROR


Bug

[OAK-9037] - bundle:manifest fails on Java 15
[OAK-9471] - Query for split documents by Revision GC times out
[OAK-9512] - PrefixPattern.matches(String) always returns false
[OAK-9513] - PrefixPattern ignores empty namespace prefix
[OAK-9560] - Javadoc build fails if using Java11
[OAK-9700] - RevisionGC may fail with NPE
[OAK-10051] - oak-run and oak-upgrade JARs incomplete 
(META-INF/MANIFEST.MF is missing the Main-Class entry)
[OAK-10078] - antrun for reactor pom fails due to removal of tasks 
function

[OAK-10090] - update antrun version for reactor pom
[OAK-10117] - oak-run console does not start up - 
CommandNameCompleter construction fails


Improvement

[OAK-9177] - Workaround for bug #426 in versions-maven-plugin
[OAK-9613] - Define API to retrieve parent or null for a given Item
[OAK-9618] - Use s.apache.org redirects for JCR specs/javadocs
[OAK-9800] - Update Maven Plugins and Apache Parent POM to version 29
[OAK-9819] - Improve Node.hasProperty/getProperty and 
Node.hasNode/getNode combinations
[OAK-10087] - TypeEditor: constraint exception for invalid child 
node should contain that node's effective type


Task

[OAK-8883] - Update jar plugin to 3.2.0
[OAK-9482] - upgrade httpclient to v 4.5.13
[OAK-9831] - Update spotbugs plugin to 4.7.1.0
[OAK-9832] - Update jacoco plugin to 0.8.8
[OAK-10002] - oak-core: bump up logging for deprecated Guava based 
APIs to INFO

[OAK-10032] - get rid of ant-run plugin dependency
[OAK-10040] - Update animal-sniffer dependency to 1.22
[OAK-10041] - Upgrade maven-bundle-plugin to 5.1.8
[OAK-10042] - Update checkstyle-plugin dependency to version 3.1.2
[OAK-10043] - Upgrade maven-versions-plugin to 2.14.1
[OAK-10045] - Upgrade gmavenplus-plugin to 1.13.1
[OAK-10046] - oak-it-osgi: remove unneeded workaround 
maven-resources-plugin
[OAK-10047] - oak-core: bump up logging for deprecated Guava based 
APIs to WARN

[OAK-10062] - consolidate and update groovy versions to 2.4.21
[OAK-10065] - avoid-use of groovy-all artefact
[OAK-10066] - update groovy dependency to 2.5.20
[OAK-10076] - Bump netty dependency from 4.1.68.Final to 4.1.86.Final
[OAK-10094] - Bump up warning level for deprecated uses of 
java.security.Group to ERROR

[OAK-10105] - Guava deprecations: set minimal logging level to 'info'
[OAK-10110] - add test coverage for FileIOUtils.TransformingComparator
[OAK-10122] - it-osgi: update commons-fileupload to 1.5
[OAK-10123] - solr-core: update commons-fileupload to 1.5
[OAK-10124] - upgrade httpclient/mime to 4.5.14
[OAK-10125] - upgrade httpcore to 4.4.16
[OAK-10138] - Update Oak trunk and Oak 1.22 to Jackrabbit 2.20.9



In addition to the above-mentioned changes, this release contains
all changes included up to the previous Apache Jackrabbit Oak 1.22.x 
release.


For more detailed information about all the changes in this and other
Oak releases, please see the Oak issue tracker at

  https://issues.apache.org/jira/browse/OAK

Release Contents


This release consists of a single source archive packaged as a zip file.
The archive can be unpacked with the jar tool from your JDK installation.
See the README.md file for instructions on how to build this release.

The source archive is accompanied by a SHA512 checksums and a PGP
signature that you can use to verify the authenticity of your
download. The public key used for the PGP signature can be found at
https://www.apache.org/dist/jackrabbit/KEYS.

About Apache Jackrabbit Oak
---

Jackrabbit Oak is a scalable, high-performance hierarchical content
repository designed for use as the foundation of modern world-class
web sites and other demanding content applications.

The Oak effort is a part of the Apache Jackrabbit project.
Apache 

[RESULT] [VOTE] Release Apache Jackrabbit Oak 1.22.15

[Julian Reschke]

On 04.04.2023 08:48, Julian Reschke wrote:

...



Hi there,

The vote passes as follows:

+1 Julian Reschke 
+1 Marcel Reutegger 
+1 Woonsan Ko 

Thanks for voting. I'll push the release out.

Best regards, Julian

Re: Guava Migration (yes, a must read)

[Julian Reschke]

On 06.04.2023 15:51, Marcel Reutegger wrote:

Hi Julian,

Thanks for the hard work so far. It’s really good to see progress on
this issue. I encourage everyone to contribute and migrate Oak
modules to the new shaded Guava module.

Is there a way to instruct the build to fail if someone is trying
to introduce a dependency to a shaded Guava package in an
Oak API?


That's a good idea; will do some research next week.

Guava Migration (yes, a must read)

[Julian Reschke]

Hi everybody,

as some have noticed, we have begun the migration away from Guava 15.0 
to a *shaded* version of Guava (latest and greatest).


A new subproject has been added (oak-shaded-guava), which repackages 
Guava 31 under the package name o.a.jackrabbit.guava. See 
 for details and discussion.


If your IDE acts weird (be it Eclipse or IntelliJ), it's because it does 
not understand the shaded subproject. Sorry for that. While there's no 
fix for the IDEs, the workaround is to disable oak-shaded-guava 
(Intellij) or remove it (Eclipse) - after having built it locally with 
Maven.


We may decide at a later point to work around this by moving this out of 
the reactor pom.


What's next?

1) We have a few sub projects that currently expose Guava in APIs; these 
APIs have been deprecated for long, and I'll remove those APIs *after* 
the next release (1.52.0).


2) In the meantime, everybody can help by converting "their" sub 
projects. (If you do so, please add a sub-task to 
). This usually means 
adding the dependency to the POM, and rewriting import statements. I 
usually just run:


~~~
#!/bin/bash

find . -name "*.java" -exec sed 
"s/^import\scom\.google\.common\.\(.*;\)/import 
org.apache.jackrabbit.guava.common.\1/g" -i {} ";"
find . -name "*.java" -exec sed 
"s/^import\sstatic\scom\.google\.common\.\(.*;\)/import static 
org.apache.jackrabbit.guava.common.\1/g" -i {} ";"

~~~

WARNING: this is destructive. Only run it on a Git checkout with no 
local changes, and do not do it inside your project root. You have been 
warned.


After running this, you may find that a Guava 15 method actually has 
been removed. Usually googling for the method signature will tell you 
what happened.


For the modules where I already did the conversion, I also took the 
opportunity to convert things to standard JDK 11 lingo where simple. 
https://issues.apache.org/jira/browse/OAK-10180 / 
https://github.com/apache/jackrabbit-oak/pull/890 is a good example for 
that.


The currently planned timeline is:

1.52.0 (May?): release with shaded guava subproject and as many 
subprojects converted as possible


1.54.0 (July?): remove deprecated APIs exposing native Guava

1.56.0: completely get rid of our Guava 15 dependency, only use the 
shaded variant.


Feedback either here or in 
 appreciated.


Julian

[ANNOUNCE] Apache Jackrabbit 2.21.16 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit 2.21.16. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit -- Version 2.21.16

Introduction


This is Apache Jackrabbit(TM) 2.21.16, a fully compliant implementation 
of the

Content Repository for Java(TM) Technology API, version 2.0 (JCR 2.0) as
specified in the Java Specification Request 283 (JSR 283).

Apache Jackrabbit 2.21.16 is an unstable release cut directly from
Jackrabbit trunk, with a focus on new features and other
improvements. For production use we recommend the latest stable 2.20.x
release.

Changes in Jackrabbit 2.21.16
-

Bug

[JCR-4907] - Javadocs have incorrect copyright date
[JCR-4917] - spi-commons: NameParser is too picky (allow non-ASCII 
whitespace)


Task

[JCR-4908] - Update commons file-upload dependency to 1.5
[JCR-4909] - specify maven-rar-plugin dependency
[JCR-4910] - Update tomcat dependency to 8.5.86
[JCR-4912] - set baseline comparisonVersion to latest stable (2.20.9)
[JCR-4913] - spi-commons: improve error messages for 
org.apache.jackrabbit.spi.commons.conversion.NameParser.parse

[JCR-4918] - vfs-ext: update hadoop-hdfs-client dependency to 3.3.5
[JCR-4919] - Update tomcat dependency to 8.5.87
[JCR-4922] - Remove javadoc-plugin dependency (use the one provided 
by Apache parent pom)
[JCR-4923] - Remove release-plugin dependency (use the one provided 
by Apache parent pom)



For more detailed information about all the changes in this and other
Jackrabbit releases, please see the Jackrabbit issue tracker at

https://issues.apache.org/jira/browse/JCR

Release Contents


This release consists of a single source archive packaged as a zip file.
The archive can be unpacked with the jar tool from your JDK installation.
See the README.txt file for instructions on how to build this release.

The source archive is accompanied by an SHA512 checksum and a
PGP signature that you can use to verify the authenticity of your
download. The public key used for the PGP signature can be found at
https://www.apache.org/dist/jackrabbit/KEYS.

About Apache Jackrabbit
---

Apache Jackrabbit is a fully conforming implementation of the Content
Repository for Java Technology API (JCR). A content repository is a
hierarchical content store with support for structured and unstructured
content, full text search, versioning, transactions, observation, and
more.

For more information, visit http://jackrabbit.apache.org/

About The Apache Software Foundation


Established in 1999, The Apache Software Foundation provides organizational,
legal, and financial support for more than 140 freely-available,
collaboratively-developed Open Source projects. The pragmatic Apache License
enables individual and commercial users to easily deploy Apache software;
the Foundation's intellectual property framework limits the legal exposure
of its 3,800+ contributors.

For more information, visit http://www.apache.org/

Trademarks
--

Apache Jackrabbit, Jackrabbit, Apache, the Apache feather logo, and the 
Apache

Jackrabbit project logo are trademarks of The Apache Software Foundation.

Re: [VOTE] Release Apache Jackrabbit Oak 1.22.15

[Julian Reschke]

On 04.04.2023 08:48, Julian Reschke wrote:

...


[X] +1 Release this package as Apache Jackrabbit Oak 1.22.15

...where...


[INFO] Apache Maven 3.6.3 (cecedd343002696d0abb50b32b541b8a6ba2883f)
[INFO] OS name: "windows 11", version: "10.0", arch: "amd64", family: "windows"
[INFO] Java version: 11.0.16.1, vendor: Oracle Corporation, runtime: 
C:\usr\local\jdk-11.0.16.1
[INFO] MAVEN_OPTS: -Xmx2g


Best regards, Julian

[VOTE] Release Apache Jackrabbit Oak 1.22.15

[Julian Reschke]

A candidate for the Jackrabbit Oak 1.22.15 release is available at:

https://dist.apache.org/repos/dist/dev/jackrabbit/oak/1.22.15/

The release candidate is a zip archive of the sources in:

 https://github.com/apache/jackrabbit-oak/tree/jackrabbit-oak-1.22.15/

The SHA1 checksum of the archive is
8851c6dfcece935fcab2af013e96bac00c45a860.

A staged Maven repository is available for review at:

https://repository.apache.org/

The command for running automated checks against this release candidate is:

# run in SVN checkout of
https://dist.apache.org/repos/dist/dev/jackrabbit
$ sh check-release.sh oak 1.22.15
8851c6dfcece935fcab2af013e96bac00c45a860

Please vote on releasing this package as Apache Jackrabbit Oak 1.22.15.
The vote is open for the next 72 hours and passes if a majority of at
least three +1 Jackrabbit PMC votes are cast.

[ ] +1 Release this package as Apache Jackrabbit Oak 1.22.15
[ ] -1 Do not release this package because...

Best regards, Julian

Jackrabbit Oak 1.22.15 Release Plan

[Julian Reschke]

Hi,

I'm planning to cut Jackrabbit Oak 1.22.15 on Tuesday.

The list of open issues scheduled for 1.22.15 is empty:

https://issues.apache.org/jira/issues/?jql=fixVersion%20%3D%201.22.15%20AND%20project%20%3D%20OAK%20AND%20resolution%20%3D%20Unresolved%20ORDER%20BY%20priority%20DESC

The CI tests are passing:

https://ci-builds.apache.org/job/Jackrabbit/job/jackrabbit-oak-1.22/

(most of the time; will need to investigate CI flakiness...)

The candidate release notes are here:

https://github.com/apache/jackrabbit-oak/blob/1.22/RELEASE-NOTES.txt

If there are any objections please let me know.

Best regards, Julian

[ANNOUNCE] Apache Jackrabbit Oak 1.50.0 released

[Julian Reschke]

The Apache Jackrabbit community is pleased to announce the release of
Apache Jackrabbit Oak 1.50.0. The release is available for download at:

 http://jackrabbit.apache.org/downloads.html

See the full release notes below for details about this release:



Release Notes -- Apache Jackrabbit Oak -- Version 1.50.0

Introduction


Jackrabbit Oak is a scalable, high-performance hierarchical content
repository designed for use as the foundation of modern world-class
web sites and other demanding content applications.

Apache Jackrabbit Oak 1.50.0 is an incremental feature release based
on and compatible with earlier stable Jackrabbit Oak 1.x
releases. This release is considered stable and targeted for
production use.

While Oak 1.50.0 compiles and tests successfully on Java 17, Javadocs
generation fails on Java 17 (but works as expected on Java 11).

The Oak effort is a part of the Apache Jackrabbit project.
Apache Jackrabbit is a project of the Apache Software Foundation.

Changes in Oak 1.50.0
-

Technical task

[OAK-10007] - update Guava related deprecations with 'since' and 
'forRemoval' properties
[OAK-10084] - oak-commons: bump up logging for deprecated Guava 
based APIs to ERROR
[OAK-10085] - oak-core-spi: bump up logging for deprecated Guava 
based APIs to ERROR
[OAK-10109] - deprecate FileIOUtils.TransformingComparator with 
Guava Function parameter


Bug

[OAK-9827] - Flaky test: SplitPersistenceBlobTest
[OAK-9938] - oak-run GenerateVersionInconsistencyReport exception
[OAK-10081] - oak-run tests left over "blobs" (next to "src")
[OAK-10082] - Group.getMembers() needs to resolve inherited members 
of dynamic groups

[OAK-10090] - update antrun version for reactor pom
[OAK-10092] - doc-railroad project fails on Java 11; 
plexus-component-metadata needs update

[OAK-10095] - NullPointerException in FieldFactory.dateToLong
[OAK-10112] - avoid use of Guava Iterators.emptyIterator
[OAK-10117] - oak-run console does not start up - 
CommandNameCompleter construction fails

[OAK-10120] - SessionImpl.hasCapability is prone to NPE
[OAK-10136] - DynamicBoostLite scores matches on tags equally with 
matches on other fields

[OAK-10137] - Static variable referenced from a non-static context

New Feature

[OAK-10001] - Bump up minimal Java version to 11

Improvement

[OAK-10049] - Enable access to the secondary Azure blobstore 
service endpoint in Oak blobstore
[OAK-10087] - TypeEditor: constraint exception for invalid child 
node should contain that node's effective type

[OAK-10099] - DynamicSyncContext: skip warning for everyone group
[OAK-10102] - Disable lazy index download by default
[OAK-10114] - Node diff with many changes uses excessive memory
[OAK-10119] - Fix AzureJournalFileTest failures on slow Jenkins
[OAK-10121] - Extend SessionImpl.hasCapability to cover access 
control write operations
[OAK-10131] - ExternalGroupPrincipalProvider should return 
ItemBasedPrincipals if dynamic group option is enabled
[OAK-10132] - Duplication in XPathConditionVisitor and 
ImpersonationImpl

[OAK-10145] - Rate limit the log messages for IndexUpdate

Task

[OAK-10086] - oak-core: bump up logging for deprecated Guava based 
APIs to ERROR
[OAK-10098] - Oak Run - PurgeOldIndexVersion - Add support to auto 
purge ES indexes and delete remote ES indexes as well
[OAK-10101] - Improve exception message when retrieving String 
properties
[OAK-10103] - oak-store-document: remove deprecated 
SystemPropertySupplier

[OAK-10104] - Extend version consistency check
[OAK-10105] - Guava deprecations: set minimal logging level to 'info'
[OAK-10110] - add test coverage for FileIOUtils.TransformingComparator
[OAK-10111] - oak-search-elastic: add support for custom analyzers
[OAK-10113] - Lower error to warn in findUncachedWithRetry, to 
clarify the severity
[OAK-10118] - Inconsistency in 'order by' handling of missing field 
between Lucene / Elastic

[OAK-10122] - it-osgi: update commons-fileupload to 1.5
[OAK-10123] - solr-core: update commons-fileupload to 1.5
[OAK-10124] - upgrade httpclient/mime to 4.5.14
[OAK-10125] - upgrade httpcore to 4.4.16
[OAK-10126] - Extend consistency check to cover jcr:predecessors 
and jcr:successors

[OAK-10128] - Disable coverage check for oak-jcr integration tests
[OAK-10129] - Disable Sonar checks on PRs from forks - take 2
[OAK-10133] - Fix AzureJournalFileTest failing on slow Jenkins
[OAK-10134] - Update Oak GitHub actions
[OAK-10138] - Update Oak trunk and Oak 1.22 to Jackrabbit 2.20.9
[OAK-10144] - allow Javadoc errors on oak-run(-*)

Documentation

[OAK-10069] - Best practices on how to setup access control 
external identities
[OAK-10107] - update javdoc of class 
org.apache.jackrabbit.oak.plugins.nodetype.write.ReadWriteNodeTypeManager



In addition to the 

[RESULT] [VOTE] Release Apache Jackrabbit Oak 1.50.0

[Julian Reschke]

On 18.03.2023 10:50, Julian Reschke wrote:

...


Hi there,

The vote passes as follows:

+1 Julian Reschke 
+1 Marcel Reutegger 
+1 Woonsan Ko 

Thanks for voting. I'll push the release out.

Best regards, Julian