Skip to content

docs: complete the 0.1.0 changelog #50

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
garydgregory merged 4 commits into from
Aug 26, 2026
Merged

docs: complete the 0.1.0 changelog #50

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
32cbbc2
docs: complete the 0.1.0 changelog
ppkarwasz Aug 26, 2026
fef8d78
docs: leave RELEASE-NOTES.txt to the release process
ppkarwasz Aug 26, 2026
281fb1c
Merge branch 'main' into docs/changelog-0.1.0
garydgregory Aug 26, 2026
3ae36a1
fix: merge changelog
ppkarwasz Aug 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 15 additions & 4 deletions src/changes/changes.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,11 +32,22 @@ The <action> type attribute can be add, update, fix, or remove.
</properties>
<body>
<release version="0.1.0" date="YYYY-MM-DD" description="First release.">
<action type="add" dev="ppkarwasz">
Secure-by-default JAXP factory creation via XmlFactories, with implementation-specific hardening recipes for the
stock JDK, Android, Apache Xalan, Apache Xerces, Woodstox, and Saxon-HE.
</action>
<!-- ADD -->
<action type="add" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary Gregory">Add secure-by-default JAXP factory creation via XmlFactories, donated from the copernik-xml-factory project (https://github.com/copernik-eu/copernik-xml-factory) and covering the stock JDK, Android, Apache Xalan, Apache Xerces, Woodstox, and Saxon-HE.</action>
<action type="add" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary Gregory" issue="COMMONSXML-9">Install a non-removable resolver floor on every resolver channel (EntityResolver, LSResourceResolver, URIResolver, and XMLResolver), routing caller-supplied resolvers through it as allow-lists.</action>
<action type="add" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary Gregory">Harden the SAXTransformerFactory extension surface (TransformerHandler, TemplatesHandler, and XMLFilter) and TransformerFactory.getAssociatedStylesheet.</action>
<action type="add" dev="ppkarwasz" due-to="Piotr P. Karwasz, Jarek Potiuk, Gary Gregory">Document the threat model on the project site, including the denied-fetch contract and the supported runtime floor (OpenJDK 8 and Android API 33 or later).</action>
<action type="add" dev="ppkarwasz" due-to="Gary Gregory, Piotr P. Karwasz" issue="COMMONSXML-11">Add GitHub CI builds for Java 26 and 27-EA.</action>
<!-- FIX -->
<action type="fix" dev="ppkarwasz" due-to="Ta Duc Thien, Piotr P. Karwasz, Gary Gregory" issue="COMMONSXML-10">Block XInclude (xi:include) href resolution by default, since the JAXP external-access properties do not govern it.</action>
<action type="fix" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary Gregory">Restore the hardened configuration when a factory or parser is reset() instead of reverting to the implementation defaults.</action>
<action type="fix" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary Gregory">Parse a Source opted in by a caller-supplied URIResolver using a hardened parser.</action>
<!-- UPDATE -->
<action type="update" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary Gregory" issue="COMMONSXML-1,COMMONSXML-5,COMMONSXML-6,COMMONSXML-7,COMMONSXML-8">Recognize XML implementations by the JAXP features and properties they support instead of by their implementation class name, extending the hardening to any compliant implementation.</action>
<action type="update" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary Gregory" issue="COMMONSXML-4">Define a consistent contract for denied external fetches: unresolved external references resolve to empty content on every implementation, unless the org.apache.commons.xml.throwOnUnresolved system property requests rejection.</action>
<action type="update" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary Gregory" issue="COMMONSXML-3">Reduce the shaded footprint by splitting the hardeners and resolver floors into independent entry points.</action>
<!-- REMOVE -->
<action type="remove" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary Gregory" issue="COMMONSXML-2">Remove the Limits class that applied uniform processing limits across implementations.</action>
</release>
</body>
</document>
Loading