Merge branch 'apache:main' into feature/CXF-8811

.github/workflows/scorecards.yml

@@ -49,7 +49,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # tag=v4.3.3
+        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # tag=v4.3.4
         with:
           name: SARIF file
           path: results.sarif

distribution/src/main/release/release_notes.txt

@@ -1,4 +1,4 @@
-Apache CXF 4.0.4 Release Notes
+Apache CXF 4.0.5 Release Notes
 
 1. Overview
 
@@ -21,7 +21,7 @@ for further information and requirements for upgrading from earlier
 versions of CXF.
 
 
-4.0.4 fixes over 28 JIRA issues reported by users and the community.
+4.0.5 fixes over 19 JIRA issues reported by users and the community.
 
 
 2. Installation Prerequisites 
@@ -63,50 +63,34 @@ for caveats when upgrading.
 
 7. Specific issues, features, and improvements fixed in this version
 
-
 ** Bug
-    * [CXF-8812] - Content-Type header created with collection containing "null" value
-    * [CXF-8834] - "Operation [{.../wsdl}Issue] already exists" when calling JaxWsServerFactoryBean.create() for SecurityTokenService
-    * [CXF-8932] - [WSDL2JAVA] Not working on JDK11
-    * [CXF-8936] - Fix h2 protocol negotiation in Jetty Transport
-    * [CXF-8939] - java.lang.NullPointerException: Cannot invoke "java.util.List.size()" because the return value of "java.util.Map$Entry.getValue()" is null
-    * [CXF-8940] - ws-security.must-understand works only if security.enable.streaming is true
-    * [CXF-8944] - wsdl2java frontend jaxws21 doesn't work
-    * [CXF-8945] - [JAX-WS] The client out interceptor chain is not called in case of oneway operation
-    * [CXF-8946] - HttpClient in CXF causing memory leak
-    * [CXF-8952] - HttpClientHTTPConduit in CXF doesn't support TLSv1.3 along with other protocols
-    * [CXF-8955] - Custom timeout with Message.RECEIVE_TIMEOUT not working with hc5 / hc
-    * [CXF-8957] - The org.apache.cxf.systest.jaxrs.JAXRSMultipartTest randomly hangs under JDK-21
-    * [CXF-8959] - Detect order dependent flakiness in AttachmentUtilTest.java in core module
-    * [CXF-8962] - HttpClientHTTPConduit sets Content-Type Header for DELETE requests with empty body
-    * [CXF-8963] - URI is always unknown in server request metrics 
-    * [CXF-8964] - Update Bouncycastle from unsupported xxx-jdk15on to xxx-jdk18on
-    * [CXF-8965] - Apache CXF Netty Integration, URI not encoded
-    * [CXF-8978] - Codegen plugin fails with IBM JDK
-    * [CXF-8983] - cxf-services-sts-core should depend on cxf-rt-rs-security-jose instead of cxf-rt-rs-security-jose-jaxrs
-    * [CXF-8984] - HttpClientHTTPConduit.HttpClientWrappedOutputStream throws NPE in closeInputStream()
-
-
-** New Feature
-    * [CXF-8911] - Allow creating a custom CXFHttpAsyncResponseConsumer
-    * [CXF-8970] - ensure we can build and run without bouncycastle dependencies
+    * [CXF-8951] - Concurrent WebClient usage causes massive thread overhead
+    * [CXF-8980] - JaxRS client - receive timeout not working since CXF 4.0.1
+    * [CXF-8987] - Java 21 - HttpClientHTTPConduit thread locked during shutdown 
+    * [CXF-9007] - NullPointerException in XMLStreamDataWriter.writeNode
+    * [CXF-9009] - Async operations fail in concurrent calls
+    * [CXF-9011] - WSDLTo JAXWS Frontend service.vm Velocity template uses deprecated URL constructor
+    * [CXF-9015] - Typo in JsonMapObjectReaderWriter treats \h as a special character instead of \n
+    * [CXF-9030] - "-suppress-generated-date" does not omit timestamps from @Generated
 
 
-** Improvement
-    * [CXF-8894] - ContextHandler - Unimplemented getRequestCharacterEncoding() - use org.eclipse.jetty.servlet.ServletContextHandler
-    * [CXF-8928] - Reduce code quality warnings in generated code
-    * [CXF-8933] - Add doPrivileged block to ProxyFactoryProxySelector.select() in  HttpClientHTTPConduit
-    * [CXF-8937] - Add `cxf-integration-tracing-micrometer` to bom
-    * [CXF-8948] - wsdlto tool should throw exception when bindingFiles is invalid
-    * [CXF-8953] - Better support of the HTTPS protocol versions used by client/server conduits
-    * [CXF-8954] - Always create MBeanServer instance per Jetty Server instance and destroy server properly at shutdown
-    * [CXF-8968] - OpenTelemetryClientFeature cannot be used as a CDI bean unless it has a no-args constructor
 
 
+** Improvement
+    * [CXF-8971] - Introduce a customerizedAlgorithmSuite and make all parameters of it configurable
+    * [CXF-8982] - LoggingFeature does not hide sensitive xml elements with namespace prefix
+    * [CXF-8988] - Update to Spring Security 6.1.x release line
+    * [CXF-8996] - JAXRS Bean introspection utility Beanspector relies on Class.getMethods natural order
+    * [CXF-9016] - Upgrade Spring-Framework to 5.3.34 in Apache-cxf
+
 ** Test
-    * [CXF-8981] - WSS4J  Encyption using the Key Agreement Method with the apache-CXF
+    * [CXF-8994] - CorbaConduitTest no longer requires IBM JDK destination activation routine.
+    * [CXF-8997] - AbstractSTSTokenTest and TransportBindingTests no longer need to set https protocol to TLSv1 on IBM Java
+    * [CXF-8999] - KerberosTokenTest testKerberosViaCustomTokenAction should not run on IBM Java
+    * [CXF-9006] - TrustedAuthorityValidatorCRLTest#testIsCertChainValid fails when using Red Hat OpenJDK on PPC64LE
+    * [CXF-9019] - Increase unit test coverage on cxf-rt-frontend-jaxws jaxws spi package.
 
 
 ** Task
-    * [CXF-8935] - Add doPrivileged block to httpclient.sendAsync() in HttpClientHTTPConduit
+    * [CXF-9001] - CDI extension not comptible with IBM Semeru
 

distribution/src/main/release/samples/pom.xml

@@ -32,8 +32,8 @@
         <maven.deploy.skip>true</maven.deploy.skip>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <cxf.spring.boot.version>3.3.1</cxf.spring.boot.version>
-        <cxf.spring.cloud.eureka.version>4.1.2</cxf.spring.cloud.eureka.version>
-        <cxf.jetty12.version>12.0.10</cxf.jetty12.version>
+        <cxf.spring.cloud.eureka.version>4.1.3</cxf.spring.cloud.eureka.version>
+        <cxf.jetty12.version>12.0.11</cxf.jetty12.version>
         <cxf.netty.version>4.1.111.Final</cxf.netty.version>
         <cxf.httpcomponents.client.version>4.5.14</cxf.httpcomponents.client.version>
         <cxf.swagger.ui.version>5.17.14</cxf.swagger.ui.version>
@@ -227,7 +227,7 @@
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-surefire-plugin</artifactId>
-                    <version>3.3.0</version>
+                    <version>3.3.1</version>
                 </plugin>
                 <plugin>
                 <groupId>org.apache.maven.plugins</groupId>

parent/pom.xml

@@ -92,7 +92,7 @@
         <cxf.arquillian.version>1.8.0.Final</cxf.arquillian.version>
         <cxf.arquillian.weld.container.version>3.0.2.Final</cxf.arquillian.weld.container.version>
         <cxf.aspectj.version>1.9.22.1</cxf.aspectj.version>
-        <cxf.assertj.version>3.26.0</cxf.assertj.version>
+        <cxf.assertj.version>3.26.3</cxf.assertj.version>
         <cxf.atmosphere.version.range>[3.0, 4.0)</cxf.atmosphere.version.range>
         <cxf.atmosphere.version>3.0.8</cxf.atmosphere.version>
         <cxf.bcprov.version>1.77</cxf.bcprov.version>
@@ -113,7 +113,7 @@
         <cxf.ehcache3.version>3.10.8</cxf.ehcache3.version>
         <cxf.el-api.version>5.0.1</cxf.el-api.version>
         <cxf.findbugs.version>3.0.2</cxf.findbugs.version>
-        <cxf.jvnet.jaxb.version>4.0.7</cxf.jvnet.jaxb.version>
+        <cxf.jvnet.jaxb.version>4.0.8</cxf.jvnet.jaxb.version>
         <cxf.geronimo.jta.version>1.1.1</cxf.geronimo.jta.version>
         <cxf.geronimo.openapi.version>1.0.15</cxf.geronimo.openapi.version>
         <cxf.glassfish.el.version>4.0.2</cxf.glassfish.el.version>
@@ -122,7 +122,7 @@
         <cxf.hamcrest.version>2.2</cxf.hamcrest.version>
         <cxf.hazelcast.version>5.4.0</cxf.hazelcast.version>
         <cxf.hibernate.em.version>6.5.2.Final</cxf.hibernate.em.version>
-        <cxf.hibernate.validator.version>7.0.5.Final</cxf.hibernate.validator.version>
+        <cxf.hibernate.validator.version>8.0.1.Final</cxf.hibernate.validator.version>
         <cxf.hsqldb.version>2.7.3</cxf.hsqldb.version>
         <cxf.httpcomponents.asyncclient.version.range>[4.0,4.2)</cxf.httpcomponents.asyncclient.version.range>
         <cxf.httpcomponents.asyncclient.version>4.1.5</cxf.httpcomponents.asyncclient.version>
@@ -132,7 +132,7 @@
         <cxf.httpcomponents.client5.version>5.2.1</cxf.httpcomponents.client5.version>
         <cxf.httpcomponents.core5.version>5.2.4</cxf.httpcomponents.core5.version>
         <cxf.jackson.version>2.17.1</cxf.jackson.version>
-        <cxf.jackson.databind.version>2.17.1</cxf.jackson.databind.version>
+        <cxf.jackson.databind.version>2.17.2</cxf.jackson.databind.version>
         <cxf.jacorb.version>3.9</cxf.jacorb.version>
         <cxf.jaeger.version>1.8.1</cxf.jaeger.version>
         <cxf.jakarta.activation.version>2.1.3</cxf.jakarta.activation.version>
@@ -161,7 +161,7 @@
         <cxf.jcache.version>1.1.1</cxf.jcache.version>
         <cxf.jdom.version>1.0</cxf.jdom.version>
         <cxf.jettison.version>1.5.4</cxf.jettison.version>
-        <cxf.jetty12.version>12.0.10</cxf.jetty12.version>
+        <cxf.jetty12.version>12.0.11</cxf.jetty12.version>
         <cxf.jetty.version>${cxf.jetty12.version}</cxf.jetty.version>
         <cxf.jexl.version>3.3</cxf.jexl.version>
         <cxf.joda.time.version>2.10.10</cxf.joda.time.version>
@@ -177,8 +177,8 @@
         <cxf.logback.classic.version>1.5.6</cxf.logback.classic.version>
         <cxf.lucene.version>9.11.1</cxf.lucene.version>
         <cxf.maven.core.version>3.9.8</cxf.maven.core.version>
-        <cxf.micrometer.version>1.13.1</cxf.micrometer.version>
-        <cxf.micrometer-tracing.version>1.3.1</cxf.micrometer-tracing.version>
+        <cxf.micrometer.version>1.13.2</cxf.micrometer.version>
+        <cxf.micrometer-tracing.version>1.3.2</cxf.micrometer-tracing.version>
         <cxf.microprofile.config.version>3.1</cxf.microprofile.config.version>
         <cxf.microprofile.rest.client.version>3.0.1</cxf.microprofile.rest.client.version>
         <cxf.microprofile.openapi.version>3.1.1</cxf.microprofile.openapi.version>
@@ -191,16 +191,16 @@
         <cxf.netty.tcnative.version>2.0.46.Final</cxf.netty.tcnative.version>
         <cxf.olingo.version>2.0.12</cxf.olingo.version>
         <cxf.openjpa.version>3.2.2</cxf.openjpa.version>
-        <cxf.opentelemetry.version>1.39.0</cxf.opentelemetry.version>
-        <cxf.opentelemetry.semconv.version>1.25.0-alpha</cxf.opentelemetry.semconv.version>
+        <cxf.opentelemetry.version>1.40.0</cxf.opentelemetry.version>
+        <cxf.opentelemetry.semconv.version>1.26.0-alpha</cxf.opentelemetry.semconv.version>
         <cxf.opentracing.version>0.33.0</cxf.opentracing.version>
         <cxf.openwebbeans.version>2.0.27</cxf.openwebbeans.version>
         <cxf.parsson.version>1.1.6</cxf.parsson.version>
         <cxf.persistence-api.version>3.1.0</cxf.persistence-api.version>
-        <cxf.plexus-archiver.version>4.9.2</cxf.plexus-archiver.version>
+        <cxf.plexus-archiver.version>4.10.0</cxf.plexus-archiver.version>
         <cxf.plexus-utils.version>3.5.1</cxf.plexus-utils.version>
         <cxf.reactivestreams.version>1.0.4</cxf.reactivestreams.version>
-        <cxf.reactor.version>3.6.7</cxf.reactor.version>
+        <cxf.reactor.version>3.6.8</cxf.reactor.version>
         <cxf.rhino.version>1.7.15</cxf.rhino.version>
         <cxf.rxjava.version>1.3.8</cxf.rxjava.version>
         <cxf.rxjava2.version>2.2.21</cxf.rxjava2.version>
@@ -216,7 +216,7 @@
         <cxf.spring.ldap.version>3.2.4</cxf.spring.ldap.version>
         <cxf.spring.mock>spring-test</cxf.spring.mock>
         <cxf.spring.security.version>6.3.1</cxf.spring.security.version>
-        <cxf.spring.version>6.1.10</cxf.spring.version>
+        <cxf.spring.version>6.1.11</cxf.spring.version>
         <cxf.stax-ex.version>1.8.3</cxf.stax-ex.version>
         <cxf.swagger.ui.version>5.17.14</cxf.swagger.ui.version>
         <cxf.swagger.v3.version>2.2.22</cxf.swagger.v3.version>
@@ -275,7 +275,8 @@
         <cxf.wsdl4j.bundle.version>1.6.3_1</cxf.wsdl4j.bundle.version>
         <cxf.xmlresolver.bundle.version>1.2_5</cxf.xmlresolver.bundle.version>
         <cxf.xpp3.bundle.version>1.1.4c_6</cxf.xpp3.bundle.version>
-        <cxf.awaitility.version>4.2.1</cxf.awaitility.version>
+        <!-- Downgrade to 4.2.0 due to https://github.com/awaitility/awaitility/pull/279 -->
+        <cxf.awaitility.version>4.2.0</cxf.awaitility.version>
     </properties>
     <build>
         <resources>
@@ -582,12 +583,12 @@
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-invoker-plugin</artifactId>
-                    <version>3.6.0</version>
+                    <version>3.7.0</version>
                     <dependencies>
                         <dependency>
                             <groupId>org.apache.groovy</groupId>
                             <artifactId>groovy</artifactId>
-                            <version>4.0.21</version>
+                            <version>4.0.22</version>
                         </dependency>
                     </dependencies>
                 </plugin>

pom.xml

@@ -45,7 +45,7 @@
         <cxf.jdk.version>17</cxf.jdk.version>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <site.deploy.url>scp://people.apache.org/www/cxf.apache.org/maven-site</site.deploy.url>
-        <maven-owasp-plugin-version>10.0.1</maven-owasp-plugin-version>
+        <maven-owasp-plugin-version>10.0.2</maven-owasp-plugin-version>
         <preparationGoals>clean install</preparationGoals>
     </properties>
     <distributionManagement>
@@ -490,7 +490,7 @@
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-surefire-plugin</artifactId>
-                    <version>3.3.0</version>
+                    <version>3.3.1</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
@@ -559,7 +559,7 @@
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-surefire-report-plugin</artifactId>
-                    <version>3.3.0</version>
+                    <version>3.3.1</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>

systests/jaxrs/src/test/java/org/apache/cxf/systest/jaxrs/JAXRS20ClientServerBookTest.java

@@ -99,6 +99,7 @@
 import static org.hamcrest.Matchers.greaterThan;
 import static org.hamcrest.Matchers.hasKey;
 import static org.hamcrest.Matchers.lessThan;
+import static org.hamcrest.Matchers.lessThanOrEqualTo;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotNull;
@@ -164,8 +165,11 @@ public void testGetGenericBookManyClientsInParallel() throws InterruptedExceptio
                 .mapToObj(id -> threadMXBean.getThreadInfo(id))
                 .filter(Objects::nonNull)
                 .filter(t -> t.getThreadName().startsWith("HttpClient-"))
+                .filter(t -> t.getThreadName().endsWith("-SelectorManager"))
                 .count();
 
+        // Capture the number of client threads at start
+        final long expectedHttpClientThreads = captureHttpClientThreads.get();
         final Collection<WebClient> clients = new ArrayList<>();
         try {
             final String target = "http://localhost:" + PORT + "/bookstore/genericbooks/123";
@@ -198,8 +202,8 @@ public void testGetGenericBookManyClientsInParallel() throws InterruptedExceptio
         clients.forEach(WebClient::close);
 
         // Since JDK-21, HttpClient Implements AutoCloseable
-        if (Runtime.version().feature() > 21) { 
-            assertThat(httpClientThreads.get(), equalTo(0L));
+        if (Runtime.version().feature() >= 21) { 
+            assertThat(captureHttpClientThreads.get(), lessThanOrEqualTo(expectedHttpClientThreads));
         }
     }
 
@@ -215,10 +219,11 @@ public void testGetGenericBookSingleClientInParallel() throws InterruptedExcepti
                 .mapToObj(id -> threadMXBean.getThreadInfo(id))
                 .filter(Objects::nonNull)
                 .filter(t -> t.getThreadName().startsWith("HttpClient-"))
+                .filter(t -> t.getThreadName().endsWith("-SelectorManager"))
                 .count();
 
         // Capture the number of client threads at start
-        final long httpClientThreads = captureHttpClientThreads.get();
+        final long expectedHttpClientThreads = captureHttpClientThreads.get();
         final WebClient client = WebClient.create(target, true);
         try {
             final Collection<Future<?>> futures = new ArrayList<>(); 
@@ -245,13 +250,13 @@ public void testGetGenericBookSingleClientInParallel() throws InterruptedExcepti
 
         pool.shutdown();
         // Since JDK-21, HttpClient Implements AutoCloseable
-        if (pool.awaitTermination(2, TimeUnit.MINUTES) && Runtime.version().feature() > 21) {
-            assertThat(captureHttpClientThreads.get(), equalTo(httpClientThreads));
+        if (pool.awaitTermination(2, TimeUnit.MINUTES) && Runtime.version().feature() >= 21) {
+            assertThat(captureHttpClientThreads.get(), lessThanOrEqualTo(expectedHttpClientThreads));
         } else {
             pool.shutdownNow();
             // Since JDK-21, HttpClient Implements AutoCloseable
-            if (pool.awaitTermination(2, TimeUnit.MINUTES) && Runtime.version().feature() > 21) {
-                assertThat(captureHttpClientThreads.get(), equalTo(httpClientThreads));
+            if (pool.awaitTermination(2, TimeUnit.MINUTES) && Runtime.version().feature() >= 21) {
+                assertThat(captureHttpClientThreads.get(), lessThanOrEqualTo(expectedHttpClientThreads));
             }
         }
     }

systests/microprofile/pom.xml

@@ -49,6 +49,30 @@
                 <version>${cxf.arquillian.version}</version>
                 <scope>test</scope>
             </dependency>
+            <dependency>
+                <groupId>org.jboss.arquillian.container</groupId>
+                <artifactId>arquillian-container-spi</artifactId>
+                <version>${cxf.arquillian.version}</version>
+                <scope>test</scope>
+            </dependency>
+            <dependency>
+                <groupId>org.jboss.arquillian.testenricher</groupId>
+                <artifactId>arquillian-testenricher-cdi-jakarta</artifactId>
+                <version>${cxf.arquillian.version}</version>
+                <scope>test</scope>
+            </dependency>
+            <dependency>
+                <groupId>org.jboss.arquillian.test</groupId>
+                <artifactId>arquillian-test-spi</artifactId>
+                <version>${cxf.arquillian.version}</version>
+                <scope>test</scope>
+            </dependency>
+            <dependency>
+                <groupId>org.jboss.arquillian.container</groupId>
+                <artifactId>arquillian-container-test-spi</artifactId>
+                <version>${cxf.arquillian.version}</version>
+                <scope>test</scope>
+            </dependency>
             <dependency>
                 <groupId>commons-logging</groupId>
                 <artifactId>commons-logging</artifactId>