You are viewing a plain text version of this content. The canonical link for it is here.
- [PR] Bump org.apache.maven.plugins:maven-surefire-report-plugin from 3.5.5 to 3.5.6 [cxf-xjc-utils] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/01 02:18:30 UTC, 1 replies.
- [PR] Bump org.apache.maven.plugins:maven-dependency-plugin from 3.10.0 to 3.11.0 [cxf-xjc-utils] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/01 02:18:56 UTC, 1 replies.
- [PR] Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.5 to 3.5.6 [cxf-xjc-utils] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/01 02:19:00 UTC, 1 replies.
- [PR] Bump github/codeql-action from 4.35.5 to 4.36.0 [cxf-xjc-utils] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/01 02:20:52 UTC, 1 replies.
- [PR] Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.5 to 3.5.6 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/01 04:42:51 UTC, 1 replies.
- [PR] Bump github/codeql-action from 4.35.5 to 4.36.0 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/01 04:43:32 UTC, 1 replies.
- [PR] Bump cxf.dropwizard5.version from 5.0.6 to 5.0.7 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/01 04:43:57 UTC, 1 replies.
- [PR] Bump org.apache.maven.plugins:maven-surefire-report-plugin from 3.5.5 to 3.5.6 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/01 04:44:04 UTC, 1 replies.
- [PR] Bump org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.48 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/01 04:48:46 UTC, 2 replies.
- Re: [PR] Bump org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.47 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/01 04:48:48 UTC, 1 replies.
- [PR] compare oauth2 secret tokens with constant-time MessageDigest.isEqual [cxf] - posted by "dxbjavid (via GitHub)" <gi...@apache.org> on 2026/06/01 10:24:50 UTC, 3 replies.
- [PR] require azp when oidc id token has multiple audiences [cxf] - posted by "dxbjavid (via GitHub)" <gi...@apache.org> on 2026/06/01 21:15:28 UTC, 3 replies.
- Re: [PR] Add SECURITY.md + AGENTS.md pointing at the CXF umbrella threat model for discoverability [cxf-xjc-utils] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/06/02 07:31:32 UTC, 0 replies.
- Re: [PR] Add SECURITY.md + AGENTS.md pointing at the CXF umbrella threat model for discoverability [cxf-build-utils] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/06/02 07:32:39 UTC, 0 replies.
- [PR] escape raw quotes after an escaped backslash in escapeJson [cxf] - posted by "dxbjavid (via GitHub)" <gi...@apache.org> on 2026/06/02 08:53:33 UTC, 2 replies.
- [PR] Properly handle nested arrays in json parsing [cxf] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/06/02 09:02:23 UTC, 3 replies.
- Re: [PR] More SchemaFactory hardenings [cxf] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/06/02 09:05:46 UTC, 13 replies.
- [PR] Harden JNDI for integration/jca [cxf] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/06/02 09:30:13 UTC, 1 replies.
- [PR] compare pkce code verifier and client secret hash in constant time [cxf] - posted by "dxbjavid (via GitHub)" <gi...@apache.org> on 2026/06/02 11:23:38 UTC, 3 replies.
- [PR] Bump github/codeql-action from 4.35.4 to 4.36.0 [cxf-fediz] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/02 12:53:39 UTC, 2 replies.
- Re: [PR] Bump github/codeql-action from 4.35.4 to 4.35.5 [cxf-fediz] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/02 12:53:41 UTC, 1 replies.
- [PR] Get the headers from the validated signature entry [cxf] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/06/02 13:03:06 UTC, 1 replies.
- Re: [PR] Add limit to the maximum number of attachment headers to be collected [cxf] - posted by "reta (via GitHub)" <gi...@apache.org> on 2026/06/02 15:36:44 UTC, 3 replies.
- Re: [PR] [CXF-9213]make RetryStrategy stateless [cxf] - posted by "ffang (via GitHub)" <gi...@apache.org> on 2026/06/03 00:43:05 UTC, 1 replies.
- [PR] Add default constraints on the number of JSON objects/array entries t… [cxf] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/06/03 07:21:23 UTC, 1 replies.
- [PR] Bump actions/checkout from 6 to 6.0.2 [cxf-build-utils] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/03 12:51:50 UTC, 1 replies.
- [PR] Bump net.sourceforge.pmd:pmd-java from 7.24.0 to 7.25.0 [cxf-build-utils] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/03 12:52:01 UTC, 1 replies.
- [PR] Bump org.apache.maven.plugins:maven-surefire-report-plugin from 3.5.5 to 3.5.6 [cxf-build-utils] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/03 12:52:21 UTC, 1 replies.
- [PR] Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.5 to 3.5.6 [cxf-build-utils] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/03 12:52:24 UTC, 1 replies.
- [PR] Bump github/codeql-action from 4.35.5 to 4.36.0 [cxf-build-utils] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/03 12:52:53 UTC, 1 replies.
- Re: [PR] Add umbrella threat model + AGENTS.md and link from SECURITY.md for security-model discoverability [cxf] - posted by "reta (via GitHub)" <gi...@apache.org> on 2026/06/03 14:08:08 UTC, 3 replies.
- [PR] Bump jaxb-runtime-version from 4.0.8 to 4.0.9 [cxf-xjc-utils] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/03 20:21:46 UTC, 1 replies.
- [PR] Bump cxf.dropwizard4.version from 4.2.38 to 4.2.39 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/03 21:12:12 UTC, 1 replies.
- [PR] Bump cxf.hibernate.em.version from 7.3.6.Final to 7.4.0.Final [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/03 21:12:42 UTC, 1 replies.
- [PR] Bump jaxen:jaxen from 2.0.3 to 2.0.4 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/03 21:12:52 UTC, 1 replies.
- [PR] Bump org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.49 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/03 21:14:37 UTC, 2 replies.
- Re: [PR] Update Jetty to 12.1.10 [cxf] - posted by "reta (via GitHub)" <gi...@apache.org> on 2026/06/03 21:21:35 UTC, 0 replies.
- Re: [PR] Bump cxf.jetty.version from 12.1.8 to 12.1.9 [cxf] - posted by "reta (via GitHub)" <gi...@apache.org> on 2026/06/03 21:27:56 UTC, 3 replies.
- [PR] Introduce default value for maxFormParameterCount [cxf] - posted by "reta (via GitHub)" <gi...@apache.org> on 2026/06/04 02:28:23 UTC, 1 replies.
- [PR] Bump org.sonarsource.scanner.maven:sonar-maven-plugin from 5.6.0.6792 to 5.7.0.6970 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/04 04:18:21 UTC, 1 replies.
- [PR] Bump org.webjars:swagger-ui from 5.32.5 to 5.32.6 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/04 04:18:46 UTC, 1 replies.
- [PR] Bump tools.jackson.core:jackson-databind from 3.1.3 to 3.1.4 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/04 04:19:02 UTC, 2 replies.
- [PR] Bump org.glassfish.jaxb:jaxb-xjc from 4.0.8 to 4.0.9 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/04 04:19:39 UTC, 3 replies.
- [PR] compare username token password and digest in constant time [cxf] - posted by "dxbjavid (via GitHub)" <gi...@apache.org> on 2026/06/04 08:36:59 UTC, 2 replies.
- [PR] Bump com.puppycrawl.tools:checkstyle from 12.3.1 to 13.5.0 [cxf-xjc-utils] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/05 01:12:32 UTC, 2 replies.
- [PR] Bump ch.qos.logback:logback-classic from 1.5.32 to 1.5.33 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/05 02:52:03 UTC, 1 replies.
- [PR] Bump com.puppycrawl.tools:checkstyle from 13.4.2 to 13.5.0 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/05 02:52:22 UTC, 1 replies.
- [PR] Bump org.jboss.ws:jbossws-api from 3.0.0.Final to 3.1.0.Final [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/05 02:52:43 UTC, 1 replies.
- [PR] Bump net.sourceforge.pmd:pmd-core from 7.24.0 to 7.25.0 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/05 02:52:57 UTC, 1 replies.
- [VOTE] Release CXF 4.2.2 and 4.1.7 - posted by Freeman Fang <fr...@gmail.com> on 2026/06/05 03:41:48 UTC, 11 replies.
- [PR] Removing deprecated junit ExpectedException.none [cxf] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/06/05 10:16:18 UTC, 1 replies.
- [PR] Add sensible default value to attachment-max-size property [cxf] - posted by "reta (via GitHub)" <gi...@apache.org> on 2026/06/06 19:34:23 UTC, 3 replies.
- [PR] Bump github/codeql-action from 4.36.0 to 4.36.1 [cxf-xjc-utils] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/08 01:13:50 UTC, 1 replies.
- [PR] Bump org.graalvm.buildtools:native-maven-plugin from 1.1.0 to 1.1.1 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/08 02:42:55 UTC, 1 replies.
- [PR] Bump org.jboss.ws.cxf:jbossws-cxf-client from 7.3.8.Final to 7.4.0.Final [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/08 02:42:58 UTC, 1 replies.
- [PR] Bump org.apache.mina:mina-core from 2.2.7 to 2.2.8 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/08 02:43:33 UTC, 1 replies.
- [PR] Bump github/codeql-action from 4.36.0 to 4.36.1 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/08 02:44:00 UTC, 1 replies.
- [PR] Bump actions/checkout from 6.0.2 to 6.0.3 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/08 02:44:15 UTC, 1 replies.
- [PR] Bump ch.qos.logback:logback-classic from 1.5.33 to 1.5.34 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/08 02:44:41 UTC, 1 replies.
- [PR] Bump actions/checkout from 6.0.2 to 6.0.3 [cxf-fediz] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/08 13:13:01 UTC, 2 replies.
- [PR] Bump github/codeql-action from 4.35.4 to 4.36.1 [cxf-fediz] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/08 13:14:27 UTC, 2 replies.
- [PR] Configure GitHub workflows to use concurrency cancel-in-progress for [cxf] - posted by "apupier (via GitHub)" <gi...@apache.org> on 2026/06/08 13:22:41 UTC, 2 replies.
- [PR] Bump actions/checkout from 6.0.2 to 6.0.3 [cxf-build-utils] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/08 22:12:51 UTC, 1 replies.
- [PR] Bump github/codeql-action from 4.36.0 to 4.36.1 [cxf-build-utils] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/08 22:14:01 UTC, 1 replies.
- [PR] Bump org.eclipse.parsson:parsson from 1.1.7 to 1.1.9 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/09 02:44:08 UTC, 1 replies.
- [PR] Bump net.sourceforge.pmd:pmd-java from 7.24.0 to 7.25.0 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/09 02:44:28 UTC, 2 replies.
- [PR] Bump jaxen:jaxen from 2.0.4 to 2.0.5 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/09 02:46:15 UTC, 1 replies.
- [PR] Bump jakarta.json.bind:jakarta.json.bind-api from 3.0.1 to 3.0.2 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/09 02:46:41 UTC, 1 replies.
- [PR] Fix Mockito agent warnings [cxf] - posted by "reta (via GitHub)" <gi...@apache.org> on 2026/06/10 02:29:07 UTC, 2 replies.
- [PR] Bump cxf.jackson.version from 3.1.4 to 3.2.0 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/10 02:43:40 UTC, 1 replies.
- [PR] Bump org.apache.maven.plugins:maven-dependency-plugin from 3.10.0 to 3.11.0 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/10 02:45:09 UTC, 1 replies.
- [PR] Bump org.jacoco:jacoco-maven-plugin from 0.8.14 to 0.8.15 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/10 02:45:34 UTC, 1 replies.
- [PR] Bump org.eclipse.jdt:org.eclipse.jdt.core from 3.45.0 to 3.46.0 [cxf-xjc-utils] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/11 01:12:37 UTC, 1 replies.
- [PR] Bump com.sun.xml.ws:jaxws-rt from 4.0.4 to 4.0.5 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/11 02:43:11 UTC, 1 replies.
- [PR] Bump com.sun.xml.messaging.saaj:saaj-impl from 3.0.5 to 3.0.6 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/11 02:43:27 UTC, 1 replies.
- [PR] Bump cxf.opentelemetry.version from 1.62.0 to 1.63.0 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/11 02:44:05 UTC, 1 replies.
- [PR] Bump org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.50 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/11 02:45:07 UTC, 2 replies.
- CVE-2026-49875: Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/06/11 16:47:46 UTC, 0 replies.
- CVE-2026-50623: Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/06/11 16:49:56 UTC, 0 replies.
- CVE-2026-50627: Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/06/11 16:52:00 UTC, 0 replies.
- CVE-2026-50628: Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/06/11 16:54:11 UTC, 0 replies.
- CVE-2026-50629: Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/06/11 16:55:00 UTC, 0 replies.
- CVE-2026-50630: Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/06/11 16:56:27 UTC, 0 replies.
- CVE-2026-50631: Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/06/11 17:00:01 UTC, 0 replies.
- CVE-2026-50632: Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/06/11 17:02:27 UTC, 0 replies.
- CVE-2026-50633: Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/06/11 17:03:54 UTC, 0 replies.
- CVE-2026-50634: Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/06/11 17:05:47 UTC, 0 replies.
- CVE-2026-50645: Apache CXF: No restriction on attachment headers per message - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/06/11 17:08:25 UTC, 0 replies.
- [PR] Bump jaxen:jaxen from 2.0.5 to 2.0.6 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/12 02:46:01 UTC, 1 replies.
- [PR] Bump org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.51 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/12 02:46:22 UTC, 2 replies.
- [PR] Bump org.jvnet.jaxb:jaxb-plugins from 4.0.15 to 4.0.16 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/12 02:46:40 UTC, 1 replies.
- [PR] Bump org.glassfish.grizzly:grizzly-http-server from 5.0.1 to 5.0.2 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/12 02:47:10 UTC, 1 replies.
- [PR] strip cr/lf from attachment part headers in writeHeaders [cxf] - posted by "dxbjavid (via GitHub)" <gi...@apache.org> on 2026/06/12 05:52:14 UTC, 2 replies.
- [PR] Bump org.codehaus.plexus:plexus-archiver from 4.11.0 to 4.12.0 [cxf-xjc-utils] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/15 01:12:30 UTC, 1 replies.
- [PR] Bump github/codeql-action from 4.36.1 to 4.36.2 [cxf-xjc-utils] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/15 01:13:35 UTC, 1 replies.
- [PR] Bump org.springframework.ldap:spring-ldap-core from 4.0.4 to 4.1.0 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/15 02:43:01 UTC, 3 replies.
- [PR] Bump cxf.micrometer.version from 1.16.6 to 1.17.0 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/15 02:43:40 UTC, 3 replies.
- [PR] Bump github/codeql-action from 4.36.1 to 4.36.2 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/15 02:44:17 UTC, 1 replies.
- [PR] Bump cxf.hibernate.em.version from 7.4.0.Final to 7.4.1.Final [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/15 02:44:18 UTC, 1 replies.
- [PR] Bump org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.52 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/15 02:49:05 UTC, 2 replies.
- [PR] Bump github/codeql-action from 4.35.4 to 4.36.2 [cxf-fediz] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/15 12:44:10 UTC, 0 replies.
- [PR] Bump github/codeql-action from 4.36.1 to 4.36.2 [cxf-build-utils] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/15 22:13:43 UTC, 1 replies.
- [PR] CXF-9219: cxf-bom manages dependencies for 4.x that no longer exist or are not published [cxf] - posted by "reta (via GitHub)" <gi...@apache.org> on 2026/06/16 01:56:53 UTC, 1 replies.
- [PR] Bump cxf.spring.boot.version from 4.0.7 to 4.1.0 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/16 02:45:27 UTC, 7 replies.
- [PR] Bump cxf.micrometer-tracing.version from 1.6.6 to 1.7.0 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/16 02:46:09 UTC, 3 replies.
- [PR] Bump org.graalvm.buildtools:native-maven-plugin from 1.1.1 to 1.1.2 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/16 02:48:01 UTC, 1 replies.
- [PR] Bump cxf.spring.security.version from 7.0.6 to 7.1.0 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/16 02:49:01 UTC, 3 replies.
- [PR] validate hex digits when decoding quoted-printable attachments [cxf] - posted by "dxbjavid (via GitHub)" <gi...@apache.org> on 2026/06/16 09:15:32 UTC, 6 replies.
- [PR] Make JCacheCodeDataProvider#removeCodeGrant atomic [cxf] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/06/16 14:31:13 UTC, 1 replies.
- [PR] Bump com.fasterxml.woodstox:woodstox-core from 7.2.0 to 7.2.1 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/17 02:44:32 UTC, 1 replies.
- Re: [PR] Use Spring Boot 4.1.x baseline [cxf] - posted by "reta (via GitHub)" <gi...@apache.org> on 2026/06/17 02:45:43 UTC, 2 replies.
- [PR] Bump com.squareup.okhttp3:okhttp from 4.12.0 to 5.4.0 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/17 02:47:06 UTC, 0 replies.
- [PR] Bump org.codehaus.plexus:plexus-archiver from 4.11.0 to 4.12.0 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/17 02:47:23 UTC, 1 replies.
- [PR] Bump com.unboundid:unboundid-ldapsdk from 7.0.4 to 7.0.5 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/17 02:50:04 UTC, 1 replies.
- [PR] Require c_hash for the hybrid case [cxf] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/06/17 12:17:20 UTC, 1 replies.
- Re: [PR] Add draft threat model + AGENTS.md and link from SECURITY.md for security-model discoverability [cxf-fediz] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/06/17 14:27:16 UTC, 0 replies.
- [PR] Updating Jettison to 1.5.6 [cxf] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/06/17 15:31:35 UTC, 1 replies.
- [PR] Bump commons-logging:commons-logging from 1.3.6 to 1.4.0 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/18 02:43:18 UTC, 1 replies.
- [PR] Bump io.swagger.core.v3:swagger-jaxrs2-jakarta from 2.2.50 to 2.2.51 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/18 02:46:47 UTC, 1 replies.
- [PR] Bump org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.53 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/18 02:47:05 UTC, 2 replies.
- [PR] Respect the AsyncRequestProducer contract by properly implementing available() method [cxf] - posted by "reta (via GitHub)" <gi...@apache.org> on 2026/06/18 11:54:48 UTC, 6 replies.
- [PR] More SchemaFactory hardenings (CVE-2026-49875) [cxf] - posted by "eballetbaz (via GitHub)" <gi...@apache.org> on 2026/06/18 13:44:22 UTC, 2 replies.
- [PR] Remove deprecared JUnit5TestShouldBePackagePrivate rule [cxf-build-utils] - posted by "reta (via GitHub)" <gi...@apache.org> on 2026/06/18 21:56:13 UTC, 1 replies.
- [PR] Make sure ActiveMQ Artemis uses Netty 4.2.x (not 4.1.x ones) [cxf] - posted by "reta (via GitHub)" <gi...@apache.org> on 2026/06/19 01:28:41 UTC, 2 replies.
- [PR] Bump org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.54 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/19 02:43:02 UTC, 2 replies.
- [PR] Bump cxf.openfeign.version from 13.12 to 13.13 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/19 02:45:10 UTC, 1 replies.
- [PR] CXF-9221: JCache providers use inverted isExpired() logic causing expired tokens/codes to never be evicted [cxf] - posted by "reta (via GitHub)" <gi...@apache.org> on 2026/06/20 16:31:22 UTC, 2 replies.
- [PR] validate redirect origin in oidc rp sign-in completion [cxf] - posted by "dxbjavid (via GitHub)" <gi...@apache.org> on 2026/06/21 06:08:24 UTC, 8 replies.
- [PR] Bump actions/checkout from 6 to 7 [cxf-xjc-utils] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/22 01:12:30 UTC, 1 replies.
- [PR] Bump com.puppycrawl.tools:checkstyle from 12.3.1 to 13.6.0 [cxf-xjc-utils] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/22 01:12:35 UTC, 2 replies.
- [PR] Bump actions/setup-java from 5.2.0 to 5.3.0 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/22 02:42:49 UTC, 1 replies.
- [PR] Bump actions/checkout from 6.0.3 to 7.0.0 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/22 02:43:01 UTC, 1 replies.
- [PR] Bump com.puppycrawl.tools:checkstyle from 13.5.0 to 13.6.0 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/22 02:44:37 UTC, 1 replies.
- [PR] Bump org.apache.mina:mina-core from 2.2.8 to 2.2.9 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/22 02:44:57 UTC, 1 replies.
- [PR] Bump org.asynchttpclient:async-http-client from 3.0.10 to 3.0.11 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/22 02:45:31 UTC, 1 replies.
- [PR] Bump actions/checkout from 6.0.2 to 7.0.0 [cxf-fediz] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/22 12:44:08 UTC, 0 replies.
- [PR] Bump actions/setup-java from 5.2.0 to 5.3.0 [cxf-fediz] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/22 12:44:16 UTC, 2 replies.
- [PR] Bump actions/checkout from 6.0.3 to 7.0.0 [cxf-build-utils] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/22 22:13:30 UTC, 1 replies.
- [PR] Bump org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.55 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/23 02:43:39 UTC, 2 replies.
- [PR] Bump cxf.tomcat.version from 11.0.22 to 11.0.23 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/23 02:45:42 UTC, 1 replies.
- [PR] Bump io.opentelemetry.semconv:opentelemetry-semconv from 1.41.1 to 1.42.0 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/23 02:52:06 UTC, 1 replies.
- [PR] [CXF-8926] replace PipedInputStream with TimedBlockingPipe to fix MTO… [cxf] - posted by "ffang (via GitHub)" <gi...@apache.org> on 2026/06/25 13:11:16 UTC, 0 replies.
- cxf-4.1.7 causes WildFly regression when Security Manager is enabled - posted by Fabio Burzigotti via dev <de...@cxf.apache.org> on 2026/06/25 16:30:01 UTC, 4 replies.
- [PR] Bump org.apache.kerby:kerb-simplekdc from 2.1.1 to 2.1.2 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/26 02:48:04 UTC, 1 replies.
- [PR] Bump cxf.hibernate.em.version from 7.4.1.Final to 7.4.2.Final [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/26 02:49:11 UTC, 1 replies.
- [PR] Bump org.apache.commons:commons-jexl3 from 3.6.2 to 3.6.3 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/26 02:53:54 UTC, 1 replies.
- [PR] CXF-9222 - Remove partialMatchScopeValidation for OAuth [cxf] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/06/26 09:03:06 UTC, 1 replies.
- [PR] CXF-9226: AsyncHTTPConduit throws ISE instead of HTTPException(407) o… [cxf] - posted by "ffang (via GitHub)" <gi...@apache.org> on 2026/06/26 13:40:38 UTC, 0 replies.
- [PR] [CXF-9227] Fix SecurityManager permission regressions introduced in 4… [cxf] - posted by "ffang (via GitHub)" <gi...@apache.org> on 2026/06/26 16:30:12 UTC, 6 replies.
- [PR] Bump org.javassist:javassist from 3.31.0-GA to 3.32.0-GA [cxf-xjc-utils] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/29 01:12:25 UTC, 1 replies.
- [PR] Bump org.apache.httpcomponents.core5:httpcore5 from 5.4.2 to 5.4.3 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/29 02:42:59 UTC, 2 replies.
- [PR] Bump org.webjars:swagger-ui from 5.32.6 to 5.32.8 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/29 02:43:28 UTC, 1 replies.
- [PR] Bump ch.qos.logback:logback-classic from 1.5.34 to 1.5.35 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/29 02:45:32 UTC, 1 replies.
- [PR] Bump org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.56 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/29 02:45:52 UTC, 0 replies.
- [PR] Bump actions/setup-java from 5.3.0 to 5.4.0 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/29 02:45:58 UTC, 1 replies.
- [PR] Bump actions/cache from 5.0.5 to 6.1.0 [cxf] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/29 02:46:08 UTC, 1 replies.
- [PR] Bump github/codeql-action/upload-sarif from 4.35.4 to 4.36.2 [cxf-fediz] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/29 12:43:57 UTC, 0 replies.
- [PR] Bump github/codeql-action/analyze from 4.35.4 to 4.36.2 [cxf-fediz] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/29 12:45:15 UTC, 0 replies.
- [PR] Bump actions/setup-java from 5.2.0 to 5.4.0 [cxf-fediz] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/29 12:48:00 UTC, 0 replies.
- Re: [PR] Bump org.apache.commons:commons-jexl3 from 3.6.3 to 3.6.4 [cxf] - posted by "reta (via GitHub)" <gi...@apache.org> on 2026/06/30 13:00:18 UTC, 0 replies.
- Re: [PR] Bump cxf.activemq.artemis.version from 2.54.0 to 2.55.0 [cxf] - posted by "reta (via GitHub)" <gi...@apache.org> on 2026/06/30 13:00:30 UTC, 0 replies.
- Re: [PR] Bump org.hibernate.validator:hibernate-validator from 9.1.0.Final to 9.1.1.Final [cxf] - posted by "reta (via GitHub)" <gi...@apache.org> on 2026/06/30 13:00:48 UTC, 0 replies.
- [PR] Enforce scheme checks for decoupled destinations [cxf] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/06/30 14:19:01 UTC, 1 replies.
- [PR] Bump org.apache:apache from 38 to 39 [cxf-build-utils] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/30 22:12:46 UTC, 1 replies.