Is a 2.12 in the future?

["Cantor, Scott" <ca...@osu.edu>]

My project's older branch has a dependency on Xerces for historical
reasons, and we were made aware of an old CVE from 2013 [1] that
apparently has been corrected in trunk as of 16 months ago [2], but we're
trying to assess our options here (the most unpleasant being to fork if
that's the only way we can get a fix out).

Is there any likelihood of a 2.12 with this fix within the imminent future?

-- Scott

[1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4002
[2] https://svn.apache.org/viewvc?view=revision&revision=1499506


---------------------------------------------------------------------
To unsubscribe, e-mail: j-users-unsubscribe@xerces.apache.org
For additional commands, e-mail: j-users-help@xerces.apache.org

Re: Is a 2.12 in the future?

["Cantor, Scott" <ca...@osu.edu>]

On 10/16/14, 3:33 PM, "Michael Glavassevich" <mr...@ca.ibm.com> wrote:
>
>Long overdue to have a new release but not likely in the imminent future.

Thanks, I appreciate the update.

> 
>Would be great if we had more volunteers who could dedicate time to that.

I already do so on the C++ side, including as essentially the sole
maintainer for Santuario there, and we have significant input into the
Java version. If we weren't about to ship major upgrades that move us back
to the off the shelf JDK JAXP implementation, I suspect we would be
considering tha possibility of working on Xerces-J, but alas it's a
self-fulfilling prophecy I suppose. We had to move because of the lack of
volunteers already.

-- Scott


---------------------------------------------------------------------
To unsubscribe, e-mail: j-users-unsubscribe@xerces.apache.org
For additional commands, e-mail: j-users-help@xerces.apache.org

Re: Is a 2.12 in the future?

[Michael Glavassevich <mr...@ca.ibm.com>]

"Cantor, Scott" <ca...@osu.edu> wrote on 10/03/2014 04:19:46 PM:
 
> My project's older branch has a dependency on Xerces for historical
> reasons, and we were made aware of an old CVE from 2013 [1] that
> apparently has been corrected in trunk as of 16 months ago [2], but 
we're
> trying to assess our options here (the most unpleasant being to fork if
> that's the only way we can get a fix out).
> 
> Is there any likelihood of a 2.12 with this fix within the imminent 
future?

Long overdue to have a new release but not likely in the imminent future. 
Would be great if we had more volunteers who could dedicate time to that.

> -- Scott
> 
> [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4002
> [2] https://svn.apache.org/viewvc?view=revision&revision=1499506
> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: j-users-unsubscribe@xerces.apache.org
> For additional commands, e-mail: j-users-help@xerces.apache.org

Thanks.

Michael Glavassevich
XML Technologies and WAS Development
IBM Toronto Lab
E-mail: mrglavas@ca.ibm.com
E-mail: mrglavas@apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: j-users-unsubscribe@xerces.apache.org
For additional commands, e-mail: j-users-help@xerces.apache.org