[jira] [Updated] (SANTUARIO-583) Replace Xalan dependency with JDK XML

["Michael Vorburger (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/SANTUARIO-583?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Michael Vorburger updated SANTUARIO-583:
----------------------------------------
    Affects Version/s: Java 2.3.0

> Replace Xalan dependency with JDK XML
> -------------------------------------
>
>                 Key: SANTUARIO-583
>                 URL: https://issues.apache.org/jira/browse/SANTUARIO-583
>             Project: Santuario
>          Issue Type: Improvement
>          Components: Java
>    Affects Versions: Java 2.3.0
>            Reporter: Michael Vorburger
>            Assignee: Colm O hEigeartaigh
>            Priority: Major
>
> [https://github.com/apache/santuario-xml-security-java/blob/master/pom.xml] currently has a dependency on {{{}xalan:xalan:2.7.2{}}}.
> My understanding (please do correct me if this is wrong) is that the JDK has a XSLT XML API since many many years, and (Apache) Xalan <[https://xalan.apache.org|https://xalan.apache.org/]> is "legacy" and unmaintained.
> Would it make sense for Santuario to fully replace its Xalan dependency with JDK XML? Or is this "not possible" or "much more complicated than you think"?
> This has come up during an internal review at the company where I work by day, and wanted to get in touch with the active maintainers of Santuario ([~coheig] / [~colm] / [~coheigea@progress.com] ?) to gauge your initial reaction to this idea. Is this something you would be willing to do as maintainers of this project? Is it something you would merge a Pull Request that someone would contribute? Or is it something you are "against" for any reason?
> Some background for full disclosure: Outside of my day job at the company where I work for which I'm raising this issue, I'm myself an active Apache Committer, in other projects. I do not actually anticipate myself contributing this change to Santuario, but would potentially like to help to facilitate an "upstream first" work of a work colleague for this.



--
This message was sent by Atlassian Jira
(v8.20.1#820001)