You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@xalan.apache.org by Mukul Gandhi <ga...@gmail.com> on 2025/05/07 16:39:41 UTC
Xalan-J XSLT 3.0 release?
Hi all,
I'm wondering whether, we can have a Xalan-J XSLT 3.0
implementation's beta release around these days? Or, is it still early
or too early?
--
Regards,
Mukul Gandhi
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@xalan.apache.org
For additional commands, e-mail: dev-help@xalan.apache.org
RE: Xalan-J XSLT 3.0 release?
Posted by "Marquart, Joshua (Coral Springs)" <jo...@Fiserv.com.INVALID>.
XALANJ-2792 represents the existing CVE-2019-2981 vulnerability identified on Xalan_2.7.3
I have seen no code added to git to remedy this CVE.
If there was, please point me to a branch and I’ll review.
A patch was submitted to XALANJ-2792
XALANJ-2793 represents the existing CVE-2019-2973 vulnerability identified on Xalan_2.7.3
I have seen no code added to git to remedy this CVE.
If there was, please point me to a branch and I’ll review.
A patch was submitted to XALANJ-2793
XALANJ-2591 fails with Xalan_2.7.2 and 2.7.3; it worked in 2.7.1
I have seen no code added to git to remedy this CVE.
If there was, please point me to a branch and I’ll review.
Xalan ServiceMix for 2.7.3_* and 2.7.2_* incorporates the patch from XALANJ-2591, and the issue no longer presents.
-Josh
From: Gary Gregory <ga...@gmail.com>
Sent: Monday, May 12, 2025 9:37 AM
To: dev@xalan.apache.org
Subject: Re: Xalan-J XSLT 3.0 release?
⚠ EXTERNAL MESSAGE – Think Before You Click
Hi Josh,
Have you tested the code in git for the changes you mentioned? Or, are looking for changes to the code that are not there?
Ty,
Gary
On Mon, May 12, 2025, 09:12 Marquart, Joshua (Coral Springs) <jo...@fiserv.com.invalid>> wrote:
It would be nice to see 2.7.4 release with
1 - the vulnerabilities fixed: CVE-2019-2981 ( XALANJ-2792 ), CVE-2019-2973 ( XALANJ-2793 )
2 - the fix for attributes that was not actually released ( XALANJ-2591, fixed in Apache ServiceMix Xalan )
I've been forced to move on to another library.
-Josh
-----Original Message-----
From: Gary Gregory <ga...@gmail.com>>
Sent: Monday, May 12, 2025 7:22 AM
To: dev@xalan.apache.org<ma...@xalan.apache.org>
Subject: Re: Xalan-J XSLT 3.0 release?
⚠ EXTERNAL MESSAGE – Think Before You Click
I should say that I'm interested in pushing a 2.7.x maintenance release to gather up whatever has changed since the previous release and possibly fixing whatever low-hanging fruit we want. This might turn into a 2.8.0 release depending on what's changed.
Gary
On Mon, May 12, 2025 at 7:20 AM Gary Gregory <ga...@gmail.com>> wrote:
>
> Hi All,
>
> We can have a release anytime we want IMO; it's just a matter of using
> the best label: alpha-1, beta-1, or m1 (m for milestone).
>
> Gary
>
> On Wed, May 7, 2025 at 12:40 PM Mukul Gandhi <ga...@gmail.com>> wrote:
> >
> > Hi all,
> > I'm wondering whether, we can have a Xalan-J XSLT 3.0
> > implementation's beta release around these days? Or, is it still
> > early or too early?
> >
> > --
> > Regards,
> > Mukul Gandhi
> >
> > --------------------------------------------------------------------
> > - To unsubscribe, e-mail: dev-unsubscribe@xalan.apache.org<ma...@xalan.apache.org> For
> > additional commands, e-mail: dev-help@xalan.apache.org<ma...@xalan.apache.org>
> >
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@xalan.apache.org<ma...@xalan.apache.org> For additional commands, e-mail: dev-help@xalan.apache.org<ma...@xalan.apache.org>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@xalan.apache.org<ma...@xalan.apache.org>
For additional commands, e-mail: dev-help@xalan.apache.org<ma...@xalan.apache.org>
Re: Xalan-J XSLT 3.0 release?
Posted by Gary Gregory <ga...@gmail.com>.
Hi Josh,
Have you tested the code in git for the changes you mentioned? Or, are
looking for changes to the code that are not there?
Ty,
Gary
On Mon, May 12, 2025, 09:12 Marquart, Joshua (Coral Springs)
<jo...@fiserv.com.invalid> wrote:
> It would be nice to see 2.7.4 release with
>
> 1 - the vulnerabilities fixed: CVE-2019-2981 ( XALANJ-2792 ),
> CVE-2019-2973 ( XALANJ-2793 )
>
> 2 - the fix for attributes that was not actually released ( XALANJ-2591,
> fixed in Apache ServiceMix Xalan )
>
> I've been forced to move on to another library.
>
> -Josh
>
> -----Original Message-----
> From: Gary Gregory <ga...@gmail.com>
> Sent: Monday, May 12, 2025 7:22 AM
> To: dev@xalan.apache.org
> Subject: Re: Xalan-J XSLT 3.0 release?
>
> ⚠ EXTERNAL MESSAGE – Think Before You Click
>
>
>
> I should say that I'm interested in pushing a 2.7.x maintenance release to
> gather up whatever has changed since the previous release and possibly
> fixing whatever low-hanging fruit we want. This might turn into a 2.8.0
> release depending on what's changed.
>
> Gary
>
> On Mon, May 12, 2025 at 7:20 AM Gary Gregory <ga...@gmail.com>
> wrote:
> >
> > Hi All,
> >
> > We can have a release anytime we want IMO; it's just a matter of using
> > the best label: alpha-1, beta-1, or m1 (m for milestone).
> >
> > Gary
> >
> > On Wed, May 7, 2025 at 12:40 PM Mukul Gandhi <ga...@gmail.com>
> wrote:
> > >
> > > Hi all,
> > > I'm wondering whether, we can have a Xalan-J XSLT 3.0
> > > implementation's beta release around these days? Or, is it still
> > > early or too early?
> > >
> > > --
> > > Regards,
> > > Mukul Gandhi
> > >
> > > --------------------------------------------------------------------
> > > - To unsubscribe, e-mail: dev-unsubscribe@xalan.apache.org For
> > > additional commands, e-mail: dev-help@xalan.apache.org
> > >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@xalan.apache.org For additional
> commands, e-mail: dev-help@xalan.apache.org
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@xalan.apache.org
> For additional commands, e-mail: dev-help@xalan.apache.org
>
RE: Xalan-J XSLT 3.0 release?
Posted by "Marquart, Joshua (Coral Springs)" <jo...@Fiserv.com.INVALID>.
It would be nice to see 2.7.4 release with
1 - the vulnerabilities fixed: CVE-2019-2981 ( XALANJ-2792 ), CVE-2019-2973 ( XALANJ-2793 )
2 - the fix for attributes that was not actually released ( XALANJ-2591, fixed in Apache ServiceMix Xalan )
I've been forced to move on to another library.
-Josh
-----Original Message-----
From: Gary Gregory <ga...@gmail.com>
Sent: Monday, May 12, 2025 7:22 AM
To: dev@xalan.apache.org
Subject: Re: Xalan-J XSLT 3.0 release?
⚠ EXTERNAL MESSAGE – Think Before You Click
I should say that I'm interested in pushing a 2.7.x maintenance release to gather up whatever has changed since the previous release and possibly fixing whatever low-hanging fruit we want. This might turn into a 2.8.0 release depending on what's changed.
Gary
On Mon, May 12, 2025 at 7:20 AM Gary Gregory <ga...@gmail.com> wrote:
>
> Hi All,
>
> We can have a release anytime we want IMO; it's just a matter of using
> the best label: alpha-1, beta-1, or m1 (m for milestone).
>
> Gary
>
> On Wed, May 7, 2025 at 12:40 PM Mukul Gandhi <ga...@gmail.com> wrote:
> >
> > Hi all,
> > I'm wondering whether, we can have a Xalan-J XSLT 3.0
> > implementation's beta release around these days? Or, is it still
> > early or too early?
> >
> > --
> > Regards,
> > Mukul Gandhi
> >
> > --------------------------------------------------------------------
> > - To unsubscribe, e-mail: dev-unsubscribe@xalan.apache.org For
> > additional commands, e-mail: dev-help@xalan.apache.org
> >
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@xalan.apache.org For additional commands, e-mail: dev-help@xalan.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@xalan.apache.org
For additional commands, e-mail: dev-help@xalan.apache.org
Re: Xalan-J XSLT 3.0 release?
Posted by Mukul Gandhi <ga...@gmail.com>.
Hi Gary,
On Mon, May 12, 2025 at 5:12 PM Gary Gregory <ga...@gmail.com> wrote:
> I can do that unless someone else wants to. I'll start with 2.x and
> I'll start looking the state of the repo this week.
This is great.
Hoping to see Xalan-J new RCs (depending on the scope you decide) in
the coming days.
Many thanks.
--
Regards,
Mukul Gandhi
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@xalan.apache.org
For additional commands, e-mail: dev-help@xalan.apache.org
Re: Xalan-J XSLT 3.0 release?
Posted by Gary Gregory <ga...@gmail.com>.
On Mon, May 12, 2025 at 7:37 AM Mukul Gandhi <ga...@gmail.com> wrote:
>
> Hi Gary,
> Thanks for your reply.
>
> On Mon, May 12, 2025 at 4:52 PM Gary Gregory <ga...@gmail.com> wrote:
> >
> > I should say that I'm interested in pushing a 2.7.x maintenance
> > release to gather up whatever has changed since the previous release
> > and possibly fixing whatever low-hanging fruit we want. This might
> > turn into a 2.8.0 release depending on what's changed.
>
> We should definitely have a 2.7.x maintenance release, possibly with
> release version 2.8.0 as you've suggested. Together with this, we may
> have Xalan-J's XSLT 3.0 alpha, beta or a milestone release if Xalan-J
> team is interested in that.
>
> Who will make Xalan-J's new release RCs?
I can do that unless someone else wants to. I'll start with 2.x and
I'll start looking the state of the repo this week.
Gary
>
> Many thanks.
>
> --
> Regards,
> Mukul Gandhi
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@xalan.apache.org
> For additional commands, e-mail: dev-help@xalan.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@xalan.apache.org
For additional commands, e-mail: dev-help@xalan.apache.org
Re: Xalan-J XSLT 3.0 release?
Posted by Mukul Gandhi <ga...@gmail.com>.
Hi Gary,
Thanks for your reply.
On Mon, May 12, 2025 at 4:52 PM Gary Gregory <ga...@gmail.com> wrote:
>
> I should say that I'm interested in pushing a 2.7.x maintenance
> release to gather up whatever has changed since the previous release
> and possibly fixing whatever low-hanging fruit we want. This might
> turn into a 2.8.0 release depending on what's changed.
We should definitely have a 2.7.x maintenance release, possibly with
release version 2.8.0 as you've suggested. Together with this, we may
have Xalan-J's XSLT 3.0 alpha, beta or a milestone release if Xalan-J
team is interested in that.
Who will make Xalan-J's new release RCs?
Many thanks.
--
Regards,
Mukul Gandhi
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@xalan.apache.org
For additional commands, e-mail: dev-help@xalan.apache.org
Re: Xalan-J XSLT 3.0 release?
Posted by Gary Gregory <ga...@gmail.com>.
I should say that I'm interested in pushing a 2.7.x maintenance
release to gather up whatever has changed since the previous release
and possibly fixing whatever low-hanging fruit we want. This might
turn into a 2.8.0 release depending on what's changed.
Gary
On Mon, May 12, 2025 at 7:20 AM Gary Gregory <ga...@gmail.com> wrote:
>
> Hi All,
>
> We can have a release anytime we want IMO; it's just a matter of using
> the best label: alpha-1, beta-1, or m1 (m for milestone).
>
> Gary
>
> On Wed, May 7, 2025 at 12:40 PM Mukul Gandhi <ga...@gmail.com> wrote:
> >
> > Hi all,
> > I'm wondering whether, we can have a Xalan-J XSLT 3.0
> > implementation's beta release around these days? Or, is it still early
> > or too early?
> >
> > --
> > Regards,
> > Mukul Gandhi
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@xalan.apache.org
> > For additional commands, e-mail: dev-help@xalan.apache.org
> >
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@xalan.apache.org
For additional commands, e-mail: dev-help@xalan.apache.org
Re: Xalan-J XSLT 3.0 release?
Posted by Gary Gregory <ga...@gmail.com>.
Hi All,
We can have a release anytime we want IMO; it's just a matter of using
the best label: alpha-1, beta-1, or m1 (m for milestone).
Gary
On Wed, May 7, 2025 at 12:40 PM Mukul Gandhi <ga...@gmail.com> wrote:
>
> Hi all,
> I'm wondering whether, we can have a Xalan-J XSLT 3.0
> implementation's beta release around these days? Or, is it still early
> or too early?
>
> --
> Regards,
> Mukul Gandhi
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@xalan.apache.org
> For additional commands, e-mail: dev-help@xalan.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@xalan.apache.org
For additional commands, e-mail: dev-help@xalan.apache.org