[jira] [Assigned] (RAMPART-451) remove xalan dependency due to it being end of life

["Robert Lazarski (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/RAMPART-451?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Robert Lazarski reassigned RAMPART-451:
---------------------------------------

    Assignee: Robert Lazarski

> remove xalan dependency due to it being end of life
> ---------------------------------------------------
>
>                 Key: RAMPART-451
>                 URL: https://issues.apache.org/jira/browse/RAMPART-451
>             Project: Rampart
>          Issue Type: Improvement
>            Reporter: PJ Fanning
>            Assignee: Robert Lazarski
>            Priority: Major
>
> Xalan is no longer supported.
> https://lists.apache.org/thread/s8kjny5270ssfcp46v0fl39lk98987w7
> Is Rampart still supported? It's been a while (2017) since last release - but this release has a dependency on xalan - see https://mvnrepository.com/artifact/org.apache.rampart/rampart-core/1.7.1
> There are a number of other dependencies that have CVEs too.
> It is better to use JAXP TransformerFactory than using xalan directly. If you add xalan dependency just to ensure that you have a JAXP compliant transformer on the classpath, this is unnecessary - the Java runtime has a built-in implementation.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: java-dev-unsubscribe@axis.apache.org
For additional commands, e-mail: java-dev-help@axis.apache.org