We have fixed a few bugs and added enhancements since the release of
Apache Commons Secure XML 1.0.0, so I would like to release Apache
Commons Secure XML 1.1.0.
Apache Commons Secure XML 1.1.0 RC1 is available for review here:
https://dist.apache.org/repos/dist/dev/commons/secure-xml/1.1.0-RC1
(svn revision 88170)
The Git tag commons-secure-xml-1.1.0-RC1 commit for this RC is
22936183b876d473d7de20de669eab19dbbf137c, which you can browse here:
https://gitbox.apache.org/repos/asf?p=commons-secure-xml.git;a=commit;h=22936183b876d473d7de20de669eab19dbbf137c
You may checkout this tag using:
git clone https://gitbox.apache.org/repos/asf/commons-secure-xml.git
--branch commons-secure-xml-1.1.0-RC1 commons-secure-xml-1.1.0-RC1
Maven artifacts are here:
https://repository.apache.org/content/repositories/orgapachecommons-1967/org/apache/commons/commons-secure-xml/1.1.0/
These are the artifacts and their hashes:
#Release SHA-512s
#Sat Oct 03 02:23:05 UTC 2026
commons-secure-xml-1.1.0-bin.tar.gz=3c5337624100592624a589317c1bcac13a699f8a0735b7c378739c18394dd94eb8900753176f9f8d352ca153345d6510b24c12849a6fdcff2ec993ef6bdbb97f
commons-secure-xml-1.1.0-bin.zip=9b20b8a2cf27ccf392792914353802edbbe5b139a1333cd6bb50c7c482a45b0a20731fc62b67d29410f59f1ff02fe299c93f56e3cdfeee0dec16f0a83a14d881
commons-secure-xml-1.1.0-bom.json=df107b7b2678ab071d602b6be4bbfd48338ff74ee8604833ba9f76bdcff576b5854a4873fb56cf5c755a2a64e08b682a80cba5270bebdd2359f5ad01d6f311f4
commons-secure-xml-1.1.0-bom.xml=890dc3647b85a073e59ed2fa6ad27644fbbb28453880b94e4bdc27b79f6f6959b1d475826ebc6a6902961a275275909fc583a331aec0c6daea9a79c0c0d52bf5
commons-secure-xml-1.1.0-javadoc.jar=2fa465ec66ed70bbf04105567e12eb832da9f8e38c4aef1caac00131cdb6bccbc7861a0687419a489fd3688841f0ed6e880a06402c5a2da4d3b07bbe17315714
commons-secure-xml-1.1.0-sources.jar=0e650164b80744597971b0028d7c247cc00418ea1f87a34179c75115583a2879141cead273ab0141c66a0652ec9af61c735b2bb961fbf1a704c5e619d3f84bee
commons-secure-xml-1.1.0-src.tar.gz=cfe99526c45f9964bd5d89f9a10e50054072aba64b1f693d8901e6674010fcd4fe4abd2da24e8e1e8d9a822fdcd49b4fb64b4b960c6a6e7d453d6dbd6b000ebc
commons-secure-xml-1.1.0-src.zip=0960817254e138d060baa9f574cdebaa88a3d5672d7a302ea7387922021eea11d106360fbe3cabffa27ea00846619dd35c2f864da9e0029ab518981dd6e33eb1
commons-secure-xml-1.1.0-test-sources.jar=f2b71ea10675948cb5f7919d0d6d0ec1c0edc6fd2e1af037048530d4bb604b569ca48160f0428da71b11259e3c5fbe14c065244a91bee90e844f82590f19ccc2
org.apache.commons_commons-secure-xml-1.1.0.spdx.json=25e2ee5a5dba83e6396e20ff0bf1918c7c259194e545454a33e1299778e9327b62baae4c2477d67d618634ce433f6529ce582fb58db469497505148d094a3f68
I have tested this with 'mvn' and 'mvn clean install site' using:
openjdk version "25.0.4.1" 2026-08-18
OpenJDK Runtime Environment Homebrew (build 25.0.4.1)
OpenJDK 64-Bit Server VM Homebrew (build 25.0.4.1, mixed mode, sharing)
Apache Maven 3.10.0 (c43a36b8d67be7e0805a411bc0898af1a51f5472)
Maven home: /opt/homebrew/Cellar/maven/3.10.0/libexec
Java version: 25.0.4.1, vendor: Homebrew, runtime:
/opt/homebrew/Cellar/openjdk@25/25.0.4.1/libexec/openjdk.jdk/Contents/Home
Default locale: en_US, platform encoding: UTF-8, time zone: UTC
OS name: "mac os x", version: "26.7.1", arch: "aarch64", family: "mac"
Darwin Garys-MacBook-Pro.local 25.6.0 Darwin Kernel Version 25.6.0:
Tue Aug 18 17:48:46 PDT 2026;
root:xnu-12377.161.15.700.19~2/RELEASE_ARM64_T6041 arm64
Docker version 29.8.1, build 4a63305
Details of changes since 1.0.0 are in the release notes:
https://dist.apache.org/repos/dist/dev/commons/secure-xml/1.1.0-RC1/RELEASE-NOTES.txt
https://dist.apache.org/repos/dist/dev/commons/secure-xml/1.1.0-RC1/site/changes.html
Site:
https://dist.apache.org/repos/dist/dev/commons/secure-xml/1.1.0-RC1/site/index.html
(Note some *relative* links are broken and the 1.1.0 directories
are not yet created - these will be OK once the site is deployed.)
JApiCmp Report (compared to 1.0.0):
https://dist.apache.org/repos/dist/dev/commons/secure-xml/1.1.0-RC1/site/japicmp.html
RAT Report:
https://dist.apache.org/repos/dist/dev/commons/secure-xml/1.1.0-RC1/site/rat-report.html
KEYS:
https://downloads.apache.org/commons/KEYS
Please review the release candidate and vote.
This vote will close no sooner than 72 hours from now.
[ ] +1 Release these artifacts
[ ] +0 OK, but...
[ ] -0 OK, but really should fix...
[ ] -1 I oppose this release because...
Thank you,
Gary Gregory,
Release Manager (using key 530AA5F25C25011F)
The following is intended as a helper and refresher for reviewers.
Validating a release candidate
==============================
These guidelines are NOT complete.
Requirements: Git, Java, and Maven.
You can validate a release from a release candidate (RC) tag as follows.
1a) Download and decompress the source archive from:
https://dist.apache.org/repos/dist/dev/commons/secure-xml/1.1.0-RC1/source
1b) Check out the RC tag from git (optional)
This is optional, as a reviewer must at least check source distributions.
git clone https://gitbox.apache.org/repos/asf/commons-secure-xml.git
--branch commons-secure-xml-1.1.0-RC1 commons-secure-xml-1.1.0-RC1
cd commons-secure-xml-1.1.0-RC1
2) Checking the build
All components should include a default Maven goal, such that you can
run 'mvn' from the command line by itself.
2) Check Apache licenses
This step is not required if the site includes a RAT report page,
which you then must check.
This check should be included in the default Maven build, but you can
check it with:
mvn apache-rat:check
3) Check binary compatibility
This step is not required if the site includes a JApiCmp report page,
which you then must check.
This check should be included in the default Maven build, but you can
check it with:
mvn verify -DskipTests -P japicmp japicmp:cmp
4) Build the package
This check should be included in the default Maven build, but you can
check it with:
mvn -V clean package
You can record the Maven and Java version produced by -V in your VOTE reply.
To gather OS information from a command line:
Windows: ver
Linux: uname -a
4b) Check reproducibility
To check that a build is reproducible, run:
mvn clean verify artifact:compare -DskipTests
-Dreference.repo=https://repository.apache.org/content/repositories/staging/
'-Dbuildinfo.ignore=*/*.spdx.json'
Note that this excludes SPDX files from the check.
5) Build the site for a single module project
Note: Some plugins require the components to be installed instead of packaged.
mvn site
Check the site reports in:
- Windows: target\site\index.html
- Linux: target/site/index.html
-the end-
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
