Apache CXF 4.2.3 Release Notes

1. Overview

The 4.2.x versions of Apache CXF is a significant new version of CXF
that provides several new features and enhancements.  

New features include:
    * The release is based on JakartaEE 11
    * Support of Spring Framework 7 / Spring Boot 4 /  Spring Security 7
    * Jetty 12.1
    * Weld 6
    * Spring LDAP 4
    * Hibernate 7.2
    * Hibernate Validator 9.1
    * Apache Tika 3.2
    * Jackson 3.0
    * Tomcat 11
    * Undertow 2.4
    * Apache Lucene 10 (needs JDK-21)
    * JUnit 6
    * Apache Mina 3
    * Apache HttpClient 5.5
    * AssertJ 4.0
    * Micrometer 1.16.0 / Micrometer Tracing 1.6.0
    * Apache HttpClient5 5.6 (compression changes)
    * JSpecify annotations (instead of jakarta.* equivalents)
    * Glassfish Grizzly Http Server 5.0.0 (needs JDK-21)

Important notes:
* CXF 4.2 now requires Java 17 as minimum

Users are encouraged to review the migration guide at:
https://cxf.apache.org/docs/42-migration-guide.html
for further information and requirements for upgrading from earlier
versions of CXF.


4.2.3 fixes over 10 JIRA issues reported by users and the community.


2. Installation Prerequisites 

Before installing Apache CXF, make sure the following products,
with the specified versions, are installed on your system:

    * Java 17 Development Kit
    * Apache Maven 3.x to build the samples


3.  Integrating CXF Into Your Application

If you use Maven to build your application, you need merely add
appropriate dependencies. See the pom.xml files in the samples.

If you don't use Maven, you'll need to add one or more jars to your
classpath. The file lib/WHICH_JARS should help you decide which 
jars you need.

4. Building the Samples

Building the samples included in the binary distribution is easy. Change to
the samples directory and follow the build instructions in the README.txt file 
included with each sample.

5. Reporting Problems

If you have any problems or want to send feedback of any kind, please e-mail the
CXF dev list, dev@cxf.apache.org.  You can also file issues in JIRA at:

http://issues.apache.org/jira/browse/CXF

6. Migration notes:

See the migration guide at:
http://cxf.apache.org/docs/42-migration-guide.html
for caveats when upgrading.

7. Specific issues, features, and improvements fixed in this version

** Sub-task
    * [CXF-9229] - Prove that CXF can support Post-Quantum Cryptography TLS using the X25519MLKEM768 hybrid key-encapsulation mechanism (KEM).



** Bug
    * [CXF-9161] - Some of the OIDCFlowTest fail with timeout (JPA only) when HttpClient instance is shared
    * [CXF-9219] - cxf-bom manages dependencies for 4.x that no longer exist or are not published
    * [CXF-9221] - JCache providers use inverted isExpired() logic causing expired tokens/codes to never be evicted
    * [CXF-9222] - partialMatchScopeValidation allows prefix-based scope escalation (e.g., read grants readwrite)
    * [CXF-9223] - completeAudienceMatch=false defaults to prefix matching for audience validation, widening resource access
    * [CXF-9225] - OIDC RP does not enforce nonce validation for Implicit/Hybrid flows
    * [CXF-9226] - Proxy authentication fails with IllegalStateException instead of HTTPException (407)
    * [CXF-9227] - CXF 4.1.7 regression: more SecurityManager permission requirements

** Task
    * [CXF-9230] - Update to Spring Boot 4.1 release line
