New Features:

  • New cxf-bom artifactId for importing all the CXF artifacts
  • New support for Microprofile OpenAPI (as alternative to Swagger Core 2.0)
  • New samples to show WS-Transaction usage, OpenAPI v3.0 with Microprofile
  • Ability in Logging feature to mask sensitive information
  • New support for SSEs in Microprofile Rest Client
  • OAuth 2.0 Authorization Server Metadata / OpenID Provider Metadata

Major dependency changes:

There have been several major dependency changes and updates.  Several of these updates may have an impact on user applications and configuration.  Check the migration guides for these dependencies for extra information if impacted. 

  • Spring Boot is updated to 2.3.x, Spring to 5.2.x and Spring Security to 5.3.x
  • Apache WSS4J is updated to 2.3.x, Apache Santuario to 2.2.x.
  • Jackson updated to 2.11
  • Dropwizard Metrics are updated to 4.1.x
  • Hibernate Validator is updated to 6.1.x
  • EhCache is updated to 3.8.x
  • The Woodstox Stax2 2 API is updated to 4.2. Woodstox core is updated to 6.2.x.
  • Jakarta dependencies are used where possible, please check your dependency tree for duplicates after updating
    • Jakarta Servlet-API
    • Jakarta XML Bind-API
    • Jakarta XML WS-API
    • Jakarta XML SOAP-API
    • Jakarta JWS-API
    • Jakarta JSON-API
    • Jakarta JSON Bind-API
    • Jakarta Annotation-API
    • Jakarta Activation-API
    • Jakarta EL-API
    • Jakarta Mail-API
    • Jakarta Validation-API
    • Jakarta CDI-API
    • Jakarta Rest-API was already part of a previous release
  • MicroProfile Rest Client is updated to 2.0
  • Brave updated to 5.11
  • Lucene updated to 8.2
  • Mina updated to 2.1
  • Undertow updated to 2.1

Major Notes:

  • Revocation is now disabled by default in the XKMS TrustedAuthorityValidator (it now supports a wider range of revocation checking when enabled).

Removed Features:

  • The Log4jLogger from CXF core is removed. Instead you can use the Slf4jLogger and whatever logging binding you want by including the appropriate jar.
  • The ability to create a JMX Connector has been removed. Local JMX monitoring can be done using standard tools, and remote JMX monitoring is done using the standard JVM JXM options. See the docs for more information.