Apache CXF 4.2.x release line uses JDK-17 baseline.

New Features:

  • The release is based on JakartaEE 11 ( CXF-8828 - ( ) )
  • Support of Spring Framework 7 / Spring Boot 4 /  Spring Security 7
  • Jetty 12.1
  • Weld 6
  • Spring LDAP 4
  • Hibernate 7 .2
  • Hibernate Validator 9.1
  • Apache Tika 3.2
  • Jackson 3.0
  • Tomcat 11
  • Undertow 2.4
  • Apache Lucene 10 (needs JDK-21)
  • JUnit 6
  • Apache Mina 3
  • Apache HttpClient 5.5
  • AssertJ 4.0
  • Micrometer 1.16.0 / Micrometer Tracing 1.6.0
  • Apache HttpClient5 5.6 (compression changes)
  • JSpecify annotations (instead of jakarta.* equivalents)
  • Glassfish Grizzly Http Server 5.0.0 (needs JDK-21)

Removed Features:

  • removed org.apache.cxf.feature.LoggingFeature (deprecated for a long time) and related classes, the replacement is org.apache.cxf.ext.logging.LoggingFeature
    <dependency>
   <groupId>org.apache.cxf</groupId>
   <artifactId>cxf-rt-features-logging</artifactId>
   <version>4.2.0</version>
</dependency>
  • removed <logging> namespace handler, the replacement is explicit use of org.apache.cxf.ext.logging.LoggingFeature 
    <cxf:bus>
    <cxf:features>
        <bean class="org.apache.cxf.ext.logging.LoggingFeature"/>
    </cxf:features>
</cxf:bus>

Changes in 4.2.4

WSS4J 4.0.2 is required (SignatureConfirmation)

Apache CXF 4.2.4 stores the full signature value, instead of a 32-bit hash of it, for WS-Security SignatureConfirmation processing. This change works together with WSS4J 4.0.2, which expects the signature values in the new format. CXF 4.2.4 therefore depends on WSS4J 4.0.2 (CXF 4.2.3 used WSS4J 4.0.1).

If your application or runtime pins an older WSS4J version (for example, through <dependencyManagement> or a WSS4J copy provided by an application server), upgrade all org.apache.wss4j artifacts to 4.0.2 together with CXF 4.2.4, for example:

<dependency>
    <groupId>org.apache.wss4j</groupId>
    <artifactId>wss4j-ws-security-dom</artifactId>
    <version>4.0.2</version>
</dependency>

Using CXF 4.2.4 with WSS4J 4.0.1 or older makes the SignatureConfirmation check (WSHandler.checkSignatureConfirmation) fail for services that use SignatureConfirmation (for example, a WS-SecurityPolicy with <sp:RequireSignatureConfirmation/>). There is no option to restore the old behaviour: the CXF and WSS4J changes must be used together.

The SignatureConfirmation elements on the wire are not affected, so CXF 4.2.4 endpoints still interoperate with clients and services on older versions.