Apache CXF 2.4.8 Release Notes

1. Overview

The 2.4.x versions of Apache CXF are significant new versions of CXF 
that provides several new features and enhancements.  

New features include: 
* Log Browser Console - see the logbrowser sample for an example
* Transformation feature provides for a fast and effective way to transform inbound 
  and/or outbound XML messages, please see the TransformationFeature page for more 
  information.
* JIBX databinding
* Faster startup and reduced spring configuration. The Spring support has been redone
  to be based on the ExtensionManagerBus. This results in much faster startup. It also
  means that all of the imports of META-INF/cxf/cxf-extension-*.xml are no longer 
  needed and are deprecated.  Additionaly, all features are now available when 
  using the ExtensionManager Bus instead of being forced to use Spring.
* WSS4J has been updated from 1.5.x to 1.6. See http://ws.apache.org/wss4j/wss4j16.html
  for the list of new features and upgrade notes for Apache WSS4J 1.6.  Some notable new 
  features for CXF users include:
    * SAML2 support: WSS4J 1.6 includes full support for creating, manipulating and 
    parsing SAML2 assertions, via the Opensaml2 library. See
    http://coheigea.blogspot.com/2011/02/support-for-saml2-assertions-in-wss4j.html 
    for more information.
    * Performance work: A general code-rewrite has been done with a focus on improving 
    performance.
    * Support for Crypto trust-stores: WSS4J 1.6 separates the concept of keystore and 
    truststores. See http://coheigea.blogspot.com/2011/01/wss4j-16-crypto-property-change.html
    for more information.
 * WS-SecurityPolicy support for SAML tokens.
 * Initial OSGi Blueprint support for JAX-WS and JAX-RS
 * A simple framework for building an STS was added to CXF's WS-Security module.   See the
   sts_issue_operation sample to see this being used to generate SAML tokens based on X509 
   certs used for the authentication.


Users are encourage to review the migration guide at:
http://cxf.apache.org/docs/24-migration-guide.html
for further information and requirements for upgrading to 2.4.0.   In particular, the upgrades 
to WSS4J and Neethi will require some migration work if you use the WSS4J API's directly or
have created your own Policy objects or builders.   Additionally, XmlSchema was update to 2.0 
so any custom Aegis types may need to be updated.


2.4.8 fixes over 42 JIRA issues reported by users and the community.


2. Installation Prerequisites 

Before installing Apache CXF, make sure the following products,
with the specified versions, are installed on your system:

    * Java 5 Development Kit
    * Apache Maven 2.2.1 or 3.x
    * Some samples can be built with Apache Ant 1.6 or later


3.  Integrating CXF Into You Application

If you use Maven to build your application, you need merely add
appropriate dependencies. See the pom.xml files in the samples.

If you don't use Maven, you'll need to add one or more jars to your
classpath. The file lib/WHICH_JARS should help you decide which 
jars you need.

4. Building the Samples

Building the samples included in the binary distribution is easy. Change to
the samples directory and follow the build instructions in the README.txt file 
included with each sample.

5. Reporting Problems

If you have any problems or want to send feedback of any kind, please e-mail the
CXF dev list, dev@cxf.apache.org.  You can also file issues in JIRA at:

http://issues.apache.org/jira/browse/CXF


6. Migration notes:

See the migration guide at:
http://cxf.apache.org/docs/24-migration-guide.html
for caveats when upgrading from CXF 2.3.x to 2.4.x.

7. Specific issues, features, and improvements fixed in this version

** Bug
    * [CXF-4238] - Spring JAXRSClientFactoryBeanDefinitionParser reports a wrong factory bean class
    * [CXF-4243] - RequestImpl.selectVariant() using wrong headers
    * [CXF-4254] - NPE in OnlySignEntireHeadersAndBody policy validation when the STR Transform is used
    * [CXF-4259] - JAX-RS Set-Cookie handler needs to ignore Expires property
    * [CXF-4265] - Potential NPE when Soap fault has no role
    * [CXF-4267] - A NPE in AttatchmentDataSource could be guarded.
    * [CXF-4268] - WADL 2 Java doesn't respect catalogs
    * [CXF-4269] - In some cases, the javascript client will not output the ns declaration for wrapper element of an rpc/lit method
    * [CXF-4275] - Sample readme file incorrect
    * [CXF-4277] - STSClient does not use returned KeyInfo size when creating a secret key
    * [CXF-4279] - WS-Security ehcache things never shutdown
    * [CXF-4280] - case insensitive MetadataMap keyset
    * [CXF-4284] - Fix JAXB-based providers to report 400 for all read-related exceptions
    * [CXF-4285] - WADLGenerator ignores header or query parameters when FormParam parameters are available
    * [CXF-4288] - SecureAnnotationsInterceptor maps roles only based on method name
    * [CXF-4294] - Exception Cache ws-security.timestamp.cache.instance already exists or Cache ws-security.nonce.cache.instance already exists
    * [CXF-4297] - WS-RM destination should update ack-ranges in RMStore before sending out acks
    * [CXF-4305] - FIQL only gives nullpointerexception. @Context SearchContext does not seem to work.
    * [CXF-4306] - Mixing up FormParam and Multipart annotations cause exceptions when some parts contain the binary payload
    * [CXF-4307] - The inbound Cookie header should be parsed using a semicolon separator by default
    * [CXF-4310] - WADLGenerator can not create QName when XMLRootElement has no name attribute and correctly manage schemas with empty namespaces
    * [CXF-4312] - JAX-WS clients set executor to a "thread per async request" version
    * [CXF-4313] - Hourly GC Caused by Framework - Unable to GC tune application if using framework.
    * [CXF-4315] - CXF does not read decoupled destination parameters from a config file
    * [CXF-4316] - Support EndorsingSupportingToken SignedElements with the Transport binding
    * [CXF-4319] - Incoming cookies containing parameters with '$' can not be processed
    * [CXF-4334] - Schema validation does not validate elements in soap header
    * [CXF-4336] - org.apache.cxf.bus.blueprint.ConfigurerImpl may get IllegalStateException: Execution container has not been set
    * [CXF-4342] - NullPointerException in CachedOutputStream
    * [CXF-4349] - JAXRS frontend  should report the actual method request and response types to providers

** Improvement
    * [CXF-4248] - DocLiteralInInterceptor throws NPE if oneWay operation sends non-empty response
    * [CXF-4257] - Should catch RejectedExecutionException in WS-Addr's rebaseReponse as done in OneWayProcessorInterceptor
    * [CXF-4314] - Introduce a search bean which can hold properties with different names
    * [CXF-4322] - Update RequestDispatcherProvider to do the basic discovery of view handlers based on the current class name
    * [CXF-4326] - Remove the XPathFactory.newInstance from XPathUtils' constructor to improve the performance a bit
    * [CXF-4327] - Add blueprint support on the cxf-clustering
    * [CXF-4328] - Add spring schema for cxf clustering
    * [CXF-4338] - config option to allow suppression of server version display in http response headers
    * [CXF-4345] - Allow user-specified feature for JAXRSClientFactory
    * [CXF-4346] - Support to set the messageType from the jms URI

** Task
    * [CXF-4247] - Add cache for not found wrapper class to avoid trying load them for many times 

** Test
    * [CXF-4126] - Can override built-in action  on WSS4JOutInterceptor but seems impossible to add a new custom action on WSS4JOutInterceptor 
    * [CXF-4335] - WSSecTest  use some unecessary properties for WSS4JInterceptor configuration


