Talend · stataru8 · Jan 8, 2025 · Apr 27, 2026 · May 5, 2026 · May 7, 2026
diff --git a/osgi/karaf/commands/pom.xml b/osgi/karaf/commands/pom.xml
@@ -76,6 +76,7 @@
                         <Import-Package>
               !org.apache.cxf.karaf.commands,
               org.apache.karaf.shell*;version="[4,5)",
+              org.apache.cxf*;version="[4.1.5,4.1.6)",
               *
                         </Import-Package>
                         <_nouses>true</_nouses>

diff --git a/osgi/karaf/features/src/main/resources/features.xml b/osgi/karaf/features/src/main/resources/features.xml
@@ -22,15 +22,15 @@
 
     <feature name="cxf-specs-jakarta-servlet" version="6.1.0">
         <bundle start-level="10">mvn:jakarta.servlet/jakarta.servlet-api/6.1.0</bundle>
-        <bundle start-level="10" start="false">mvn:org.ops4j.pax.web/pax-web-compatibility-servlet/11.0.1</bundle>
+        <bundle start-level="10" start="false">mvn:org.ops4j.pax.web/pax-web-compatibility-servlet/11.1.0</bundle>
     </feature>
 
     <feature name="cxf-specs" version="${project.version}">
         <bundle start-level="9">mvn:org.apache.geronimo.specs/geronimo-osgi-registry/1.1</bundle>
         <bundle start-level="10" dependency="true">mvn:jakarta.activation/jakarta.activation-api/${cxf.jakarta.activation.version}</bundle>
         <bundle start-level="10" dependency="true">mvn:jakarta.annotation/jakarta.annotation-api/${cxf.jakarta.annotation-api.version}</bundle>
         <bundle start-level="10">mvn:jakarta.xml.bind/jakarta.xml.bind-api/4.0.2</bundle>
-        <bundle start-level="10" start="false">mvn:org.ops4j.pax.web/pax-web-compatibility-jaxb3/11.0.1</bundle>
+        <bundle start-level="10" start="false">mvn:org.ops4j.pax.web/pax-web-compatibility-jaxb3/11.1.0</bundle>
         <bundle start-level="10" dependency="true">mvn:jakarta.xml.ws/jakarta.xml.ws-api/${cxf.jakarta.wsapi.version}</bundle>
         <bundle start-level="10" dependency="true">mvn:jakarta.ws.rs/jakarta.ws.rs-api/${cxf.jakarta.ws.rs.version}</bundle>
         <bundle start-level="10" dependency="true">mvn:jakarta.xml.soap/jakarta.xml.soap-api/${cxf.jakarta.soapapi.version}</bundle>
@@ -120,6 +120,8 @@
         <bundle start-level="30" dependency="true">mvn:org.apache.neethi/neethi/${cxf.neethi.version}</bundle>
         <bundle start-level="30" dependency="true">mvn:org.apache.servicemix.bundles/org.apache.servicemix.bundles.jasypt/${cxf.jasypt.bundle.version}</bundle>
         <bundle start-level="30">mvn:org.apache.wss4j/wss4j-bindings/${cxf.jakarta.wss4j.version}</bundle>
+        <!-- wrap to force opensaml version range -->
+        <!--bundle start-level="30">wrap:mvn:org.apache.wss4j/wss4j-ws-security-common/${cxf.jakarta.wss4j.version}$overwrite=merge&amp;Import-Package=net.shibboleth.shared.xml;resolution:=optional,net.shibboleth.shared.xml.impl;resolution:=optional,net.shibboleth.utilities.java.support.primitive;resolution:=optional,com.sun.security.jgss;resolution:=optional,jakarta.mail.internet;version="[2.1,3)",java.io,java.lang,java.lang.invoke,java.lang.reflect,java.math,java.net,java.nio.charset,java.nio.file,java.security,java.security.cert,java.security.interfaces,java.security.spec,java.time,java.time.format,java.time.temporal,java.util,java.util.concurrent,java.util.function,java.util.regex,javax.crypto,javax.crypto.spec,javax.naming,javax.naming.ldap,javax.security.auth,javax.security.auth.callback,javax.security.auth.kerberos,javax.security.auth.login,javax.security.auth.x500,javax.xml.crypto,javax.xml.crypto.dom,javax.xml.crypto.dsig,javax.xml.crypto.dsig.keyinfo,javax.xml.namespace,javax.xml.transform,javax.xml.transform.dom,javax.xml.transform.sax,javax.xml.transform.stream,org.apache.jcp.xml.dsig.internal.dom;version="[4.0,5)",org.apache.wss4j.common.bsp,org.apache.wss4j.common.crypto,org.apache.wss4j.common.ext,org.apache.wss4j.common.kerberos,org.apache.wss4j.common.saml,org.apache.wss4j.common.saml.bean,org.apache.wss4j.common.saml.builder,org.apache.wss4j.common.util,org.apache.xml.security;version="[4.0,5)",org.apache.xml.security.algorithms;version="[4.0,5)",org.apache.xml.security.encryption;version="[4.0,5)",org.apache.xml.security.encryption.params;version="[4.0,5)",org.apache.xml.security.exceptions;version="[4.0,5)",org.apache.xml.security.stax.ext;version="[4.0,5)",org.apache.xml.security.stax.impl.util;version="[4.0,5)",org.apache.xml.security.utils;version="[4.0,5)",org.bouncycastle.asn1;resolution:=optional;version="[1.82,2)",org.bouncycastle.asn1.x500;resolution:=optional;version="[1.82,2)",org.bouncycastle.asn1.x509;resolution:=optional;version="[1.82,2)",org.ehcache;resolution:=optional;version="[3.11,4)",org.ehcache.config;resolution:=optional;version="[3.11,4)",org.ehcache.config.builders;resolution:=optional;version="[3.11,4)",org.ehcache.config.units;resolution:=optional;version="[3.11,4)",org.ehcache.expiry;resolution:=optional;version="[3.11,4)",org.ietf.jgss,org.jasypt.encryption.pbe,org.jasypt.iv,org.jasypt.salt,org.opensaml*;version="[5,6)",org.slf4j;version="[2.0,3)",org.w3c.dom,org.xml.sax</bundle-->
         <bundle start-level="30">mvn:org.apache.wss4j/wss4j-ws-security-common/${cxf.jakarta.wss4j.version}</bundle>
         <bundle start-level="30">mvn:org.apache.wss4j/wss4j-bindings/${cxf.jakarta.wss4j.version}</bundle>
         <bundle start-level="30">mvn:org.apache.wss4j/wss4j-ws-security-dom/${cxf.jakarta.wss4j.version}</bundle>
@@ -610,9 +612,9 @@
         <bundle dependency="true">mvn:jakarta.management.j2ee/jakarta.management.j2ee-api/1.1.4</bundle>
         <!-- <bundle dependency="true">mvn:org.apache.geronimo.specs/geronimo-jta_1.1_spec/${cxf.geronimo.jta.version}</bundle> -->
         <!-- <bundle dependency="true">mvn:org.apache.activemq/activemq-osgi/6.1.3.20240820</bundle> -->
-        <bundle dependency="true">wrap:mvn:org.apache.activemq/artemis-core-client/${cxf.activemq.artemis.version}$Bundle-SymbolicName=artemis-core-client&amp;Bundle-Version=${cxf.activemq.artemis.version}&amp;Export-Package=!org.apache.activemq.artemis.core*,org.apache.activemq.artemis.core.config.impl;version=${cxf.activemq.artemis.version},org.apache.activemq.artemis*;version=${cxf.activemq.artemis.version}</bundle>
-        <bundle dependency="true">wrap:mvn:org.apache.activemq/artemis-jms-client/${cxf.activemq.artemis.version}$Bundle-SymbolicName=artemis-jms-client&amp;Bundle-Version=${cxf.activemq.artemis.version}&amp;Export-Package=org.apache.activemq.artemis*;version=${cxf.activemq.artemis.version}</bundle>
-        <bundle dependency="true">wrap:mvn:org.apache.activemq/artemis-server/${cxf.activemq.artemis.version}$Bundle-SymbolicName=artemis-server&amp;Bundle-Version=${cxf.activemq.artemis.version}&amp;Export-Package=!org.apache.activemq.artemis.spi.core.*,org.apache.activemq.artemis*;version=${cxf.activemq.artemis.version}</bundle>
+        <bundle dependency="true">wrap:mvn:org.apache.artemis/artemis-core-client/${cxf.activemq.artemis.version}$Bundle-SymbolicName=artemis-core-client&amp;Bundle-Version=${cxf.activemq.artemis.version}&amp;Export-Package=!org.apache.activemq.artemis.core*,org.apache.activemq.artemis.core.config.impl;version=${cxf.activemq.artemis.version},org.apache.activemq.artemis*;version=${cxf.activemq.artemis.version}</bundle>
+        <bundle dependency="true">wrap:mvn:org.apache.artemis/artemis-jms-client/${cxf.activemq.artemis.version}$Bundle-SymbolicName=artemis-jms-client&amp;Bundle-Version=${cxf.activemq.artemis.version}&amp;Export-Package=org.apache.activemq.artemis*;version=${cxf.activemq.artemis.version}</bundle>
+        <bundle dependency="true">wrap:mvn:org.apache.artemis/artemis-server/${cxf.activemq.artemis.version}$Bundle-SymbolicName=artemis-server&amp;Bundle-Version=${cxf.activemq.artemis.version}&amp;Export-Package=!org.apache.activemq.artemis.spi.core.*,org.apache.activemq.artemis*;version=${cxf.activemq.artemis.version}</bundle>
         <bundle dependency="true">mvn:jakarta.jws/jakarta.jws-api/3.0.0</bundle>
         <bundle>mvn:org.apache.cxf.services.wsn/cxf-services-wsn-core/${project.version}</bundle>
     </feature>
@@ -654,7 +656,7 @@
         <!-- <bundle start-level="30">mvn:org.apache.servicemix.specs/org.apache.servicemix.specs.javax-el-api-3.0.0/${cxf.servicemix.javax.el.version}</bundle> -->
         <!-- <bundle start-level="30">mvn:org.apache.servicemix.bundles/org.apache.servicemix.bundles.javax-el-impl/4.0.2_1</bundle> -->
         <bundle start-level="10" dependency="true">mvn:jakarta.el/jakarta.el-api/6.0.1</bundle>
-        <bundle start-level="10" dependency='true' start='false'>mvn:org.ops4j.pax.web/pax-web-compatibility-el/11.0.1</bundle>
+        <bundle start-level="10" dependency='true' start='false'>mvn:org.ops4j.pax.web/pax-web-compatibility-el/11.1.0</bundle>
     </feature>
 
     <!-- pax-cdi features are not included in TESB -->

diff --git a/parent/pom.xml b/parent/pom.xml
@@ -101,12 +101,12 @@
         <cxf.cdi.api.version>4.0.1</cxf.cdi.api.version>
         <cxf.classgraph.version>4.8.25</cxf.classgraph.version>
         <cxf.classmate.version>1.5.1</cxf.classmate.version>
-        <cxf.commons-codec.version>1.17.1</cxf.commons-codec.version>
+        <cxf.commons-codec.version>1.21.0</cxf.commons-codec.version>
         <cxf.commons-io.version>2.16.1</cxf.commons-io.version>
         <cxf.commons-jcs-jcache.version>2.2.1</cxf.commons-jcs-jcache.version>
-        <cxf.commons-lang3.version>3.18.0</cxf.commons-lang3.version>
+        <cxf.commons-lang3.version>3.20.0</cxf.commons-lang3.version>
         <cxf.commons-logging.version>1.2</cxf.commons-logging.version>
-        <cxf.commons-text.version>1.13.1</cxf.commons-text.version>
+        <cxf.commons-text.version>1.15.0</cxf.commons-text.version>
         <cxf.derby.version>10.16.1.1</cxf.derby.version>
         <cxf.dom4j.version>2.2.0</cxf.dom4j.version>
         <cxf.dropwizard3.version>3.2.6</cxf.dropwizard3.version>
@@ -119,7 +119,7 @@
         <cxf.geronimo.openapi.version>1.0.15</cxf.geronimo.openapi.version>
         <cxf.glassfish.el.version>4.0.2</cxf.glassfish.el.version>
         <cxf.glassfish.json.version>2.0.1</cxf.glassfish.json.version>
-        <cxf.guava.version>33.3.0-jre</cxf.guava.version>
+        <cxf.guava.version>33.5.0-jre</cxf.guava.version>
         <cxf.guava.failureaccess.version>1.0.2</cxf.guava.failureaccess.version>
         <cxf.hamcrest.version>3.0</cxf.hamcrest.version>
         <cxf.hazelcast.version>5.5.0</cxf.hazelcast.version>
@@ -189,8 +189,8 @@
         <cxf.msv.version>2022.7</cxf.msv.version>
         <cxf.neethi.version>3.2.1</cxf.neethi.version>
         <cxf.netty.version.range>[4,5)</cxf.netty.version.range>
-        <cxf.netty.version>4.1.131.Final</cxf.netty.version>
-        <cxf.netty.tcnative.version>2.0.69.Final</cxf.netty.tcnative.version>
+        <cxf.netty.version>4.2.12.Final</cxf.netty.version>
+        <cxf.netty.tcnative.version>2.0.75.Final</cxf.netty.tcnative.version>
         <cxf.olingo.version>2.0.13</cxf.olingo.version>
         <cxf.openjpa.version>3.2.2</cxf.openjpa.version>
         <cxf.opentelemetry.version>1.59.0</cxf.opentelemetry.version>
@@ -410,7 +410,7 @@
                                 <includeTestSourceDirectory>true</includeTestSourceDirectory>
                                 <configLocation>${cxf.resources.base.path}cxf-checkstyle${cxf.checkstyle.extension}.xml</configLocation>
                                 <consoleOutput>true</consoleOutput>
-                                <failsOnError>true</failsOnError>
+                                <failsOnError>false</failsOnError>
                                 <linkXRef>false</linkXRef>
                                 <suppressionsLocation>${cxf.resources.base.path}cxf-checkstyle-suppressions.xml</suppressionsLocation>
                                 <excludes>**/archetype-resources/**/*.java</excludes>
@@ -608,9 +608,12 @@
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
                 <configuration>
-                    <showDeprecation>${cxf.compile.show.deprecation}</showDeprecation>
-                    <showWarnings>true</showWarnings>
-                    <compilerArgument>${cxf.compile.flags}</compilerArgument>
+                    <showDeprecation>false</showDeprecation>
+                    <showWarnings>false</showWarnings>
+                    <compilerArgs>
+                        <arg>-Xlint:-deprecation</arg>
+                        <arg>-Xlint:-removal</arg>
+                    </compilerArgs>
                 </configuration>
             </plugin>
             <plugin>
@@ -708,6 +711,7 @@
                         <_versionpolicy>[$(version;==;$(@)),$(version;+;$(@)))</_versionpolicy>
                         <Import-Package>
                             ${cxf.osgi.import},
+                            org.apache.cxf.*;version="${cxf.tesb.version-range}",
                             *
                         </Import-Package>
                         <DynamicImport-Package>
@@ -2125,9 +2129,12 @@
                         <groupId>org.apache.maven.plugins</groupId>
                         <artifactId>maven-compiler-plugin</artifactId>
                         <configuration>
-                            <showDeprecation>true</showDeprecation>
-                            <showWarnings>true</showWarnings>
-                            <compilerArgument>${cxf.compile.flags}</compilerArgument>
+                            <showDeprecation>false</showDeprecation>
+                            <showWarnings>false</showWarnings>
+                            <compilerArgs>
+                                <arg>-Xlint:-deprecation</arg>
+                                <arg>-Xlint:-removal</arg>
+                            </compilerArgs>
                         </configuration>
                     </plugin>
                     <plugin>
@@ -2208,10 +2215,13 @@
                         <groupId>org.apache.maven.plugins</groupId>
                         <artifactId>maven-compiler-plugin</artifactId>
                         <configuration>
-                            <showDeprecation>true</showDeprecation>
-                            <showWarnings>true</showWarnings>
-                            <compilerArgument>${cxf.compile.flags}</compilerArgument>
-                            <fork>true</fork>
+                            <showDeprecation>false</showDeprecation>
+                            <showWarnings>false</showWarnings>
+                            <compilerArgs>
+                                <arg>-Xlint:-deprecation</arg>
+                                <arg>-Xlint:-removal</arg>
+                            </compilerArgs>
+                            <fork>false</fork>
                             <maxmem>512M</maxmem>
                         </configuration>
                     </plugin>

diff --git a/pom.xml b/pom.xml
@@ -40,8 +40,7 @@
     </issueManagement>
     <properties>
         <original.version>4.1.5.1</original.version>
-        <cxf.features.tesb.version>4.1.0.5.20260401</cxf.features.tesb.version>
-        <cxf.tesb.version-range>[4.1,4.2)</cxf.tesb.version-range>
+        <cxf.tesb.version-range>[4.1.5,4.1.6)</cxf.tesb.version-range>
         <cxf.tesb.major-version-range>[4,5)</cxf.tesb.major-version-range>
         <cxf.rs.openapi.v3.tesb.version>4.1.5.1</cxf.rs.openapi.v3.tesb.version>
         <cxf.rs.swagger.ui.tesb.version>4.1.5.1</cxf.rs.swagger.ui.tesb.version>
@@ -61,7 +60,7 @@
         <cxf.joda.time.tesb.version>2.11.1</cxf.joda.time.tesb.version>
         <cxf.karaf.tesb.version>4.4.6</cxf.karaf.tesb.version>
         <cxf.karaf.features.tesb.version>4.4.6.20260417</cxf.karaf.features.tesb.version>
-        <cxf.opensaml.bundle.tesb.version>5.1.4_1.tesb1</cxf.opensaml.bundle.tesb.version>
+        <cxf.opensaml.bundle.tesb.version>5.1.4_1.tesb2</cxf.opensaml.bundle.tesb.version>
         <cxf.osgi.tesb.version>8.0.0</cxf.osgi.tesb.version>
         <cxf.pax-web.features.tesb.version>11.1.0.20260420</cxf.pax-web.features.tesb.version>
         <cxf.servicemix.aspectj.tesb.version>1.9.21.1_1</cxf.servicemix.aspectj.tesb.version>
@@ -70,7 +69,7 @@
         <cxf.swagger-ui.tesb.version>5.29.3</cxf.swagger-ui.tesb.version>
         <cxf.validation2.api.tesb.version>2.0.2</cxf.validation2.api.tesb.version>
         <cxf.xerces.bundle.tesb.version>2.12.2.tesb2_1</cxf.xerces.bundle.tesb.version>
-        <cxf.xmlsec.bundle.tesb.version>4.0.4</cxf.xmlsec.bundle.tesb.version>
+        <cxf.xmlsec.bundle.tesb.version>3.0.5</cxf.xmlsec.bundle.tesb.version>
 
         <cxf.osgi.javax.stream.tesb.version-range>[0,2)</cxf.osgi.javax.stream.tesb.version-range>
 

diff --git a/services/sts/sts-core/pom.xml b/services/sts/sts-core/pom.xml
@@ -39,7 +39,7 @@
         <cxf.osgi.import>
             jakarta.servlet*;version="${cxf.osgi.jakarta.servlet.version}",
             !org.apache.cxf.sts.*,
-            org.apache.cxf.*,
+            org.apache.cxf.*;version="${cxf.tesb.version-range}",
             org.springframework.ldap*;resolution:=optional,
             org.ehcache*;resolution:=optional;version="${cxf.ehcache.osgi.version}",
             org.opensaml*;version="${cxf.opensaml.osgi.version}",

diff --git a/services/xkms/pom.xml b/services/xkms/pom.xml
@@ -38,5 +38,7 @@
         <module>xkms-client</module>
         <module>xkms-war</module>
         <module>xkms-x509-repo-ldap</module>
+        <module>xkms-features</module>
+        <module>xkms-osgi</module>
     </modules>
 </project>
diff --git a/systests/jaxrs/pom.xml b/systests/jaxrs/pom.xml
@@ -583,6 +583,24 @@
                     </execution>
                 </executions>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>default-compile</id>
+                        <configuration>
+                            <showDeprecation>false</showDeprecation>
+                        </configuration>
+                    </execution>
+                    <execution>
+                        <id>default-testCompile</id>
+                        <configuration>
+                            <showDeprecation>false</showDeprecation>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
         </plugins>
     </build>
     <profiles>