XMLBeans History

Latest release files are available.

Some bug fixes and packaging clean-up (for a more complete list of changes see CHANGES.txt or JIRA).

Some bug fixes and packaging clean-up (for a more complete list of changes see CHANGES.txt or JIRA).

Some bug fixes and packaging clean-up (for a more complete list of changes see CHANGES.txt or JIRA).

Some bug fixes and packaging clean-up (for a more complete list of changes see CHANGES.txt or JIRA).

Some bug fixes and packaging clean-up (for a more complete list of changes see CHANGES.txt or JIRA).

Some bug fixes and packaging clean-up (for a more complete list of changes see CHANGES.txt or JIRA).

Some bug fixes and packaging clean-up (for a more complete list of changes see CHANGES.txt or JIRA).

Description:
When parsing XML files using XMLBeans 2.6.0 or below, the underlying parser created by XMLBeans could be susceptible to XML External Entity (XXE) attacks.

This issue was fixed a few years ago but on review, we decided we should have a CVE to raise awareness of the issue.

Mitigation:
Affected users are advised to update to Apache XMLBeans 3.0.0 or above which fixes this vulnerability. XMLBeans 4.0.0 or above is preferable.

References: XML external entity attack

Some bug fixes and packaging clean-up (for a more complete list of changes see CHANGES.txt or JIRA).

Some bug fixes and packaging clean-up (for a more complete list of changes see CHANGES.txt or JIRA).

Some bug fixes (for a more complete list of changes see CHANGES.txt or JIRA).

The Apache POI project has unretired the XMLBeans codebase and is maintaining it as a sub-project. Until now the XMLBeans codebase was held in the Apache Attic where former Apache projects are kept for the public good.

Few of the improvements in this release (for a more complete list of changes see CHANGES.txt or XMLBEANS-518).

• XMLBEANS-518: Support new XmlOptions to control XML parser settings

The Apache POI project has unretired the XMLBeans codebase and is maintaining it as a sub-project. Until now the XMLBeans codebase was held in the Apache Attic where former Apache projects are kept for the public good.

Few of the improvements in this release (for a more complete list of changes see CHANGES.txt or XMLBEANS-517).

• XMLBEANS-517: use safe XML parsers
• XMLBEANS-515: remove piccolo support
• XMLBEANS-514: make Java 6 the lowest supported runtime
• Fix for XMLBEANS-332: XMLBeans changes surrogate pair bytes to question marks

Few of the improvements in this release (for a more complete list of changes see CHANGES.txt).

• Add new xml option CopyUseNewSynchronizationDomain used for copy. This fixes the scenario when copy and access (ex. selectPath) are used in a multithreading environment.
• Entitize \r when not in pretty print, this helps with maintainig \r entities
• Update durations to latest spec.
• Fix for compiling schema that contains complex type with simple content that has facets defined in the base simple type
• Introducing a default maximum entity replacement limit of 10kb, it can be controled by using the option XmlOptions.setLoadEntityBytesLimit.
• Added multiple entry points and refactored code for xsd2inst code.
• Many synchronization and stability bug fixes

Note: Starting with XmlBeans 2.6.0, binary files are compatible with JDK1.6. Sources are still compatible with JDK 1.4. When using JDK 1.4, xmlbeans-qname.jar is required on classpath of your application alongside xbean.jar.

Few of the improvements in this release (for a more complete list of changes see CHANGES.txt).

• "User types" feature - allows mapping of Schema simple types to custom user Java classes
• Option to perform additional, stricter Schema validation checks: XMLBEANS-350
• Updated pattern for dayTimeDuration
• Extended year min/max value limitations
• Support for date and time types with hour 24.
• NOTATION built-in type
• Many synchronization and stability bug fixes

Note: XmlBeans 2.5.0 is still compatible with JDK 1.4. When using JDK 1.4, xmlbeans-qname.jar is required on classpath of your application alongside xbean.jar.

Git read-only access to XMLBeans sources is now available. Please see the Git at Apache page for details. Git Clone URL: git://git.apache.org/xmlbeans.git and Http Clone URL: http://git.apache.org/xmlbeans.git.

Now search and browse XMLBeans source code is available thanks to grepcode.

New features in this release (for a more complete list of changes see CHANGES.txt).

• Finer grained support for CDATA
• Upgraded support for Saxon 9
• Added more fine-grained control over XML to Java name mapping
• Add support for JVM-supported encodings
• Bug fixes

Advanced XPath and XQuery support is provided through Saxon-9.0.0.4.

XmlBeans 2.4.0 is still compatible with JDK 1.4, xmlbeans-qname.jar is required on classpath of your application alongside xbean.jar

In order to run XmlBeans 2.3.0 with JDK 1.4, it is necessary to add xmlbeans-qname.jar on the classpath of your application alongside xbean.jar

Because XMLBeans 2.3.0 is designed to be used with Saxon-8.8 for XPath/XQuery support and because Saxon is not backwards-compatible, it is strongly reccomended that if you use Saxon-8.6.1 with XMLBeans, you upgrade to Saxon-8.8.

Few of the improvements in this release (for a more complete list of changes see CHANGES.txt).

• Added options to handle serialization of CDATA sections
• Improved XQuery support by updating to SaxonB-8.8
• Numerous bug fixes

As mentioned earlier, as of the 2.2.0 release, XMLBeans has been updated to use Saxon-B version 8.6.1 for (untyped) XPath/XQuery support.

Important! The Saxon DOM support (which XMLBeans uses) has been moved to a separate jar file - saxon8-dom.jar. Which means that now the jars that you need to have on the classpath for XPath/XQuery support are:

• saxon8.jar
• saxon8-dom.jar
• xbean_xpath.jar

To download Saxon-B, go to https://sourceforge.net/projects/saxon, click the "download" link and then choose Saxon 8.6.1 from the list of files. Make sure you look at the license, which is MPL (Mozilla Public License) 1.0.

These are a few of the improvements in this release for a more complete list of changes see CHANGES.txt

• Updated to the latest XMLSchema.xsd - January 25, 2006
• Updated XmlBeans to work with SaxonB-8.6.1 in place of SaxonB8.1
• XQuery external variable binding support

The source version of Apache XmlBeans has been updated to use SaxonB 8.6.1 (previously it used to be SaxonB 8.1.1). At the moment this is only available if you download and build the source from Subversion but when the next point release is released the binary distribution will use SaxonB 8.6.1 as well.

The first dot release in the V2 line is now available from your favorite mirror.

This release contains a few small features that you may find useful, along with the usual assortment of bug and performance fixes. See the list of changes at CHANGES.txt

Here's a short list of improvements in this release:

• Improved XQuery/XPath integration - Both XQuery and XPath on XMLBeans are now fully integrated. XPath and XQuery expressions can return other XMLObjects, or they can be executed using an XmlCursor instance, in which case you manipulate the results using a cursor.
• DOM Level II Support - DOM Level II support is now implemented natively so that you can handle the underlying XML in the DOM style. You can switch between DOM, XmlCursor, and XmlObject (either untyped or typed). This improves performance and reduces the memory footprint over Version 1.
• Extensions - You can now add custom functionality to generated XMLBeans. You can pass to the Schema Compiler 1) an interface that defines the set of methods to implement and 2) a static handler that implements this functionality. The generated classes will implement the interface and, for each method, call out to the static handler.
• Improved Error Handling - This version adds error codes and ensures message consistency. In addition, fail-fast behavior is provided for simple types, while access to the post schema validation infoset is made available during validation.
• Performance - Performance has been improved across the board. Native DOM support improves performance and memory footprint; XML parsing is now by default performed by Piccolo, a high performance parser; incremental compilation of only modified artifacts has been added; and the performance of the XmlCursor implementation has been greatly improved.
• JDK 1.5 Generics - Generated classes now optionally take advantage of JDK 1.5 Generics. Note that JDK 1.4 continues to be supported.
• XML Instance/XSD Generation - You can generate a sample XML instance from schema using the xsd2inst tool (which uses the SchemaInstanceGenerator class). You can also generate a schema from an instance using the inst2xsd tool (which uses the Inst2Xsd class).

The binary distribution of XMLBeans 2.0.0-beta1 is missing the xbean_xpath.jar and xmlpublic.jar from the archive. You can download the source distribution and build these jars yourself, or get the jars from an Apache mirror:

https://www.apache.org/dyn/closer.cgi/xmlbeans/binaries/xbean_xpath-2.0.0-beta1.jar
https://www.apache.org/dyn/closer.cgi/xmlbeans/binaries/xmlpublic-2.0.0-beta1.jar

The xbean_xpath.jar is used in conjunction with saxon-8.2 to execute xpath and xquery expressions. The xmlpublic.jar contains all the XMLBeans public APIs. For the beta2 release we will double check that these jars are in the distribution! Sorry for the confusion.

The Apache XMLBeans project is pleased to announce new releases of XMLBeans available for download: 2.0.0-beta1, 1.0.4, and 1.0.4-jdk1.3.

The 2.0.0-beta1 release is a significant improvement from previous release and has been in development for about 10 months. The 1.0.4 release is a maintenance release focused on stability and bug fixes. The 1.0.4-jdk1.3 release is the first release of XMLBeans compatible with JDK 1.3.

Major goals of the 2.0.0-beta1 release:

• source backwards compatible
• improve usability of wildcards, substitution groups, error handling
• a native DOM level 2 API
• integration with Saxon xpath/xquery engine
• performance improvements
• instance to schema and schema to instance tools

For a comprehensive list of improvements, see the CHANGES.txt file in the distribution.

XMLBeans changed it's repository from CVS to Subversion. See the sources at the new location: https://svn.apache.org/viewcvs.cgi/xmlbeans/trunk/. The CVS location is read-only, no further changes are aplied to it and it will be closed soon.

Read Configuring XMLBeans by Hetal Shah posted on the dev2dev website. (More XMLBeans articles.)

I've put my presentation from ApacheCon 2004 online, titled Apache XMLBeans 2: Accessing the Full Power of XML in Java (ppt). Enjoy! (More XMLBeans articles.)

ApacheCon US 2004 (13-17 November 2004). ApacheCon is the conference for all things Apache. Come along and learn about a range of new technologies, meet some Apache folks and share the knowledge. See more information about Apache Conferences. Cliff Schmidt and Kevin Krouse are scheduled to speak about XMLBeans.

Read XML-Java Data Binding Using XMLBeans by Hetal C. Shah posted on the O'Reilly website. (More XMLBeans articles.)

Version 1.0.3 is Apache XMLBeans first release since becoming a Top Level Project in the Apache Software Foundation.

Apache XMLBeans Project has graduated out the Apache Incubator Project to become Top Level Project in the Apache Software Foundation. Apache XMLBeans provides a simplified model for interacting with XML documents. The project originated with a contribution from BEA Inc., however, after its time within the Apache Incubator, it is now a full-fledged Apache community and codebase under Apache License 2.0. Cliff Schmidt is the Chair of the new Apache XMLBeans PMC (Project Management Committee).

Apache XMLBeans Team has released XMLBeans Version 1.0.2. Download version 1.0.2 from the Source and Binaries section.

Apache XMLBeans is an effort undergoing incubation at the Apache Software Foundation (ASF), sponsored by the XML project.

Incubation is required of all newly accepted projects until a further review indicates that the infrastructure, communications, and decision making process have stabilized in a manner consistent with other successful ASF projects. While incubation status is not necessarily a reflection of the completeness or stability of the code, it does indicate that the project has yet to be fully endorsed by the ASF.