CHANGELOG.md

 # Change log
 All notable changes to this project are documented in this file following the [Keep a CHANGELOG](http://keepachangelog.com) conventions.
 
+## 7.5.1
+### Fixed
+- CVE affecting **Spring Boot** 4.3.18: upgraded to: **4.3.20**
+
+
+## 7.5.0
+### Changed
+- Upgraded managed dependency versions:
+	- Spring: 4.3.18
+	- guava: 24.1.1-jre
+	- jaxb2-basics: 1.11.1
+
+- Upgraded managed build plugin versions:
+	- jaxb2-rich-contact-plugin version: 2.0.1
+
+- Replaced maven-jaxb2-plugin with maven-jaxb22-plugin v0.14.0 for Java 1.8 compatibility
+- Changed company name to Thales in copyright
+
+
+## 7.4.0
+### Changed
+- Dependency versions:
+	- CXF: 3.2.5 (fix CVE-2018-1305, CVE-2018-1304)
+
+
+## 7.3.0
+### Changed
+- Dependency versions: 
+  - logback-classic: 1.2.3
+  - logback-ext-spring: 0.1.5
+  - Spring: 4.3.14.RELEASE
+  - CXF: 3.2.4
+  - Saxon-HE: 9.8.0-12
+- Plugin versions:
+  - OWASP dependency-check-maven: 3.2.1 
+
 
 ## 7.2.0
 ### Changed

atom-model/pom.xml

@@ -3,7 +3,7 @@
 	<parent>
 		<groupId>org.ow2.authzforce</groupId>
 		<artifactId>authzforce-ce-parent</artifactId>
-		<version>7.2.1-SNAPSHOT</version>
+		<version>7.5.2-SNAPSHOT</version>
 	</parent>
 	<artifactId>authzforce-ce-atom-model</artifactId>
 	<packaging>jar</packaging>

pdp-ext-model/pom.xml

@@ -3,7 +3,7 @@
 	<parent>
 		<groupId>org.ow2.authzforce</groupId>
 		<artifactId>authzforce-ce-parent</artifactId>
-		<version>7.2.1-SNAPSHOT</version>
+		<version>7.5.2-SNAPSHOT</version>
 	</parent>
 	<artifactId>authzforce-ce-pdp-ext-model</artifactId>
 	<name>${project.groupId}:${project.artifactId}</name>

pom.xml

@@ -2,10 +2,10 @@
    <modelVersion>4.0.0</modelVersion>
    <groupId>org.ow2.authzforce</groupId>
    <artifactId>authzforce-ce-parent</artifactId>
-   <version>7.2.1-SNAPSHOT</version>
+   <version>7.5.2-SNAPSHOT</version>
    <packaging>pom</packaging>
    <name>${project.groupId}:${project.artifactId}</name>
-   <description>Authzforce - Parent of all AuthzForce components</description>
+   <description>AuthzForce - Parent of all AuthzForce components</description>
    <properties>
       <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
       <!-- Controls maven compiler plugin -source -->
@@ -16,15 +16,15 @@
       <maven.build.timestamp.format>yyyy</maven.build.timestamp.format>
       <currentYear>${maven.build.timestamp}</currentYear>
       <artifactId.prefix>authzforce-ce</artifactId.prefix>
-      <!-- Fix the project URL for all Authzforce project -->
+      <!-- Fix the project URL for all AuthzForce project -->
       <project.url>https://authzforce.ow2.org</project.url>
       <git.url.base>https://gitlab.ow2.org/authzforce</git.url.base>
-      <jaxb2-basics.version>0.11.1</jaxb2-basics.version>
+      <jaxb2-basics.version>1.11.1</jaxb2-basics.version>
       <jaxb2-value-constructor.version>3.0</jaxb2-value-constructor.version>
       <slf4j.version>1.7.25</slf4j.version>
-      <!-- This version must match the Spring version used by 'logback-ext-spring' in dependencyManagement. -->
-      <spring.version>4.3.12.RELEASE</spring.version>
-      <cxf.version>3.2.1</cxf.version>
+      <!-- This version must match the Spring version's MAJOR.MINOR used by 'logback-ext-spring' and cxf-spring-boot-* in dependencyManagement. (All 4.3.x versions up to 4.3.16 are affected by CVEs.) -->
+      <spring.version>4.3.20.RELEASE</spring.version>
+      <cxf.version>3.2.5</cxf.version>
    </properties>
    <url>${project.url}</url>
    <inceptionYear>2012</inceptionYear>
@@ -36,9 +36,9 @@
    </licenses>
    <developers>
       <developer>
-         <name>The AuthZForce Team</name>
+         <name>The AuthzForce Team</name>
          <email>http://scr.im/azteam</email>
-         <organization>Thales Services</organization>
+         <organization>THALES</organization>
          <organizationUrl>http://thalesgroup.com</organizationUrl>
       </developer>
    </developers>
@@ -48,9 +48,8 @@
       <tag>HEAD</tag>
       <url>${git.url.base}/parent</url>
    </scm>
-   <!-- distributionManagement defined in oss-parent POM already -->
    <modules>
-      <!-- Only common modules here, i.e. (in)direct dependencies of all other AuthZForce CE projects -->
+      <!-- Only common modules here, i.e. (in)direct dependencies of all other AuthzForce CE projects -->
       <module>xmlns-model</module>
       <module>atom-model</module>
       <module>xacml-model</module>
@@ -89,18 +88,18 @@
          </dependency>
          <dependency>
             <!-- https://github.com/qos-ch/logback-extensions/wiki/Spring. Used by authzforce webapp for configuring logback with Spring. Declared here to make sure version matches with other logback/spring 
-               dependencies used by other Authzforce projects. -->
+               dependencies used by other AuthzForce projects. -->
             <groupId>org.logback-extensions</groupId>
             <artifactId>logback-ext-spring</artifactId>
             <!-- TODO: upgrade so that logback-classic dependency version matches below -->
-            <version>0.1.4</version>
+            <version>0.1.5</version>
          </dependency>
          <dependency>
             <groupId>ch.qos.logback</groupId>
             <artifactId>logback-classic</artifactId>
             <!-- This version must match the version used by the one of 'logback-ext-spring' above. -->
             <!-- Versions before 1.2.0 (excluded) affected by CVE-2017-5929 -->
-            <version>1.2.2</version>
+            <version>1.2.3</version>
          </dependency>
          <dependency>
             <groupId>org.springframework</groupId>
@@ -155,12 +154,12 @@
          <dependency>
             <groupId>net.sf.saxon</groupId>
             <artifactId>Saxon-HE</artifactId>
-            <version>9.7.0-14</version>
+            <version>9.8.0-12</version>
          </dependency>
          <dependency>
             <groupId>com.google.guava</groupId>
             <artifactId>guava</artifactId>
-            <version>22.0</version>
+            <version>24.1.1-jre</version>
          </dependency>
          <dependency>
             <groupId>org.json</groupId>
@@ -174,32 +173,32 @@
             <version>1.6.1</version>
          </dependency>
          <!-- /Third party dependencies -->
-         <!-- Common AuthZForce CE dependencies. Only child modules here (see <modules>). -->
+         <!-- Common AuthzForce CE dependencies. Only child modules here (see <modules>). -->
          <dependency>
             <groupId>${project.groupId}</groupId>
             <artifactId>${artifactId.prefix}-xmlns-model</artifactId>
             <!-- Version updated automatically by maven jgitflow:release-start -->
-            <version>7.2.1-SNAPSHOT</version>
+            <version>7.5.2-SNAPSHOT</version>
          </dependency>
          <dependency>
             <groupId>${project.groupId}</groupId>
             <artifactId>${artifactId.prefix}-atom-model</artifactId>
             <!-- Version updated automatically by maven jgitflow:release-start -->
-            <version>7.2.1-SNAPSHOT</version>
+            <version>7.5.2-SNAPSHOT</version>
          </dependency>
          <dependency>
             <groupId>${project.groupId}</groupId>
             <artifactId>${artifactId.prefix}-xacml-model</artifactId>
             <!-- Version updated automatically by maven jgitflow:release-start -->
-            <version>7.2.1-SNAPSHOT</version>
+            <version>7.5.2-SNAPSHOT</version>
          </dependency>
          <dependency>
             <groupId>${project.groupId}</groupId>
             <artifactId>${artifactId.prefix}-pdp-ext-model</artifactId>
             <!-- Version updated automatically by maven jgitflow:release-start -->
-            <version>7.2.1-SNAPSHOT</version>
+            <version>7.5.2-SNAPSHOT</version>
          </dependency>
-         <!-- /Common AuthZForce CE dependencies -->
+         <!-- /Common AuthzForce CE dependencies -->
       </dependencies>
    </dependencyManagement>
    <build>
@@ -214,7 +213,7 @@
                      <!-- Values to be substituted in template -->
                      <inceptionYear>${project.inceptionYear}</inceptionYear>
                      <currentYear>${currentYear}</currentYear>
-                     <copyrightOwner>Thales Services SAS</copyrightOwner>
+                     <copyrightOwner>THALES</copyrightOwner>
                      <projectName>AuthzForce CE</projectName>
                   </properties>
                   <!-- <header>com/mycila/maven/plugin/license/templates/GPL-3.txt</header> -->
@@ -251,12 +250,23 @@
                <!-- Consider combining with Red Hat Victims and OSS Index. More info on Victims vs. Dependency-check: https://bugzilla.redhat.com/show_bug.cgi?id=1388712 -->
                <groupId>org.owasp</groupId>
                <artifactId>dependency-check-maven</artifactId>
-               <version>3.0.2</version>
+               <version>4.0.2</version>
+            </plugin>
+             <plugin>
+               <groupId>org.jvnet.jaxb2.maven2</groupId>
+               <artifactId>maven-jaxb22-plugin</artifactId>
+               <version>0.14.0</version>
+               <configuration>
+                  <debug>false</debug>
+                  <strict>false</strict>
+                  <verbose>false</verbose>
+                  <removeOldOutput>true</removeOldOutput>
+               </configuration>
             </plugin>
             <plugin>
                <groupId>org.jvnet.jaxb2.maven2</groupId>
                <artifactId>maven-jaxb2-plugin</artifactId>
-               <version>0.13.0</version>
+               <version>0.14.0</version>
                <configuration>
                   <debug>false</debug>
                   <strict>false</strict>

xacml-model/pom.xml

@@ -3,7 +3,7 @@
 	<parent>
 		<groupId>org.ow2.authzforce</groupId>
 		<artifactId>authzforce-ce-parent</artifactId>
-		<version>7.2.1-SNAPSHOT</version>
+		<version>7.5.2-SNAPSHOT</version>
 	</parent>
 	<artifactId>authzforce-ce-xacml-model</artifactId>
 	<name>${project.groupId}:${project.artifactId}</name>
@@ -57,7 +57,7 @@
 			</plugin>
 			<plugin>
 				<groupId>org.jvnet.jaxb2.maven2</groupId>
-				<artifactId>maven-jaxb2-plugin</artifactId>
+				<artifactId>maven-jaxb22-plugin</artifactId>
 				<configuration>
 					<verbose>false</verbose>
 					<extension>true</extension>
@@ -85,7 +85,7 @@
 						<plugin>
                             <groupId>net.codesup.util</groupId>
                             <artifactId>jaxb2-rich-contract-plugin</artifactId>
-                            <version>1.15.0</version>
+                            <version>2.0.1</version>
                         </plugin>
 					</plugins>
 					<bindingDirectory>src/main/jaxb</bindingDirectory>

xacml-model/src/main/java/org/ow2/authzforce/xacml/Xacml3JaxbHelper.java

 /**
- * Copyright 2012-2018 Thales Services SAS.
+ * Copyright 2012-2019 THALES.
  *
  * This file is part of AuthzForce CE.
  *

xacml-model/src/main/java/org/ow2/authzforce/xacml/identifiers/XPathVersion.java

 /**
- * Copyright 2012-2018 Thales Services SAS.
+ * Copyright 2012-2019 THALES.
  *
  * This file is part of AuthzForce CE.
  *

xacml-model/src/main/java/org/ow2/authzforce/xacml/identifiers/XacmlAttributeCategory.java

 /**
- * Copyright 2012-2018 Thales Services SAS.
+ * Copyright 2012-2019 THALES.
  *
  * This file is part of AuthzForce CE.
  *

xacml-model/src/main/java/org/ow2/authzforce/xacml/identifiers/XacmlAttributeId.java

 /**
- * Copyright 2012-2018 Thales Services SAS.
+ * Copyright 2012-2019 THALES.
  *
  * This file is part of AuthzForce CE.
  *

xacml-model/src/main/java/org/ow2/authzforce/xacml/identifiers/XacmlDatatypeId.java

 /**
- * Copyright 2012-2018 Thales Services SAS.
+ * Copyright 2012-2019 THALES.
  *
  * This file is part of AuthzForce CE.
  *

xacml-model/src/main/java/org/ow2/authzforce/xacml/identifiers/XacmlNodeName.java

 /**
- * Copyright 2012-2018 Thales Services SAS.
+ * Copyright 2012-2019 THALES.
  *
  * This file is part of AuthzForce CE.
  *

xacml-model/src/main/java/org/ow2/authzforce/xacml/identifiers/XacmlResourceScope.java

 /**
- * Copyright 2012-2018 Thales Services SAS.
+ * Copyright 2012-2019 THALES.
  *
  * This file is part of AuthzForce CE.
  *

xacml-model/src/main/java/org/ow2/authzforce/xacml/identifiers/XacmlStatusCode.java

 /**
- * Copyright 2012-2018 Thales Services SAS.
+ * Copyright 2012-2019 THALES.
  *
  * This file is part of AuthzForce CE.
  *

xacml-model/src/main/java/org/ow2/authzforce/xacml/identifiers/XacmlVersion.java

 /**
- * Copyright 2012-2018 Thales Services SAS.
+ * Copyright 2012-2019 THALES.
  *
  * This file is part of AuthzForce CE.
  *

xacml-model/src/test/java/org/ow2/authzforce/xacml/test/Test.java

 /**
- * Copyright 2012-2018 Thales Services SAS.
+ * Copyright 2012-2019 THALES.
  *
  * This file is part of AuthzForce CE.
  *

xmlns-model/pom.xml

@@ -3,7 +3,7 @@
 	<parent>
 		<groupId>org.ow2.authzforce</groupId>
 		<artifactId>authzforce-ce-parent</artifactId>
-		<version>7.2.1-SNAPSHOT</version>
+		<version>7.5.2-SNAPSHOT</version>
 	</parent>
 	<artifactId>authzforce-ce-xmlns-model</artifactId>
 	<name>${project.groupId}:${project.artifactId}</name>