We just released Apache Commons Secure XML to provide secure-by-default JAXP factory creation, abstracting over implementation-specific XXE securing differences between the stock JDK and external JAXP implementations (Android, Apache Xalan, Apache Xerces, Woodstox, Saxon-HE) s.apache.org/521yh

Thank you @aws for sponsoring me on @github . You can join them at my sponsors profile:

Apache Commons this week released Codec 1.19.0 and IO 2.21.0 - commons.apache.org/proper/commo... - commons.apache.org/proper/commo... @apache.org @javabubble.bsky.social #opensource #java #apache #apachecommons

Apache Lucene has issued the following releases: ✅ Lucene 9.12.2 ✅ Lucene 10.2.2 To download, visit buff.ly/Gu4l9Bs Lucene is a high-performance, full-featured text search engine library written entirely in #Java.

RIP Java Applets. You made Java popular and helped it grow to what it is today. JEP 504: Remove the Applet API has been proposed to target (openjdk.org/jeps/504), so there will be no more applets with the next JDK (JDK 26).

Heads up CVE watchers! We just published CVE-2025-48976: Apache Commons FileUpload: DoS via part headers. Pick up version 1.6.0 or 2.0.0-M4 lists.apache.org/thread/fbs3w... #cve #apache #security

I just backed Arkand & Book of Magic for Free League's Dragonbane RPG on @Kickstarter www.kickstarter.com/projects/119...

Arkand & Book of Magic for Free League's Dragonbane RPG

A double feature for the award-winning Dragonbane RPG – explore the City of Waves and Flames and delve deep into the tomes of magic.

kickstarter.com

That more good will than I could muster virtualize.sh/blog/ground-...

Ground control to Major Trial

When a $130M aerospace company chooses to endlessly abuse free trials instead of typing git pull, you start to question gravity, or at least common sense.

virtualize.sh

Just wow virtualize.sh/blog/ground-...

Ground control to Major Trial

When a $130M aerospace company chooses to endlessly abuse free trials instead of typing git pull, you start to question gravity, or at least common sense.

virtualize.sh

A great (and long) visual and text essay on the 75-year anniversary of F1: www.bbc.co.uk/sport/extra/...

F1 at 75

A look back at 75 years of F1 history with Getty images.

bbc.co.uk

Want an easy way to do some real good in the world? Join me on Kiva and invest in Marya’s success in United States! www.kiva.org/invitedby/ga...

Can you help Gary Gregory support Marya?

Kiva is a loan, not a donation. With Kiva you can lend as little as $25 and make a big change in someone's life.

kiva.org

Apache Commons Collections 4.5.0 is now available from the download CDN and Maven Central. Visit us at commons.apache.org/proper/commo...

Here are the latest Apache Commons releases: - JXPATH-1.4.0: 2025-04-18 - JEXL-3.5.0: 2025-04-16 - IO-2.19.0: 2025-04-12 - TEXT-1.13.1: 2025-04-10 Come see us: commons.apache.org

LWN has a nice write on how successfully use FOSS in government lwn.net/Articles/101...

Over at Apache Commons VFS, we published two CVEs: - CVE-2025-27553: Apache Commons VFS: Possible path traversal issue when using NameScope.DESCENDENT - CVE-2025-30474: Apache Commons VFS: Failing to find an FTP file can reveal the URI's password in an error message

I am pleased to announce Apache Commons CSV 1.14.0. Commons CSV reads and writes files in Comma Separated Value (CSV) format variations. See commons.apache.org/proper/commo...

The Apache Commons VFS Project team is pleased to announce the release of Apache Commons VFS Project 2.10.0. Apache Commons VFS is a Virtual File System library for Java 8 or later. commons.apache.org/proper/commo... #theASF #ApacheCommons

The Apache Commons BeanUtils team is pleased to announce the release of Apache Commons BeanUtils 1.10.1. This is our old-school Java Bean utility library available at commons.apache.org/proper/commo... #theASF #ApacheCommons

The Apache Commons team is pleased to announce Apache Commons Logging 1.3.5. Commons Logging is a thin adapter allowing configurable bridging to other, well-known logging systems. Historical list of changes: commons.apache.org/proper/commo... Website: commons.apache.org/proper/commo...

Beware fellow FOSS maintainers: “Outlier. You are doing it wrong,” Potiuk wrote in a LinkedIn post that tagged Outlier. “Please stop all the people who you are tricking into creating AI-generated, completely nonsense issues in many open-source repositories.” from thenewstack.io/ai-is-spammi...

AI Is Spamming Open Source Repos With Fake Issues

A maintainer tracked down an AI company that said the spam was a mistake. But reports suggest the problem is more widespread and growing.

thenewstack.io

The Apache Commons Codec team announces the release of Apache Commons Codec 1.18.0. Commons Codec contains encodes and decodes Base16, Base32, Base64, digest, and Hexadecimal. The codec package also maintains a collection of phonetic encoding utilities. commons.apache.org/proper/commo...

The Apache Commons Pool team announces the release of Apache Commons Pool 2.12.1. Commons Pool provides an object-pooling API and several object-pool implementations, with robust instance tracking and pool monitoring. commons.apache.org/proper/commo...

Outlier AI. You are doing it wrong. Hiring people to post completely nonsenese or copy&pasted issues in reputable open-source repositories - and make maintainers train your AI on it ? not good. There are 50 such issues in last few days in @airflow repo [1] and counting. More details in [2] […]

The Apache Commons team announces Commons Codec 1.17.2 for #Java Codec contains encoders and decoders for formats such as Base16, Base32, Base64, digest, and Hexadecimal. The codec package also maintains a collection of phonetic encoding utilities. See commons.apache.org/proper/commo...

The Apache Commons team is happy to announce Apache Commons 1.13.0. - Changes: commons.apache.org/proper/commo... - Site: commons.apache.org/proper/commo... - Repo github.com/apache/commo...

Great read @sethmlarson.dev !

Seth Larson@sethmlarson.dev · 2y ago

I've noticed a concerning trend of "slop security reports" being sent to open source projects. Here are thoughts about what platforms, reporters, and maintainers can do to fight back: #oss #opensource #security #vulnerability #vuln #cve #slop #ai #llm sethmlarson.dev/slop-securit...

The Apache Commons DBCP team is pleased to announce the release of Apache Commons DBCP 2.13.0; Java8+ This is a minor release, including bug fixes and enhancements. Changes: commons.apache.org/proper/commo... Site: commons.apache.org/proper/commo... Download: commons.apache.org/proper/commo...