Oxalis 7.0.0

What's Changed

• Major version i.e. incompatible with previous version
• Jakarta version upgrade by @smahieu87
• Require upgrade to Tomcat 10.x
• Run with all Java versions starting 11 to 23 without any workaround and/or warning messages
• Migration from Opentracing (archived/unsupported) to OpenTelemetry
• Added configurable properties in oxalis.conf for locator and global dns server vs organization dns

# Configure following properties for BusdoxLocator and BdxlLocator in Oxalis.conf as per your requirements
lookup.locator.busdox.timeout=30
lookup.locator.busdox.maxRetries=3
# If below lookup.locator.busdox.enablePublicDNS is set to true then it will use Google & Cloudflare DNS thereby bypassing organization DNS. 
# Google DNS is faster, but it also performs DNSSEC validation by default. 
# If DNSSEC signature expired in SML then it will throw SERVFAIL error. 
# There is trade-off between speed vs security. Keep it false, if you are Not sure what you are doing.  
lookup.locator.busdox.enablePublicDNS = false 

lookup.locator.bdxl.timeout=20
lookup.locator.bdxl.maxRetries=2
# If below lookup.locator.bdxl.enablePublicDNS is set to true then it will use Google & Cloudflare DNS thereby bypassing organization DNS. 
# Google DNS is faster, but it also performs DNSSEC validation by default. 
# If DNSSEC signature expired in SML then it will throw SERVFAIL error. 
# There is trade-off between speed vs security. Keep it false, if you are Not sure what you are doing.  
lookup.locator.bdxl.enablePublicDNS = false

• Further refinement of lookup results, error handling with actionable messages
• Bump peppol-specifications to version 2.3.0
• Bump pkix-ocsp version to 2.3.0
• Bump commons-certvalidator to version 4.4.0
• Bump vefa-peppol to version 3.8.0
• Bump guava version to 33.3.1-jre
• Bump h2 database to version 2.3.232
• Bump dnsjava version to 3.6.2
• Bump logback version version to 1.5.6
• Bump Jetty version to 11.0.24
• Updated ELMA SMP domain
• Replaced old revoked AP test certificate with Norstella test AP certificate
• Updated SMP Prod and Test Certificate

New Contributors

• @smahieu87 made his first contribution for Jakarta version upgrade

Oxalis 7.0.0-RC1

What's Changed

• Major version i.e. incompatible with previous version
• Jakarta version upgrade by @smahieu87
• Require upgrade to Tomcat 10.x
• Run with all Java versions starting 11 to 23 without any workaround and/or warning messages
• Migration from Opentracing (Archived/unsupported) to OpenTelemetry
• Added configurable properties in oxalis.conf for locator and global dns server vs organization dns

# Configure following properties for BusdoxLocator and BdxlLocator in Oxalis.conf as per your requirements
lookup.locator.busdox.timeout=30
lookup.locator.busdox.maxRetries=3
lookup.locator.busdox.enablePublicDNS = false
lookup.locator.bdxl.timeout=20
lookup.locator.bdxl.maxRetries=2
lookup.locator.bdxl.enablePublicDNS = false

• Further refinement of lookup result error handling with actionable messages
• Bump peppol-specifications to version 2.3.0
• Bump pkix-ocsp version to 2.3.0
• Bump commons-certvalidator to version 4.4.0
• Bump vefa-peppol to version 3.8.0
• Bump guava version to 33.3.1-jre
• Bump h2 database to version 2.3.232
• Bump dnsjava version to 3.6.2
• Bump logback version version to 1.5.6
• Bump Jetty version to 11.0.24
• Updated ELMA SMP domain
• Replaced old revoked AP test certificate with Norstella test AP certificate
• Updated SMP Prod and Test Certificate

New Contributors

• @smahieu87 made his first contribution for Jakarta version upgrade

Oxalis 6.7.0

• Added eDEC Codelist version 8.9 support
• Bump vefa-peppol version to 3.7.0
• Bump dnsjava version to 3.6.0
• Bump commons-certvalidator version to 4.2.0
• Replaced expired Peppol test certificate
• Optimized BdxlLocator and BusdoxLocator to fix network-level errors as participant not found

# Following additional "maxRetries" and "timeout" properties configured in "reference.conf" for BusdoxLocator and BdxlLocator
mode.default.lookup.locator = {
    class: network.oxalis.vefa.peppol.lookup.locator.BusdoxLocator

    bdxl: {
        .....
        .....
        maxRetries: 3
        timeout: 30
    }

    busdox: {
        .....
        .....
        maxRetries: 3
        timeout: 30
    }
}

Full Changelog: v6.6.0...v6.7.0

Oxalis 6.6.0

• Added eDEC Codelist version 8.8 support
• Bump vefa-peppol version to 3.6.0
• Bump Bouncycastle version to 1.78.1 to fix following vulnerabilities:
  • Bouncy Castle crafted signature and public key can be used to trigger an infinite loop
  • Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")
  • Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.
  • Bouncy Castle Denial of Service (DoS)
  • Bouncy Castle For Java LDAP injection vulnerability
• Bump commons-certvalidator to version 4.1.0
• Bump dnsjava to 3.5.3 version
• France Peppol certificate update

Full Changelog: v6.5.0...v6.6.0

Oxalis 6.5.0

• Bump vefa-peppol to version 3.5.0
• Added Dummy certificates and fixed Test cases

Full Changelog: v6.4.0...v6.5.0

Oxalis 6.4.0

• Added eDEC codelist v8.7 support
• Fixed security vulnerability related to logback-classic by version upgrae from 1.3.5 to 1.3.12
• Fixed Test cases

Full Changelog: v6.3.0...v6.4.0

Oxalis 6.3.0

• Bump vefa-peppol version to 3.3.1 to fix AS4 Transport value
  Full Changelog: v6.2.0...v6.3.0

Oxalis 6.2.0

• Made C1 country code mandatory as per Peppol SBDH v2.0.1 i.e. Outbound message will fail, if C1 country code is Missing in SBD Header. Note that since Oxalis version 4.1.0, it is duty of SP AP to construct SBD Header and pass it as input payload.
• Fixed Jetty Vulnerability
• Fixed H2 database Vulnerability

Full Changelog: v6.1.1...v6.2.0

Oxalis 6.1.1

• Added support for Peppol SBDH v2.0.1 and eDEC Code Lists v8.6: 745b40e
• Bump h2 from 2.1.214 to 2.2.220: d4020bd
• Bump vefa.peppol to 3.2.0
• Bump Peppol specifications to 2.2.0

Full Changelog: v6.0.0...v6.1.1

Oxalis 6.0.0

• Java 11 as minimum supported Java version
• Upgraded to Jakarta EE 8
• Added minimum level support for Peppol France POC
• Additional Document Type Identifier "peppol-doctype-wildcard" Scheme Support
• Participant identifier schemes JP:IIN (0221) for Japan and MY:EIF (0230) for Malaysia added as per OpenPeppol eDEC Code List version 8.5
• Transport profiles START, AS2v1 and ASv2 deprecated as per OpenPeppol eDEC Code List version 8.4, will be removed in future released
• Participant identifier schemes IT:VAT (9906), IT:CF (9907), NO:ORGNR (9908), SE:VAT (9955), DE:LID (9958) removed as per OpenPeppol eDEC Code List version 8.4
• Participant identifier schemes IT:COD (0205) added as per OpenPeppol eDEC Code List version 8.4
• Bump dnsjava to version 3.5.2
• Improvement in SML Locator (busdox locator and bdxl locator) changes, error handling and retries mechanism
• ApacheFetcher is now the default Fetcher
• Bump vefa.peppol to 3.1.0
• Bump commons-certvalidator to 4.0.0
• Bump Peppol specifications to 2.0.0
• Bump Guava version to 32.0.1-jre
• Bump Jetty version to 10.0.13
• Bump TestNG version to 7.7.1
• Bump mockito-core version to 4.11.0
• Updated Dummy Test Certificate

Full Changelog: v5.5.0...v6.0.0