Oxalis 7.2.0

• eDEC CodeList Support: Added support for eDEC CodeList v9.3
• Peppol PKI 2025: Added Peppol PKI 2025 Truststore for dual capability usage
• Fixed lookup for SMP deployed as non root application: Fix for SMP document/service lookup for SMP deployments under non-root context path
• NAPTR Lookup Support (PFUOI 4.4.0): In this release, NAPTR lookup is the default lookup method.
• Basic MLS Support: Added basic support for “MLS_TO” and “MLS_TYPE”
• Enhanced B2B (eB2B): Support: Added basic eB2B support
• Added validation for SBDH fields to handle missing/empty identifier values and provide clearer error messages
• PINT Wildcard Migration: Getting rid of “oxalis.pint.wildcard.migration.phase” parameter
• Bump HTTP Client to 5.4.4
• Bump Apache CXF to 4.0.9
• Bump Vefa-Peppol: 4.2.1
• OSSRH to Maven Central Repository migration: Added necessary configuration to support OSSRH to Central Publisher Portal migration.
• Set HTTP response code to 200 for invalid certificate
• Bump Commons-CertValidator to 4.6.0
• Bump Peppol Specifications to 2.5.0
• Bump commons-lang3 version to 3.18.0
• Bump Jetty to 11.0.25
• Bump JAXB (impl) to 4.0.5
• Bump Guava to 33.4.8-jre
• Bump Joda-Time to 2.14.0
• Bump Commons-dbcp2 to 2.13.0
• Bump Commons-io to 2.19.0
• Bump MariaDB Java Client to 3.5.3
• Bump Hsqldb to 2.7.4
• Bump Logback to 1.5.18
• Bump OpenTelemetry (HTTP Client) to 2.16.0-alpha
• Bump OpenTelemetry Core to 1.50.0
• Bump TestNG to 7.11.0
• Bump Mockito Core to 5.17.0
• Bump Lombok to 1.18.38
• Bump MetaInf Services to 1.11

Full Changelog: v7.1.1...v7.2.0

Oxalis 7.2.0-RC5

• eDEC CodeList Support: Added support for eDEC CodeList v9.3
• Peppol PKI 2025: Added Peppol PKI 2025 Truststore for dual capability usage
• NAPTR Lookup Support (PFUOI 4.4.0): In this release, NAPTR lookup is the default lookup method.
• PINT Wildcard Migration: Getting rid of “oxalis.pint.wildcard.migration.phase” parameter
• Basic MLS Support: Added basic support for “MLS_TO” and “MLS_TYPE”
• Enhanced B2B (eB2B): Support: Added basic eB2B support
• Added validation for SBDH fields to handle missing/empty identifier values and provide clearer error messages
• Bump HTTP Client to 5.4.4
• Bump Apache CXF to 4.0.9
• Bump Vefa-Peppol: 4.2.1
• OSSRH to Maven Central Repository migration: Added necessary configuration to support OSSRH to Central Publisher Portal migration.
• Set HTTP response code to 200 for invalid certificate
• Bump Commons-CertValidator to 4.6.0
• Bump Peppol Specifications to 2.5.0
• Bump commons-lang3 version to 3.18.0
• Bump Jetty to 11.0.25
• Bump JAXB (impl) to 4.0.5
• Bump Guava to 33.4.8-jre
• Bump Joda-Time to 2.14.0
• Bump Commons-dbcp2 to 2.13.0
• Bump Commons-io to 2.19.0
• Bump MariaDB Java Client to 3.5.3
• Bump Hsqldb to 2.7.4
• Bump Logback to 1.5.18
• Bump OpenTelemetry (HTTP Client) to 2.16.0-alpha
• Bump OpenTelemetry Core to 1.50.0
• Bump TestNG to 7.11.0
• Bump Mockito Core to 5.17.0
• Bump Lombok to 1.18.38
• Bump MetaInf Services to 1.11

Full Changelog: v7.1.1...v7.2.0-RC5

Oxalis 7.2.0-RC4

• eDEC CodeList Support: Added support for eDEC CodeList v9.3
• Peppol PKI 2025: Added Peppol PKI 2025 Truststore for dual capability usage
• Set HTTP response code to 200 for invalid certificate
• NAPTR Lookup Support (PFUOI 4.4.0): In this release, NAPTR lookup is the default lookup method (No additional parameter needed in oxalis.conf). Users who prefer to continue using CNAME lookup may do so until T2 (01.11.2025). To use CNAME lookup with this version, set the following property in oxalis.conf:

lookup.locator.class=network.oxalis.vefa.peppol.lookup.locator.BusdoxLocator

• PINT Wildcard Migration: Getting rid of “oxalis.pint.wildcard.migration.phase” parameter
• Basic MLS Support: Added basic support for “MLS_TO” and “MLS_TYPE”
• Enhanced B2B (eB2B): Support: Added basic eB2B support
• OSSRH to Maven Central Repository migration: Added necessary configuration to support OSSRH to Central Publisher Portal migration.
• Bump HTTP Client to 5.4.4
• Bump Apache CXF to 4.0.9
• Bump Vefa-Peppol: 4.2.0-RC5
• Bump Commons-CertValidator to 4.6.0
• Bump Peppol Specifications to 2.5.0
• Bump commons-lang3 version to 3.18.0
• Bump Jetty to 11.0.25
• Bump JAXB (impl) to 4.0.5
• Bump Guava to 33.4.8-jre
• Bump Joda-Time to 2.14.0
• Bump Commons-dbcp2 to 2.13.0
• Bump Commons-io to 2.19.0
• Bump MariaDB Java Client to 3.5.3
• Bump Hsqldb to 2.7.4
• Bump Logback to 1.5.18
• Bump OpenTelemetry (HTTP Client) to 2.16.0-alpha
• Bump OpenTelemetry Core to 1.50.0
• Bump TestNG to 7.11.0
• Bump Mockito Core to 5.17.0
• Bump Lombok to 1.18.38
• Bump MetaInf Services to 1.11

Full Changelog: v7.1.1...v7.2.0-RC4

Oxalis 7.2.0-RC3

• eDEC CodeList Support: Added support for eDEC CodeList v9.3
• Peppol PKI 2025: Added Peppol PKI 2025 Truststore for dual capability usage
• NAPTR Lookup Support (PFUOI 4.4.0): In this release, NAPTR lookup is the default lookup method (No additional parameter needed in oxalis.conf). Users who prefer to continue using CNAME lookup may do so until T2 (01.11.2025). To use CNAME lookup with this version, set the following property in oxalis.conf:

lookup.locator.class=network.oxalis.vefa.peppol.lookup.locator.BusdoxLocator

• PINT Wildcard Migration: Getting rid of “oxalis.pint.wildcard.migration.phase” parameter
• Basic MLS Support: Added basic support for “MLS_TO” and “MLS_TYPE”
• Enhanced B2B (eB2B): Support: Added basic eB2B support
• OSSRH to Maven Central Repository migration: Added necessary configuration to support OSSRH to Central Publisher Portal migration.
• Bump HTTP Client to 5.4.4
• Bump Apache CXF to 4.0.9
• Bump Vefa-Peppol: 4.2.0-RC4
• Bump Commons-CertValidator to 4.6.0
• Bump Peppol Specifications to 2.5.0
• Bump commons-lang3 version to 3.18.0
• Bump Jetty to 11.0.25
• Bump JAXB (impl) to 4.0.5
• Bump Guava to 33.4.8-jre
• Bump Joda-Time to 2.14.0
• Bump Commons-dbcp2 to 2.13.0
• Bump Commons-io to 2.19.0
• Bump MariaDB Java Client to 3.5.3
• Bump Hsqldb to 2.7.4
• Bump Logback to 1.5.18
• Bump OpenTelemetry (HTTP Client) to 2.16.0-alpha
• Bump OpenTelemetry Core to 1.50.0
• Bump TestNG to 7.11.0
• Bump Mockito Core to 5.17.0
• Bump Lombok to 1.18.38
• Bump MetaInf Services to 1.11

Full Changelog: v7.1.1...v7.2.0-RC3

Oxalis 7.1.1

• eDEC CodeList Support: Added support for eDEC CodeList v9.3
• Bump vefa-peppol version to 4.0.1 to make resolvedServiceMetaDataURIList threadsafe
• NAPTR Lookup Support (PFUOI 4.4.0): Users who wish to enable NAPTR lookup can do so by configuring the following property in oxalis.conf:

lookup.locator.class=network.oxalis.vefa.peppol.lookup.locator.BdxlLocator

• Peppol Wildcard Change (PFUOI 4.3.0)
  To support the Peppol PINT wildcard migration, a new parameter has been introduced: oxalis.pint.wildcard.migration.phase
  In this release, the default value is set to 1. However, you can configure this value in oxalis.conf as and when needed as per timeframe:

# For T1 (May 15th, 2025, onward): - Set value to 1 on/after May 15th, 2025) - Default value in this version
oxalis.pint.wildcard.migration.phase=1

For PINT documents. always use "peppol-doctype-wildcard" as Document Type Identifier Scheme in SBDH otherwise default "busdox-docid-qns" value will be considered. This can lead to SMP lookup error if SMP registration is only available with "peppol-doctype-wildcard" and you are Not providing Document Type Identifier Scheme in SBDH. For details, refer "PINT Wildcard Migration Plan"

• Added code to set HTTP version with default value '1.1'. You can also configure [OPTIONAL] it in oxalis.conf as:

oxalis.http.version=1.1

• Added check [OPTIONAL] in inbound component to verify whether incoming message belong to your AP

# Configure below properties in oxalis.conf in production environment (access.point.isReceiverCheckEnabled=true), if you as receiving AP want to verify whether incoming messages belong to you as per your SMP registration. For Point-to-Point/simulated environment, set access.point.isReceiverCheckEnabled=false

access.point.isReceiverCheckEnabled=false
my.access.point.url="http://api.example.com/oxalis/as4"

• Removed outdated FRPOC support
• Fixed expired dummy AP certificates
• Bump peppol-specifications from 2.3.0 to 2.4.0
• Bump bouncycastle from 1.78.1 to 1.80
• Bump guava from 33.3.1-jre to 33.4.0-jre
• Bump joda-time from 2.12.2 to 2.13.0
• Bump slf4j from 2.0.6 to 2.0.17
• Bump logback from 1.5.6 to 1.5.16
• Bump lombok from 1.18.24 to 1.18.32
• Bump httpclient, from 4.5.13 to 4.5.14
• Corrected jakarta.servlet-api.version
• Bump commons-lang3 version to 3.18.0
• Updated GitHub CI Actions
• Added support for publishing to maven central repository
• Added Self Sign certificate and removed unreachable or moved URI

Full Changelog: v7.1.0...v7.1.1

Oxalis 7.2.0-RC1

• NAPTR Lookup Support (PFUOI 4.4.0): In this release, NAPTR lookup is now the default lookup method.
  Users who prefer to continue using CNAME lookup may do so until T2 (01.11.2025). To maintain CNAME lookup with this version, set the following property in oxalis.conf:

lookup.locator.class=network.oxalis.vefa.peppol.lookup.locator.BusdoxLocator

• Peppol Wildcard Change (PFUOI 4.3.0)
  To support the Peppol PINT wildcard migration, a new mandatory parameter has been introduced: oxalis.pint.wildcard.migration.phase
  In this release, the default value is set to 1. However, you can configure this value in oxalis.conf as and when needed as per timeframe:

# For T1 (May 15th, 2025, onward): - Set value to 1 on/after May 15th, 2025 ) - Default value in this version
oxalis.pint.wildcard.migration.phase=1
# For T2 (~September 03, 2025/TBD): - "busdox scheme exact match" in PINT messages will be removed in T2. You will start getting error message with phrase "...or SMP registration is not valid" when you continue trying to send PINT message with "busdox scheme" 
oxalis.pint.wildcard.migration.phase=2

For PINT documents. always use "peppol-doctype-wildcard" as Document Type Identifier Scheme in SBDH otherwise default "busdox-docid-qns" value will be considered. This can lead to SMP lookup error if SMP registration is only available with "peppol-doctype-wildcard" and you are Not providing Document Type Identifier Scheme in SBDH. For details, refer "PINT Wildcard Migration Plan"

• Bump httpclient to 5.4.4
• Bump vefa.peppol to 4.1.1
• Bump commons-certvalidator to 4.6.0
• Bump peppol-specifications to 2.5.0
• Bump cxf to 4.0.8
• Bump jetty to 11.0.25
• Bump jaxb-impl to 4.0.5
• Bump guava to 33.4.8-jre
• Bump joda-time to 2.14.0
• Bump commons-dbcp2 to 2.13.0
• Bump commons-io to 2.19.0
• Bump mariadb-java-client to 3.5.3
• Bump hsqldb to 2.7.4
• Bump logback to 1.5.18
• Bump opentelemetry.apache.httpclient to 2.16.0-alpha
• Bump opentelemetry to 1.50.0
• Bump testng to 7.11.0
• Bump mockito-core to 5.17.0
• Bump lombok to 1.18.38
• Bump metainf-services to 1.11

Full Changelog: v7.1.0...v7.2.0-RC1

Oxalis 7.0.0

What's Changed

• Major version i.e. incompatible with previous version
• Jakarta version upgrade by @smahieu87
• Require upgrade to Tomcat 10.1.x
• Run with all Java versions starting 11 to 21 without any workaround and/or warning messages
• Migration from Opentracing (archived/unsupported) to OpenTelemetry
• Added configurable properties in oxalis.conf for locator and global dns server vs organization dns

# Configure following properties for BusdoxLocator and BdxlLocator in Oxalis.conf as per your requirements
lookup.locator.busdox.timeout=30
lookup.locator.busdox.maxRetries=3
# If below lookup.locator.busdox.enablePublicDNS is set to true then it will use Google & Cloudflare DNS thereby bypassing organization DNS. 
# Google DNS is faster, but it also performs DNSSEC validation by default. 
# If DNSSEC signature expired in SML then it will throw SERVFAIL error. 
# There is trade-off between speed vs security. Keep it false, if you are Not sure what you are doing.  
lookup.locator.busdox.enablePublicDNS = false 

lookup.locator.bdxl.timeout=20
lookup.locator.bdxl.maxRetries=2
# If below lookup.locator.bdxl.enablePublicDNS is set to true then it will use Google & Cloudflare DNS thereby bypassing organization DNS. 
# Google DNS is faster, but it also performs DNSSEC validation by default. 
# If DNSSEC signature expired in SML then it will throw SERVFAIL error. 
# There is trade-off between speed vs security. Keep it false, if you are Not sure what you are doing.  
lookup.locator.bdxl.enablePublicDNS = false

• Further refinement of lookup results, error handling with actionable messages
• Bump peppol-specifications to version 2.3.0
• Bump pkix-ocsp version to 2.3.0
• Bump commons-certvalidator to version 4.4.0
• Bump vefa-peppol to version 3.8.0
• Bump guava version to 33.3.1-jre
• Bump h2 database to version 2.3.232
• Bump dnsjava version to 3.6.2
• Bump logback version to 1.5.6
• Bump Jetty version to 11.0.24
• Updated ELMA SMP domain
• Replaced old revoked AP test certificate with Norstella test AP certificate
• Updated SMP Prod and Test Certificate

New Contributors

• @smahieu87 made his first contribution for Jakarta version upgrade

Oxalis 6.7.0

• Added eDEC Codelist version 8.9 support
• Bump vefa-peppol version to 3.7.0
• Bump dnsjava version to 3.6.0
• Bump commons-certvalidator version to 4.2.0
• Replaced expired Peppol test certificate
• Optimized BdxlLocator and BusdoxLocator to fix network-level errors as participant not found

# Following additional "maxRetries" and "timeout" properties configured in "reference.conf" for BusdoxLocator and BdxlLocator
mode.default.lookup.locator = {
    class: network.oxalis.vefa.peppol.lookup.locator.BusdoxLocator

    bdxl: {
        .....
        .....
        maxRetries: 3
        timeout: 30
    }

    busdox: {
        .....
        .....
        maxRetries: 3
        timeout: 30
    }
}

Full Changelog: v6.6.0...v6.7.0

Oxalis 6.6.0

• Added eDEC Codelist version 8.8 support
• Bump vefa-peppol version to 3.6.0
• Bump Bouncycastle version to 1.78.1 to fix following vulnerabilities:
  • Bouncy Castle crafted signature and public key can be used to trigger an infinite loop
  • Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")
  • Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.
  • Bouncy Castle Denial of Service (DoS)
  • Bouncy Castle For Java LDAP injection vulnerability
• Bump commons-certvalidator to version 4.1.0
• Bump dnsjava to 3.5.3 version
• France Peppol certificate update

Full Changelog: v6.5.0...v6.6.0

Oxalis 6.5.0

• Bump vefa-peppol to version 3.5.0
• Added Dummy certificates and fixed Test cases

Full Changelog: v6.4.0...v6.5.0