Quarkus CXF 3.39.0 release notes

Before Quarkus CXF 3.39.0, quarkus-cxf pulled in quarkus-jackson as a transitive dependency. This caused conflicts when the application used an alternative JSON processing library such as JSON-B. Since Quarkus CXF 3.39.0, the unnecessary quarkus-jackson dependency was removed.

Special thanks to @ngChris for reporting the issue.

The WS-Addressing decoupled endpoint error messages from CXF now reference Quarkus CXF configuration properties instead of CXF system properties. This makes it easier to configure quarkus.cxf.endpoint.addressing.decoupled.enabled and quarkus.cxf.endpoint.addressing.decoupled.allowed-schemes when encountering these errors.

Before Quarkus CXF 3.39.0 and 3.33.11, WS-Addressing clients could request non-anonymous reply or fault destinations without explicitly enabling this on the server. Since Quarkus CXF 3.33.11, such requests are rejected with a DestinationUnreachable fault by default to prevent Server-Side Request Forgery (SSRF). Applications that require decoupled WS-Addressing callbacks must enable them using quarkus.cxf.endpoint.addressing.decoupled.enabled and configure the allowed URI scheme prefixes via quarkus.cxf.endpoint.addressing.decoupled.allowed-schemes if the defaults are insufficient.

Before Quarkus CXF 3.39.0 and 3.33.11, CXF did not impose a default maximum attachment size. Since Quarkus CXF 3.33.11, the upgrade to CXF 4.1.8 introduces a default limit of 50 MB. Applications that process larger attachments must explicitly configure the CXF attachment-max-size contextual property. See Securing CXF Services for details.