XML Resolver version 6.0.23
Published by Closing in on 6.1, this release exercises the new build infrastructure, mitigates a couple of Microsoft CVEs in the C# resolver, and adds support for “new” HTTP status codes in the Java resolver.
I anticipate that this will be the last experimental release of the 6.x code base. The first “real” release, 6.1, should be out later this month. But before I could do that, I needed to make sure that the new build infrastructure worked. And it does…now.
On the C# side, there were a couple of recently reported CVEs in Microsoft APIs that are dependencies on the C# resolver. I don’t actually think the effected APIs are used, but it seemed prudent to push a fix for them. On that basis, I also published an update to the legacy v2.x branch for C#. But you should really switch to 6.0.23 if you can.
(I think I’ve done the Microsoft builds in a more portable way on .NET, but reports to the contrary humbly accepted. It remains an ecosystem for which I have, at best, a shaky understanding.)
On the Java side, my plan was just to do an infrastructure/build update but along the way, I encountered a “new” HTTP response code in the wild. I mean, it was published in 2015, so it’s hardly new new, but it was new to me. Turns out the new hosting infrastructure for xmlresolver.org uses 308 for permanent redirects instead of 301. The technical distinction has to do with the request method and it makes complete sense, it had just passed me by somehow.
If you can take version 6.0.23 (on either platform) for a test drive and kick the tires (or tyres), I’d appreciate it.