eXist-db 7.0.0-beta5

Overview

eXist-7.0.0-beta5 covers 203 merged pull requests since eXist-7.0.0-beta3. Like beta3,
this remains a beta — not recommended for production use.

Note: eXist-7.0.0-beta4 was never released — its build failed, so no installers were
published. eXist-7.0.0-beta5 is the direct successor to eXist-7.0.0-beta3; everything
beta4 would have contained is included here.

Installer & Packaging Updates

This window had an unusual amount of installer churn, closing out several issues left over from
beta3's "signed but not yet working" installers:

• macOS DMG notarization fixed — the codesign script for lz4-java's native library was
  hardcoded to version 1.11.0; two Dependabot bumps moved the actual dependency to 1.11.2
  without updating the script, breaking the beta4 build. Now driven from a single
  lz4-java.version property shared between the dependency and the codesign step, matching the
  existing jansi.version pattern. (#6715)
• macOS .app launch fixed — LSArchitecturePriority, stripFirstElement, and an IzPack
  minVersion bump so the beta3 .app actually starts. (#6434)
• IzPack installer stabilized — rolled back 5.2.5 → 5.2.4 after a console-mode regression
  (#6438), then re-bumped to 5.2.6 once fixed (#6445); restored xz compression (#6611); fixed a
  missing classpath entry that threw NoClassDefFoundError: org/xmlresolver/Resolver during
  post-install (#6444).
• Windows installer JAR — fixed a runner.temp path bug that was silently dropping the
  installer JAR from release artifacts (#6435).
• Content/package selection screen — added missing XAR files, made the OpenAPI XAR a
  mandatory install, cleaned up installer copy (#6519).
• JnlpJarFiles realigned with the jars added in #5806 (#6516).
• Distribution & installer job cleanup — removed dead assembly code, fixed Installer.jar
  generation and publishing (#6460), and dropped an unused plexus dependency left over from that
  cleanup (#6523).

What's Changed

Features

• [feature] Distinct error codes for sm: permission functions (let callers map 403 vs 400) by @joewiz in #6464
• [feature] response:stream-binary-resource — zero-copy binary download by @joewiz in #6466
• [feature] request module: Accept-header parsing and content negotiation by @joewiz in #6477
• [feature] Native EXPath HTTP Client (java.net.http + Methanol); remove Apache HttpClient by @joewiz in #6482
• [feature] Enable HTTP/2 for jetty by @dizzzz in #6485
• [feature] Adds new xmldb-api security services by @reinhapa in #6520
• XSD 1.1 support — store-time document validation via a Saxon catalog resolver (#6530),
  versioned native schemas shipped with governance CI (#6528), and follow-up validation/catalog
  fixes (#6496), all by @duncdrum
• [feature] Add @enabled attribute to conf.xml elements to disable entries without removing them by @duncdrum in #6550
• [feature] request: add request:get-uploaded-file-headers() by @joewiz in #6583
• [feature] Unix-style execute-without-read for stored XQuery by @line-o in #6586
• Add system:get-jmx-token() to expose JMXServlet's access token by @line-o in #6631
• Publish JMH benchmark results to a gh-pages dashboard by @duncdrum in #6608

Bug Fixes

• [bugfix] distinguish XPTY0004 from XQDY0074 in computed constructors by @line-o in #6268
• [fix] remove omit-original-xml-declaration flag by @line-o in #6277
• [bugfix] fn:xml-to-json: enforce F&O 3.1 §17.4.2 structural validation (+10 XQTS HEAD) by @joewiz in #6350
• [bugfix] Preserve attribute namespace when copied via enclosed expression (+4 XQTS HEAD) by @joewiz in #6356
• [bugfix] InteractiveClient/GUI: when connection to database fails, allow user to reconnect easily. by @dizzzz in #6424
• [bugfix] FileLock: remove shared ByteBuffer to fix concurrent save/read race by @joewiz in #6430
• [bugfix] repo:remove: throw with diagnostic info instead of swallowing exceptions by @joewiz in #6432
• [bugfix] Preserve ft:highlight-field-matches under facet drill-down by @joewiz in #6454
• [bugfix] Windows startup.bat: use %BASEDIR% for exist.autodeploy.dir (closes #6456) by @joewiz in #6457
• [bugfix] asterisk and dot in element()-typed args in field @expression by @duncdrum in #6461
• [bugfix] eliminate port-binding TOCTOU race in test servers by @duncdrum in #6462
• [bugfix] Compile statically-named arrow operator to a direct function call (closes #3887, #3336, #3885) by @joewiz in #6469
• [bugfix] Log a deferred (tail-call) function's error once, not once per Sequence accessor by @joewiz in #6470
• [bugfix] External variable: supplied value overrides declared default by @joewiz in #6475
• Improve function resolution by @line-o in #6476
• [bugfix] RESTServer: set Content-Type for JSON results by @joewiz in #6478
• [bugfix] map keys: compare by op:same-key, never coerce across type families by @joewiz in #6491
• [bugfix] xmldb:store: parse binary content stored under an XML mime type by @joewiz in #6497
• [bugfix] fixes potential NPE by @reinhapa in #6499
• [bugfix] Function: report the actual argument count in arity-mismatch errors by @joewiz in #6504
• [bugfix] Fix premature closing of still-referenced binary values by @joewiz in #6506
• [bugfix] Sequence.containsReference: recurse into nested map/array items by @joewiz in #6507
• [bugfix] http-client: support the src attribute on http:body (#6510) by @joewiz in #6511
• [bugfix] http-client: honor http:body/@method for inline body serialization by @joewiz in #6513
• [bugfix] http-client: parse a non-well-formed HTML response to a document by @joewiz in #6514
• [bugfix] http-client: byte-safe multipart response parsing with nesting by @joewiz in #6515
• [bugfix] Bind context item for trailing function-call path step on stored docs by @joewiz in #6522
• Fix BrokerPool.inServiceMode JMM data race with volatile by @duncdrum in #6533
• [bugfix] Stop backup prolog stderr spam; fix DeadlockIT CI hang by @duncdrum in #6534
• [bugfix] Silence Log4j StatusLogger noise in Maven test forks by @duncdrum in #6535
• [hotfix] repair build by @dizzzz in #6545
• [bugfix] Forward port PR #6544: fix XSLT imports and document builder isolation by @line-o in #6546
• Fix Jetty shutdown hang and BrokerPool read-only race by @duncdrum in #6572
• [bugfix] Parse multipart/form-data for all HTTP methods, not only POST by @joewiz in #6581
• [hotfix]: align BouncyCastle modules to override Tika 1.84 by @duncdrum in #6591
• [bugfix] Restore XQuery pool integrity for execute-only callers by @line-o in #6599
• [bugfix] Make mvn package re-runnable by @line-o in #6602
• [bugfix] request: expose If-Modified-Since to handlers during view handover by @joewiz in #6606
• [bugfix] Tolerate ambiguous URI segments in getServletPath() by @line-o in #6622
• Fix xml:id FORG0001 spam in PrecedingAxisBenchmark by @duncdrum in #6645
• [bugfix] Release the stored query's READ_LOCK at end-of-compile over REST and XML-RPC by @line-o in #6647
• [bugfix] Guard against null Path.of(getRealPath()/getPathTranslated()) across servlet/urlrewrite code by @duncdrum in #6649
• [bugfix] update ParseHtmlTest to match codelibs nekohtml 3.0.4 behavior by @dizzzz in #6662
• [bugfix] Fix resource leak Lucene AnalyzerConfig by @dizzzz in #6663
• [bugfix] Anchor .moderne ignore pattern so it applies at any depth by @duncdrum in #6685
• [bugfix] cover native collection.xconf.xsd via OASIS catalog + jaxp by @duncdrum in #6687
• [bugfix] Replace CachingResponseWrapper's header-name allowlist with buffer+replay by @duncdrum in #6692
• [bugfix] Fix CachingResponseWrapper gaps exposed by the Jetty 12 upgrade by @duncdrum in #6694
• [bugfix] XQSuite: don't re-serialize already-serialized failure values by @joewiz in #6699
• [bugfix] Look up a named attribute kind test in the attribute index on the self axis by @joewiz in #6703
• [bugfix] Handle SQLexception gracefully for rs.getMetaData() by @dizzzz in #6712

Performance

• [optimize] PrecedingFilter: K-bounded sliding window for preceding::*[K] (#2129 follow-up to PR #6325) by @joewiz in #6330
• [optimize] fn:deep-equal: streaming fast-path for persistent-DOM trees (closes #4050) by @joewiz in #6337
• [optimize] xmldb:store — stream a binary value instead of materializing to a heap byte[] by @joewiz in #6467

Security

• [security] improve Docker file by @line-o in #6524

Refactoring

• [refactor] Revise HttpClient creation and caching. by @dizzzz in #6503
• [refactor] RESTServer: decompose doGet/doPost and clear Codacy findings by @line-o in #6562
• [refactor] Apply OpenRewrite Java21 recipe by @dizzzz in #6630

Tests, CI, Build & Internal Tooling

• [ci] compare-results.xslt: surface runner-JAR drift warning when build SHAs differ by @joewiz in #6332
• [test] Cover arrow-operator placeholder edge cases (#6471) by @joewiz in #6472
• [doc] AGENTS.md: add XQSuite-vs-Java test-selection rubric; remove stale Known Issues by @joewiz in #6483
• [test] Cover boost-config + facet drill-down in the ft:highlight regression by @joewiz in #6486
• [ignore] override jackson-databind dep version by @line-o in #6525
• Generate test conf.xml/controller-config.xml fixtures from canonical at build time by @duncdrum in #6531
• Fix flaky CI tests: HTTP/2 hangs, broker/txn ordering races, and BrokerPool shutdown safety by @duncdrum in #6532
• [ci] Publish container attestations via staging-then-promote by @line-o in #6543
• [ignore] textual update by @dizzzz in #6548
• [build] add maven wrapper by @line-o in #6555
• [ci] Post XQTS result comparison as a PR comment by @line-o in #6564
• [ignore] only ignore the contents of .moderne/ (allows negations) by @line-o in #6565
• Update exist-xqts-runner version to 2.0.0-RC3 by @line-o in #6584
• [ci] Update Prethink recipe by @dizzzz in #6595
• [ci] update Moderne build configuration by @line-o in #6600
• [ci] Enable OCI media types for container image attestations by @line-o in #6629
• [test] Poll for shared-pool visibility instead of asserting it synchronously by @line-o in #6635
• Fix ci-benchmarks.yml: activate perf-tests profile by @duncdrum in #6641
• Unify exist-core-jmh and exist-indexes-jmh maven wiring; fix broken Lucene/conf.xml benchmarks by @duncdrum in #6646
• [ci] Pin oci-artifact=false so Docker Hub/Scout can ingest published images by @line-o in #6648
• [ci] Separate real outcome changes from recording noise in the XQTS comparison by @line-o in #6650
• [ci] Update exist-xqts-runner to 2.0.0-RC4 by @line-o in #6651
• [doc] Document recursive xmldb:create-collection() #3869 by @AzazelSensei in #6666
• [test] Extract nested classes and consolidate test suite by @duncdrum in #6693

Dependency Updates (96)

New Contributors

• @AzazelSensei made their first contribution in #6666

Full Changelog: eXist-7.0.0-beta3...eXist-7.0.0-beta5