Oxalis-NG v1.3.0-RC1

✨ Enhancements

• Added support for OpenPeppol eDEC Code Lists v9.6
• Upgraded vefa-peppol to version 4.4.0-RC1
• Introduced read/write capabilities for Peppol Message Level Status (MLS)

🛠️ Changes & Fixes

• Removed support for Peppol G2 PKI (OpenPeppol will revoke all G2 PKI certificates effective 20 April 2026)
• Updated message identifier to use SBDH InstanceIdentifier in line with ETSI REMEvidence semantics
• Applied Oxalis-NG default HTTP client settings for safer Peppol operation
• Fixed oxalis.http.pool.validate_after_inactivity to be interpreted in milliseconds instead of seconds
• Corrected ISSUER entity name to Oxalis-NG
• Replaced string equality checks with semantic DN comparison
• Relaxed validation to allow non-Peppol document type identifiers (now generates a warning instead of failure)
• Upgraded core dependencies:
  • Apache CXF → 4.0.11
  • WSS4J → 3.0.5
  • Jetty → 11.0.26
• Configured CXF TLS handling to use JVM defaults
• Cleaned up dependencies by removing unused components (e.g., Ehcache and others)

👏 New Contributors
Thanks to @GoldSucc for first contribution (#57)

Full Changelog: v1.2.0...v1.3.0-RC1

Oxalis-NG v1.2.2

• OpenPeppol eDEC Code Lists: Added support for OpenPeppol eDEC Code Lists v9.5
• TICC-174: Replace string equality with semantic DN comparison
• Relax validation to allow non-Peppol document type identifier with warning

Full Changelog: v1.2.1...v1.2.2

Oxalis-NG v1.2.1

This tag release introduces explicit handling for "BEAst document profiles". BEAst profiles that currently do not conform to OpenPeppol eDEC code lists are supported with a warning and are treated as non-Peppol document types.

Oxalis-NG v1.2.0

• eDEC CodeList Support: Added support for eDEC CodeList v9.3
• Peppol PKI 2025: Added Peppol PKI 2025 Truststore for dual capability usage
• Fixed lookup for SMP deployed as non root application: Fix for SMP document/service lookup for SMP deployments under non-root context path
• NAPTR Lookup Support (PFUOI 4.4.0): In this release, NAPTR lookup is the default lookup method.
• Basic MLS Support: Added basic support for “MLS_TO” and “MLS_TYPE”
• Enhanced B2B (eB2B): Support: Added basic eB2B support
• Added validation for SBDH fields to handle missing/empty identifier values and provide clearer error messages
• PINT Wildcard Migration: Getting rid of “oxalis.pint.wildcard.migration.phase” parameter
• Bump HTTP Client to 5.4.4
• Bump Apache CXF to 4.0.9
• Bump Vefa-Peppol: 4.2.1
• Added Oxalis-NG browser type user agent reflecting Oxalis-NG version in headers
• OSSRH to Maven Central Repository migration: Added necessary configuration to support OSSRH to Central Publisher Portal migration.
• Set HTTP response code to 200 for invalid certificate
• Bump Commons-CertValidator to 4.6.0
• Bump Peppol Specifications to 2.5.0
• Bump commons-lang3 version to 3.18.0
• Bump Jetty to 11.0.25
• Bump JAXB (impl) to 4.0.5
• Bump Guava to 33.4.8-jre
• Bump Joda-Time to 2.14.0
• Bump Commons-dbcp2 to 2.13.0
• Bump Commons-io to 2.19.0
• Bump MariaDB Java Client to 3.5.3
• Bump Hsqldb to 2.7.4
• Bump Logback to 1.5.18
• Bump OpenTelemetry (HTTP Client) to 2.16.0-alpha
• Bump OpenTelemetry Core to 1.50.0
• Bump TestNG to 7.11.0
• Bump Mockito Core to 5.17.0
• Bump Lombok to 1.18.38
• Bump MetaInf Services to 1.11

Full Changelog: v1.1.1...v1.2.0

Oxalis-NG v1.2.0-RC8

• eDEC CodeList Support: Added support for eDEC CodeList v9.3
• Peppol PKI 2025: Added Peppol PKI 2025 Truststore for dual capability usage
• NAPTR Lookup Support (PFUOI 4.4.0): In this release, NAPTR lookup is the default lookup method.
• PINT Wildcard Migration: Getting rid of “oxalis.pint.wildcard.migration.phase” parameter
• Basic MLS Support: Added basic support for “MLS_TO” and “MLS_TYPE”
• Enhanced B2B (eB2B): Support: Added basic eB2B support
• Added validation for SBDH fields to handle missing/empty identifier values and provide clearer error messages
• Bump HTTP Client to 5.4.4
• Bump Apache CXF to 4.0.9
• Bump Vefa-Peppol: 4.2.1
• Added Oxalis-NG browser type user agent reflecting Oxalis-NG version in headers
• OSSRH to Maven Central Repository migration: Added necessary configuration to support OSSRH to Central Publisher Portal migration.
• Set HTTP response code to 200 for invalid certificate
• Bump Commons-CertValidator to 4.6.0
• Bump Peppol Specifications to 2.5.0
• Bump commons-lang3 version to 3.18.0
• Bump Jetty to 11.0.25
• Bump JAXB (impl) to 4.0.5
• Bump Guava to 33.4.8-jre
• Bump Joda-Time to 2.14.0
• Bump Commons-dbcp2 to 2.13.0
• Bump Commons-io to 2.19.0
• Bump MariaDB Java Client to 3.5.3
• Bump Hsqldb to 2.7.4
• Bump Logback to 1.5.18
• Bump OpenTelemetry (HTTP Client) to 2.16.0-alpha
• Bump OpenTelemetry Core to 1.50.0
• Bump TestNG to 7.11.0
• Bump Mockito Core to 5.17.0
• Bump Lombok to 1.18.38
• Bump MetaInf Services to 1.11

Full Changelog: v1.1.1...v1.2.0-RC8

Oxalis-NG v1.2.0-RC7

• eDEC CodeList Support: Added support for eDEC CodeList v9.3
• Peppol PKI 2025: Added Peppol PKI 2025 Truststore for dual capability usage
• Set HTTP response code to 200 for invalid certificate
• NAPTR Lookup Support (PFUOI 4.4.0): In this release, NAPTR lookup is the default lookup method (No additional parameter needed in oxalis.conf). Users who prefer to continue using CNAME lookup may do so until T2 (01.11.2025). To use CNAME lookup with this version, set the following property in oxalis.conf:

lookup.locator.class=network.oxalis.vefa.peppol.lookup.locator.BusdoxLocator

• PINT Wildcard Migration: Getting rid of “oxalis.pint.wildcard.migration.phase” parameter
• Basic MLS Support: Added basic support for “MLS_TO” and “MLS_TYPE”
• Enhanced B2B (eB2B): Support: Added basic eB2B support
• OSSRH to Maven Central Repository migration: Added necessary configuration to support OSSRH to Central Publisher Portal migration.
• Bump HTTP Client to 5.4.4
• Bump Apache CXF to 4.0.9
• Bump Vefa-Peppol: 4.2.0-RC5
• Added Oxalis-NG browser type user agent reflecting Oxalis-NG version in headers
• Bump Commons-CertValidator to 4.6.0
• Bump Peppol Specifications to 2.5.0
• Bump commons-lang3 version to 3.18.0
• Bump Jetty to 11.0.25
• Bump JAXB (impl) to 4.0.5
• Bump Guava to 33.4.8-jre
• Bump Joda-Time to 2.14.0
• Bump Commons-dbcp2 to 2.13.0
• Bump Commons-io to 2.19.0
• Bump MariaDB Java Client to 3.5.3
• Bump Hsqldb to 2.7.4
• Bump Logback to 1.5.18
• Bump OpenTelemetry (HTTP Client) to 2.16.0-alpha
• Bump OpenTelemetry Core to 1.50.0
• Bump TestNG to 7.11.0
• Bump Mockito Core to 5.17.0
• Bump Lombok to 1.18.38
• Bump MetaInf Services to 1.11

Full Changelog: v1.1.1...v1.2.0-RC7

Oxalis-NG v1.2.0-RC6

• eDEC CodeList Support: Added support for eDEC CodeList v9.3
• Peppol PKI 2025: Added Peppol PKI 2025 Truststore for dual capability usage
• NAPTR Lookup Support (PFUOI 4.4.0): In this release, NAPTR lookup is the default lookup method (No additional parameter needed in oxalis.conf). Users who prefer to continue using CNAME lookup may do so until T2 (01.11.2025). To use CNAME lookup with this version, set the following property in oxalis.conf:

lookup.locator.class=network.oxalis.vefa.peppol.lookup.locator.BusdoxLocator

• PINT Wildcard Migration: Getting rid of “oxalis.pint.wildcard.migration.phase” parameter
• Basic MLS Support: Added basic support for “MLS_TO” and “MLS_TYPE”
• Enhanced B2B (eB2B): Support: Added basic eB2B support
• OSSRH to Maven Central Repository migration: Added necessary configuration to support OSSRH to Central Publisher Portal migration.
• Bump HTTP Client to 5.4.4
• Bump Apache CXF to 4.0.9
• Bump Vefa-Peppol: 4.2.0-RC4
• Added Oxalis-NG browser type user agent reflecting Oxalis-NG version in headers
• Bump Commons-CertValidator to 4.6.0
• Bump Peppol Specifications to 2.5.0
• Bump commons-lang3 version to 3.18.0
• Bump Jetty to 11.0.25
• Bump JAXB (impl) to 4.0.5
• Bump Guava to 33.4.8-jre
• Bump Joda-Time to 2.14.0
• Bump Commons-dbcp2 to 2.13.0
• Bump Commons-io to 2.19.0
• Bump MariaDB Java Client to 3.5.3
• Bump Hsqldb to 2.7.4
• Bump Logback to 1.5.18
• Bump OpenTelemetry (HTTP Client) to 2.16.0-alpha
• Bump OpenTelemetry Core to 1.50.0
• Bump TestNG to 7.11.0
• Bump Mockito Core to 5.17.0
• Bump Lombok to 1.18.38
• Bump MetaInf Services to 1.11

Full Changelog: v1.1.1...v1.2.0-RC6

Oxalis-NG v1.2.0-RC5

• eDEC CodeList Support: Added support for eDEC CodeList v9.3
• Peppol PKI 2025: Added Peppol PKI 2025 Truststore for dual capability usage
• NAPTR Lookup Support (PFUOI 4.4.0): In this release, NAPTR lookup is the default lookup method (No additional parameter needed in oxalis.conf). Users who prefer to continue using CNAME lookup may do so until T2 (01.11.2025). To use CNAME lookup with this version, set the following property in oxalis.conf:

lookup.locator.class=network.oxalis.vefa.peppol.lookup.locator.BusdoxLocator

• PINT Wildcard Migration: Getting rid of “oxalis.pint.wildcard.migration.phase” parameter
• Basic MLS Support: Added basic support for “MLS_TO” and “MLS_TYPE”
• Enhanced B2B (eB2B): Support: Added basic eB2B support
• OSSRH to Maven Central Repository migration: Added necessary configuration to support OSSRH to Central Publisher Portal migration.
• Bump HTTP Client to 5.4.4
• Bump Apache CXF to 4.0.9
• Bump Vefa-Peppol: 4.2.0-RC4
• Bump Commons-CertValidator to 4.6.0
• Bump Peppol Specifications to 2.5.0
• Bump commons-lang3 version to 3.18.0
• Bump Jetty to 11.0.25
• Bump JAXB (impl) to 4.0.5
• Bump Guava to 33.4.8-jre
• Bump Joda-Time to 2.14.0
• Bump Commons-dbcp2 to 2.13.0
• Bump Commons-io to 2.19.0
• Bump MariaDB Java Client to 3.5.3
• Bump Hsqldb to 2.7.4
• Bump Logback to 1.5.18
• Bump OpenTelemetry (HTTP Client) to 2.16.0-alpha
• Bump OpenTelemetry Core to 1.50.0
• Bump TestNG to 7.11.0
• Bump Mockito Core to 5.17.0
• Bump Lombok to 1.18.38
• Bump MetaInf Services to 1.11

Full Changelog: v1.1.1...v1.2.0-RC5

Oxalis-NG v1.2.0-RC4

• eDEC CodeList Support: Added support for eDEC CodeList v9.3
• Peppol PKI 2025: Added Peppol PKI 2025 Truststore for dual capability usage
• NAPTR Lookup Support (PFUOI 4.4.0): NAPTR Lookup is the Default lookup method for Peppol participant discovery in this release.
• PINT Wildcard Migration: Getting rid of “oxalis.pint.wildcard.migration.phase” parameter
• Basic MLS Support: Added basic support for “MLS_TO” and “MLS_TYPE”
• Enhanced B2B (eB2B): Support: Added basic eB2B support
• OSSRH to Maven Central Repository migration: Added necessary configuration to support OSSRH to Central Publisher Portal migration.
• Bump HTTP Client to 5.4.4
• Bump Vefa-Peppol: 4.2.0-RC3
• Bump Commons-CertValidator to 4.6.0
• Bump Peppol Specifications to 2.5.0
• Bump commons-lang3 version to 3.18.0
• Bump Apache CXF to 4.0.8
• Bump Jetty to 11.0.25
• Bump JAXB (impl) to 4.0.5
• Bump Guava to 33.4.8-jre
• Bump Joda-Time to 2.14.0
• Bump Commons-dbcp2 to 2.13.0
• Bump Commons-io to 2.19.0
• Bump MariaDB Java Client to 3.5.3
• Bump Hsqldb to 2.7.4
• Bump Logback to 1.5.18
• Bump OpenTelemetry (HTTP Client) to 2.16.0-alpha
• Bump OpenTelemetry Core to 1.50.0
• Bump TestNG to 7.11.0
• Bump Mockito Core to 5.17.0
• Bump Lombok to 1.18.38
• Bump MetaInf Services to 1.11

Full Changelog: v1.1.1...v1.2.0-RC4

Oxalis-NG v1.1.1

• eDEC CodeList Support: Added support for eDEC CodeList v9.3
• Bump vefa-peppol version to 4.0.1 to make resolvedServiceMetaDataURIList threadsafe
• NAPTR Lookup Support (PFUOI 4.4.0): Users who wish to enable NAPTR lookup can do so by configuring the following property in oxalis.conf:

lookup.locator.class=network.oxalis.vefa.peppol.lookup.locator.BdxlLocator

• Peppol Wildcard Change (PFUOI 4.3.0)
  To support the Peppol PINT wildcard migration, a new parameter has been introduced: oxalis.pint.wildcard.migration.phase
  In this release, the default value is set to 1. However, you can configure this value in oxalis.conf as and when needed as per timeframe:

# For T1 (May 15th, 2025, onward): - Set value to 1 on/after May 15th, 2025) - Default value in this version
oxalis.pint.wildcard.migration.phase=1

For PINT documents. always use "peppol-doctype-wildcard" as Document Type Identifier Scheme in SBDH otherwise default "busdox-docid-qns" value will be considered. This can lead to SMP lookup error if SMP registration is only available with "peppol-doctype-wildcard" and you are Not providing Document Type Identifier Scheme in SBDH. For details, refer "PINT Wildcard Migration Plan"

• Added code to set HTTP version with default value '1.1'. You can also configure [OPTIONAL] it in oxalis.conf as:

oxalis.http.version=1.1

• Added check [OPTIONAL] in inbound component to verify whether incoming message belong to your AP

# Configure below properties in oxalis.conf in production environment (access.point.isReceiverCheckEnabled=true), if you as receiving AP want to verify whether incoming messages belong to you as per your SMP registration. For Point-to-Point/simulated environment, set access.point.isReceiverCheckEnabled=false

access.point.isReceiverCheckEnabled=false
my.access.point.url="http://api.example.com/oxalis/as4"

• Removed outdated FRPOC support
• Fixed expired dummy AP certificates
• Bump peppol-specifications from 2.3.0 to 2.4.0
• Bump bouncycastle from 1.78.1 to 1.80
• Bump guava from 33.3.1-jre to 33.4.0-jre
• Bump joda-time from 2.12.2 to 2.13.0
• Bump slf4j from 2.0.6 to 2.0.17
• Bump logback from 1.5.6 to 1.5.16
• Bump lombok from 1.18.24 to 1.18.32
• Bump httpclient, from 4.5.13 to 4.5.14
• Corrected jakarta.servlet-api.version
• Bump commons-lang3 version to 3.18.0
• Updated GitHub CI Actions
• Added support for publishing to maven central repository
• Added Self Sign certificate and removed unreachable or moved URI

Full Changelog: v1.1.0...v1.1.1