The JAXP 1.4.6 release corresponds to Java SE 7 update 4. It includes security and conformance enhancement, and fixes of critical issues in the areas of performance, and regression. This release also includes updates from Apache Xalan 2.7.1. The sources of this release have been integrated into OpenJDK 7 update 4. Please read below for more details about this update.

Changes and bug fixes:

1. Conformance
   During the development, over a thousand new tests have been added to the JAXP TCK and JCK that will be the basis of future JAXP TCK and JCK releases. The JAXP 1.4.6 release has been tested against these new tests, and is ready for those releases.
   
   In addition, customers reported 7042647 , 7055530, 6767322 have also been resolved.
   
   
2. New Implementation-only Feature and Security Improvement
   The JAXP plugability layer allows compliant parsers to be used in place of the default implementation. In reality, using different implementations (e.g. the default validation component with a third party parser) in one processing may not be practical. The plugability layer therefore does nothing but negatively affects performance in many of such applications. The following implementation-only feature is added to validation, transformation and XPath to allow users to skip the plugability layer:
   
   final String ORACLE_FEATURE_SERVICE_MECHANISM = "www.oracle.com/feature/use-service-mechanism";
   
   To maintain backward compatibility, this feature is on by default, which means using the service mechanism. Where desired, it can be turned off by setting the value to false as done in the following:
   factory.setFeature(ORACLE_FEATURE_SERVICE_MECHANISM, false);
   
   The change improves security by disallowing unwanted plugin of unknown implementations. Note that when running in secure mode or security manager is in place, this feature has no effect. In secure mode, components from the same implementation will be loaded regardless of the setting of the feature. That means, client that loads factory instance using newInstance() with no arguments will continue to load dependent components through the services mechanism, when the factoryClassName parameter is provided however, the components from default implementation will always be used.
   
   
3. New Implementation-only Property
   The Apache Xalan update below introduced a change that although technically correct, was nonetheless an incompatible change. As reported in the change request 7150637, it caused NetBeans test failures and spurious reformatting of project metadata of users' projects that the version control tool would take as if there were real changes. The incompatible behavior would more than likely cause more problems to users' applications as did to the JAXP SQE tests.
   
   To solve the problem, an implementation specific property has been added that can be used to essentially neutralize the Apache change to bring back the original behavior. The property can be used as shown below:
   
   

                   static final String ORACLE_IS_STANDALONE = "www.oracle.com/xml/is-standalone";
                   //catch IllegalArgumentException when running with previous releases
                   try {
                       transformer.setOutputProperty(ORACLE_IS_STANDALONE, "yes");
                   } catch (IllegalArgumentException e) {
                       //expected for previous releases
                   }        
                   

4. Apache Update
   JAXP 1.4.6 includes 29 patches from Xalan 2.7.1.
   
   
   
   

• For all changes and fixes made in the JAXP 1.4.6 release, please refer to:
  
  The JAXP 1.4.6 Change Log