The Apache BVal project implements the Java EE Bean Validation
specification(s) and related extensions, and became a top-level project of
the foundation on February 15, 2012.
During the past quarter we released Apache BVal 2.0.0 which delivers an
implementation of the latest 2.0 Bean Validation JSR specification.
The recent release included code that, unless deliberately circumvented,
would prevent the behavior at the core of the security vulnerability reported
during Q2.
The Bean Validation EG leadership has reached out to encourage us to obtain
official status as a conforming implementation. This is primarily a matter
of configuration tooling which we hope to address in a forthcoming point
release.
We have received a small number of post-release bug reports which we intend
to address in the immediate future when the team's non-volunteer workload
permits.
