Upgrade Apache CXF from 2.1.1 to 3.5.9 for Spring 5 compatibility

[Copilot]

Apache CXF Upgrade from 2.1.1 to 3.x

Completed Tasks:

• Research compatible CXF 3.x version for Spring 5.3.26 and Java 17
• Update CXF dependencies in treebase-core/pom.xml from 2.1.1 to 3.5.9
• Update CXF configuration files in treebase-web/src/main/webapp/WEB-INF/cxf-servlet.xml for CXF 3.x compatibility
• Re-enable cxf-servlet.xml in treebase-web/src/main/webapp/WEB-INF/web.xml contextConfigLocation
• Verify CXFServlet configuration in treebase-web/src/main/webapp/WEB-INF/web.xml (already enabled)
• Test treebase-core module builds successfully with CXF 3.5.9
• Verify web service code compatibility (StudyServiceByKeywordImp.java uses standard JAX-WS annotations - no code changes needed)
• Run code review (passed with no issues)
• Run security scanning (passed)
• Fix pre-existing compilation error in ListTaxaSearchController.java

Summary:

Successfully upgraded Apache CXF from 2.1.1 to 3.5.9 to be compatible with Spring 5.3.26 and Java 17. The upgrade required minimal changes:

• Updated 3 dependency versions in treebase-core/pom.xml
• Removed deprecated CXF 2.x import statements in cxf-servlet.xml (CXF 3.x uses Spring-based auto-configuration)
• Re-enabled cxf-servlet.xml in web.xml contextConfigLocation

Also fixed a pre-existing compilation error in ListTaxaSearchController that was preventing the build from succeeding. The error was due to incorrect type mapping for HttpServletRequest.getParameterMap().

All changes follow best practices and maintain backward compatibility with existing JAX-WS web services. Full build now succeeds.

Original prompt

Previously, we deactivated usage of Apache CXF 2.1.1 because it is too old for Spring 5. We need to do an upgrade to CXF 3.x. So, investigate where it was being imported in pom.xml files (now commented out) and do the upgrade, make any required code changes if the CXF API has changed, and do any needed reactivations in the XML configuration files of the web app.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[rvosa]

@copilot build error:

[INFO] -------------------------------------------------------------
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  20.194 s
[INFO] Finished at: 2026-01-05T21:32:30Z
[INFO] ------------------------------------------------------------------------
Error:  Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.11.0:compile (default-compile) on project treebase-web: Compilation failure
Error:  /home/runner/work/treebase/treebase/treebase-web/src/main/java/org/cipres/treebase/web/controllers/ListTaxaSearchController.java:[27,68] incompatible types: java.util.Map<java.lang.String,java.lang.String[]> cannot be converted to java.util.Map<java.lang.String,java.lang.Object>
Error:  -> [Help 1]
Error:  
Error:  To see the full stack trace of the errors, re-run Maven with the -e switch.
Error:  Re-run Maven using the -X switch to enable full debug logging.
Error:  
Error:  For more information about the errors and possible solutions, please read the following articles:
Error:  [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
Error: Process completed with exit code 1.

[Copilot]

@copilot build error:

...

Fixed in commit 7c32b2a. The error was a pre-existing issue in ListTaxaSearchController.java (not related to the CXF upgrade). The problem was that request.getParameterMap() returns Map<String, String[]> but the code was trying to assign it to Map<String, Object>. Updated the type and properly extracted the first value from the String array. The build now succeeds.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• getahead.org
  • Triggering command: /opt/hostedtoolcache/CodeQL/2.23.8/x64/codeql/tools/linux64/java/bin/java /opt/hostedtoolcache/CodeQL/2.23.8/x64/codeql/tools/linux64/java/bin/java -jar /opt/hostedtoolcache/CodeQL/2.23.8/x64/codeql/xml/tools/xml-extractor.jar --fileList=/home/REDACTED/work/treebase/.codeql-scratch/dbs/java/working/files-to-index8039082189223421428.list --sourceArchiveDir=/home/REDACTED/work/treebase/.codeql-scratch/dbs/java/src --outputDir=/home/REDACTED/work/treebase/.codeql-scratch/dbs/java/trap/java (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)