Version 3.2.1 has a CVSS 10.0 vulnerability. That's the worst kind of
vulnerability that exists. By merely existing on the classpath, this
library causes the Java serialization parser for the entire JVM process
to go from being a state machine to a turing machine. A turing machine
with an exec() function!
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8103
https://commons.apache.org/proper/commons-collections/security-reports.html
http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/
Huuuuge commit: restructured into project hierarchy, no other code changes. Everything compiles, tests run, but deployment is broken and will be remodeled.
HandlingEventService.registerHandlingEvent() signature takes value objects instead of HandlingEventRegistrationAttempt, decoupling it from message queues.
Creating sample data using domain objects and storing with Hibernate, for simplicity.
Estimated time of arrival is now a property of the Cargo aggregate.
Tracking web interface has new look for 1.1.
Admin interface shows more time related information.
Serverside now handles change of destination (no UI yet though)
Switched to Apache CXF for JAX-WS implementation (Metro is truly horrible).
Upgraded Spring, Hibernate, ActiveMQ etc to latest releases, cleaned up the pom a bit. Lived through the farce that is Java logging frameworks, once again...
Some restructuring of web service related classes.
Moved web interfaces, web service and RMI remoting facade to iface package (temporarily renamed due to refactoring problems in IntelliJ when a package is named as a reserved word)