OpenSAML cannot be used on the module path (or on custom class loaders)

[Rafael Winterhalter]

Hello,

libraries like Spring Security rely on your Versions class, which reads the
version from the package metadata. Unfortunately, it is up to the class
loader implementation what value is returned for this metadata. On the
JVM's module class loader, this value is always null. Currently, this
breaks Spring Security:
https://github.com/spring-projects/spring-security/issues/19628

It is more stable to read the version from a file that is placed in your
project, so the handling goes through resource lookup, not through metadata
attachment. I attached a patch file that applies this patch.

Note that Spring Security has a bug of its own. Nonetheless, this should be
avoided also in the source, to avoid breaking consumers of the library.

Best regards, Rafael
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20260831/e3a5e4e1/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: metadata.patch
Type: text/x-patch
Size: 5363 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/dev/attachments/20260831/e3a5e4e1/attachment.bin>