+++ This bug was initially created as a clone of Bug #1070281 +++

Upgrade for following components is needed

org.jboss.spec.javax.xml.ws:jboss-jaxws-api_2.2_spec   2.0.2.Final
   2.0.1.Final-redhat-2 is currently used
org.jboss.spec.javax.xml.soap:jboss-saaj-api_1.3_spec  1.0.3.Final
   1.0.2.Final-redhat-2 is currently used

com.sun.xml.bind:jaxb-impl 2.2.6
   2.2.5.redhat-7 is currently used
com.sun.xml.bind:jaxb-xjc  2.2.6
    2.2.5.redhat-7 is currently used

There are important fixes such as:
 * https://issues.jboss.org/browse/JBEE-134
 * https://issues.jboss.org/browse/JBEE-135

Discussed with Alessio, he agrees with updates.

IRC log:
<rsvoboda> asoldano, ping
<asoldano> rsvoboda, pong
<rsvoboda> asoldano, Hi Alessio
<rsvoboda> asoldano, I'm running some tests on EAP 6.3.0 DR1 we received today
<asoldano> rsvoboda, ok
<rsvoboda> asoldano, could you please assist me with some dependency tre items ?
<rsearls> asoldano: ok
<asoldano> rsvoboda, let's try :)
<rsvoboda> asoldano, http://pastebin.test.redhat.com/193771 -- there are 3 areas to investigate
<rsvoboda> asoldano, first -    |  +- wsdl4j:wsdl4j:jar:1.6.2.redhat-6:comile
<rsvoboda> asoldano, when using BOM I have older version ...1.6.3 vs. :1.6.2.redhat-6 - can it be problem :) ?
<asoldano> rsvoboda, not that I know
<asoldano> rsvoboda, should likely work the same with both 1.6.2 and 1.6.3
<rsvoboda> asoldano, the same for case II - jboss-jaxws-api_2.2_spec ++ jboss-saaj-api_1.3_spec
<rsvoboda> asoldano, both are spec so I gues it's fine ...
<asoldano> rsvoboda, well, generally speaking do not underestimate jboss-jaxws-api, there's an important impl there, the code resolving the proper jaxws impl using jboss modules on AS/WFLY container... but in this case I think there's no problem
<asoldano> rsvoboda, expecially regarding jaxb, instead, we should probably update the AS
<rsvoboda> asoldano, ./jboss-eap-6.3/modules/system/layers/base/javax/xml/ws/api/main/jboss-jaxws-api_2.2_spec-2.0.1.Final-redhat-2.jar
<rsvoboda> asoldano, server is not using 2.0.2
<rsvoboda> asoldano, ./jboss-eap-6.3/modules/system/layers/base/javax/xml/soap/api/main/jboss-saaj-api_1.3_spec-1.0.2.Final-redhat-2.jar   .... 1.0.3 is not used in server
<asoldano> rsvoboda, yes... the server should likely be updated
<rsvoboda> asoldano, ok, I will create BZ for it
<rsvoboda> asoldano, can we check case III from pastebin ?
<asoldano> rsvoboda, regarding the jboss-jaxws/saaj api thing, I think I remember there were some security manager related changes lately
<asoldano> rsvoboda, but I'm 100% sure
<rsvoboda> asoldano, case III - server is again using older version -- ./jboss-eap-6.3/modules/system/layers/base/com/sun/xml/bind/main/jaxb-impl-2.2.5.redhat-7.jar
<asoldano> rsvoboda, perhaps Shelly can point to the actual list of changes
<asoldano> rsvoboda, also in that case, I think the newer one should be used
<rsvoboda> asoldano, case III - plus the dep. tree is totally different 
<asoldano> rsvoboda, not a major problem using 2.2.5, but...
<rsvoboda> asoldano, I have list of changes + Vladimir sent today list of changes in DR1
<asoldano> rsvoboda, I think we already noticed that for jaxb in the past, right?
<rsvoboda> asoldano, not really sure, to many things happening :)
<asoldano> rsvoboda, eheh
<asoldano> rsvoboda, I have some memories around productization having a modified build for jaxb or something
<asoldano> rsvoboda, but I can't remember for sure, perhaps it was not for EAP 6 ?
<asoldano> rsvoboda, ideally, update everything
<rsvoboda> asoldano, +1 to update everything
<rsvoboda> asoldano, "productization having a modified build for jaxb or something" -- that's true - they decoupled the one jar into many 
<asoldano> rsvoboda, ah, ok
<asoldano> rsvoboda, regarding jboss-jaxws spec move from 2.0.1 to 2.0.2, it should have https://issues.jboss.org/browse/JBEE-134 and https://issues.jboss.org/browse/JBEE-135 
<rsvoboda> asoldano, thanks for links

--- Additional comment from Rostislav Svoboda on 2014-05-16 03:34:55 EDT ---

Still present in EAP 6.3.0 ER4

https://jenkins.mw.lab.eng.bos.redhat.com/hudson/view/EAP6/view/EAP6-WS/job/eap-6x-jbossws-cxf-client-dep-tree/36/artifact/jbossqe-eap-tests-ws/jbossws-cxf-client/dependency-tree-4.3.0.Final-redhat-2-using-BOM.txt

--- Additional comment from Paul Gier on 2014-05-19 16:54:49 EDT ---

I created the separate issue (bug #1099171) for the jaxb upgrade because I think that one will be more difficult.  

This bug can be used for the jaxws-api (2.0.1.Final->2.0.2.Final) and saaj-api updates (1.0.2.Final->1.0.3.Final).

One fix to jaxws-api since previous release:
https://github.com/jboss/jboss-jaxws-api_spec/commit/09e41d9bf1d9d7cfdf17045435d1869bb8c0638f

One fix to saaj-api since previous release:
https://github.com/jboss/jboss-saaj-api_spec/commit/a1fd1a89eada491b53f04e245bf9f5be4630916f