What is the impact of the Apache Chemistry project moving into the Attic in February 2022 on IBM ECM CMIS?

Content

The Apache Chemistry project was moved to the Attic by the Apache Foundation: https://attic.apache.org/projects/chemistry.html.

This document uses a Question and Answer format to address the effect of this change in status of the Apache Chemistry project on the on-going support of IBM CMIS.

Question:

Will IBM stop packaging the CMIS v1.1 implementation in its current state?

Answer:

IBM will continue packaging the IBM CMIS spec v1.1 implementation that uses OpenCMIS. We have no plans to reimplement CMIS spec v1.1 without leveraging OpenCMIS. However, as security vulnerabilities are reported, we are upgrading the JAR files leveraged by OpenCMIS to remediate the security vulnerabilities. This strategy will continue while suitable JAR files are available that can be introduced without making code changes in the OpenCMIS framework.

Question:

Will IBM updates the OpenCMIS framework?

Answer:

No. IBM has no intention to update and maintain the OpenCMIS framework on behalf of the Apache Attic project team. However, as security vulnerabilities are reported, we are upgrading the JAR files leveraged by OpenCMIS to remediate the security vulnerabilities. This strategy will continue while suitable JAR files are available that can be introduced without making code changes in the OpenCMIS framework.

Question:

As an IBM CMIS customer, are there any alternatives to using IBM CMIS v1.1?

Answer:

There are three options for IBM CMIS v1.1 customers to consider:

• Continue using IBM CMIS v1.1 with the knowledge that IBM will not fix security vulnerabilities that require code changes to resolve.
• Use Content Services GraphQL in place of CMIS for applications on FileNet P8.

  https://www.ibm.com/docs/en/filenet-p8-platform/5.5.x?topic=development-overview

• Use IBM CMIS v1.0, which is IBM's own implementation of the CMIS v1.0 specification.

  https://www.ibm.com/docs/en/content-navigator/3.0.11?topic=navigator-planning-installing-configuring-ecm-cmis

  Also, refer to the following technote that details the differences between the CMIS v1.0 and v1.1 implementations: https://www.ibm.com/support/pages/node/6430249