-

The big OSGi bundle used in the Karaf features.xml has been replaced with the individual modules which are now all individual bundles. The big OSGi bundle is still built, but some features may not be available if that is used instead of the little bundles.
New ability to configure HTTP Conduits from the OSGi config:admin service
New ability to configure the CXF created HTTP Jetty ports from config:admin service
OAuth 2 support
STS updates to support Renew and Cancel as well as updates to support more pluggable token validations.

+

The big OSGi bundle used in the Karaf features.xml has been replaced with the individual modules which are now all individual bundles. The big OSGi bundle is still built, but some features may not be available if that is used instead of the little bundles.
New ability to configure HTTP Conduits from the OSGi config:admin service
New ability to configure the CXF created HTTP Jetty ports from config:admin service
OAuth 2 support
The STS now supports the Renewal binding for SAML and SecurityContextTokens.
The STS also supports bulk issuing/validation/cancelling/renewal of security tokens.
The STS supports some advanced features based around Claims, such as Claims Transformation, and pluggable custom Claims Parsing.
The WS-Security module now supports replay detection by default of Timestamps and UsernameToken nonces.

@@ -140,7 +140,7 @@ Apache CXF -- 2.6 Migration Guide

-

The org.apache.cxf.tools.* classes that were in cxf-api have been moved into cxf-tools-common or cxf-tools-validator.
The org.apache.cxf.ws.policy classes that were in cxf-api have been moved into cxf-rt-ws-policy.
cxf-common-utilities is no longer available. All the classes in there were moved into cxf-api to represent a complete "api".
Various classes in cxf-rt-core and cxf-rt-ws-addr have been moved up to cxf-api to resolve split-package issues. Dependencies on cxf-rt-core would have transitively brought in cxf-api anyway, so there should be little impact.
Spring is now an optional component of the http-jetty transports module and other modules. Applications that may have pulled in Spring transitively via CXF will be required to declare required spring dependencies in their own poms directly.
Most of the optional JAX-RS Providers have been moved out of the cxf-rt-frontend-jaxrs module and into a cxf-rt-rs-extension-provi ders module with the various dependencies marked optional/provided. Applications that use these optional providers will need to add the required dependencies. Also, the package names of many of those providers has changed to resolve split-package issues. Example: org.apache.cxf.jaxrs.provider.JSONProvider -> org.apache.cxf.jaxrs.provider.json.JSONProvider

+

The org.apache.cxf.tools.* classes that were in cxf-api have been moved into cxf-tools-common or cxf-tools-validator.
The org.apache.cxf.ws.policy classes that were in cxf-api have been moved into cxf-rt-ws-policy.
cxf-common-utilities is no longer available. All the classes in there were moved into cxf-api to represent a complete "api".
Various classes in cxf-rt-core and cxf-rt-ws-addr have been moved up to cxf-api to resolve split-package issues. Dependencies on cxf-rt-core would have transitively brought in cxf-api anyway, so there should be little impact.
Spring is now an optional component of the http-jetty transports module and other modules. Applications that may have pulled in Spring transitively via CXF will be required to declare required spring dependencies in their own poms directly.
Most of the optional JAX-RS Providers have been moved out of the cxf-rt-frontend-jaxrs module and into a cxf-rt-rs-extension-provi ders module with the various dependencies marked optional/provided. Applications that use these optional providers will need to add the required dependencies. Also, the package names of many of those providers has changed to resolve split-package issues. Example: org.apache.cxf.jaxrs.provider.JSONProvider -> org.apache.cxf.jaxrs.provider.json.JSONProvider
EhCache is now a compile time dependency of the cxf-rt-ws-security module to support caching and replay detection. It can be safely excluded downstream, at the expense of weakening the caching support.