diff --git a/mdx/at_aconet/beans.xml b/mdx/at_aconet/beans.xml
index 5ab7a9fc..9d29767b 100644
--- a/mdx/at_aconet/beans.xml
+++ b/mdx/at_aconet/beans.xml
@@ -98,7 +98,7 @@
         Fetch the production entities as a collection.
     -->
     <bean id="at_aconet_productionEntities" parent="mda.CompositeStage">
-        <property name="composedStages">
+        <property name="stages">
             <list>
                 <ref bean="at_aconet_productionAggregate"/>
 
@@ -120,7 +120,7 @@
         Fetch the eduGAIN export entities as a collection.
     -->
     <bean id="at_aconet_edugainEntities" parent="mda.CompositeStage">
-        <property name="composedStages">
+        <property name="stages">
             <list>
                 <ref bean="at_aconet_edugainAggregate"/>
 
diff --git a/mdx/at_aconet/verbs.xml b/mdx/at_aconet/verbs.xml
index f3db7439..b5bd033e 100644
--- a/mdx/at_aconet/verbs.xml
+++ b/mdx/at_aconet/verbs.xml
@@ -95,7 +95,7 @@
                     a while to resolve.
                 -->
                 <bean id="filterEntities" parent="mda.EntityFilterStage"
-                    p:whitelistingEntities="false">
+                    p:keepingEntities="false">
                     <property name="designatedEntities">
                         <set>
                         </set>
diff --git a/mdx/common-beans.xml b/mdx/common-beans.xml
index 9d2ac290..aa8abf41 100644
--- a/mdx/common-beans.xml
+++ b/mdx/common-beans.xml
@@ -57,7 +57,7 @@
         Shibboleth-defined Resource class parent bean.
     -->
     <bean id="HTTPResource" abstract="true"
-        class="net.shibboleth.ext.spring.resource.HTTPResource"/>
+        class="net.shibboleth.shared.spring.httpclient.resource.HTTPResource"/>
 
     <!--
         component_parent
@@ -73,7 +73,8 @@
 
         Parent for XML Signature validation stages.
 
-        Applies global algorithm blacklists. For values, see:
+        Applies global algorithm exclusions. For values, see:
+
             http://www.w3.org/TR/xmlsec-algorithms/
 
         Establishes a default of *not* permitting empty references
@@ -82,12 +83,12 @@
         require it.
     -->
     <bean id="XMLSignatureValidationStage" abstract="true" parent="mda.XMLSignatureValidationStage">
-        <property name="blacklistedDigests">
+        <property name="disallowedDigests">
             <list>
                 <value>http://www.w3.org/2001/04/xmldsig-more#md5</value>
             </list>
         </property>
-        <property name="blacklistedSignatureMethods">
+        <property name="disallowedSignatureMethods">
             <list>
                 <value>http://www.w3.org/2001/04/xmldsig-more#rsa-md5</value>
             </list>
@@ -103,13 +104,13 @@
     -->
     <bean id="XMLSignatureValidationStageSHA256" abstract="true"
         parent="XMLSignatureValidationStage">
-        <property name="blacklistedDigests">
+        <property name="disallowedDigests">
             <list>
                 <value>http://www.w3.org/2000/09/xmldsig#sha1</value>
                 <value>http://www.w3.org/2001/04/xmldsig-more#md5</value>
             </list>
         </property>
-        <property name="blacklistedSignatureMethods">
+        <property name="disallowedSignatureMethods">
             <list>
                 <value>http://www.w3.org/2000/09/xmldsig#rsa-sha1</value>
                 <value>http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1</value>
@@ -121,26 +122,25 @@
     <!-- *** Parent beans for Shibboleth spring-extensions factory beans. *** -->
 
     <bean id="DOMDocumentFactoryBean" abstract="true"
-        class="net.shibboleth.ext.spring.factory.DOMDocumentFactoryBean"/>
+        class="net.shibboleth.shared.spring.factory.DOMDocumentFactoryBean"/>
 
-    <!-- PKCS11PrivateKeyFactoryBean is in MDA in V0.9.2. -->
     <bean id="PKCS11PrivateKeyFactoryBean" abstract="true"
-        class="net.shibboleth.metadata.util.PKCS11PrivateKeyFactoryBean"/>
+        class="net.shibboleth.shared.spring.security.factory.PKCS11PrivateKeyFactoryBean"/>
 
     <bean id="PrivateKeyFactoryBean" abstract="true"
-        class="net.shibboleth.ext.spring.factory.PrivateKeyFactoryBean"/>
+        class="net.shibboleth.shared.spring.security.factory.PrivateKeyFactoryBean"/>
 
     <bean id="PublicKeyFactoryBean" abstract="true"
-        class="net.shibboleth.ext.spring.factory.PublicKeyFactoryBean"/>
+        class="net.shibboleth.shared.spring.security.factory.PublicKeyFactoryBean"/>
 
     <bean id="X509CertificateChainFactoryBean" abstract="true"
-        class="net.shibboleth.ext.spring.factory.X509CertificateChainFactoryBean"/>
+        class="net.shibboleth.shared.spring.security.factory.X509CertificateChainFactoryBean"/>
 
     <bean id="X509CertificateFactoryBean" abstract="true"
-        class="net.shibboleth.ext.spring.factory.X509CertificateFactoryBean"/>
+        class="net.shibboleth.shared.spring.security.factory.X509CertificateFactoryBean"/>
 
     <!-- *** Default Shibboleth component bean id property from Spring bean id *** -->
-    <bean class="net.shibboleth.ext.spring.config.IdentifiableBeanPostProcessor" lazy-init="false"/>
+    <bean class="net.shibboleth.shared.spring.config.IdentifiableBeanPostProcessor" lazy-init="false"/>
 
 
     <!--
@@ -155,11 +155,11 @@
     <bean id="conversionService" class="org.springframework.context.support.ConversionServiceFactoryBean">
         <property name="converters">
             <set>
-                <bean class="net.shibboleth.ext.spring.config.DurationToLongConverter" />
-                <bean class="net.shibboleth.ext.spring.config.StringToIPRangeConverter" />
-                <bean class="net.shibboleth.ext.spring.config.BooleanToPredicateConverter" />
-                <bean class="net.shibboleth.ext.spring.config.StringBooleanToPredicateConverter" />
-                <bean class="net.shibboleth.ext.spring.config.StringToResourceConverter" />
+                <bean class="net.shibboleth.shared.spring.config.StringToDurationConverter" />
+                <bean class="net.shibboleth.shared.spring.config.StringToIPRangeConverter" />
+                <bean class="net.shibboleth.shared.spring.config.BooleanToPredicateConverter" />
+                <bean class="net.shibboleth.shared.spring.config.StringBooleanToPredicateConverter" />
+                <bean class="net.shibboleth.shared.spring.config.StringToResourceConverter" />
             </set>
         </property>
     </bean>
@@ -286,7 +286,7 @@
         A NamespaceContext that assigns the usual prefix for each of the commonly used XML namespaces.
         This is used in the evaluation of XPath expressions.
     -->
-    <bean id="commonNamespaces" class="net.shibboleth.utilities.java.support.xml.SimpleNamespaceContext">
+    <bean id="commonNamespaces" class="net.shibboleth.metadata.dom.SimpleNamespaceContext">
         <constructor-arg>
             <util:map map-class="java.util.HashMap">
                 <entry key="alg"        value-ref="alg_namespace"/>
@@ -702,7 +702,7 @@
         any items that had errors.  Items with just warnings are retained.
     -->
     <bean id="errorAnnouncingFilter" parent="mda.CompositeStage">
-        <property name="composedStages">
+        <property name="stages">
             <list>
                 <ref bean="warningAndErrorAnnouncer"/>
                 <ref bean="errorRemover"/>
@@ -718,7 +718,7 @@
         Warnings are not announced, and do not cause termination.
     -->
     <bean id="errorTerminatingFilter" parent="mda.CompositeStage">
-        <property name="composedStages">
+        <property name="stages">
             <list>
                 <ref bean="errorAnnouncer"/>
                 <ref bean="errorTerminator"/>
@@ -990,7 +990,7 @@
         These options can be removed once the underlying issue has been resolved.
     -->
     <bean id="httpClientBuilder"
-        class="net.shibboleth.utilities.java.support.httpclient.HttpClientBuilder"
+        class="net.shibboleth.shared.httpclient.HttpClientBuilder"
         p:connectionDisregardTLSCertificate="true"
         p:socketTimeout="PT100S"
         p:connectionTimeout="PT100S"
@@ -1009,7 +1009,7 @@
         A pre-configured parser pool for use by source stages.
     -->
     <bean id="parserPool" parent="component_parent"
-        class="net.shibboleth.utilities.java.support.xml.BasicParserPool"
+        class="net.shibboleth.shared.xml.impl.BasicParserPool"
         p:ignoreComments="false"
         p:ignoreElementContentWhitespace="false"/>
 
@@ -1227,7 +1227,7 @@
         that is left to the caller.
     -->
     <bean id="standardImportActions" parent="mda.CompositeStage">
-        <property name="composedStages">
+        <property name="stages">
             <list>
                 <ref bean="populateItemIds"/>
                 <ref bean="populateRegistrationAuthorities"/>
@@ -1237,7 +1237,7 @@
                     other than the ones we accept from partners.
                 -->
                 <bean id="whitelistImportedNamespaces" parent="mda.NamespacesStrippingStage"
-                    p:whitelisting="true">
+                    p:keeping="true">
                     <property name="namespaces">
                         <set>
                             <ref bean="alg_namespace"/>
@@ -1290,7 +1290,7 @@
         namespaces in the document ready for serialisation.
     -->
     <bean id="standardImportTail" parent="mda.CompositeStage">
-        <property name="composedStages">
+        <property name="stages">
             <list>
                 <!-- announce and remove any entities with errors -->
                 <ref bean="errorAnnouncingFilter"/>
diff --git a/mdx/int_edugain/beans.xml b/mdx/int_edugain/beans.xml
index 579e631a..92de8b65 100644
--- a/mdx/int_edugain/beans.xml
+++ b/mdx/int_edugain/beans.xml
@@ -86,14 +86,14 @@
         Remove blacklisted entities.
     -->
     <bean id="int_edugain_removeBlacklistedEntities" parent="mda.EntityFilterStage"
-        p:whitelistingEntities="false"
+        p:keepingEntities="false"
         p:designatedEntities-ref="int_edugain_entity_blacklist"/>
 
     <!--
         Fetch the production entities as a collection.
     -->
     <bean id="int_edugain_productionEntities" parent="mda.CompositeStage">
-        <property name="composedStages">
+        <property name="stages">
             <list>
                 <ref bean="int_edugain_productionAggregate_fromFile"/>
 
diff --git a/mdx/int_edugain/verbs.xml b/mdx/int_edugain/verbs.xml
index 6dd53099..bc936b1b 100644
--- a/mdx/int_edugain/verbs.xml
+++ b/mdx/int_edugain/verbs.xml
@@ -90,7 +90,7 @@
                 <ref bean="int_edugain_productionEntities"/>
                 <ref bean="removeUKEntities"/>
                 <bean id="removeBlacklistedEntities" parent="mda.EntityFilterStage"
-                    p:whitelistingEntities="false"
+                    p:keepingEntities="false"
                     p:designatedEntities-ref="int_edugain_verify_blacklist"/>
 
                 <!--
@@ -127,7 +127,7 @@
                 <ref bean="int_edugain_productionEntities"/>
                 <ref bean="removeUKEntities"/>
                 <bean id="removeBlacklistedEntities" parent="mda.EntityFilterStage"
-                    p:whitelistingEntities="false"
+                    p:keepingEntities="false"
                     p:designatedEntities-ref="int_edugain_verify_blacklist"/>
 
                 <ref bean="standardImportActions"/>
@@ -156,7 +156,7 @@
 
                 <!-- remove all entities *other* than the ones in the blacklist -->
                 <bean id="removeAllButBlacklistedEntities" parent="mda.EntityFilterStage"
-                    p:whitelistingEntities="true"
+                    p:keepingEntities="true"
                     p:designatedEntities-ref="int_edugain_verify_blacklist"/>
 
                 <!-- flag up any remaining entities -->
diff --git a/mdx/test/beans.xml b/mdx/test/beans.xml
index e3a8f5a0..19367897 100644
--- a/mdx/test/beans.xml
+++ b/mdx/test/beans.xml
@@ -23,7 +23,7 @@
         Fetch and process the entities as a collection.
     -->
     <bean id="test_entities" parent="mda.CompositeStage">
-        <property name="composedStages">
+        <property name="stages">
             <list>
                 <ref bean="test_aggregate"/>
                 <ref bean="disassemble"/>
diff --git a/mdx/uk/beans.xml b/mdx/uk/beans.xml
index 3b05a0a3..4d24136d 100644
--- a/mdx/uk/beans.xml
+++ b/mdx/uk/beans.xml
@@ -42,7 +42,7 @@
                 <value>administrative</value>
             </list>
         </property>
-        <property name="whitelistingTypes" value="false"/>
+        <property name="keepingTypes" value="false"/>
     </bean>
 
 
@@ -238,9 +238,9 @@
 
         Check against UKf-specific list of compromised RSA keys.
     -->
-    <bean id="compromised.ukf" parent="mda.X509RSAOpenSSLBlacklistValidator"
+    <bean id="compromised.ukf" parent="mda.X509RSAOpenSSLKeylistValidator"
         p:id="compromised.ukf">
-        <property name="blacklistResource">
+        <property name="keylistResource">
             <bean parent="FileSystemResource" c:_="${blocklists.dir}/compromised-keys.txt"/>
         </property>
     </bean>
@@ -271,7 +271,7 @@
         described by the EmailAddressStringValidator. In particular,
         this requires the "mailto:" scheme."
     -->
-    <bean id="check_uk_email" parent="ukf.StringElementValidationStage"
+    <bean id="check_uk_email" parent="mda.StringElementValidationStage"
         p:elementName-ref="md-EmailAddress">
         <property name="validators">
             <bean id="format" parent="ukf.EmailAddressStringValidator"/>
@@ -377,7 +377,7 @@
             </bean>
         </property>
         <property name="sourceFileFilter">
-            <bean parent="ukf.RegexFileFilter">
+            <bean parent="mda.RegexFileFilter">
                 <constructor-arg value="uk\d{6}.xml"/>
             </bean>
         </property>
@@ -388,7 +388,7 @@
         Fetch and process the registered entities as a collection.
     -->
     <bean id="uk_registeredEntities" parent="mda.CompositeStage">
-        <property name="composedStages">
+        <property name="stages">
             <list>
                 <ref bean="uk_fetchFragmentFiles"/>
                 <ref bean="uk_processFragment"/>
@@ -442,7 +442,7 @@
                     <property name="validators">
                         <list>
                             <!-- Error on DSA keys. -->
-                            <bean p:id="DSA" parent="ukf.X509DSADetector"/>
+                            <bean p:id="DSA" parent="mda.X509DSADetector"/>
 
                             <!-- Error on RSA key length less than 2048 bits. -->
                             <bean p:id="RSAKeyLength" parent="mda.X509RSAKeyLengthValidator"
@@ -450,10 +450,10 @@
                             <!-- Error on small RSA public exponents. -->
                             <bean p:id="RSAExponent" parent="mda.X509RSAExponentValidator"/>
                             <!-- Error on keys vulnerable to ROCA. -->
-                            <bean p:id="ROCA" parent="ukf.X509ROCAValidator"/>
+                            <bean p:id="ROCA" parent="mda.X509ROCAValidator"/>
 
                             <!--
-                                Debian weak key blacklists.
+                                Debian weak key lists.
 
                                 Don't need to check for keys below our minimum key size.
                             -->
@@ -461,7 +461,7 @@
                             <ref bean="debian.4096"/>
 
                             <!--
-                                Compromised key blacklists.
+                                Compromised key lists.
 
                                 Again, don't need to check for keys below our minimum key size.
                             -->
@@ -617,7 +617,7 @@
         Fetch the export entities as a collection.
     -->
     <bean id="uk_exportedEntities" parent="mda.CompositeStage">
-        <property name="composedStages">
+        <property name="stages">
             <list>
                 <ref bean="uk_exportAggregate"/>
 
diff --git a/mdx/uk/edugain-policy.xml b/mdx/uk/edugain-policy.xml
index 39dbf2cf..5edc6683 100644
--- a/mdx/uk/edugain-policy.xml
+++ b/mdx/uk/edugain-policy.xml
@@ -43,7 +43,7 @@
 
     -->
     <bean id="edugainPolicy" parent="mda.CompositeStage">
-        <property name="composedStages">
+        <property name="stages">
             <list>
 
                 <!--
@@ -102,13 +102,12 @@
 
         eduGAIN-specific rules for Scope elements.
     -->
-    <bean id="check_edugain_scopes" p:id="checkScopes" parent="inc.stage_parent"
-        class="uk.org.iay.incommon.mda.dom.saml.shib.ScopeValidationStage">
+    <bean id="check_edugain_scopes" p:id="checkScopes" parent="mda.ScopeValidationStage">
         <property name="validators">
             <list>
-                <bean p:id="empty" parent="inc.RejectStringRegexValidator"
+                <bean p:id="empty" parent="mda.RejectStringRegexValidator"
                     p:regex="" p:message="scope element must not be empty"/>
-                <bean p:id="whiteSpace" parent="inc.RejectStringRegexValidator"
+                <bean p:id="whiteSpace" parent="mda.RejectStringRegexValidator"
                     p:regex=".*\s.*" p:message="scope '%s' includes white space"/>
 
                 <!--
@@ -117,17 +116,17 @@
                     nevertheless known to be legitimately used as
                     security domains.
                 -->
-                <bean p:id="mil.no" parent="inc.AcceptStringValueValidator"
+                <bean p:id="mil.no" parent="mda.AcceptStringValueValidator"
                     p:value="mil.no"/>
 
-                <bean p:id="domainName" parent="inc.AsDomainNameStringValidator"
+                <bean p:id="domainName" parent="mda.AsDomainNameStringValidator"
                     p:message="scope is not a valid domain name: %s">
                     <property name="validators">
                         <list>
                             <!-- DNS name validators -->
-                            <bean p:id="publicSuffix" parent="inc.RejectDomainNamePublicSuffixValidator"
+                            <bean p:id="publicSuffix" parent="mda.RejectDomainNamePublicSuffixValidator"
                                 p:message="scope is a public suffix: '%s'"/>
-                            <bean p:id="noPublicSuffix" parent="inc.RejectDomainNameNotUnderPublicSuffixValidator"
+                            <bean p:id="noPublicSuffix" parent="mda.RejectDomainNameNotUnderPublicSuffixValidator"
                                 p:message="scope is not under a public suffix: '%s'"/>
                         </list>
                     </property>
@@ -136,25 +135,25 @@
         </property>
         <property name="regexpValidators">
             <list>
-                <bean p:id="empty" parent="inc.RejectStringRegexValidator"
+                <bean p:id="empty" parent="mda.RejectStringRegexValidator"
                     p:regex="" p:message="regex scope element must not be empty"/>
-                <bean p:id="whiteSpace" parent="inc.RejectStringRegexValidator"
+                <bean p:id="whiteSpace" parent="mda.RejectStringRegexValidator"
                     p:regex=".*\s.*" p:message="regex scope '%s' includes white space"/>
-                <bean p:id="endAnchor" parent="inc.RejectStringRegexValidator"
+                <bean p:id="endAnchor" parent="mda.RejectStringRegexValidator"
                     p:regex=".*[^$]" p:message="regex scope '%s' does not end with an anchor ('$')"/>
-                <bean p:id="literalTail" parent="inc.AsLiteralTailStringValidator"
+                <bean p:id="literalTail" parent="mda.AsLiteralTailStringValidator"
                     p:message="regular expression '%s' does not end with a literal tail">
                     <property name="validators">
                         <!-- validators to apply to the literal tail -->
                         <list>
-                            <bean p:id="domainName" parent="inc.AsDomainNameStringValidator"
+                            <bean p:id="domainName" parent="mda.AsDomainNameStringValidator"
                                 p:message="literal tail is not a valid domain name: %s">
                                 <property name="validators">
                                     <list>
                                         <!-- DNS name validators for the literal tail -->
-                                        <bean p:id="publicSuffix" parent="inc.RejectDomainNamePublicSuffixValidator"
+                                        <bean p:id="publicSuffix" parent="mda.RejectDomainNamePublicSuffixValidator"
                                             p:message="literal tail is a public suffix: '%s'"/>
-                                        <bean p:id="noPublicSuffix" parent="inc.RejectDomainNameNotUnderPublicSuffixValidator"
+                                        <bean p:id="noPublicSuffix" parent="mda.RejectDomainNameNotUnderPublicSuffixValidator"
                                             p:message="literal tail is not under a public suffix: '%s'"/>
                                     </list>
                                 </property>
diff --git a/mdx/uk/generate.xml b/mdx/uk/generate.xml
index 778d17c1..22117bf9 100644
--- a/mdx/uk/generate.xml
+++ b/mdx/uk/generate.xml
@@ -61,7 +61,7 @@
         Assemble a UK-style aggregate with an appropriate ID.
     -->
     <bean id="assembleAggregate" parent="mda.CompositeStage">
-        <property name="composedStages">
+        <property name="stages">
             <list>
                 <ref bean="uk_assemble"/>
                 <!--
@@ -71,7 +71,7 @@
                 -->
                 <bean id="setStaticID" parent="mda.GenerateIdStage">
                     <property name="generator">
-                        <bean parent="ukf.FixedStringIdentifierGenerationStrategy" c:_="_"/>
+                        <bean parent="mda.FixedStringIdentifierGenerationStrategy" c:_="_"/>
                     </property>
                 </bean>
             </list>
@@ -87,7 +87,7 @@
         the registered metadata.
     -->
     <bean id="checkPublishable" parent="mda.CompositeStage">
-        <property name="composedStages">
+        <property name="stages">
             <list>
                 <ref bean="checkSchemas"/>
                 <ref bean="check_aggregate"/>
@@ -109,7 +109,7 @@
     <!--
         Entity attribute matcher for the SIRTFI assurance certification.
     -->
-    <bean id="SIRTFI.entity.attribute.matcher" parent="ukf.AssuranceCertificationMatcher"
+    <bean id="SIRTFI.entity.attribute.matcher" parent="mda.AssuranceCertificationMatcher"
         c:_="https://refeds.org/sirtfi"/>
 
     <!--
@@ -122,7 +122,7 @@
         Strip SIRTFI information.
     -->
     <bean id="strip.SIRTFI" parent="mda.CompositeStage">
-        <property name="composedStages">
+        <property name="stages">
             <list>
                 <!-- remove REFEDS contacts associated with SIRTFI -->
                 <bean id="strip.SIRTFI.contacts" parent="mda.XSLTransformationStage"
@@ -133,7 +133,7 @@
 
                 <!-- remove the SIRTFI entity attribute -->
                 <bean id="entityAttributes" parent="mda.EntityAttributeFilteringStage"
-                    p:whitelisting="false">
+                    p:keeping="false">
                     <property name="rules">
                         <list>
                             <ref bean="SIRTFI.entity.attribute.matcher"/>
@@ -167,7 +167,7 @@
             </list>
         </property>
         <property name="requiringRegistrationInformation" value="true"/>
-        <property name="whitelistingRegistrationAuthorities" value="false"/>
+        <property name="keepingRegistrationAuthorities" value="false"/>
     </bean>
 
     <!--
@@ -176,11 +176,11 @@
         Filter out entities which are included in our global import blacklist.
     -->
     <bean id="removeBlacklistedEntities" parent="mda.EntityFilterStage"
-        p:whitelistingEntities="false"
+        p:keepingEntities="false"
         p:designatedEntities-ref="importEntityBlacklist"/>
 
     <bean id="entityAttributes.blacklist" parent="mda.EntityAttributeFilteringStage">
-        <property name="whitelisting" value="false"/>
+        <property name="keeping" value="false"/>
         <property name="rules">
             <list>
                 <!-- Deny "InCommon registration" attribute (duplicates mdrpi:registrationAuthority) -->
@@ -358,7 +358,7 @@
         removes everything it does not need.
     -->
     <bean id="CDSStripUnwanted" parent="mda.CompositeStage">
-        <property name="composedStages">
+        <property name="stages">
             <list>
                 <ref bean="stripComments"/>
 
@@ -562,7 +562,7 @@
                     p:flowName="fallback"/>
 
                 <bean id="removeFallbackBlocklist" parent="mda.EntityFilterStage"
-                    p:whitelistingEntities="false"
+                    p:keepingEntities="false"
                     p:designatedEntities-ref="fallbackEntityBlocklist"/>
 
                 <ref bean="assembleAggregate"/>
@@ -615,7 +615,7 @@
     </bean>
 
     <bean id="uk_testPipeline" parent="mda.CompositeStage">
-        <property name="composedStages">
+        <property name="stages">
             <list>
                 <!-- Apply flow constraints for this flow. -->
                 <bean id="flowConstraints" parent="ukf.FlowConstraintApplyingStage"
@@ -901,9 +901,9 @@
                     Fork a new output pipeline for the registrar statistics.
                 -->
                 <bean id="rawRegistrarDemux" parent="mda.PipelineDemultiplexerStage">
-                    <property name="pipelineAndSelectionStrategies">
+                    <property name="pipelinesAndStrategies">
                         <list>
-                            <bean class="net.shibboleth.utilities.java.support.collection.Pair">
+                            <bean parent="mda.PipelineAndStrategy">
                                 <constructor-arg ref="uk_statisticsPipeline"/>
                                 <constructor-arg ref="everythingSelector"/>
                             </bean>
@@ -950,13 +950,13 @@
                     too many UK-specific transformations are performed.
                 -->
                 <bean id="registrarDemux" parent="mda.PipelineDemultiplexerStage">
-                    <property name="pipelineAndSelectionStrategies">
+                    <property name="pipelinesAndStrategies">
                         <list>
-                            <bean class="net.shibboleth.utilities.java.support.collection.Pair">
+                            <bean parent="mda.PipelineAndStrategy">
                                 <constructor-arg ref="uk_exportPipeline"/>
                                 <constructor-arg ref="uk_exportSelector"/>
                             </bean>
-                            <bean class="net.shibboleth.utilities.java.support.collection.Pair">
+                            <bean parent="mda.PipelineAndStrategy">
                                 <constructor-arg ref="uk_exportPreviewPipeline"/>
                                 <constructor-arg ref="uk_exportPreviewSelector"/>
                             </bean>
@@ -1022,17 +1022,17 @@
                     Fork into new pipelines for the production, fallback and WAYF aggregates.
                 -->
                 <bean id="productionDemux" parent="mda.PipelineDemultiplexerStage">
-                    <property name="pipelineAndSelectionStrategies">
+                    <property name="pipelinesAndStrategies">
                         <list>
-                            <bean class="net.shibboleth.utilities.java.support.collection.Pair">
+                            <bean parent="mda.PipelineAndStrategy">
                                 <constructor-arg ref="uk_productionPipeline"/>
                                 <constructor-arg ref="everythingSelector"/>
                             </bean>
-                            <bean class="net.shibboleth.utilities.java.support.collection.Pair">
+                            <bean parent="mda.PipelineAndStrategy">
                                 <constructor-arg ref="uk_fallbackPipeline"/>
                                 <constructor-arg ref="everythingSelector"/>
                             </bean>
-                            <bean class="net.shibboleth.utilities.java.support.collection.Pair">
+                            <bean parent="mda.PipelineAndStrategy">
                                 <constructor-arg ref="uk_wayfPipeline"/>
                                 <constructor-arg ref="uk_wayfSelector"/>
                             </bean>
@@ -1096,13 +1096,13 @@
                     Fork into new pipelines for additional aggregates.
                 -->
                 <bean id="preProductionDemux" parent="mda.PipelineDemultiplexerStage">
-                    <property name="pipelineAndSelectionStrategies">
+                    <property name="pipelinesAndStrategies">
                         <list>
-                            <bean class="net.shibboleth.utilities.java.support.collection.Pair">
+                            <bean parent="mda.PipelineAndStrategy">
                                 <constructor-arg ref="CDSAllPipeline"/>
                                 <constructor-arg ref="CDSAllSelector"/>
                             </bean>
-                            <bean class="net.shibboleth.utilities.java.support.collection.Pair">
+                            <bean parent="mda.PipelineAndStrategy">
                                 <constructor-arg ref="WugenPipeline"/>
                                 <constructor-arg ref="WugenSelector"/>
                             </bean>
diff --git a/mdx/uk/mdq-multisign.xml b/mdx/uk/mdq-multisign.xml
index 40865ca1..606d21cc 100644
--- a/mdx/uk/mdq-multisign.xml
+++ b/mdx/uk/mdq-multisign.xml
@@ -63,7 +63,7 @@
                 <!-- Set ID and cacheDuration attributes. -->
                 <bean parent="mda.GenerateIdStage">
                     <property name="generator">
-                        <bean parent="ukf.FixedStringIdentifierGenerationStrategy" c:_="_"/>
+                        <bean parent="mda.FixedStringIdentifierGenerationStrategy" c:_="_"/>
                     </property>
                 </bean>
                 <bean parent="mda.SetCacheDurationStage" p:cacheDuration="${cacheDuration.perEntity.duration}"/>
diff --git a/mdx/uk/verbs.xml b/mdx/uk/verbs.xml
index 3aa0ed25..8fea7470 100644
--- a/mdx/uk/verbs.xml
+++ b/mdx/uk/verbs.xml
@@ -255,7 +255,7 @@
                     we don't accept from registrants.
                 -->
                 <bean id="whitelistImportedNamespaces" parent="mda.NamespacesStrippingStage"
-                    p:whitelisting="true">
+                    p:keeping="true">
                     <property name="namespaces">
                         <set>
                             <ref bean="alg_namespace"/>
@@ -339,7 +339,7 @@
                     <property name="validators">
                         <list>
                             <!-- Error on DSA keys. -->
-                            <bean p:id="DSA" parent="ukf.X509DSADetector"/>
+                            <bean p:id="DSA" parent="mda.X509DSADetector"/>
 
                             <!-- Error on RSA key length less than 2048 bits. -->
                             <bean p:id="RSAKeyLength" parent="mda.X509RSAKeyLengthValidator"
@@ -347,10 +347,10 @@
                             <!-- Error on small RSA public exponents. -->
                             <bean p:id="RSAExponent" parent="mda.X509RSAExponentValidator"/>
                             <!-- Error on keys vulnerable to ROCA. -->
-                            <bean p:id="ROCA" parent="ukf.X509ROCAValidator"/>
+                            <bean p:id="ROCA" parent="mda.X509ROCAValidator"/>
 
                             <!--
-                                Debian weak key blacklists.
+                                Debian weak key lists.
 
                                 Don't need to check for keys below our minimum key size.
                             -->
@@ -358,7 +358,7 @@
                             <ref bean="debian.4096"/>
 
                             <!--
-                                Compromised key blacklists.
+                                Compromised key lists.
 
                                 Again, don't need to check for keys below our minimum key size.
                             -->
diff --git a/mdx/us_incommon/beans.xml b/mdx/us_incommon/beans.xml
index 8d99949b..22cad05a 100644
--- a/mdx/us_incommon/beans.xml
+++ b/mdx/us_incommon/beans.xml
@@ -86,7 +86,7 @@
         Fetch the production entities as a collection.
     -->
     <bean id="us_incommon_productionEntities" parent="mda.CompositeStage">
-        <property name="composedStages">
+        <property name="stages">
             <list>
                 <ref bean="us_incommon_productionAggregate"/>
 
@@ -108,7 +108,7 @@
         Synthesise an export collection by filtering the production entities.
     -->
     <bean id="us_incommon_exportedEntities" parent="mda.CompositeStage">
-        <property name="composedStages">
+        <property name="stages">
             <list>
                 <ref bean="us_incommon_productionAggregate"/>
 
@@ -135,7 +135,7 @@
                     Filter out all entities not involved in the pilot.
                 -->
                 <bean id="us_incommon_pilot_filterEntities" parent="mda.EntityFilterStage"
-                    p:whitelistingEntities="true">
+                    p:keepingEntities="true">
                     <property name="designatedEntities">
                         <set>
                             <value>https://ligo.org/ligovirgo/cbcnote/shibboleth-sp</value>
@@ -148,10 +148,10 @@
                     Remove all contact information.
                 -->
                 <bean id="us_incommon_remove_contacts" parent="mda.ContactPersonFilterStage"
-                    p:whitelistingTypes="true">
+                    p:keepingTypes="true">
                     <property name="designatedTypes">
                         <set>
-                            <!-- no whitelisted types implies remove everything -->
+                            <!-- no kept types implies remove everything -->
                         </set>
                     </property>
                 </bean>
@@ -175,7 +175,7 @@
         Fake an export aggregate by aggregating the exported entities.
     -->
     <bean id="us_incommon_exportedAggregate" parent="mda.CompositeStage">
-        <property name="composedStages">
+        <property name="stages">
             <list>
                 <ref bean="us_incommon_exportedEntities"/>
                 <ref bean="assemble"/>
diff --git a/mdx/validation-beans.xml b/mdx/validation-beans.xml
index 4ccdb53c..4e101200 100644
--- a/mdx/validation-beans.xml
+++ b/mdx/validation-beans.xml
@@ -100,7 +100,7 @@
         Combines all check_future_N stages.
     -->
     <bean id="check_future" parent="mda.CompositeStage">
-        <property name="composedStages">
+        <property name="stages">
             <list>
                 <ref bean="check_future_0"/>
                 <ref bean="check_future_1"/>
@@ -169,7 +169,7 @@
         Composite check for the MDRPI specification.
     -->
     <bean id="check_mdrpi" parent="mda.CompositeStage">
-        <property name="composedStages">
+        <property name="stages">
             <list>
                 <ref bean="check_mdrpi_xslt"/>
             </list>
@@ -209,7 +209,7 @@
 
         Checks for the mdui:IPHint element.
     -->
-    <bean id="check_mdui_iphint" parent="ukf.IPHintValidationStage"
+    <bean id="check_mdui_iphint" parent="mda.IPHintValidationStage"
         p:checkingNetworks="true"/>
 
     <!--
@@ -241,7 +241,7 @@
         Composite check for the MDUI specification.
     -->
     <bean id="check_mdui" parent="mda.CompositeStage">
-        <property name="composedStages">
+        <property name="stages">
             <list>
                 <ref bean="check_mdui_iphint"/>
                 <ref bean="check_mdui_xslt"/>
@@ -281,7 +281,7 @@
         p:XSLResource="classpath:_rules/check_rands_support.xsl"/>
 
     <bean id="check_rands" parent="mda.CompositeStage">
-        <property name="composedStages">
+        <property name="stages">
             <list>
                 <ref bean="check_rands_member"/>
                 <ref bean="check_rands_support"/>
@@ -301,7 +301,7 @@
         p:XSLResource="classpath:_rules/check_coco_v2_support.xsl"/>
 
     <bean id="check_coco_v2" parent="mda.CompositeStage">
-        <property name="composedStages">
+        <property name="stages">
             <list>
                 <ref bean="check_coco_v2_support"/>
             </list>
@@ -422,36 +422,36 @@
     -->
 
     <!--
-        Debian weak key blacklists.
+        Debian weak key lists.
     -->
 
-    <bean id="debian.1024" parent="mda.X509RSAOpenSSLBlacklistValidator"
+    <bean id="debian.1024" parent="mda.X509RSAOpenSSLKeylistValidator"
         p:keySize="1024"
-        p:blacklistResource="classpath:net/shibboleth/metadata/keylists/rsa/legacy/debian-1024.txt"/>
+        p:keylistResource="classpath:net/shibboleth/metadata/keylists/rsa/legacy/debian-1024.txt"/>
 
-    <bean id="debian.2048" parent="mda.X509RSAOpenSSLBlacklistValidator"
+    <bean id="debian.2048" parent="mda.X509RSAOpenSSLKeylistValidator"
         p:keySize="2048"
-        p:blacklistResource="classpath:net/shibboleth/metadata/keylists/rsa/debian-2048.txt"/>
+        p:KeylistResource="classpath:net/shibboleth/metadata/keylists/rsa/debian-2048.txt"/>
 
-    <bean id="debian.4096" parent="mda.X509RSAOpenSSLBlacklistValidator"
+    <bean id="debian.4096" parent="mda.X509RSAOpenSSLKeylistValidator"
         p:keySize="4096"
-        p:blacklistResource="classpath:net/shibboleth/metadata/keylists/rsa/debian-4096.txt"/>
+        p:keylistResource="classpath:net/shibboleth/metadata/keylists/rsa/debian-4096.txt"/>
 
     <!--
-        Blacklist of known compromised 1024-bit keys, e.g., "dummy" keys shipped with
+        List of known compromised 1024-bit keys, e.g., "dummy" keys shipped with
         SAML products that are sometimes deployed by accident.
     -->
-    <bean id="compromised.1024" parent="mda.X509RSAOpenSSLBlacklistValidator"
+    <bean id="compromised.1024" parent="mda.X509RSAOpenSSLKeylistValidator"
         p:keySize="1024"
-        p:blacklistResource="classpath:net/shibboleth/metadata/keylists/rsa/legacy/compromised-1024.txt"/>
+        p:keylistResource="classpath:net/shibboleth/metadata/keylists/rsa/legacy/compromised-1024.txt"/>
 
     <!--
-        Blacklist of known compromised 2048-bit keys, e.g., "dummy" keys shipped with
+        List of known compromised 2048-bit keys, e.g., "dummy" keys shipped with
         SAML products that are sometimes deployed by accident.
     -->
-    <bean id="compromised.2048" parent="mda.X509RSAOpenSSLBlacklistValidator"
+    <bean id="compromised.2048" parent="mda.X509RSAOpenSSLKeylistValidator"
         p:keySize="2048"
-        p:blacklistResource="classpath:net/shibboleth/metadata/keylists/rsa/compromised-2048.txt"/>
+        p:keylistResource="classpath:net/shibboleth/metadata/keylists/rsa/compromised-2048.txt"/>
 
     <!--
         check_standard_certificates
@@ -462,7 +462,7 @@
         <property name="validators">
             <list>
                 <!-- Error on DSA keys. -->
-                <bean p:id="DSA" parent="ukf.X509DSADetector"/>
+                <bean p:id="DSA" parent="mda.X509DSADetector"/>
 
                 <!-- Error on RSA key length less than 2048 bits. -->
                 <bean p:id="RSAKeyLength" parent="mda.X509RSAKeyLengthValidator"
@@ -470,7 +470,7 @@
                 <!-- Error on small RSA public exponents. -->
                 <bean p:id="RSAExponent" parent="mda.X509RSAExponentValidator"/>
                 <!-- Error on keys vulnerable to ROCA. -->
-                <bean p:id="ROCA" parent="ukf.X509ROCAValidator"/>
+                <bean p:id="ROCA" parent="mda.X509ROCAValidator"/>
 
                 <!--
                     Debian weak key blacklists.
@@ -633,7 +633,7 @@
     <!--
         check_saml_strings
     -->
-    <bean id="check_saml_strings" parent="ukf.SAMLStringElementCheckingStage">
+    <bean id="check_saml_strings" parent="mda.SAMLStringElementCheckingStage">
         <property name="elementNames">
             <set>
                 <ref bean="md-Company"/>
@@ -694,7 +694,7 @@
         CHECK_std
     -->
     <bean id="CHECK_std" parent="mda.CompositeStage">
-        <property name="composedStages">
+        <property name="stages">
             <list>
                 <ref bean="check_adfs"/>
                 <ref bean="check_algsupport"/>