This is an automated email from the ASF dual-hosted git repository.
ppkarwasz pushed a change to branch dependabot/maven/net.sf.saxon-Saxon-HE-13.0
in repository https://gitbox.apache.org/repos/asf/commons-xml.git
from 456e417 User Saxon 13.0 only on JDK 17+
add d9c1909 Fix Android tests
add f6e0965 Fix issues discovered with Checkstyle
add 68a322b Merge pull request #6 from
garydgregory/fix/checkstyle_loose_ends
add 9022170 Add SpotBugs
add 070b04a Merge pull request #7 from garydgregory/fix/spotbugs_enable
add acbcd7b Bump actions/setup-java from 5.2.0 to 5.3.0
add 37f5ef9 Add Maven PMD plugin. (#8)
add 478073a Bump actions/cache from 5.0.5 to 6.0.0.
add 06425cb Add ggregory as developer in POM.
add 97ad66c Add Apache Commons XML logo assets
add 83ff0ab Use Apache Commons XML logo on site
add 87d0615 Add the same basic security page as other Commons components.
add edaf028 Fix links in site due to missing pages.
add bfabc45 Add javadoc:javadoc to default goal.
add 93c0cc0 build(deps): bump actions/checkout from 6.0.2 to 7.0.0
add 65acfe2 Merge pull request #10 from
apache/dependabot/github_actions/actions/checkout-7.0.0
add 658ce3c build(deps): bump github/codeql-action/upload-sarif
add 3b15d90 Merge pull request #9 from
apache/dependabot/github_actions/github/codeql-action/upload-sarif-4.36.2
add bfa4a5a COMMONSXML-1: DocumentBuilderFactory: capability-driven
hardening (#5)
add dec523a Fix Javadoc.
add 25df71d Refactor magic strings.
add cb65b8a Normalize spelling.
add dd2aa62 Normalize spelling.
add 2f44caa Base SchemaFactory hardening on feature support
add 8e3e198 Bump actions/cache from 6.0.0 to 6.1.0
add 1535592 Bump actions/setup-java from 5.3.0 to 5.4.0
add d956df5 Fix URL
add 0c4cb12 Fix URLs
add a6d6ab6 Add placeholder for the Apache Commons XML Security model
amendment.
add 46faf98 build(deps): bump actions/dependency-review-action from 4.9.0
to 5.0.0
add de31b56 Merge pull request #2 from
apache/dependabot/github_actions/actions/dependency-review-action-5.0.0
add 253c3a2 Merge branch 'main' of https://github.com/apache/commons-xml
into main
add b1caca8 build(deps): bump actions/cache from 5.0.5 to 6.1.0
add b58e8f0 Merge pull request #14 from
apache/dependabot/github_actions/actions/cache-6.1.0
add bd1b00b build(deps): bump actions/cache/restore from 5.0.5 to 6.1.0
add 241b28e Merge pull request #15 from
apache/dependabot/github_actions/actions/cache/restore-6.1.0
add 8a17ad4 Normalize spelling
add 3e38212 Normalize spelling
add 2e84a77 Fill in security document
add e1c91ae Fix XML indentation
add 94eb297 Generate an HTML page for the threat model
add 69069b8 Move developer section to the bottom of the file
add 8842381 Remove vertical whitespace
add 87c7172 Base SAXParserFactory hardening on feature support
add 749b96f Fix checkstyle errors
add fa3002c Merge pull request #11 from
ppkarwasz/feature/sax-feature-based-hardening
add f64805b Update title to include "Threat Model"
add 819ab42 Don't use a link for root security item.
add d2c64e7 Better text
add 9141651 Add Security section to AGENTS.md linking the security model
add ad5d6d0 Merge pull request #16 from
potiuk/asf-security/agents-md-security-link-2026-07-05
add 9575bca Merge remote-tracking branch 'apache/main' into
feature/schema-feature-based-hardening
add 9bc179b Base XMLInputFactory hardening on feature support
add eb4b59e Merge remote-tracking branch 'apache/main' into
feature/stax-feature-based-hardening
add 7a43ed0 Merge pull request #12 from
ppkarwasz/feature/stax-feature-based-hardening
add 5f9b891 Merge remote-tracking branch 'apache/main' into
feature/schema-feature-based-hardening
add 3738224 Merge pull request #13 from
ppkarwasz/feature/schema-feature-based-hardening
add b7c9414 Base TransformerFactory hardening on feature support
add a0b6ed8 Base XPathFactory hardening on feature support
add 8acc094 fix: EOF
add a8dbc70 Merge pull request #17 from
ppkarwasz/feature/transformer-feature-based-hardening
add b0c6d0a Use final.
add 93755f5 Normalize spelling.
add f397372 Merge remote-tracking branch 'apache/main' into
dependabot/maven/net.sf.saxon-Saxon-HE-13.0
No new revisions were added by this update.
Summary of changes:
.github/workflows/dependency-review.yml | 4 +-
.github/workflows/maven.yml | 16 +-
.github/workflows/scorecards-analysis.yml | 4 +-
AGENTS.md | 10 +-
CONTRIBUTING.md | 75 ++++++
NOTICE.txt | 2 +-
README.md | 266 ++++++++-------------
RELEASE-NOTES.txt | 50 ++++
SECURITY.md | 6 +-
android-tests/build.gradle.kts | 5 +-
pom.xml | 138 ++++++++---
src/changes/release-notes.vm | 140 +++++++++++
src/conf/checkstyle.xml | 84 +++++++
src/conf/maven-pmd-plugin.xml | 39 +++
src/conf/spotbugs-exclude-filter.xml | 28 +++
.../org/apache/commons/xml/AndroidProvider.java | 199 ---------------
.../commons/xml/DelegatingTransformerFactory.java | 1 -
.../commons/xml/DocumentBuilderHardener.java | 103 ++++++++
.../org/apache/commons/xml/HardeningSAXParser.java | 65 +++++
.../commons/xml/HardeningSAXParserFactory.java | 18 +-
.../org/apache/commons/xml/HardeningSchema.java | 21 +-
.../apache/commons/xml/HardeningSchemaFactory.java | 38 ++-
.../org/apache/commons/xml/HardeningValidator.java | 6 +-
.../java/org/apache/commons/xml/JaxpSetters.java | 118 +++++++--
src/main/java/org/apache/commons/xml/Limits.java | 164 ++++++++-----
.../java/org/apache/commons/xml/Resolvers.java | 5 +-
.../org/apache/commons/xml/SAXParserHardener.java | 188 +++++++++++++++
.../java/org/apache/commons/xml/SaxonProvider.java | 7 +-
.../java/org/apache/commons/xml/StaxHardener.java | 92 +++++++
.../org/apache/commons/xml/StockJdkProvider.java | 156 ------------
.../apache/commons/xml/TransformerHardener.java | 99 ++++++++
.../org/apache/commons/xml/WoodstoxProvider.java | 88 -------
.../java/org/apache/commons/xml/XPathHardener.java | 78 ++++++
.../java/org/apache/commons/xml/XalanProvider.java | 73 ------
.../org/apache/commons/xml/XercesProvider.java | 181 --------------
.../java/org/apache/commons/xml/XmlFactories.java | 137 ++---------
.../java/org/apache/commons/xml/package-info.java | 21 +-
src/media/commons-logo-component-100.xcf | Bin 0 -> 25854 bytes
src/media/commons-logo-component.xcf | Bin 0 -> 153088 bytes
src/media/logo.png | Bin 0 -> 9360 bytes
src/site/markdown/index.md | 4 +-
src/site/markdown/threat_model.md | 217 +++++++++++++++++
src/site/resources/images/logo.png | Bin 0 -> 9360 bytes
src/site/site.xml | 34 ++-
src/site/xdoc/download_xml.xml | 158 ++++++++++++
src/site/xdoc/issue-tracking.xml | 104 ++++++++
src/site/xdoc/mail-lists.xml | 215 +++++++++++++++++
src/site/xdoc/security.xml | 64 +++++
.../org/apache/commons/xml/AttackTestSupport.java | 6 +-
.../apache/commons/xml/SchemaLocationDomTest.java | 112 +++++++++
.../apache/commons/xml/SchemaLocationSaxTest.java | 128 ++++++++++
.../xml/UnsupportedXmlImplementationTest.java | 49 +++-
.../resources/leaked/schema-location-instance.xml | 4 +
src/test/resources/leaked/schema-location.xsd | 10 +
54 files changed, 2632 insertions(+), 1198 deletions(-)
create mode 100644 RELEASE-NOTES.txt
create mode 100644 src/changes/release-notes.vm
create mode 100644 src/conf/checkstyle.xml
create mode 100644 src/conf/maven-pmd-plugin.xml
create mode 100644 src/conf/spotbugs-exclude-filter.xml
delete mode 100644 src/main/java/org/apache/commons/xml/AndroidProvider.java
create mode 100644
src/main/java/org/apache/commons/xml/DocumentBuilderHardener.java
create mode 100644 src/main/java/org/apache/commons/xml/HardeningSAXParser.java
create mode 100644 src/main/java/org/apache/commons/xml/SAXParserHardener.java
create mode 100644 src/main/java/org/apache/commons/xml/StaxHardener.java
delete mode 100644 src/main/java/org/apache/commons/xml/StockJdkProvider.java
create mode 100644
src/main/java/org/apache/commons/xml/TransformerHardener.java
delete mode 100644 src/main/java/org/apache/commons/xml/WoodstoxProvider.java
create mode 100644 src/main/java/org/apache/commons/xml/XPathHardener.java
delete mode 100644 src/main/java/org/apache/commons/xml/XalanProvider.java
delete mode 100644 src/main/java/org/apache/commons/xml/XercesProvider.java
copy android-tests/settings.gradle.kts =>
src/main/java/org/apache/commons/xml/package-info.java (71%)
create mode 100644 src/media/commons-logo-component-100.xcf
create mode 100644 src/media/commons-logo-component.xcf
create mode 100644 src/media/logo.png
create mode 100644 src/site/markdown/threat_model.md
create mode 100644 src/site/resources/images/logo.png
create mode 100644 src/site/xdoc/download_xml.xml
create mode 100644 src/site/xdoc/issue-tracking.xml
create mode 100644 src/site/xdoc/mail-lists.xml
create mode 100644 src/site/xdoc/security.xml
create mode 100644
src/test/java/org/apache/commons/xml/SchemaLocationDomTest.java
create mode 100644
src/test/java/org/apache/commons/xml/SchemaLocationSaxTest.java
create mode 100644 src/test/resources/leaked/schema-location-instance.xml
create mode 100644 src/test/resources/leaked/schema-location.xsd
