dependabot[bot] opened a new pull request, #535: URL: https://github.com/apache/opennlp-sandbox/pull/535
Bumps [org.docx4j:docx4j-core](https://github.com/plutext/docx4j) from 11.5.14 to 17.0.1. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/plutext/docx4j/blob/VERSION_17_0_1/CHANGELOG.md";>org.docx4j:docx4j-core's changelog</a>.</em></p> <blockquote> <h1>Version 17.0.1</h1> <h2>Release date</h2> <p>24 July 2026</p> <h2>Contributors to this release</h2> <p>Jason Harrop</p> <p>Claude Fable 5</p> <h2>Changes in Version 17.0.1</h2> <p>New CONTRIBUTIONS.md policy, covering AI assisted contributions, please read.</p> <p>New CLAUDE.md file: Claude Code automatically reads this at the start of a session to pick up project-specific context — things like coding conventions, architecture notes, commands to run tests/builds, and other instructions — so you don't have to repeat them every time.</p> <p>Image conversion: obsolete property (starting with "org.") removed, use docx4j.openpackaging.parts.WordprocessingML.BinaryPartAbstractImage.ImageMagickExecutable. Now defaults to no conversion. Set the property to your executable if you want to handle these images.</p> <p>docx4j-diffx:</p> <ul> <li>the bundled com.topologi.diffx fork (Artistic License) is replaced by its actively maintained descendant, org.pageseeder.diffx:pso-diffx 1.3.4 (Apache License v2), used as a Maven dependency.</li> <li>w:ins/w:del dates are now formatted in UTC (previously JVM default timezone, mislabelled with a 'Z' suffix).</li> </ul> <p>HTML output:</p> <ul> <li>base64 encoded images were supported already, but now made neater and improved with new DataUriConversionImageHandler. Issue 685.</li> <li>new CidConversionImageHandler for HTML destined for email (cid: references + collected images to attach); see ConvertOutHtmlToEmail sample. Issue 685.</li> <li>ListsToContentControls: avoid NPE on invalid negative w:ilvl. See PR 683.</li> </ul> <p>Dependencies: docx4j no longer uses commons-codec directly (java.util.Base64 instead, issue 685); the jar remains as a transitive dependency, since commons-compress's module-info requires it.</p> <p>Fields:</p> <ul> <li>FieldUpdater (DOCPROPERTY/DOCVARIABLE) now handles a field instruction split across several w:instrText fragments, as Word produces when a spelling/grammar marker, rsid boundary or formatting change falls inside the instruction. See issue 645.</li> <li>FieldsPreprocessor.canonicalise run formatting (w:rPr). See issue 667.</li> <li>FieldRef.getFldName no longer throws IndexOutOfBoundsException for a complex field with empty or whitespace-only w:instrText (Word can produce these). See issue 682.</li> </ul> <p>PDF/FO output:</p> <ul> <li>mixed right-to-left and left-to-right text (eg Arabic with embedded English words) in a w:bidi paragraph is now ordered correctly. See issue 660.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/plutext/docx4j/commits";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
