dependabot[bot] opened a new pull request, #538: URL: https://github.com/apache/opennlp-sandbox/pull/538
Bumps [org.docx4j:docx4j-core](https://github.com/plutext/docx4j) from 11.5.14 to 17.0.2. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/plutext/docx4j/blob/VERSION_17_0_3/CHANGELOG.md";>org.docx4j:docx4j-core's changelog</a>.</em></p> <blockquote> <h1>Version 17.0.2</h1> <h2>Release date</h2> <p>27 July 2026</p> <h2>Contributors to this release</h2> <p>Jason Harrop</p> <p>Claude Opus 5</p> <h2>Changes in Version 17.0.2</h2> <p>Dependencies:</p> <ul> <li>org.glassfish.jaxb (jaxb-runtime, jaxb-core, txw2) versions are now managed in the parent pom, so our modules no longer resolve different versions of them, which was a dependency convergence error for consumers.</li> <li>flatten-maven-plugin 1.7.3 -> 1.8.0. Earlier versions ignored our exclusions when writing the published poms, so those poms declared dependencies we deliberately exclude: commons-logging (we use jcl-over-slf4j), and batik-gvt and batik-extension in docx4j-export-fo.</li> <li>MOXy on the module path: docx4j-copy and docx4j-generated-objects now exclude org.glassfish.jaxb:jaxb-core, so it no longer reaches you via our published poms. It defeated the exclusion docx4j-core has had since 17.0.0, because our poms list transitive dependencies directly. com.sun.xml.bind:jaxb-core, which MOXy needs, contains the same packages, so with both present a consumer resolving all modules (eg --add-modules ALL-MODULE-PATH, jlink, jpackage) failed at startup with "java.lang.module.ResolutionException: Modules com.sun.xml.bind.core and org.glassfish.jaxb.core export package org.glassfish.jaxb.core.v2.runtime.unmarshaller". Building docx4j from source was never affected.</li> </ul> <p>With the above, what you resolve from our published poms now matches what we resolve when building.</p> <p>Fonts:</p> <ul> <li>variable fonts (eg Fedora's google-noto-vf NotoSans[wght].ttf) no longer fail to load with an AssertionError from GlyphPositioningTable.DeviceTable. The GPOS anchor reader was measuring device table offsets from the wrong origin, so it read garbage; only visible when running with -ea. See issue 686.</li> <li>one unreadable font file no longer aborts discovery of all remaining fonts; it is logged (with its name, as WARN) and skipped. See issue 686.</li> </ul> <h1>Version 17.0.1 (use 17.0.2 instead)</h1> <h2>Release date</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/plutext/docx4j/commit/a4b58a2ca5a1f7b8f610f352c7d7d33e37fe47e7";><code>a4b58a2</code></a> prepare for 17.0.2 release</li> <li><a href="https://github.com/plutext/docx4j/commit/12d73802c6c280b72b5b123564041c7fb5c8de52";><code>12d7380</code></a> CHANGELOG: record three 17.0.1 fixes that went unlisted</li> <li><a href="https://github.com/plutext/docx4j/commit/585f5e1fc68cc8ace24281d63e0e1bb381ff86c8";><code>585f5e1</code></a> Don't let skipping a bad font swallow a dying JVM</li> <li><a href="https://github.com/plutext/docx4j/commit/04a9765d9153ba125bb99c5d3de400f8a02d607d";><code>04a9765</code></a> prepare for 17.0.2 release</li> <li><a href="https://github.com/plutext/docx4j/commit/dc9c19615238d1ce30e0539a2f5e909e6355b84c";><code>dc9c196</code></a> update deps</li> <li><a href="https://github.com/plutext/docx4j/commit/b0c2f0ffdc0fe4cc0af4d2dc2e29247745efdc1a";><code>b0c2f0f</code></a> Bump version to 17.0.2</li> <li><a href="https://github.com/plutext/docx4j/commit/b31d063180c8dadc0194c093e2b7fff6c4d7f5f7";><code>b31d063</code></a> Don't log a font discovery failure twice</li> <li><a href="https://github.com/plutext/docx4j/commit/1dc93ab511677068c548b7729ab41f6b2929612b";><code>1dc93ab</code></a> Exclude glassfish jaxb-core where it enters, so MOXy works for our users too</li> <li><a href="https://github.com/plutext/docx4j/commit/9a7fc05207f657c60b58c9030c26031b330e0652";><code>9a7fc05</code></a> Record why flattenDependencyMode stays 'all'</li> <li><a href="https://github.com/plutext/docx4j/commit/a6b85d4c959024f6cf3e5ad6cd1012577fdc8cc0";><code>a6b85d4</code></a> Upgrade flatten-maven-plugin to 1.8.0, so exclusions reach our published poms</li> <li>Additional commits viewable in <a href="https://github.com/plutext/docx4j/compare/docx4j-11.5.14...docx4j-17.0.2";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
