ppkarwasz opened a new pull request, #57: URL: https://github.com/apache/commons-xml/pull/57
> [!WARNING] > Stacked on #56. Mirror on each `Hardening*Factory` the static factory methods its JAXP counterpart offers, so the hardened classes are a drop-in replacement at every construction site: - **JDK 8**: the `factoryClassName`/`ClassLoader` overloads, the `SchemaFactory` and `XPathFactory` language/object-model variants, and the StAX `newFactory` family (omitting only the deprecated `XMLInputFactory.newInstance(String, ClassLoader)`). - **Java 9** `newDefaultInstance()`: resolved through a `MethodHandle` at runtime, falling back to instantiating the JDK's built-in implementation by class name on Java 8. This way we **backport** the `newDefaultInstance()` to Java 8. Calling the new methods on Java 9+ is **necessary**, because the classes are not exported through JPMS. - **Java 13** `newNSInstance()` family: implemented the way the JDK does — namespace awareness enabled on the non-NS counterpart through a private `makeNSAware` helper. Calling the Java 13 methods directly is **not** necessary: they are mere decorators. The internal namespace-aware parser construction (`newHardenedReader`, `hardenSourceToDom`, `HardeningXPath.parse`) now reuses `newNSInstance()` instead of hand-rolling the same recipe. I bumped the Android requirement to API 26 (2017), since previous versions don't handle `MethodHandle.invokeExact()`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
