ppkarwasz opened a new pull request, #109: URL: https://github.com/apache/commons-jelly/pull/109
Two commits: 1. **Bump dom4j:dom4j 1.6.1 to org.dom4j:dom4j 2.1.5**, the last dom4j release that runs on Java 8 (2.2.0 requires Java 11). 2. **Keep dom4j `SAXReader` from bypassing Commons Secure XML.** Unless an `EntityResolver` is set explicitly, `SAXReader.read` installs its own resolver, which resolves every external entity to an `InputSource` carrying only its system ID. Not addressed here: `<xu:assertDocumentsEqual>` feeds the documents' XML text into XMLUnit's `Diff`, which re-parses it with XMLUnit's own JAXP parser, so a DOCTYPE still triggers an external fetch on that path. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
