The GitHub Actions job "Java CI" on commons-xml.git/feature/document-builder-hardening has failed. Run started by GitHub user ppkarwasz (triggered by ppkarwasz).
Head commit for run: 68ad1d14a9a83aa3dd5b87b94f796b2408176e67 / Piotr P. Karwasz <[email protected]> Add minimal-footprint DocumentBuilderHardener.newInstance() entry point Expose DocumentBuilderHardener with a public newInstance() so consumers that only need a hardened DocumentBuilderFactory can shade the library and copy a minimal set of classes. jdependency (the engine maven-shade-plugin's minimizeJar uses) works at class granularity, so the shaded set is the transitive closure of this one class. To keep that closure small, install a deny-all EntityResolver as a lambda local to DocumentBuilderHardener instead of reusing Resolvers.DenyAll.ENTITY2. EntityResolver's resolveEntity(publicId, systemId) hook is consulted for the external DTD subset and every external entity, so it blocks all external fetches on the DOM path just as well, while dropping the whole Resolvers nested-class tree from the closure (12 -> 7 class files). Route XmlFactories.newDocumentBuilderFactory() through the new entry point, and add ShadingFootprintTest, which uses jdependency to pin the reachable set to exactly those 7 classes so the footprint cannot silently grow back toward the full library. Assisted-By: Claude Opus 4.8 (1M context) <[email protected]> Report URL: https://github.com/apache/commons-xml/actions/runs/27898022731 With regards, GitHub Actions via GitBox
