The GitHub Actions job "Java CI" on commons-vfs.git/master has failed. Run started by GitHub user garydgregory (triggered by garydgregory).
Head commit for run: 7eb7588496904a5dd182cdf51f8bee8977d5ba19 / Piotr P. Karwasz <[email protected]> Harden XML parsing via commons-secure-xml (#781) * Harden XML parsing via commons-secure-xml Create the document builder that parses providers.xml configuration files through org.apache.commons:commons-secure-xml. The secure factory enables FEATURE_SECURE_PROCESSING and installs a non-removable entity-resolver floor on every parser it produces: external DTD and entity lookups are resolved to empty content instead of being fetched, and internal entity expansion is bounded, regardless of the JAXP implementation on the classpath. Changes: - Add the commons-secure-xml dependency (1.0.0-SNAPSHOT until its first release) to commons-vfs2. - Route factory creation through SecureDocumentBuilderFactory in StandardFileSystemManager. Internal entities declared in a configuration file's own DTD subset still expand (setExpandEntityReferences stays on); only external content is affected. - Run the CI and CodeQL builds with -Puse-apache-snapshots (inherited from the org.apache:apache parent POM) so the commons-secure-xml SNAPSHOT resolves; CodeQL's autobuild receives the profile through MAVEN_ARGS. Assisted-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01MHgnMnGWHQoH2zD2jFdoMT * Use the Commons Secure XML 1.0.0 release candidate Bump org.apache.commons:commons-secure-xml from 1.0.0-SNAPSHOT to 1.0.0 and add the temporary staging repository https://repository.apache.org/content/repositories/orgapachecommons-1962/ after Central, so the vote gets downstream CI results. Drop the -Puse-apache-snapshots profile from the CI workflows, which the release version no longer needs. Remove the staging repository once 1.0.0 is released. Assisted-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_0167e29ScPEdfzJnEFm95imK * Bump Apache Commons Secure XML from 1.0.0-SNAPSHOT to 1.0.0 --------- Co-authored-by: Gary Gregory <[email protected]> Report URL: https://github.com/apache/commons-vfs/actions/runs/34034537854 With regards, GitHub Actions via GitBox
