The GitHub Actions job "Java CI" on commons-text.git/feat/use-commons-xml has failed. Run started by GitHub user ppkarwasz (triggered by ppkarwasz).
Head commit for run: bc9c20447a11dfbde21defdcc7713a62a0ba7ee8 / Piotr P. Karwasz <[email protected]> Drop the insecure XmlStringLookup fallback Commons Secure XML blocks external resource fetching with an entity resolver rather than with parser features, so the opt-outs the previous commit documented never worked: neither a feature map without secure processing nor the javax.xml.accessExternalDTD system property reaches the resolver floor. Always create the factories through SecureDocumentBuilderFactory and SecureXPathFactory instead. Changes: - Remove the plain-JAXP fallback from XmlStringLookup.lookup(String), along with the DEFAULT_XML_FEATURES and DEFAULT_XPATH_FEATURES maps that only existed to select it. - Document the two aspects Commons Secure XML secures separately: FEATURE_SECURE_PROCESSING governs processing limits and remains settable, while external DTD subsets and entities are blocked outright and cannot be re-enabled. - Remove the references to the "XmlStringLookup.secure" system property, which was never introduced. - Disable the tests that expect an external entity to resolve, and tighten the leak assertion now that the parser no longer rejects such documents. - Shorten the changelog entry and state the behavior change. Assisted-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01Y7VfssZLkK11bBY2kVyyY4 Report URL: https://github.com/apache/commons-text/actions/runs/34200530127 With regards, GitHub Actions via GitBox
