The GitHub Actions job "CI" on grails-core.git/grails8-groovy6-canary has failed. Run started by GitHub user jamesfredley (triggered by jamesfredley).
Head commit for run: a092b13f2f53e03db32a5bba8b48b337ae742699 / James Fredley <[email protected]> fix(testing-http-client): correct XmlUtils secure-slurper feature URIs and block external entities loudly XmlUtils declared the SAX/Xerces feature identifiers with an https scheme (https://apache.org/xml/features/..., https://xml.org/sax/features/...). The parser matches these by exact string, so setFeature threw SAXNotRecognizedException for each and the catch block swallowed it, leaving the parser at JDK defaults. On JDK 21/25 the FEATURE_SECURE_PROCESSING default disallows DOCTYPE entirely, so XmlUtilsSpec / TestHttpResponseSpec failed: an inline DOCTYPE with internal entities was rejected ("DOCTYPE is disallowed ..."). - Correct the identifiers to the http scheme so they are actually applied; disallow-doctype-decl is now explicitly false, so inline DOCTYPE with internal entities parses. - Leave external general entities enabled and instead block them via the JAXP accessExternalDTD / accessExternalSchema properties (set to ""), so a SYSTEM reference is attempted and then blocked with a thrown SAXParseException ("External Entity: ... access is not allowed") instead of being silently dropped (external-general-entities=false skips without throwing). Net external access is still fully blocked - it now fails loud, matching the specs. Verified on Groovy 6.0.0-SNAPSHOT: :grails-testing-support-http-client:test (103 tests) and :grails-testing-support-http-client:codeStyle are green. Assisted-by: claude-code:claude-4.8-opus Report URL: https://github.com/apache/grails-core/actions/runs/26657743181 With regards, GitHub Actions via GitBox
