* Wed Feb 21 2024 gus.kenion@suse.com
- Use %patch -P N instead of deprecated %patchN.
* Thu Feb 15 2024 fstrba@suse.com
- The license is actually Plexus
* Thu Nov 02 2023 shvetz.anton@gmail.com
- JPMS: Add the Automatic-Module-Name attribute to the manifest.
* Thu Aug 24 2023 fstrba@suse.com
- Make a separate flavour for a minimal dom4j-bootstrap package
used to build jaxen and full dom4j
- Added patch:
* 0001-no-jaxen-dom4.patch
* for the bootstrap package, patch out the code that requires
jaxen with dom4j support to build
* Thu Aug 24 2023 fstrba@suse.com
- Upgrade to upstream version 2.1.4
* Improvements and potentially breaking changes
+ Added new factory method
org.dom4j.io.SAXReader.createDefault(). It has more secure
defaults than new SAXReader(), which uses system
XMLReaderFactory.createXMLReader() or
SAXParserFactory.newInstance().newSAXParser().
+ If you use some optional dependency of dom4j (for example
Jaxen, xsdlib etc.), you need to specify an explicit
dependency on it in your project. They are no longer marked as
a mandatory transitive dependency by dom4j.
+ Following SAX parser features are disabled by default in
DocumentHelper.parse() for security reasons (they were enabled
in previous versions):
° http://xml.org/sax/properties/external-general-entities
° http://xml.org/sax/properties/external-parameter-entities
* Other changes:
+ updated pull-parser version
+ Reuse the writeAttribute method in writeAttributes
+ support build on OS with non-UTF8 as default charset
+ Gradle: add an automatic module name
+ Use Correct License Name "Plexus"
+ Possible vulnerability of DocumentHelper.parseText() to XML
injection
+ CVS directories left in the source tree
+ XMLWriter does not escape supplementary unicode characters
correctly
+ writer.writeOpen(x) doesn't write namespaces
+ concurrency problem with QNameCache
+ all dependencies are optional
+ SAXReader: hardcoded namespace features
+ validate QNames
+ StringIndexOutOfBoundsException in
XMLWriter.writeElementContent()
+ TreeNode has grown some generics
+ QName serialization fix
+ DocumentException initialize with nested exception
+ Accidentally occurring error in a multi-threaded test
+ compatibility with W3C DOM Level 3
+ use Java generics
- Removed patches:
* dom4j-1.6.1-bug1618750.patch
* dom4j-CVE-2018-1000632.patch
* dom4j-CVE-2020-10683.patch
* dom4j-enable-stax-datatypes.patch
* dom4j-javadoc.patch
* dom4j-sourcetarget.patch
+ not needed with this version
* Mon Jul 24 2023 fstrba@suse.com
- Do not depend on jtidy, since it is not used during build
* Wed Mar 30 2022 fstrba@suse.com
- Build against the standalone JavaEE modules unconditionally
* Mon Mar 28 2022 fstrba@suse.com
- Add alias to the new artifact coordinates org.dom4j:dom4j
- Simplify the spec file a bit
* Thu Mar 17 2022 fstrba@suse.com
- Add jaxb-api dependency for relevant distribution versions so that
we can build with JDKs that do not include the JavaEE modules
* Fri Apr 17 2020 pmonrealgonzalez@suse.com
- Security fix: [bsc#1169760, CVE-2020-10683]
* External Entity vulnerability in default SAX parser
* Add dom4j-CVE-2020-10683.patch