)]}' { "log": [ { "commit": "5b5caef4d7ca3872abe66cfa8ed2b23afc25d50d", "tree": "0f41fab14eec8267b416c50c9e660aeed50abeb9", "parents": [ "9a42255968a27a6a31469a659709055b405d28c0" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Mon Oct 26 11:03:37 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Mon Oct 26 11:03:37 2026 -0400" }, "message": "Bump github/codeql-action from 4.39.0 to 4.39.1\n" }, { "commit": "9a42255968a27a6a31469a659709055b405d28c0", "tree": "8c17633d58ad2572705d4b1cb572ecdcceda1b4b", "parents": [ "6dd9092a5817ac41f5bc27986dc7713e8ec51f91" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Wed Oct 21 15:24:13 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Wed Oct 21 15:24:13 2026 -0400" }, "message": "Bump ossf/scorecard-action from 2.4.4 to 2.5.0\n" }, { "commit": "6dd9092a5817ac41f5bc27986dc7713e8ec51f91", "tree": "87196c9dc9eeee5b179cc3dce187f600230b0fe0", "parents": [ "1625bd68307b89fc867e74c2d40a859f5493cce9" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Oct 20 20:13:02 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Oct 20 20:13:02 2026 -0400" }, "message": "Bump github/codeql-action from 4.38.3 to 4.39.0\n" }, { "commit": "1625bd68307b89fc867e74c2d40a859f5493cce9", "tree": "c4795219455fd8b2427ff7c9557c19fe6df0396b", "parents": [ "64678f028f5ea3ebb6a313377987d9553ba9552d" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sat Oct 17 15:54:40 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sat Oct 17 15:54:40 2026 -0400" }, "message": "Bump actions/setup-java from 6.0.1 to 6.1.0\n" }, { "commit": "64678f028f5ea3ebb6a313377987d9553ba9552d", "tree": "ed33d61019e8ff040aef3e3f4ae8c01a75d7b75e", "parents": [ "24a4094fec783d2502d7dc99c76a20eb934d458e" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sat Oct 17 13:33:11 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sat Oct 17 13:33:11 2026 -0400" }, "message": "Bump org.apache.commons:commons-parent from 105 to 106\n" }, { "commit": "24a4094fec783d2502d7dc99c76a20eb934d458e", "tree": "7f9f705aed6dcb466f832308cc47de55ae439bb4", "parents": [ "c99a0eb97702d89f089fae25be2e7333b88408bf", "345cdb83bfc135cd87e022864b626e7d5c6cc12d" ], "author": { "name": "Gary Gregory", "email": "garydgregory@users.noreply.github.com", "time": "Sat Oct 17 13:32:29 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 13:32:29 2026 -0400" }, "message": "Merge pull request #399 from garydgregory/commons_parent_106\n\nBump Apache Commons Parent from 105 to 106" }, { "commit": "345cdb83bfc135cd87e022864b626e7d5c6cc12d", "tree": "7f9f705aed6dcb466f832308cc47de55ae439bb4", "parents": [ "c99a0eb97702d89f089fae25be2e7333b88408bf" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sat Oct 17 13:19:01 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sat Oct 17 13:19:01 2026 -0400" }, "message": "Bump Apache Commons Parent from 105 to 106\n" }, { "commit": "c99a0eb97702d89f089fae25be2e7333b88408bf", "tree": "12edb904282385f7d7c2e168b18be2496d474005", "parents": [ "65d89c20a865b312ccd0e90904be79b40e3fd029" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Thu Oct 15 09:21:02 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Thu Oct 15 09:21:02 2026 -0400" }, "message": "Bump github/codeql-action/analyze from 4.37.5 to 4.38.3\n" }, { "commit": "65d89c20a865b312ccd0e90904be79b40e3fd029", "tree": "3567170f3e8d6c3442fcb92d81d2e5bd1f6e6060", "parents": [ "34377ca8fcdd4fe1b5eef0d3541b0fb24a89b50e" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Thu Oct 15 08:29:10 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Thu Oct 15 08:29:10 2026 -0400" }, "message": "Revert \"Bump github/codeql-action/analyze from 4.37.5 to 4.38.3\"\n\nThis reverts commit 34377ca8fcdd4fe1b5eef0d3541b0fb24a89b50e.\n" }, { "commit": "34377ca8fcdd4fe1b5eef0d3541b0fb24a89b50e", "tree": "cfa8d09364dbbcab5a940083121de909a06f7736", "parents": [ "f4b652eb6df27c693e0d12b3fc877c1025f3641e" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Thu Oct 15 06:33:51 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Thu Oct 15 06:33:51 2026 -0400" }, "message": "Bump github/codeql-action/analyze from 4.37.5 to 4.38.3\n" }, { "commit": "f4b652eb6df27c693e0d12b3fc877c1025f3641e", "tree": "3567170f3e8d6c3442fcb92d81d2e5bd1f6e6060", "parents": [ "873b698eb7e62a50e22eee056289f6399449fabc" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Thu Oct 15 06:25:31 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Thu Oct 15 06:25:31 2026 -0400" }, "message": "Bump actions/upload-artifact from 7.0.1 to 7.0.2\n" }, { "commit": "873b698eb7e62a50e22eee056289f6399449fabc", "tree": "8678985f2e8ccb00d622c677982df2a03ab90f78", "parents": [ "832d22a102e5d92b91e71ea039533387d2933d17" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sat Oct 10 08:01:57 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sat Oct 10 08:01:57 2026 -0400" }, "message": "Add github.autolink_jira\n" }, { "commit": "832d22a102e5d92b91e71ea039533387d2933d17", "tree": "3d147b7880359210f8b674489784abbbe46ac84c", "parents": [ "b89ce1752e4253989952de3491f177dc14e64f1b", "a0e35fe0bac8e547fe35c891db6d068ef0853a18" ], "author": { "name": "Gary Gregory", "email": "garydgregory@users.noreply.github.com", "time": "Tue Oct 06 06:59:36 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 06:59:36 2026 -0400" }, "message": "Merge pull request #398 from garydgregory/commons-secure-xml_1.1.0\n\nBump org.apache.commons:commons-secure-xml from 1.0.0 to 1.1.0" }, { "commit": "a0e35fe0bac8e547fe35c891db6d068ef0853a18", "tree": "3d147b7880359210f8b674489784abbbe46ac84c", "parents": [ "b89ce1752e4253989952de3491f177dc14e64f1b" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Oct 06 06:36:51 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Oct 06 06:36:51 2026 -0400" }, "message": "Bump org.apache.commons:commons-secure-xml from 1.0.0 to 1.1.0\n" }, { "commit": "b89ce1752e4253989952de3491f177dc14e64f1b", "tree": "0fa70709e944cc7d2a78518523792a6a0b4ab7cb", "parents": [ "b533c60c87777af095cabc21310434a782303659" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sat Oct 03 15:16:58 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sat Oct 03 15:16:58 2026 -0400" }, "message": "Promote Java 27 build to production\n\nBump experimental build from Java 27-ea to 28-ea.\n" }, { "commit": "b533c60c87777af095cabc21310434a782303659", "tree": "bf7d55cea17fe7a8210f418403c4aff8c4cc010a", "parents": [ "1c2f88bf65c3c14d9e0cd58b3f959066a3ecaa1a" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Fri Oct 02 09:14:30 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Fri Oct 02 09:14:30 2026 -0400" }, "message": "Bump commons.jackson.version from 2.22.1 to 2.22.3 (#397)" }, { "commit": "1c2f88bf65c3c14d9e0cd58b3f959066a3ecaa1a", "tree": "6e86541170a0846c31f305e821c6762f99cde4d5", "parents": [ "ae7939eb68a987b1122a63cecfb368ff8f047ece", "f37ded6496c2b094da14726e664ab7faeb347b5f" ], "author": { "name": "Gary Gregory", "email": "garydgregory@users.noreply.github.com", "time": "Fri Oct 02 09:13:17 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 02 09:13:17 2026 -0400" }, "message": "Merge pull request #397 from apache/dependabot/maven/commons.jackson.version-2.22.3\n\nBump commons.jackson.version from 2.22.1 to 2.22.3" }, { "commit": "f37ded6496c2b094da14726e664ab7faeb347b5f", "tree": "6e86541170a0846c31f305e821c6762f99cde4d5", "parents": [ "ae7939eb68a987b1122a63cecfb368ff8f047ece" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 01 00:32:25 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 01 00:32:25 2026 +0000" }, "message": "Bump commons.jackson.version from 2.22.1 to 2.22.3\n\nBumps `commons.jackson.version` from 2.22.1 to 2.22.3.\n\nUpdates `com.fasterxml.jackson.core:jackson-core` from 2.22.1 to 2.22.3\n- [Commits](https://github.com/FasterXML/jackson-core/compare/jackson-core-2.22.1...jackson-core-2.22.3)\n\nUpdates `com.fasterxml.jackson.core:jackson-databind` from 2.22.1 to 2.22.3\n- [Commits](https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.22.1...jackson-databind-2.22.3)\n\n---\nupdated-dependencies:\n- dependency-name: com.fasterxml.jackson.core:jackson-core\n dependency-version: 2.22.3\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: com.fasterxml.jackson.core:jackson-databind\n dependency-version: 2.22.3\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "ae7939eb68a987b1122a63cecfb368ff8f047ece", "tree": "1154481c151839e38dda033a6d66c1069b1a1720", "parents": [ "78586f2c315465da32bc6a3a8cf0e1c4e65fe915" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Thu Sep 24 12:58:10 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Thu Sep 24 12:58:10 2026 -0400" }, "message": "Bump github/codeql-action from 4.38.1 to 4.38.2\n" }, { "commit": "78586f2c315465da32bc6a3a8cf0e1c4e65fe915", "tree": "e2b4b414047c3d406480a196eed3c028c7e51359", "parents": [ "0edf1b8e00735fce5c51b4687e88553ae779c4a4" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Sep 22 07:27:15 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Sep 22 07:27:15 2026 -0400" }, "message": "Protect main branches\n" }, { "commit": "0edf1b8e00735fce5c51b4687e88553ae779c4a4", "tree": "4d22d535fc7f4fab6230c01c67fcb01eed5b2218", "parents": [ "d1c02f33fce108889d49a8888e0957694fa74a36" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sat Sep 19 11:16:38 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sat Sep 19 11:16:38 2026 -0400" }, "message": "Bump github/codeql-action/* from 4.37.9 to 4.38.1\n" }, { "commit": "d1c02f33fce108889d49a8888e0957694fa74a36", "tree": "bf915b209b0560806bda1034d06f46a42292e1fb", "parents": [ "20c2efca1a96c0e41a2a6d60409df714af840ceb" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sat Sep 19 11:08:16 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sat Sep 19 11:08:16 2026 -0400" }, "message": "Bump actions/setup-java from 6.0.0 to 6.0.1\n" }, { "commit": "20c2efca1a96c0e41a2a6d60409df714af840ceb", "tree": "556bc81adf3f05e461988a85bb7c13042c6019ce", "parents": [ "d2b0207208a120ae74dc5ddb3015722b66233303", "942a3d37f20d504ef98c75a3ef0d673ddb7e1481" ], "author": { "name": "Gary Gregory", "email": "garydgregory@users.noreply.github.com", "time": "Fri Sep 11 10:17:16 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 10:17:16 2026 -0500" }, "message": "Merge pull request #393 from apache/feat/use-commons-xml\n\nHarden XML parsing via commons-secure-xml" }, { "commit": "942a3d37f20d504ef98c75a3ef0d673ddb7e1481", "tree": "556bc81adf3f05e461988a85bb7c13042c6019ce", "parents": [ "5b1f1901a086d8ce26d76fcd73aea17f879b42d0", "d2b0207208a120ae74dc5ddb3015722b66233303" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Sep 11 10:25:02 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Sep 11 10:25:02 2026 +0200" }, "message": "Merge remote-tracking branch \u0027apache/master\u0027 into feat/use-commons-xml\n" }, { "commit": "d2b0207208a120ae74dc5ddb3015722b66233303", "tree": "2af1dbc45d647a4f31c453215ea3e90e5c0c3558", "parents": [ "7143a8be7c3158eacc4793bc96ab40aff44273ab" ], "author": { "name": "Piotr P. Karwasz", "email": "pkarwasz-github@apache.org", "time": "Fri Sep 11 10:24:03 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 10:24:03 2026 +0200" }, "message": "Bumps Groovy to version 4.0.33 (#394)\n\n* Bump org.apache.groovy:groovy from 4.0.32 to 4.0.33.\n* Keep Dependabot on the Groovy 4.x line\n\nGroovy 5.x requires Java 11, while Commons SCXML 2.0 still targets\nJava 8, so major Groovy updates need a deliberate decision rather than\nan automated pull request.\n\nAssisted-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e" }, { "commit": "5b1f1901a086d8ce26d76fcd73aea17f879b42d0", "tree": "001b9e9edf72467fe00fb516861cc1cb001543e2", "parents": [ "dc967684ea0d3a07475adb53c961b0a53ba50be9" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Sep 11 09:46:50 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Sep 11 09:46:50 2026 +0200" }, "message": "Test that ContentParser.parseXml() parses XML content\n\nThe class had no coverage for its XML methods. Assert that parseXml()\ntreats its argument as an XML document rather than as a URI, which is\nwhat DocumentBuilder.parse(String) did before the method started\nwrapping the string in an InputSource, and that parseContent() maps an\nXML document to a NodeValue and toXml() round trips back into it.\n\nAssisted-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_0127cAFjN5DYE8pLAysQps4f\n" }, { "commit": "dc967684ea0d3a07475adb53c961b0a53ba50be9", "tree": "3e8bb1e6476cc2d9d648f65b3f75c6aa0941b6cf", "parents": [ "abccffcab8bd9c027c6946b6363e1b56bccddc5d" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Sep 11 09:29:17 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Sep 11 09:29:17 2026 +0200" }, "message": "Do not create a throwaway XMLInputFactory in SCXMLReader\n\ngetReader() always called SecureXMLInputFactory.newInstance() and then\ndiscarded the result when the Configuration supplied a factoryId and a\nclass loader, replacing it with the factory created by newFactory().\nCreate only the factory that is actually used, and make the local final.\n\nAssisted-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_0127cAFjN5DYE8pLAysQps4f\n" }, { "commit": "abccffcab8bd9c027c6946b6363e1b56bccddc5d", "tree": "e843e12e4ae94df929cd22669650c8ad8b4360ee", "parents": [ "27e4b6971b000b8b88a8049bd21019f7fcb58571" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Sep 11 09:26:39 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Fri Sep 11 09:26:39 2026 +0200" }, "message": "Fail loudly when no usable XML transformer is available\n\nSCXMLWriter.getTransformer() logged the failure and returned null, so\nthe static XFORMER field silently became null and every writeNode() call\nfailed later with a NullPointerException far from the actual cause.\n\nThrow an IllegalStateException instead, with a message that names the\nreason: either the TrAX implementation found on the class path rejects\nthe output properties the writer needs, or no implementation could be\ninstantiated at all. Catch IllegalArgumentException from\nsetOutputProperties() as well, and keep TransformerFactoryConfigurationError\nin the catch so a missing implementation is reported through the same\nmessage rather than as a bare Error from the class initializer.\n\nThe failure can only be caused by the TrAX implementation in use, so\nthere is nothing for a caller to recover from.\n\nAssisted-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_0127cAFjN5DYE8pLAysQps4f\n" }, { "commit": "7143a8be7c3158eacc4793bc96ab40aff44273ab", "tree": "20284bda6a432fa6e42b2bf3ec33e092c8d90d57", "parents": [ "fb47db49301eec0e4821deea3925e74057d62d2c" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Mon Sep 07 11:02:19 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Mon Sep 07 11:02:19 2026 -0400" }, "message": "Bump org.apache.commons:commons-parent from 104 to 105.\n" }, { "commit": "27e4b6971b000b8b88a8049bd21019f7fcb58571", "tree": "51b1fa4705500fedacc3ae3174bbaa149782b8fa", "parents": [ "d48f14424e864a2d1535ccec16350ce8aa683ee4" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sun Sep 06 08:39:37 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sun Sep 06 08:39:37 2026 -0400" }, "message": "Bump Apache Commons Secure XML from 1.0.0-SNAPSHOT to 1.0.0\n" }, { "commit": "d48f14424e864a2d1535ccec16350ce8aa683ee4", "tree": "57dbb034f16acad0dd705194cfd94905e3cd84ef", "parents": [ "cb9672c2d2e336e5c51fa91d50ddcda7088583fb" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Thu Sep 03 07:04:09 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Thu Sep 03 07:04:09 2026 +0200" }, "message": "Use the Commons Secure XML 1.0.0 release candidate\n\nBump org.apache.commons:commons-secure-xml from 1.0.0-SNAPSHOT to 1.0.0\nand add the temporary staging repository\nhttps://repository.apache.org/content/repositories/orgapachecommons-1962/\nafter Central, so the vote gets downstream CI results. Drop the\n-Puse-apache-snapshots profile from the CI workflows, which the release\nversion no longer needs. Remove the staging repository once 1.0.0 is\nreleased.\n\nAssisted-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_0167e29ScPEdfzJnEFm95imK\n" }, { "commit": "cb9672c2d2e336e5c51fa91d50ddcda7088583fb", "tree": "22b6716003d599b31f7cf9699c2f55444ceb8a5c", "parents": [ "fb47db49301eec0e4821deea3925e74057d62d2c" ], "author": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Mon Aug 31 15:30:31 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "piotr@github.copernik.eu", "time": "Mon Aug 31 17:05:50 2026 +0200" }, "message": "Harden XML parsing via commons-secure-xml\n\nCreate XML stream readers, parsers, schema factories and transformers\nthrough org.apache.commons:commons-secure-xml. The secure factories\nenable FEATURE_SECURE_PROCESSING and install a non-removable\nentity-resolver floor on every parser they produce: external DTD,\nentity, schema and XInclude lookups that a caller-set resolver does not\nresolve are resolved to empty content instead of being fetched, and\ninternal entity expansion is bounded, regardless of the JAXP\nimplementation on the classpath.\n\nChanges:\n- Add the commons-secure-xml dependency (1.0.0-SNAPSHOT until its first\n release).\n- Route factory creation through SecureXMLInputFactory,\n SecureSchemaFactory and SecureDocumentBuilderFactory in SCXMLReader,\n and through SecureTransformerFactory in SCXMLWriter and ContentParser.\n A Configuration-supplied XMLResolver still takes precedence: the floor\n only handles lookups the resolver leaves unresolved, and the\n factoryId/factoryClassLoader override still selects the underlying\n implementation.\n- ContentParser.parseXml now wraps its argument in an InputSource:\n DocumentBuilder.parse(String) interprets its argument as a URI, so the\n method never actually parsed the XML content it was documented to\n parse.\n- Run the CI and CodeQL builds with -Puse-apache-snapshots (inherited\n from the org.apache:apache parent POM) so the commons-secure-xml\n SNAPSHOT resolves; CodeQL\u0027s autobuild receives the profile through\n MAVEN_ARGS.\n\nAssisted-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01MHgnMnGWHQoH2zD2jFdoMT\n" }, { "commit": "fb47db49301eec0e4821deea3925e74057d62d2c", "tree": "61ee5a2636d46e49bacc53655f3b1847a9626433", "parents": [ "fe1221ea3f899f7d40f7d03c0132b3593c8ac3ec" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Mon Aug 31 11:19:26 2026 +0000" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Mon Aug 31 11:19:26 2026 +0000" }, "message": "Bump github/codeql-action/analyze from 4.37.8 to 4.37.9.\n" }, { "commit": "fe1221ea3f899f7d40f7d03c0132b3593c8ac3ec", "tree": "0c257e5f0e68bb6edfe28ed6fb3babbb0dd64494", "parents": [ "3459c818dd0d800e0aa294be2ae38892ca91f3e0" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Thu Aug 27 13:42:11 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Thu Aug 27 13:42:11 2026 -0400" }, "message": "Bump actions/setup-java from 5.7.0 to 6.0.0.\n" }, { "commit": "3459c818dd0d800e0aa294be2ae38892ca91f3e0", "tree": "9e2c441ce9beef009ba6ef0e0f8360261b7b772f", "parents": [ "2abe2d122cd01fe18d9a7f0824e1bb93791b9718" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Aug 25 14:14:51 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Aug 25 14:14:51 2026 -0400" }, "message": "Bump github/codeql-action/init from 4.37.7 to 4.37.8\n" }, { "commit": "2abe2d122cd01fe18d9a7f0824e1bb93791b9718", "tree": "e863dc095f709220e648559cda503922e2edc6cd", "parents": [ "053010e202d32b7400620a1bc3021b97263882bd" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sat Aug 22 09:51:28 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sat Aug 22 09:51:28 2026 -0400" }, "message": "Bump org.apache.commons:commons-parent from 103 to 104.\n" }, { "commit": "053010e202d32b7400620a1bc3021b97263882bd", "tree": "3f0e83da195cafabbfe3a03ebd86554f5f0daa35", "parents": [ "fb6ced7d5f43bb68196d27b7bcc614e625401e91" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Aug 18 16:02:10 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Aug 18 16:02:10 2026 -0400" }, "message": "Bump codeql-action from 4.37.6 to 4.37.7\n" }, { "commit": "fb6ced7d5f43bb68196d27b7bcc614e625401e91", "tree": "7d0ff8889ac6eb91bb7d0124fb63b9cc50911f92", "parents": [ "915d246d7cd63edf96b83b4f64b67a5eb338c473" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Wed Aug 05 14:15:00 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Wed Aug 05 14:15:00 2026 -0400" }, "message": "Bump actions/setup-java from 5.6.0 to 5.7.0\n" }, { "commit": "915d246d7cd63edf96b83b4f64b67a5eb338c473", "tree": "5274b5493c9895e4bc0c23829fe9f910f56c343f", "parents": [ "063f03849360c9e84e4ed6d3f3050c2f467a24df" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Aug 04 15:59:24 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Aug 04 15:59:24 2026 -0400" }, "message": "Bump github/codeql-action from 4.37.3 to 4.37.6.\n" }, { "commit": "063f03849360c9e84e4ed6d3f3050c2f467a24df", "tree": "327e02e746957a72a0dee17fb994f4771c72f350", "parents": [ "8da92378d7eb08c786836a1b69e38c56a1641d94" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sun Aug 02 17:12:34 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sun Aug 02 17:12:34 2026 -0400" }, "message": "Javadoc\n" }, { "commit": "8da92378d7eb08c786836a1b69e38c56a1641d94", "tree": "26c8370533f841af3e6f1767b0a0d04bc3d99897", "parents": [ "b248cfc839df32bde7686f413b2f2e2441f3c087" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Wed Jul 29 08:14:50 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Wed Jul 29 08:14:50 2026 -0400" }, "message": "Bump ossf/scorecard-action from 2.4.3 to 2.4.4.\n" }, { "commit": "b248cfc839df32bde7686f413b2f2e2441f3c087", "tree": "c662eadf532b875694003d9cb921aac1d621cc36", "parents": [ "0cba7008ebb4a52f2f60f44505849b827f21e156" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Jul 28 14:54:43 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Jul 28 14:54:43 2026 -0400" }, "message": "Bump github/codeql-action from 4.37.1 to 4.37.3\n" }, { "commit": "0cba7008ebb4a52f2f60f44505849b827f21e156", "tree": "4d105344835826664299d85b5f997940d6bd7358", "parents": [ "63c3bf5c99f64ff23ee90de25dc660e36c7adf9c" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sat Jul 25 09:50:07 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sat Jul 25 09:50:07 2026 -0400" }, "message": "Bump actions/checkout from 7.0.0 to 7.0.1\n" }, { "commit": "63c3bf5c99f64ff23ee90de25dc660e36c7adf9c", "tree": "e43b16531c48b600991a80458f53ff0dfbb30e72", "parents": [ "09471e05f941029232f5c6f764e2dd598663eec8" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Wed Jul 22 09:42:03 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Wed Jul 22 09:42:03 2026 -0400" }, "message": "Bump org.apache.commons:commons-parent from 102 to 103.\n" }, { "commit": "09471e05f941029232f5c6f764e2dd598663eec8", "tree": "4ad8e3528eef51e975b8548779949ee48df25381", "parents": [ "25b812b48b8150480c1999b77eda14d9e9a5e2d4" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Jul 21 13:46:06 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Jul 21 13:46:06 2026 -0400" }, "message": "Bump github/codeql-action from 4.37.0 to 4.37.1\n" }, { "commit": "25b812b48b8150480c1999b77eda14d9e9a5e2d4", "tree": "e395bb6030dba87e1d880450dd3271a5fe486366", "parents": [ "1833f760fb42cd4988ad8baff3b75b017f36fc3b" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Jul 21 09:02:40 2026 -0700" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Jul 21 09:02:40 2026 -0700" }, "message": "Bump com.fasterxml.jackson.core:jackson-databind from 2.22.0 to 2.22.1\n(#392)." }, { "commit": "1833f760fb42cd4988ad8baff3b75b017f36fc3b", "tree": "621d8fce7560df8369966ca5d3af72e8deeb2cbf", "parents": [ "0effd3fba78d2caf2942e77e20f3a9378fdd4cdb", "3b2d730b01e2c26a97a34c6b3d38524ce4b2bda5" ], "author": { "name": "Gary Gregory", "email": "garydgregory@users.noreply.github.com", "time": "Tue Jul 21 12:01:21 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jul 21 12:01:21 2026 -0400" }, "message": "Merge pull request #392 from apache/dependabot/maven/com.fasterxml.jackson.core-jackson-databind-2.22.1\n\nBump com.fasterxml.jackson.core:jackson-databind from 2.22.0 to 2.22.1" }, { "commit": "3b2d730b01e2c26a97a34c6b3d38524ce4b2bda5", "tree": "621d8fce7560df8369966ca5d3af72e8deeb2cbf", "parents": [ "0effd3fba78d2caf2942e77e20f3a9378fdd4cdb" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Jul 21 15:50:59 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jul 21 15:50:59 2026 +0000" }, "message": "Bump com.fasterxml.jackson.core:jackson-databind from 2.22.0 to 2.22.1\n\nBumps [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson) from 2.22.0 to 2.22.1.\n- [Commits](https://github.com/FasterXML/jackson/commits)\n\n---\nupdated-dependencies:\n- dependency-name: com.fasterxml.jackson.core:jackson-databind\n dependency-version: 2.22.1\n dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "0effd3fba78d2caf2942e77e20f3a9378fdd4cdb", "tree": "96e2e31154586a972a83cc9b20dd122e1891704e", "parents": [ "57ddf99d0d49c13ca90246a483087ab9aec65478" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Jul 21 11:46:22 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Jul 21 11:46:22 2026 -0400" }, "message": "Bump actions/setup-java from 5.5.0 to 5.6.0\n" }, { "commit": "57ddf99d0d49c13ca90246a483087ab9aec65478", "tree": "53df4a136968357d455a21e7b39217263c907ec2", "parents": [ "cc5233d7c2a21613ff44823695a9c7672ebd4ef8" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Mon Jul 13 13:50:21 2026 -0700" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Mon Jul 13 13:50:21 2026 -0700" }, "message": "Bump actions/setup-java from 5.4.0 to 5.5.0\n" }, { "commit": "cc5233d7c2a21613ff44823695a9c7672ebd4ef8", "tree": "e762710f1fd76ad9dab1e12c06784ce956b0b989", "parents": [ "e658acac55697dd625b9744b4a85cbf5fdde17c2" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sat Jul 11 11:22:50 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sat Jul 11 11:22:50 2026 -0400" }, "message": "Javadoc\n" }, { "commit": "e658acac55697dd625b9744b4a85cbf5fdde17c2", "tree": "1ab0ca2137370f9347a95ba2bdc1773242e5731f", "parents": [ "b92c730b89e20f81225590ae47efa8461e0ff32a" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sat Jul 11 09:09:14 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sat Jul 11 09:09:14 2026 -0400" }, "message": "Javadoc\n" }, { "commit": "b92c730b89e20f81225590ae47efa8461e0ff32a", "tree": "dfd9b374511f6eff22e7ec52d5af6077e55ecebd", "parents": [ "21136d61445e116d032669666de55306f7f48d7d" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sat Jul 11 08:53:51 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sat Jul 11 08:53:51 2026 -0400" }, "message": "Javadoc\n" }, { "commit": "21136d61445e116d032669666de55306f7f48d7d", "tree": "3a240e7948966ca845a981ca8938159ea6967baa", "parents": [ "901cb350e2760b893cd07d0eecbe1650ecf79400" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Fri Jul 10 09:09:12 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Fri Jul 10 09:09:12 2026 -0400" }, "message": "Bump github/codeql-action from 4.36.3 to 4.37.0\n" }, { "commit": "901cb350e2760b893cd07d0eecbe1650ecf79400", "tree": "8587a68d67ac42426e57154a75dabbea5ada3b51", "parents": [ "a2db60191b0bfe509e964383fb1ea317dc9b8ad8" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Wed Jul 08 16:15:24 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Wed Jul 08 16:15:24 2026 -0400" }, "message": "Bump github/codeql-action from 4.36.2 to 4.36.3\n" }, { "commit": "a2db60191b0bfe509e964383fb1ea317dc9b8ad8", "tree": "b5978df55646eea60f075c18c0fd32f2ca2448ac", "parents": [ "34f42fb0a7c407740beeedaff2395151f8776772" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Mon Jul 06 13:04:07 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Mon Jul 06 13:04:07 2026 -0400" }, "message": "Bump org.apache.commons:commons-jexl3 from 3.6.4 to 3.7.0 (#391)" }, { "commit": "34f42fb0a7c407740beeedaff2395151f8776772", "tree": "a2506c0d4f2226365e659b6bf6e95c6252bfba16", "parents": [ "3289c6d187fc8b62fca0d23b05725b307f9b2c45", "1fde1eaa2bf2f578f48888d01e3559fd058af964" ], "author": { "name": "Gary Gregory", "email": "garydgregory@users.noreply.github.com", "time": "Mon Jul 06 13:02:57 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jul 06 13:02:57 2026 -0400" }, "message": "Merge pull request #391 from apache/dependabot/maven/org.apache.commons-commons-jexl3-3.7.0\n\nBump org.apache.commons:commons-jexl3 from 3.6.4 to 3.7.0" }, { "commit": "1fde1eaa2bf2f578f48888d01e3559fd058af964", "tree": "a2506c0d4f2226365e659b6bf6e95c6252bfba16", "parents": [ "773004e6e6dec599c3b873e8b9c1549a4dc18bea" ], "author": { "name": "Henrib", "email": "hbiestro@gmail.com", "time": "Mon Jul 06 15:51:03 2026 +0200" }, "committer": { "name": "Henrib", "email": "hbiestro@gmail.com", "time": "Mon Jul 06 15:51:03 2026 +0200" }, "message": "SCXML : update JexlEngine to 3.7.0\n" }, { "commit": "773004e6e6dec599c3b873e8b9c1549a4dc18bea", "tree": "638de81f01ec00963d14da89fa6aaaa460670969", "parents": [ "3289c6d187fc8b62fca0d23b05725b307f9b2c45" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Jul 02 22:17:35 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 02 22:17:35 2026 +0000" }, "message": "Bump org.apache.commons:commons-jexl3 from 3.6.4 to 3.7.0\n\nBumps org.apache.commons:commons-jexl3 from 3.6.4 to 3.7.0.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.commons:commons-jexl3\n dependency-version: 3.7.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "3289c6d187fc8b62fca0d23b05725b307f9b2c45", "tree": "e8b0d4b6c4f43f0f1554343e94b9e528eee70751", "parents": [ "6738f5ce6802bfc652a92945930ff0563a6c63a9" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Wed Jul 01 11:54:16 2026 +0000" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Wed Jul 01 11:54:16 2026 +0000" }, "message": "Bump net.sf.saxon:Saxon-HE from 12.9 to 13.0 (#387)" }, { "commit": "6738f5ce6802bfc652a92945930ff0563a6c63a9", "tree": "14cc8e805e8040725c48ace011d60c654aafb279", "parents": [ "c6a4ba8384c4642f4f08f4230aa8eb12325a222a", "fe0e1f1ba73603b16dd0f6cfa1fe2824d6e31b32" ], "author": { "name": "Gary Gregory", "email": "garydgregory@users.noreply.github.com", "time": "Wed Jul 01 07:53:16 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 01 07:53:16 2026 -0400" }, "message": "Merge pull request #387 from apache/dependabot/maven/net.sf.saxon-Saxon-HE-13.0\n\nBump net.sf.saxon:Saxon-HE from 12.9 to 13.0" }, { "commit": "c6a4ba8384c4642f4f08f4230aa8eb12325a222a", "tree": "66c1b1c9157de00cfdc8ea9d39f4b597c429cfc1", "parents": [ "d873259208b2c880007e77537f4275a03956182b" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Wed Jul 01 01:05:17 2026 +0000" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Wed Jul 01 01:05:17 2026 +0000" }, "message": "Bump org.apache.groovy:groovy from 4.0.28 to 4.0.32.\n" }, { "commit": "d873259208b2c880007e77537f4275a03956182b", "tree": "cc4ad8dd7add7513720aad0b20ef9ea9f1a935d3", "parents": [ "ca4a22216f1a31f2ad7662e6678346ff129658ec" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Wed Jul 01 01:03:57 2026 +0000" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Wed Jul 01 01:03:57 2026 +0000" }, "message": "Bump org.apache.commons:commons-jexl3 from 3.6.3 to 3.6.4 (#388)." }, { "commit": "ca4a22216f1a31f2ad7662e6678346ff129658ec", "tree": "3a44295562612d2976a22e226b1e48ba31f92cd4", "parents": [ "01233c6320aee72b87e099cf1eca2da0ccca8ed2", "372b7780da80805e826a66bc1eb20d94a307444a" ], "author": { "name": "Gary Gregory", "email": "garydgregory@users.noreply.github.com", "time": "Tue Jun 30 21:02:59 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 30 21:02:59 2026 -0400" }, "message": "Merge pull request #388 from apache/dependabot/maven/org.apache.commons-commons-jexl3-3.6.4\n\nBump org.apache.commons:commons-jexl3 from 3.6.3 to 3.6.4" }, { "commit": "01233c6320aee72b87e099cf1eca2da0ccca8ed2", "tree": "38e6be6b73c70fca4148a808b6f1675c346039bc", "parents": [ "6c831093688695bcaeae4c474c979bd6df3b4451" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Wed Jul 01 00:58:09 2026 +0000" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Wed Jul 01 00:58:09 2026 +0000" }, "message": "Add GH CI Java 26.\n\nReplace GH CI Java 26-ea with 27-ea.\n" }, { "commit": "6c831093688695bcaeae4c474c979bd6df3b4451", "tree": "d6377feafe34ae010dea91954eb166039c5ae2eb", "parents": [ "aef74066d2ef9044f43d7e72954b201fc8126c23" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Jun 30 20:51:01 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Jun 30 20:51:01 2026 -0400" }, "message": "Bump actions/setup-java from 5.3.0 to 5.4.0\n" }, { "commit": "372b7780da80805e826a66bc1eb20d94a307444a", "tree": "20c68705f61e2c12ce4171dc55937c78b5de0b2d", "parents": [ "aef74066d2ef9044f43d7e72954b201fc8126c23" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Jul 01 00:32:19 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 01 00:32:19 2026 +0000" }, "message": "Bump org.apache.commons:commons-jexl3 from 3.6.3 to 3.6.4\n\nBumps org.apache.commons:commons-jexl3 from 3.6.3 to 3.6.4.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.commons:commons-jexl3\n dependency-version: 3.6.4\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "fe0e1f1ba73603b16dd0f6cfa1fe2824d6e31b32", "tree": "66172f5da7e631f51fb8c22756cf688900ea076d", "parents": [ "aef74066d2ef9044f43d7e72954b201fc8126c23" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Jul 01 00:32:17 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 01 00:32:17 2026 +0000" }, "message": "Bump net.sf.saxon:Saxon-HE from 12.9 to 13.0\n\nBumps net.sf.saxon:Saxon-HE from 12.9 to 13.0.\n\n---\nupdated-dependencies:\n- dependency-name: net.sf.saxon:Saxon-HE\n dependency-version: \u002713.0\u0027\n dependency-type: direct:development\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "aef74066d2ef9044f43d7e72954b201fc8126c23", "tree": "4d468eb010b0bab2dd3da62c360f8c7b18354fcf", "parents": [ "22b0e406d9cd9935e3db06dda7bda63b7ec52035" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Mon Jun 29 07:30:48 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Mon Jun 29 07:30:48 2026 -0400" }, "message": "Bump actions/cache from 6.0.0 to 6.1.0\n" }, { "commit": "22b0e406d9cd9935e3db06dda7bda63b7ec52035", "tree": "814e51d42a0bda20e234c80dceab8e1418e2d722", "parents": [ "0f6b2aceb9914f4863d89201cefa28cd5fa98fc8" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Thu Jun 25 18:24:51 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Thu Jun 25 18:24:51 2026 -0400" }, "message": "Bump actions/cache from 5.0.5 to 6.0.0.\n" }, { "commit": "0f6b2aceb9914f4863d89201cefa28cd5fa98fc8", "tree": "9f72b9363734810194da924983116d28460a9e1a", "parents": [ "f2a7affc45796ed4c10b55ab9e2aaf577115ec78" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Jun 23 23:02:33 2026 +0000" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Jun 23 23:02:33 2026 +0000" }, "message": "Bump commons.jackson.version from 2.21.4 to 2.22.0 (#385).\n" }, { "commit": "f2a7affc45796ed4c10b55ab9e2aaf577115ec78", "tree": "db875b7cce9b51a57a27d9c53ec04df8e9f57d86", "parents": [ "a2b73085950c0d013c500116d32d9c30b887f79a", "11bd9a3f64dfcb50c217be04d3a4655f0ce34ccb" ], "author": { "name": "Gary Gregory", "email": "garydgregory@users.noreply.github.com", "time": "Tue Jun 23 19:00:12 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 23 19:00:12 2026 -0400" }, "message": "Merge pull request #385 from apache/dependabot/maven/com.fasterxml.jackson.core-jackson-databind-2.22.0\n\nBump com.fasterxml.jackson.core:jackson-databind from 2.21.4 to 2.22.0" }, { "commit": "11bd9a3f64dfcb50c217be04d3a4655f0ce34ccb", "tree": "db875b7cce9b51a57a27d9c53ec04df8e9f57d86", "parents": [ "a2b73085950c0d013c500116d32d9c30b887f79a" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Jun 23 22:57:38 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 23 22:57:38 2026 +0000" }, "message": "Bump com.fasterxml.jackson.core:jackson-databind from 2.21.4 to 2.22.0\n\nBumps [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson) from 2.21.4 to 2.22.0.\n- [Commits](https://github.com/FasterXML/jackson/commits)\n\n---\nupdated-dependencies:\n- dependency-name: com.fasterxml.jackson.core:jackson-databind\n dependency-version: 2.22.0\n dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "a2b73085950c0d013c500116d32d9c30b887f79a", "tree": "2808d59d22068029981922be5c9f778716126ea5", "parents": [ "0a4723ded4ca9f205ac5496a2dd09439c5c7530f" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Jun 23 22:56:52 2026 +0000" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Jun 23 22:56:52 2026 +0000" }, "message": "Bump org.apache.commons:commons-jexl3 from 3.6.2 to 3.6.3.\n" }, { "commit": "0a4723ded4ca9f205ac5496a2dd09439c5c7530f", "tree": "7b6ade1d7b5e61b290a28acf1160fd1616b2c4b3", "parents": [ "43f95a0967a38fcd5f8d040bfb9ffb9eb9f0acad" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Mon Jun 22 07:33:01 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Mon Jun 22 07:33:01 2026 -0400" }, "message": "Bump actions/setup-java from 5.2.0 to 5.3.0\n" }, { "commit": "43f95a0967a38fcd5f8d040bfb9ffb9eb9f0acad", "tree": "6bb30167d531a6fa3b6193df4f6b67128574358d", "parents": [ "954747e64a0c82298889107acb8cdf4e6cd6ea2c" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Fri Jun 19 07:29:05 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Fri Jun 19 07:29:05 2026 -0400" }, "message": "Bump actions/checkout from 6.0.3 to 7.0.0.\n" }, { "commit": "954747e64a0c82298889107acb8cdf4e6cd6ea2c", "tree": "7e4a9a7db1e16354cf5bfc2cdec25b44c14a1515", "parents": [ "3ae3275e34b69d923668d8bc01dfb04c4ffb981b" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Wed Jun 17 22:18:54 2026 +0000" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Wed Jun 17 22:18:54 2026 +0000" }, "message": "Bump commons-logging:commons-logging from 1.3.6 to 1.4.0.\n" }, { "commit": "3ae3275e34b69d923668d8bc01dfb04c4ffb981b", "tree": "99d6b86487135bd2d80567fd755673fb9a959749", "parents": [ "0736ffb2befa283300d3d1d935650abf9317cbb3" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Thu Jun 11 14:24:34 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Thu Jun 11 14:24:34 2026 -0400" }, "message": "Update legacy GitHub links in CONTRIBUTING.md\n" }, { "commit": "0736ffb2befa283300d3d1d935650abf9317cbb3", "tree": "4e91092b7a8820930053944939ad42c9539e6932", "parents": [ "76281dd537bdd5fdf94954e6ff6eba3dac633f1b" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Thu Jun 11 10:54:11 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Thu Jun 11 10:54:11 2026 -0400" }, "message": "Bump org.apache.commons:commons-parent from 101 to 102.\n" }, { "commit": "76281dd537bdd5fdf94954e6ff6eba3dac633f1b", "tree": "231be927953eff01fa1560651b8c39f466ec2f26", "parents": [ "64e2662137888b63a12c45d18020c8efe83d092e" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sun Jun 07 10:13:30 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sun Jun 07 10:13:30 2026 -0400" }, "message": "Bump GH CI actions/dependency-review-action from 4.9.0 to 5.0.0\n" }, { "commit": "64e2662137888b63a12c45d18020c8efe83d092e", "tree": "9c2f2fea11086301e54cb18dc4c5a2198df4ba4a", "parents": [ "b8cad9f1db4f0d4823c37c00b8a803d99878a0bd" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sun Jun 07 10:09:46 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sun Jun 07 10:09:46 2026 -0400" }, "message": "Bump GH CI actions/checkout from 6.0.2 to 6.0.3\n" }, { "commit": "b8cad9f1db4f0d4823c37c00b8a803d99878a0bd", "tree": "3bc5d3badbb7ed04607001632238709a917a74ab", "parents": [ "f442fec575506585caa17d888779d042280b75ee" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sat Jun 06 06:16:59 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sat Jun 06 06:16:59 2026 -0400" }, "message": "Bump org.apache.commons:commons-parent from 100 to 101\n" }, { "commit": "f442fec575506585caa17d888779d042280b75ee", "tree": "1b1ea5b91d4243c9c9d1d3237fdd18f551c76281", "parents": [ "dc40f2332971bbbc8340eae91316b6f812050027", "1584adfa2c9b650a926328b0a4266092e368e95c" ], "author": { "name": "Gary Gregory", "email": "garydgregory@users.noreply.github.com", "time": "Fri Jun 05 14:30:03 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jun 05 14:30:03 2026 -0400" }, "message": "Merge pull request #384 from raboof/security-section\n\nwebsite: introduce security page" }, { "commit": "1584adfa2c9b650a926328b0a4266092e368e95c", "tree": "1b1ea5b91d4243c9c9d1d3237fdd18f551c76281", "parents": [ "dc40f2332971bbbc8340eae91316b6f812050027" ], "author": { "name": "Arnout Engelen", "email": "arnout@bzzt.net", "time": "Fri Jun 05 19:34:57 2026 +0200" }, "committer": { "name": "Arnout Engelen", "email": "arnout@bzzt.net", "time": "Fri Jun 05 19:34:57 2026 +0200" }, "message": "website: introduce security page\n\nAs discussed in https://lists.apache.org/thread/jfb3ftjwsrnx2v1x7hn0pcm9t9gkb7k3\n" }, { "commit": "dc40f2332971bbbc8340eae91316b6f812050027", "tree": "dfa09f97c55330302332237be2733e0c775db5da", "parents": [ "32e4f231869be8abf0ec411c9b8f244257ff0382" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Fri Jun 05 07:28:55 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Fri Jun 05 07:28:55 2026 -0400" }, "message": "Bump github/codeql-action from 4.36.0 to 4.36.2\n" }, { "commit": "32e4f231869be8abf0ec411c9b8f244257ff0382", "tree": "d8c157d006b6e81d868f656e223cce6a461636cd", "parents": [ "ad0da05df8306a7fae4fdcc2246c901f160d4950" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Fri May 29 10:18:50 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Fri May 29 10:18:50 2026 -0400" }, "message": "Bump com.fasterxml.jackson.core:jackson-databind from 2.21.2 to 2.21.4\n" }, { "commit": "ad0da05df8306a7fae4fdcc2246c901f160d4950", "tree": "998dbdaa805a75dd50bdf7daed03bf35169af60c", "parents": [ "a8d2d46db06ab05068ae0dd81722d56b7564677c" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Wed May 27 16:52:38 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Wed May 27 16:52:38 2026 -0400" }, "message": "Bump github/codeql-action from 4.35.5 to 4.36.0\n" }, { "commit": "a8d2d46db06ab05068ae0dd81722d56b7564677c", "tree": "9cebca145cd644cb08d8c34948ae6fc2ca70a704", "parents": [ "39636b261f8dce2091b0bb2066f6be3603b1f689" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Thu May 21 22:08:26 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Thu May 21 22:08:26 2026 -0400" }, "message": "Bump org.apache.commons:commons-parent from 99 to 100\n" }, { "commit": "39636b261f8dce2091b0bb2066f6be3603b1f689", "tree": "54759d7e3defa38f76abbc1487219a922b3d5aba", "parents": [ "1a5338571b30f5562778ff5292ba48fcb4b29bf1" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Wed May 20 06:44:37 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Wed May 20 06:44:37 2026 -0400" }, "message": "Bump github/codeql-action from 4.35.4 to 4.35.5\n" }, { "commit": "1a5338571b30f5562778ff5292ba48fcb4b29bf1", "tree": "4f53f58bc2f2f9c29b9e676a5a60efe9b490a862", "parents": [ "640e6bc23f305c8f3fe46b836fc69f10e84fec04" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue May 12 18:50:08 2026 +0000" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue May 12 18:50:08 2026 +0000" }, "message": "Bump github/codeql-action from 4.35.3 to 4.35.4\n" }, { "commit": "640e6bc23f305c8f3fe46b836fc69f10e84fec04", "tree": "827790d68567dc11f196dfe1f05a68be7bb34001", "parents": [ "94823642231b983de89aae440bb3e5ede790b842" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue May 05 11:24:11 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue May 05 11:24:11 2026 -0400" }, "message": "Bump github/codeql-action from 4.35.2 to 4.35.3\n" }, { "commit": "94823642231b983de89aae440bb3e5ede790b842", "tree": "615ba8008c16a1ea2c8789ba2832ab94466826c5", "parents": [ "802b671b107f05c7597df264c8255e1391c8eed3" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Mon Apr 27 07:05:28 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Mon Apr 27 07:05:28 2026 -0400" }, "message": "Javadoc: No need for FQCNs.\n" }, { "commit": "802b671b107f05c7597df264c8255e1391c8eed3", "tree": "15a2f81162f8eed748a0ade77431c65a9fe87a56", "parents": [ "cfcb45eddf50709487cbca183667d217a91ce5e1" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sun Apr 26 07:53:43 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sun Apr 26 07:53:43 2026 -0400" }, "message": "Bump org.apache.commons:commons-parent from 98 to 99\n" }, { "commit": "cfcb45eddf50709487cbca183667d217a91ce5e1", "tree": "851ab03606ecd76e83945aa32e6b164ecc80eba7", "parents": [ "ec49ffc41583e3a3da9e037a7004daa9b4a932c3" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Thu Apr 23 06:57:49 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Thu Apr 23 06:57:49 2026 -0400" }, "message": "Bump commons-io:commons-io from 2.21.0 to 2.22.0.\n" }, { "commit": "ec49ffc41583e3a3da9e037a7004daa9b4a932c3", "tree": "0e6acbd3d2a681ff4a78ce7b707b3574c8e35572", "parents": [ "002cb342ad80d368baac15fbfa2cf82e7fb6502a" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Thu Apr 16 07:11:02 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Thu Apr 16 07:11:02 2026 -0400" }, "message": "Bump github/codeql-action from 4.35.1 to 4.35.2\n" }, { "commit": "002cb342ad80d368baac15fbfa2cf82e7fb6502a", "tree": "ccf0ac08500d44ff493ff11bf1a5ee490c58c3bd", "parents": [ "22d4e77ae233aaac88ed775918fa3aabb0843be3" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Wed Apr 15 08:23:23 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Wed Apr 15 08:23:23 2026 -0400" }, "message": "No need to end exception messages with an exclamation!\n" }, { "commit": "22d4e77ae233aaac88ed775918fa3aabb0843be3", "tree": "45ded54b42cf3832564b938b72959fab1ba80be1", "parents": [ "92a7b0b8237f04dddfa073221fa2ada9e1de9040" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Apr 14 07:55:28 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Apr 14 07:55:28 2026 -0400" }, "message": "Bump actions/upload-artifact from 7.0.0 to 7.0.1\n" }, { "commit": "92a7b0b8237f04dddfa073221fa2ada9e1de9040", "tree": "6c51e28dc0f6d7bfd7e8085ed5421d3b8fd7b687", "parents": [ "0442092a4e65ca0f72a54590e72b4c3c40e176b5" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Apr 14 07:49:30 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Apr 14 07:49:30 2026 -0400" }, "message": "Bump actions/cache from 5.0.4 to 5.0.5\n" }, { "commit": "0442092a4e65ca0f72a54590e72b4c3c40e176b5", "tree": "03e6435333cec6e34ea80c6ab3ac385c16b4dab2", "parents": [ "4b0d3fcddb4b2575b132b0aedde0f1117666cb2a" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Apr 07 12:59:53 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Tue Apr 07 12:59:53 2026 -0400" }, "message": "Bump org.apache.commons:commons-parent from 97 to 98\n" }, { "commit": "4b0d3fcddb4b2575b132b0aedde0f1117666cb2a", "tree": "13bbac89400051df129bfcb8073986ffe81e866a", "parents": [ "d09875c2f39ba0f4fa26bdabd0589794745ceac1" ], "author": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sun Apr 05 09:54:16 2026 -0400" }, "committer": { "name": "Gary Gregory", "email": "garydgregory@gmail.com", "time": "Sun Apr 05 09:54:16 2026 -0400" }, "message": "Use static imports only for JUnit\n" } ], "next": "d09875c2f39ba0f4fa26bdabd0589794745ceac1" }