[FREEMARKER-190]: Updated dom4j version used during FreeMarker project compilation from 1.3 to 2.1.3. Users can still use FreeMarker with dom4j 1.3 (mostly just luck, but it works). We were forced to do this because old dom4j versions have security vulnerabilities, and although FreeMarker is not affected by them (like we do not pull in dom4j as dependency into the projects of our users), we were flagged as vulnerable at certain places for merely supporting 1.3.
diff --git a/ivy.xml b/ivy.xml
index e21534f..dad9ff2 100644
--- a/ivy.xml
+++ b/ivy.xml
@@ -93,14 +93,14 @@
<dependency org="jaxen" name="jaxen" rev="1.0-FCS" conf="build.base->default" />
<dependency org="saxpath" name="saxpath" rev="1.0-FCS" conf="build.base->default" />
<dependency org="xalan" name="xalan" rev="2.7.0" conf="build.base->default">
- <!-- The lowerst supported xml-apis version depends on JDK version; prevent any collosion: -->
+ <!-- The lowerst supported xml-apis version depends on JDK version; prevent any collision: -->
<exclude org="xml-apis" module="xml-apis" />
</dependency>
- <dependency org="dom4j" name="dom4j" rev="1.3" conf="build.base->default" /> <!-- legacy -->
+ <dependency org="org.dom4j" name="dom4j" rev="2.1.3" conf="build.base->default" /> <!-- legacy -->
<dependency org="jdom" name="jdom" rev="1.0b8" conf="build.base->default" /> <!-- legacy -->
<dependency org="ant" name="ant" rev="1.6.5" conf="build.base->default">
- <!-- The lowerst supported xml-apis version depends on JDK version; prevent any collosion: -->
+ <!-- The lowerst supported xml-apis version depends on JDK version; prevent any collision: -->
<exclude org="xml-apis" module="xml-apis" />
</dependency>
