dependabot[bot] opened a new pull request, #3540: URL: https://github.com/apache/cxf/pull/3540
Bumps `cxf.tika.version` from 4.0.0 to 4.1.0. Updates `org.apache.tika:tika-core` from 4.0.0 to 4.1.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/apache/tika/blob/main/CHANGES.txt";>org.apache.tika:tika-core's changelog</a>.</em></p> <blockquote> <p>Release 4.2.0 - unreleased</p> <ul> <li> <p>Refactor date parsing for more consistent, accurate dates. File-system times from archive entries and mail attachments move to fs:created/ fs:modified. MailDateParser is superseded by TikaDates and MailUtil moved to org.apache.tika.parser.mail in tika-parser-mail-module; tika-parser-mail-commons remains as a deprecated shim and will be removed in 4.3.0. DateNormalizingMetadataFilter honors explicit offsets, normalizes every value of a multi-valued key, and fills in partial dates (2019 -> 2019-01-01T12:00:00Z) so date fields never reject a document (TIKA-4917).</p> </li> <li> <p>XmlSecurityContractTest pins XMLReaderUtils' XXE and entity-expansion defenses forbidden-apis now rejects building JAXP or Commons Secure XML parsers anywhere but XMLReaderUtils (TIKA-4939).</p> </li> <li> <p>Retire Tika's entity expansion limit (default 20) in SAX, DOM and StAX parsing in favor of standard Java configuration methods (TIKA-4940).</p> </li> <li> <p>Report the external DTDs and entities a document's XML referenced, which Tika never resolves: tk:xml-external-reference (up to 20 system ids) and tk:xml-external-reference-count on that document's metadata, and tk:xml-external-reference-embedded on a container whose embedded document had any. Every resolver Tika installs answers with an empty stream, never null (TIKA-4941).</p> </li> <li> <p>Deprecate XMLReaderUtils.getXMLInputFactory() and use SAX for XFA (TIKA-4938).</p> </li> <li> <p>Raise the default maxFilesProcessedPerProcess from 10,000 to 100,000; forked pipes JVMs restart a tenth as often (TIKA-4950).</p> </li> <li> <p>Quiet default pipes logging: per-parse timing lines (WORKER/CLIENT/ SERVER/RESOURCE_TIMING) move from INFO to TRACE, and per-fork-start, per-connection and plugin lifecycle lines move to DEBUG (TIKA-4949).</p> </li> </ul> <p>Release 4.1.0 - 9/26/2026</p> <p>HIGHLIGHTS</p> <ul> <li> <p>OCR and enrichment engines are selected by name in a new "text-recognizers" list ("[]" turns enrichment off; no list resolves one engine per media type at startup); the image and PDF parsers invoke them rather than the composite dispatching to them. The image/ocr-* pseudo-types are retired; a third-party engine still advertising them is a legacy text recognizer with a WARN. VLM parsers gain "textRecognizer" (TIKA-4872, TIKA-4884).</p> </li> <li> <p>New "exception-reporting" parse-context config redacts and bounds exception text in metadata, tika-server error bodies and pipes/grpc messages; FileSystemEmitter writes atomically. Compat: tk:exception:* values may now begin with the TikaException wrapper line (TIKA-4848).</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/apache/tika/commit/e8dd07a1f30bbf3540617ca27ccf6e63bb1bbefa";><code>e8dd07a</code></a> [maven-release-plugin] prepare release 4.1.0-rc3</li> <li><a href="https://github.com/apache/tika/commit/e53a7b479ed17c018b371ab1d483780fcc39794d";><code>e53a7b4</code></a> TIKA-4836: update aws</li> <li><a href="https://github.com/apache/tika/commit/4df21a639696ab821d2faf80884fa2545992d963";><code>4df21a6</code></a> prep for rc3</li> <li><a href="https://github.com/apache/tika/commit/e6bc8beb39245607dccb98ecee9d3a2c051db103";><code>e6bc8be</code></a> TIKA-4933: build the .run-info test fixture at test time; the source release ...</li> <li><a href="https://github.com/apache/tika/commit/f0b7ad7d3dff7160743c27c0a212abf8e9058782";><code>f0b7ad7</code></a> [maven-release-plugin] prepare for next development iteration</li> <li><a href="https://github.com/apache/tika/commit/5a75213358f3c2e0a7a898e58362d6afe1569c02";><code>5a75213</code></a> [maven-release-plugin] prepare release 4.1.0-rc2</li> <li><a href="https://github.com/apache/tika/commit/bb1f6f203259d8dfa8bff9d1067de0a20de55b9c";><code>bb1f6f2</code></a> update CHANGES.txt</li> <li><a href="https://github.com/apache/tika/commit/5c1cda53bfd99c93f0190ff5b7f3585f268c5b06";><code>5c1cda5</code></a> TIKA-4932: pipes no longer copies the caller's Content-Type hint back… (<a href="https://redirect.github.com/apache/tika/issues/3258";>#3258</a>)</li> <li><a href="https://github.com/apache/tika/commit/ebc845c390ab375722e3dd7e9b50b92cf88b99aa";><code>ebc845c</code></a> TIKA-4931: fix overrides in PipesForkParser (<a href="https://redirect.github.com/apache/tika/issues/3257";>#3257</a>)</li> <li><a href="https://github.com/apache/tika/commit/739a9c395cc90fa053f5bab0a4046eb39d24d658";><code>739a9c3</code></a> TIKA-4927: overwrite stale NER test models with the verified cache copy (<a href="https://redirect.github.com/apache/tika/issues/3256";>#3256</a>)</li> <li>Additional commits viewable in <a href="https://github.com/apache/tika/compare/4.0.0...4.1.0";>compare view</a></li> </ul> </details> <br /> Updates `org.apache.tika:tika-parser-pdf-module` from 4.0.0 to 4.1.0 Updates `org.apache.tika:tika-parser-miscoffice-module` from 4.0.0 to 4.1.0 Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
