dependabot[bot] opened a new pull request, #144: URL: https://github.com/apache/opennlp-addons/pull/144
Bumps `opennlp.version` from 3.0.0-M2 to 3.0.0-M3. Updates `org.apache.opennlp:opennlp-api` from 3.0.0-M2 to 3.0.0-M3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/apache/opennlp/releases";>org.apache.opennlp:opennlp-api's releases</a>.</em></p> <blockquote> <h2>OpenNLP 3.0.0-M3</h2> <h1>Apache OpenNLP 3.0.0-M3</h1> <p>This release focuses on <strong>security hardening</strong>, <strong>new NLP capabilities</strong>, and <strong>dependency maintenance</strong>.</p> <h2>Security Fixes</h2> <p>Three security issues are addressed in this release (also backported to <strong>2.5.9</strong>).</p> <h3>XXE in <code>DictionaryEntryPersistor</code> (OPENNLP-1819)</h3> <p>The <code>DictionaryEntryPersistor</code> previously used a <code>SAXParserFactory</code> that did not enable secure processing or disable DTD handling, leaving external entity resolution active. A malicious dictionary file could exploit this for <strong>local file disclosure</strong> or <strong>SSRF</strong> before any dictionary entry was processed.</p> <p>The parsing path is now aligned with the project's existing <code>XmlUtil</code> helper, which properly sets <code>FEATURE_SECURE_PROCESSING</code> and <code>disallow-doctype-decl</code>.</p> <h3>Arbitrary Class Instantiation in <code>ExtensionLoader</code> (OPENNLP-1820)</h3> <p><code>ExtensionLoader.instantiateExtension()</code> performed its <code>isAssignableFrom</code> type check <strong>after</strong> <code>Class.forName()</code> had already executed the target class's static initializer, allowing a crafted model archive to trigger the static initializer of any class on the classpath.</p> <p>The fix introduces a <strong>package-prefix allowlist</strong> consulted before <code>Class.forName()</code> is invoked:</p> <ul> <li>Classes under <code>opennlp.*</code> remain permitted by default.</li> <li>Other packages must be opted in via <code>ExtensionLoader.registerAllowedPackage(String)</code> or the <code>OPENNLP_EXT_ALLOWED_PACKAGES</code> system property (comma-separated list).</li> </ul> <h3>OOM via Unbounded Array Allocation in <code>AbstractModelReader</code> (OPENNLP-1821)</h3> <p><code>getOutcomes()</code>, <code>getOutcomePatterns()</code>, and <code>getPredicates()</code> read attacker-controlled 32-bit count fields from binary model streams and passed them directly to array allocations. A crafted <code>.bin</code> file could trigger an immediate <code>OutOfMemoryError</code> and crash the JVM.</p> <p>Each count is now bounded (default <strong>10,000,000</strong>, configurable via <code>-DOPENNLP_MAX_ENTRIES=<n></code>), with negative or oversized values failing fast via <code>IllegalArgumentException</code>.</p> <blockquote> <p>⚠️ For all three issues, users who cannot upgrade immediately should restrict input (dictionary and model files) to <strong>trusted sources only</strong>.</p> </blockquote> <h2>New Features & Improvements</h2> <ul> <li><strong>Roberta-based model support via ONNX</strong> — OPENNLP-1518 (<a href="https://redirect.github.com/apache/opennlp/issues/998";>#998</a>)</li> <li><strong>Byte Pair Encoding (BPE) tokenization</strong> — OPENNLP-1220 (<a href="https://redirect.github.com/apache/opennlp/issues/1011";>#1011</a>)</li> <li><strong><code>Parse.createFromTokens()</code></strong> convenience method for tokenized input — OPENNLP-53 (<a href="https://redirect.github.com/apache/opennlp/issues/1012";>#1012</a>)</li> <li><strong>Thread-safe ME classes</strong> by eliminating shared mutable instance state — OPENNLP-1816 (<a href="https://redirect.github.com/apache/opennlp/issues/1003";>#1003</a>)</li> </ul> <h2>What's Changed</h2> <ul> <li>Apache OpenNLP 3.0.0-M2 by <a href="https://github.com/mawiesne";><code>@mawiesne</code></a> in <a href="https://redirect.github.com/apache/opennlp/pull/996";>apache/opennlp#996</a></li> <li>OPENNLP-1518: Roberta-based Models - Add support for utilization via Onxx by <a href="https://github.com/rzo1";><code>@rzo1</code></a> in <a href="https://redirect.github.com/apache/opennlp/pull/998";>apache/opennlp#998</a></li> <li>OPENNLP-1817: Update log4j2 to 2.25.4 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/apache/opennlp/pull/1001";>apache/opennlp#1001</a></li> <li>Regenerated NOTICE file after dependency changes by <a href="https://github.com/github-actions";><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/apache/opennlp/pull/1009";>apache/opennlp#1009</a></li> <li>OPENNLP-1818: Update zlibsvm-core to 3.0.0 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/apache/opennlp/pull/1000";>apache/opennlp#1000</a></li> <li>Regenerated NOTICE file after dependency changes by <a href="https://github.com/github-actions";><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/apache/opennlp/pull/1010";>apache/opennlp#1010</a></li> <li>OPENNLP-53: Add Parse.createFromTokens() for convenient tokenized input by <a href="https://github.com/mawiesne";><code>@mawiesne</code></a> in <a href="https://redirect.github.com/apache/opennlp/pull/1012";>apache/opennlp#1012</a></li> <li>OPENNLP-1220: Add support for Byte Pair Encoding (BPE) by <a href="https://github.com/mawiesne";><code>@mawiesne</code></a> in <a href="https://redirect.github.com/apache/opennlp/pull/1011";>apache/opennlp#1011</a></li> <li>Bump com.ruleoftech:markdown-page-generator-plugin from 2.4.2 to 2.4.3 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/apache/opennlp/pull/1016";>apache/opennlp#1016</a></li> <li>Bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/apache/opennlp/pull/1014";>apache/opennlp#1014</a></li> <li>Bump actions/cache from 5.0.4 to 5.0.5 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/apache/opennlp/pull/1017";>apache/opennlp#1017</a></li> <li>OPENNLP-1819: Align DictionaryEntryPersistor XML parsing with XmlUtil by <a href="https://github.com/rzo1";><code>@rzo1</code></a> in <a href="https://redirect.github.com/apache/opennlp/pull/1019";>apache/opennlp#1019</a></li> <li>OPENNLP-1816: Make ME classes thread-safe by eliminating shared mutable instance state by <a href="https://github.com/krickert";><code>@krickert</code></a> in <a href="https://redirect.github.com/apache/opennlp/pull/1003";>apache/opennlp#1003</a></li> <li>OPENNLP-1822: Update ONNX runtime to 1.25.0 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/apache/opennlp/pull/1024";>apache/opennlp#1024</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/apache/opennlp/commit/416029e32ab67cbe99c3e3964c4609af3dd5775b";><code>416029e</code></a> [maven-release-plugin] prepare release opennlp-3.0.0-M3</li> <li><a href="https://github.com/apache/opennlp/commit/1f15c2baf210eb0a78f2a1a30448fb410e961844";><code>1f15c2b</code></a> Remove module on active profile as it confuses maven release plugin.</li> <li><a href="https://github.com/apache/opennlp/commit/12f60d7d1de3f910dabc0107c3bf10b217643fc7";><code>12f60d7</code></a> Add eval-tests to preparation profile</li> <li><a href="https://github.com/apache/opennlp/commit/8d3eb4ccbf7013da22b101d92b00d31cffc938cd";><code>8d3eb4c</code></a> Make checkstyle config path absolute and skip deploy/install for eval-tests</li> <li><a href="https://github.com/apache/opennlp/commit/6da32a6e72c0436074afc77de5db8da8b3b3f972";><code>6da32a6</code></a> OPENNLP-1820: Restrict ExtensionLoader to allowlisted package prefixes (<a href="https://redirect.github.com/apache/opennlp/issues/1021";>#1021</a>)</li> <li><a href="https://github.com/apache/opennlp/commit/96a073f693f3a0ded808a475f7d7773c072bb8a1";><code>96a073f</code></a> OPENNLP-1821: Prevent OutOfMemory Due To Huge Array Allocation (<a href="https://redirect.github.com/apache/opennlp/issues/1022";>#1022</a>)</li> <li><a href="https://github.com/apache/opennlp/commit/28291759c6f3d574249e08a898247e39c6c595c6";><code>2829175</code></a> Minor: Regenerated NOTICE File for 7a9ea256ba447c45fa872267082b9998070ad2a8 (...</li> <li><a href="https://github.com/apache/opennlp/commit/7a9ea256ba447c45fa872267082b9998070ad2a8";><code>7a9ea25</code></a> OPENNLP-1822: Update ONNX runtime to 1.25.0 (<a href="https://redirect.github.com/apache/opennlp/issues/1024";>#1024</a>)</li> <li><a href="https://github.com/apache/opennlp/commit/56cf783c2ee51555d54db1712fafd9f8c85a10cf";><code>56cf783</code></a> OPENNLP-1816: Make ME classes thread-safe by eliminating shared mutable insta...</li> <li><a href="https://github.com/apache/opennlp/commit/b85e45f064a9b9089b65ca73c75544092fec4eae";><code>b85e45f</code></a> OPENNLP-1819: Align DictionaryEntryPersistor XML parsing with XmlUtil helper ...</li> <li>Additional commits viewable in <a href="https://github.com/apache/opennlp/compare/opennlp-3.0.0-M2...opennlp-3.0.0-M3";>compare view</a></li> </ul> </details> <br /> Updates `org.apache.opennlp:opennlp-runtime` from 3.0.0-M2 to 3.0.0-M3 Updates `org.apache.opennlp:opennlp-formats` from 3.0.0-M2 to 3.0.0-M3 Updates `org.apache.opennlp:opennlp-cli` from 3.0.0-M2 to 3.0.0-M3 Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
