Update dependency jaxen:jaxen to v2 #157
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/jaxen-jaxen-2.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
1.1-beta-8->2.0.6Release Notes
jaxen-xpath/jaxen (jaxen:jaxen)
v2.0.6: 2.0.6Version 2.0.6 fixes one bug in the new iterative algorithms that incorrectly evaluated some parenthesized XPath expressions like
((//A)[2]//B)[1]/C.What's Changed
Idline from LICENSE.txt by @elharo in https://github.com/jaxen-xpath/jaxen/pull/519New Contributors
Full Changelog: https://github.com/jaxen-xpath/jaxen/compare/v2.0.3...v2.0.6
v2.0.5: 2.0.5Version 2.0.5 converts still more recursive algorithms in the core parser to safer iterative forms. This enables Jaxen to handle even larger and more complex XPath expressions.
For the recursive code that remains, higher level evaluation and parsing now catches stack overflow errors if they do occur, and wraps them inside a regular checked JaxenException so it won't bring down the entire program. This should be fairly robust and complete protection against DoS attacks on recursive code, even with arbitrary untrusted input. I don't know why I didn't think of this earlier. I probably just had an unquestioned rule in my head that you can't recover from errors, which isn't actually true in the case of stack overflow errors.
PRs
ElementTraversalclasspath breakage by @Copilot in https://github.com/jaxen-xpath/jaxen/pull/428PatternParser.USE_HANDLERbranch by @Copilot in https://github.com/jaxen-xpath/jaxen/pull/448masterby @Copilot in https://github.com/jaxen-xpath/jaxen/pull/476DocumentNavigator#getStringValuefor deeply nested documents by @Copilot in https://github.com/jaxen-xpath/jaxen/pull/485xmlns:*runs by @Copilot in https://github.com/jaxen-xpath/jaxen/pull/490lang()on empty/null context node with explicitFunctionCallExceptionby @Copilot in https://github.com/jaxen-xpath/jaxen/pull/501New Contributors
Full Changelog: https://github.com/jaxen-xpath/jaxen/compare/v2.0.3...v2.0.5
v2.0.4: 2.0.4This release fixes one bug in XPath evaluation involving union precedence relative to additive expressions.
It also removes all recursion from XPath expression parsing meaning Jaxen can now parse much more complex and longer XPath expression without stack overflowing. This prevents a whole class of DoS attacks when user-supplied XPath expressions are passed into a program (which you probably shouldn't be doing anyway, but it's a big world and I'm sure someone is making that mistake.)
Neither of these problems was detected by LLMs or security scanners. I continue to get a slow trickle of misguided reports about loading DTDs or URLs, but so far the automated tools are missing the big stuff. (The static security scanners were never very good in the first place.) Recursion is a vastly overused technique in Java. Unlike some other languages, Java doesn't do tail-call optimization so it's really easy to bust the stack in any recursive method. Less importantly recursive programs are almost always slower than the non-recursive equivalents. XOM is very careful to avoid recursion for these reasons. Jaxen, not so much. It still uses recursion when evaluating XPath expressions, and I'm looking at fixing that in upcoming releases.
I've started that in this release by deprecating the
simplifymethod. That method is an internal implementation detail and shouldn't have been public in the first place, but like a lot of Java programs Jaxen uses many more packages than it should. Packages are meant for access control boundaries, not for separating programs into related groups of functionality.PRs
ElementTraversalclasspath breakage by @Copilot in https://github.com/jaxen-xpath/jaxen/pull/428PatternParser.USE_HANDLERbranch by @Copilot in https://github.com/jaxen-xpath/jaxen/pull/448masterby @Copilot in https://github.com/jaxen-xpath/jaxen/pull/476Full Changelog: https://github.com/jaxen-xpath/jaxen/compare/v2.0.3...v2.0.4
v2.0.3: 2.0.3What's Changed
id()to return unique node-set results and add regression coverage by @Copilot in https://github.com/jaxen-xpath/jaxen/pull/412id()deduplication with dual ID-typed attributes on one element by @Copilot in https://github.com/jaxen-xpath/jaxen/pull/416Full Changelog: https://github.com/jaxen-xpath/jaxen/compare/v2.0.2...v2.0.3
v2.0.2: 2.0.22.0.2 fixes two bugs in XPath conformance.
substring()function now handles Nan and Inf values according to spec.|now correctly sorts attribute nodes before child nodes.New Contributors
Full Changelog: https://github.com/jaxen-xpath/jaxen/compare/v2.0.1...v2.0.2
v2.0.1: 2.0.1The build is now fully byte-per-byte reproducible. If you use the same JDK on the same platform to compile, you'll get the same bytes out every time. This is a prerequisite for hash-based defenses against supply chain and MITM attacks.
The release has been mostly automated. It's not quite a one-click deploy but it's close.
Several bugs in XPath conformance detected by Claude Sonnet 4.6 were fixed:
round()function returns negative zero for values between -0.5 and -0.0.number()function rejects some strings Java recognizes as a number but XPath does not.anyMatchingNode()andevaluateAsBoolean()no longer throwNoSuchElementExceptionwhen evaluating an XPath expression with multiple predicates and more nodes than predicates.DefaultCommentNodeStep.getText()includes predicates. (This one's very unlikely to have any effect on XPath queries or evaluation.)The DOMNavigator can now search inside entity reference and document fragment nodes.
What's Changed
>by @Copilot in https://github.com/jaxen-xpath/jaxen/pull/257XPathReader.LTafter perf check by @Copilot in https://github.com/jaxen-xpath/jaxen/pull/275XXXnull-handling comment inAncestorOrSelfAxisIteratorby @Copilot in https://github.com/jaxen-xpath/jaxen/pull/276New Contributors
Full Changelog: https://github.com/jaxen-xpath/jaxen/compare/v2.0.0...v2.0.1
v2.0.0: 2.0.0Despite the major version bump, this should be a drop in replacement for almost every project, The two major possible incompatibilities are:
was depending on them to be loaded transitively it will need to add
explicit dependencies to build.
On the plus side, this makes classpaths much smaller and less complex, and will shut up a lot of noise from static analysis tools.
In addition the Jaxen core code is also a little smaller and has fixed a few minor bugs in XPath evaluation, mostly weird cases found by fuzzing that are unlikely to arise in practice.
v1.2.0Deprecate pattern package.
Require Java 1.4.
Don't bundle org.w3c.dom
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.