build(deps): bump jaxen:jaxen from 2.0.3 to 2.0.4

[dependabot]

Bumps jaxen:jaxen from 2.0.3 to 2.0.4.

Release notes

Sourced from jaxen:jaxen's releases.

2.0.4

This release fixes one bug in XPath evaluation involving union precedence relative to additive expressions.

It also removes all recursion from XPath expression parsing meaning Jaxen can now parse much more complex and longer XPath expression without stack overflowing. This prevents a whole class of DoS attacks when user-supplied XPath expressions are passed into a program (which you probably shouldn't be doing anyway, but it's a big world and I'm sure someone is making that mistake.)

Neither of these problems was detected by LLMs or security scanners. I continue to get a slow trickle of misguided reports about loading DTDs or URLs, but so far the automated tools are missing the big stuff. (The static security scanners were never very good in the first place.) Recursion is a vastly overused technique in Java. Unlike some other languages, Java doesn't do tail-call optimization so it's really easy to bust the stack in any recursive method. Less importantly recursive programs are almost always slower than the non-recursive equivalents. XOM is very careful to avoid recursion for these reasons. Jaxen, not so much. It still uses recursion when evaluating XPath expressions, and I'm looking at fixing that in upcoming releases.

I've started that in this release by deprecating the simplify method. That method is an internal implementation detail and shouldn't have been public in the first place, but like a lot of Java programs Jaxen uses many more packages than it should. Packages are meant for access control boundaries, not for separating programs into related groups of functionality.

PRs

• Bump org.apache.maven.plugins:maven-project-info-reports-plugin from 3.6.2 to 3.9.0 by @​dependabot[bot] in jaxen-xpath/jaxen#426
• Bump org.apache.maven.plugins:maven-assembly-plugin from 3.7.1 to 3.8.0 by @​dependabot[bot] in jaxen-xpath/jaxen#425
• Bump org.apache.maven.plugins:maven-javadoc-plugin from 3.10.1 to 3.12.0 by @​dependabot[bot] in jaxen-xpath/jaxen#422
• Bump org.apache.maven.plugins:maven-resources-plugin from 3.3.1 to 3.5.0 by @​dependabot[bot] in jaxen-xpath/jaxen#423
• Upgrade XOM to 1.4.2 and fix Java 8 ElementTraversal classpath breakage by @​Copilot in jaxen-xpath/jaxen#428
• Resolve unresolved Maven site variables and enforce static HTML/CSS-only Pages output by @​Copilot in jaxen-xpath/jaxen#430
• remove public modifier from interfaces by @​hduelme in jaxen-xpath/jaxen#172
• don't fully qualify SAXPathException by @​elharo in jaxen-xpath/jaxen#439
• Fix unterminated string literal handling and add regression tests at lexer and API levels by @​Copilot in jaxen-xpath/jaxen#433
• avoid recursion by @​elharo in jaxen-xpath/jaxen#431
• remove debugging code by @​elharo in jaxen-xpath/jaxen#446
• deprecate simplify by @​elharo in jaxen-xpath/jaxen#445
• Inline dead PatternParser.USE_HANDLER branch by @​Copilot in jaxen-xpath/jaxen#448
• deprecate simplify by @​elharo in jaxen-xpath/jaxen#449
• Suppress javac obsolete-options warnings for Java 1.5 target builds by @​Copilot in jaxen-xpath/jaxen#453
• add 2.0.4 release notes by @​elharo in jaxen-xpath/jaxen#456
• Fix XPath union precedence relative to additive expressions by @​Copilot in jaxen-xpath/jaxen#460
• Remove recursion from union operations by @​elharo in jaxen-xpath/jaxen#455
• Avoid recursion when processing and and or by @​elharo in jaxen-xpath/jaxen#461
• Prevent parser stack overflow on deeply nested parenthesized filter expressions by @​Copilot in jaxen-xpath/jaxen#462
• Bump org.apache.maven.plugins:maven-gpg-plugin from 3.2.7 to 3.2.8 by @​dependabot[bot] in jaxen-xpath/jaxen#468
• Bump org.apache.maven.plugins:maven-jar-plugin from 3.3.0 to 3.5.0 by @​dependabot[bot] in jaxen-xpath/jaxen#469
• Bump org.apache.maven.plugins:maven-surefire-report-plugin from 3.5.1 to 3.5.5 by @​dependabot[bot] in jaxen-xpath/jaxen#466
• Bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.23.1 to 0.26.0 by @​dependabot[bot] in jaxen-xpath/jaxen#465
• Characterization tests for the pattern package by @​elharo in jaxen-xpath/jaxen#470
• Revise Jaxen 2.0.4 change history details by @​elharo in jaxen-xpath/jaxen#472
• Update release notes for version 2.0.4 by @​elharo in jaxen-xpath/jaxen#474
• Switch release workflow to PR-based handoff for protected master by @​Copilot in jaxen-xpath/jaxen#476
• Update version number to 2.0.4 in index.xml by @​elharo in jaxen-xpath/jaxen#477
• Update index.xml before release by @​elharo in jaxen-xpath/jaxen#478

Full Changelog: jaxen-xpath/jaxen@v2.0.3...v2.0.4

Commits

• f593b48 Release 2.0.4
• 522d085 Update index.xml before release (#478)
• 94bf85f Update version number to 2.0.4 in index.xml (#477)
• 81589cc Switch release workflow to PR-based handoff for protected master (#476)
• 6a24e88 Update release notes for version 2.0.4 (#474)
• 2c71f01 Revise Jaxen 2.0.4 change history details (#472)
• 5d4a6af Characterization tests for the pattern package (#470)
• 37f6c3b Bump com.github.siom79.japicmp:japicmp-maven-plugin (#465)
• 36a8cd0 Bump org.apache.maven.plugins:maven-surefire-report-plugin (#466)
• c70ca5b Bump org.apache.maven.plugins:maven-jar-plugin from 3.3.0 to 3.5.0 (#469)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)