Sourced from org.eclipse.rdf4j:rdf4j-bom's releases.

RDF4J 5.3.2 is now available. This is a patch release fixing 2 issues, including a security fix for XML parsing.

The security fix is a follow-up to CVE-2018-1000644. Several XML parser entry points were not covered by the earlier fix and could still allow XML External Entity (XXE) style processing in some configurations. RDF4J 5.3.2 hardens these paths so DOCTYPE declarations, external entities, and external DTD loading are rejected or disabled by default.

We recommend that users who parse untrusted XML-based RDF4J data or query results upgrade to this release.

For more details, have a look at the release notes.

• e0bbd99 release 5.3.2
• 94b5ea1 GH-5824 Harden XML parsing defaults (#5887)
• af158e0 bump central-publishing-maven-plugin (#5892)
• 19800bb bump central-publishing-maven-plugin
• ed72c4d GH-5824 clarify XML parser configuration docs
• 95cfa65 GH-5824 Apply SPARQL XML config to tuple parser
• 8950734 GH-5824 Preserve XML parser compatibility
• 5929694 GH-5824 Harden XML parsing defaults
• 6d057c0 Harden auto-format workflow against untrusted comment triggers and fork pushe...
• dc26887 Delete initial-evidence.txt
• Additional commits viewable in compare view