Bump jaxen:jaxen from 1.1.6 to 2.0.6

[dependabot]

Bumps jaxen:jaxen from 1.1.6 to 2.0.6.

Release notes

Sourced from jaxen:jaxen's releases.

2.0.6

Version 2.0.6 fixes one bug in the new iterative algorithms that incorrectly evaluated some parenthesized XPath expressions like ((//A)[2]//B)[1]/C.

What's Changed

• Remove $Id$ line from LICENSE.txt by @​elharo in jaxen-xpath/jaxen#519
• Revise RELEASING.md for clarity and completeness by @​elharo in jaxen-xpath/jaxen#523
• Add contribution license acknowledgment to default PR template by @​Copilot in jaxen-xpath/jaxen#525
• Fix canFlattenParenthesizedFilterExpr to reject patterns with path operators after predicates by @​michael-sevcik in jaxen-xpath/jaxen#518
• Update RELEASING.md The release script updates index.xml so it doesn't need to be done maually by @​elharo in jaxen-xpath/jaxen#527
• Update release notes for version 2.0.5 by @​elharo in jaxen-xpath/jaxen#530
• Change title from 'Status' to 'Release Notes' by @​elharo in jaxen-xpath/jaxen#531
• Update release workflow to bump src/site/xdoc/releases.xml version references by @​Copilot in jaxen-xpath/jaxen#529
• Add change history for Jaxen version 2.0.6 by @​elharo in jaxen-xpath/jaxen#526
• Redo change by @​elharo in jaxen-xpath/jaxen#532
• Update release notes for versions 2.0.5 and 2.0.6 by @​elharo in jaxen-xpath/jaxen#533

New Contributors

• @​github-actions[bot] made their first contribution in jaxen-xpath/jaxen#479
• @​michael-sevcik made their first contribution in jaxen-xpath/jaxen#518

Full Changelog: jaxen-xpath/jaxen@v2.0.3...v2.0.6

2.0.5

Version 2.0.5 converts still more recursive algorithms in the core parser to safer iterative forms. This enables Jaxen to handle even larger and more complex XPath expressions.

For the recursive code that remains, higher level evaluation and parsing now catches stack overflow errors if they do occur, and wraps them inside a regular checked JaxenException so it won't bring down the entire program. This should be fairly robust and complete protection against DoS attacks on recursive code, even with arbitrary untrusted input. I don't know why I didn't think of this earlier. I probably just had an unquestioned rule in my head that you can't recover from errors, which isn't actually true in the case of stack overflow errors.

PRs

• Bump org.apache.maven.plugins:maven-project-info-reports-plugin from 3.6.2 to 3.9.0 by @​dependabot[bot] in jaxen-xpath/jaxen#426
• Bump org.apache.maven.plugins:maven-assembly-plugin from 3.7.1 to 3.8.0 by @​dependabot[bot] in jaxen-xpath/jaxen#425
• Bump org.apache.maven.plugins:maven-javadoc-plugin from 3.10.1 to 3.12.0 by @​dependabot[bot] in jaxen-xpath/jaxen#422
• Bump org.apache.maven.plugins:maven-resources-plugin from 3.3.1 to 3.5.0 by @​dependabot[bot] in jaxen-xpath/jaxen#423
• Upgrade XOM to 1.4.2 and fix Java 8 ElementTraversal classpath breakage by @​Copilot in jaxen-xpath/jaxen#428
• Resolve unresolved Maven site variables and enforce static HTML/CSS-only Pages output by @​Copilot in jaxen-xpath/jaxen#430
• remove public modifier from interfaces by @​hduelme in jaxen-xpath/jaxen#172
• don't fully qualify SAXPathException by @​elharo in jaxen-xpath/jaxen#439
• Fix unterminated string literal handling and add regression tests at lexer and API levels by @​Copilot in jaxen-xpath/jaxen#433
• avoid recursion by @​elharo in jaxen-xpath/jaxen#431
• remove debugging code by @​elharo in jaxen-xpath/jaxen#446
• deprecate simplify by @​elharo in jaxen-xpath/jaxen#445
• Inline dead PatternParser.USE_HANDLER branch by @​Copilot in jaxen-xpath/jaxen#448
• deprecate simplify by @​elharo in jaxen-xpath/jaxen#449
• Suppress javac obsolete-options warnings for Java 1.5 target builds by @​Copilot in jaxen-xpath/jaxen#453
• add 2.0.4 release notes by @​elharo in jaxen-xpath/jaxen#456
• Fix XPath union precedence relative to additive expressions by @​Copilot in jaxen-xpath/jaxen#460
• Remove recursion from union operations by @​elharo in jaxen-xpath/jaxen#455
• Avoid recursion when processing and and or by @​elharo in jaxen-xpath/jaxen#461
• Prevent parser stack overflow on deeply nested parenthesized filter expressions by @​Copilot in jaxen-xpath/jaxen#462
• Bump org.apache.maven.plugins:maven-gpg-plugin from 3.2.7 to 3.2.8 by @​dependabot[bot] in jaxen-xpath/jaxen#468
• Bump org.apache.maven.plugins:maven-jar-plugin from 3.3.0 to 3.5.0 by @​dependabot[bot] in jaxen-xpath/jaxen#469

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)