docx4j 11.5.6 and -ImportXHTML 11.5.6 released

[jason]

docx4j release

To get this release, please see https://www.docx4java.org/downloads.html

Please note that with this release, if you are processing files > 50MB in size, you will need to set properties docx4j.openpackaging.package.MAX_UNCOMPRESSED_SIZE.unzip.error and docx4j.openpackaging.parts.MAX_BYTES.unzip.error to larger values. See https://github.com/plutext/docx4j/blob/ ... erties#L53

Release highlights:

PDF via XSL FO output: map symbol font characters to UTF-8; specify font to use for these on Linux and Windows systems. (OSX is a TODO)

Support bullet symbols in HTML output.

Some build and security tweaks:-

* pom.xml in released jars is created with flatten-maven-plugin, now with flattenDependencyMode set to all. This pulls up both direct and transitive dependencies, and uses exclusions, so that in effect there are no transitive dependencies.

* build process now includes plugins: spotbugs, cyclonedx (to generate bom), owasp dependency check

* Zip bomb defenses: default for docx4j.openpackaging.parts.MAX_BYTES.unzip.error changed from disabled to 50 MB.
Additional settings introduced:
- MAX_UNCOMPRESSED_SIZE for the entire file (defaults to 50MB);
- MAX_RATIO, which triggers on a suspect compression ratio (defaults to 500); only checked when reading from a File (not InputStream).

* StaX XMLInputFactory configuration refactored (noted because StaX XMLInputFactory is central to docx4j's operation, and configuring it is central to secure operation).


docx4j-ImportXHTML release

Update pom to use docx4j 11.5.6

As for docx4j 11.5.6:
- pom included in jars is built with flatten-maven-plugin now with flattenDependencyMode set to all. This pulls up both direct and transitive dependencies, and uses exclusions, so that in effect there are no transitive dependencies.
- build process now includes plugins: spotbugs, cyclonedx (to generate bom), owasp dependency check

Maven co-ordinates:

Syntax: [ Download ] [ Hide ]

Syntax: [ Download ] [ Show ]

Using xml Syntax Highlighting

       
<dependency>
    <groupId>org.docx4j</groupId>
    <artifactId>docx4j-ImportXHTML-core</artifactId>
    <version>11.5.6</version>
</dependency>
 

Parsed in 0.000 seconds, using GeSHi 1.0.8.4

docx4j-ImportXHTML is also included in the docx4j-community zip distribution, in the /optional dir