Skip to content

Conversation

@baev
Copy link
Member

@baev baev commented Dec 9, 2025

Context

Apache Tika has an XXE vulnerability, and the fixed version of tika-core requires Java 11. Since we only use a content type detector from tika-core, and it has already been ported to TypeScript in Allure 3, it seems like a good idea to remove tika-core in Allure 2 as well.

Please note: Allure is not affected by this vulnerability!

Checklist

@baev baev added type:security Security vulnerability or fix type:dependencies Pull requests that update a dependency and removed type:security Security vulnerability or fix labels Dec 9, 2025
@DineshKumarRA DineshKumarRA mentioned this pull request Dec 10, 2025
2 tasks
@baev baev merged commit 570fd81 into main Dec 10, 2025
18 checks passed
@baev baev deleted the get-rid-tika-core branch December 10, 2025 12:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

theme:build theme:generator type:dependencies Pull requests that update a dependency

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants