Assigning reviewers:

R: @robertwb for label java.

Note: If you would like to opt out of this review, comment assign to next reviewer.

Available commands:

• stop reviewer notifications - opt out of the automated review tooling
• remind me after tests pass - tag the comment author after tests pass
• waiting on author - shift the attention set back to the author (any comment or push by the author will return the attention set to the reviewers)

The PR bot will only process comments in the main thread (not review comments).

@Abacn - is Robert the right reviewer here?

This change is to prevent XXE in xmlio, however it might be backwards incompatible, so I was wondering what the team thinks about whether we should just merge and note it in release notes, or add an option to support the old/new behavior. Feel ff

checked that JAXBCoder is only used in XmlIO readfiles and XmlSource, which are bounded sources, so upgrade compatibility should be of minimum concern here

ok - does that mean no concerns from you on merging @Abacn ?

@dvd-22 please add a reference to this change in CHANGES.md so it's noted in release notes for the next release. From there we can merge if @Abacn has no concerns.