chore(deps): update dependency org.xmlunit:xmlunit-core to v2.14.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.xmlunit:xmlunit-core (source)	2.9.1 → 2.14.0

---

Release Notes

xmlunit/xmlunit (org.xmlunit:xmlunit-core)

v2.14.0

• marked jakarta.xml.bind-api as optional in xmlunit-core.
  PR #​340 by @​arimu1

v2.13.0

Compare Source

• added explicit settings to the Validator classes that disable (external) DTD loading during validation. The default
  remains to allow loading of external content as this is often a requirement during validation.

  PRs #​331 and #​332 by
  @​jmestwa-coder

• added constructor overloads to JAXPXPathEngine to allow specifying the DocumentBuilderFactory used for the
  Source overloads of the selectNodes and evaluate methods.

  PRs #​333 by @​jmestwa-coder

• IsDateTimePlaceholderHandler now parses the explicit and ISO date formats using Locale.US rather than the JVM
  default locale so results no longer depend on the host locale. An optional second argument allows specifying a
  different locale as a BCP 47 language tag.

  PR #​335 by @​jmestwa-coder

v2.12.0

Compare Source

• bumped xmlunit-assertj3's dependency on assert to 3.27.7.

  This is to make people aware of
  GHSA-rqfh-9r24-8c9r

  XMLUnit itself does not use the affected code in AssertJ so the upgrade is not strictly necessary - and this is why
  the xmlunit-assertj module is not updated. In fact the assertions provided by xmlunit-assertj3 are the recommended
  upgrade path for users of AssertJ 3.x+.

  PRs #​320 and
  #​321

• actually made withDTDParsingDisabled do what it says.

  This is a bugfix and in a way it is backwards incompatible as it changes default behavior in a way that I intended to
  do with XMLUnit 2.6.0 eight years ago. DocumentBuilderFactoryConfigurer.DefaultWithDTDParsing provides the
  behavior of XMLUnit 2.6.0 to 2.11.0.

  PRs #​326 by @​jmestwa-coder
  and #​328

v2.11.0

Compare Source

• the xmlunit-jakarta-jaxb-impl no longer depends on org.glassfish.jaxb:jaxb-runtime directly.
  Issue #​313 PR #​314

  This is a breaking change and may force you to add an explicit dependency if you are using the module and rely on
  XMLUnit to provide the JAXB implementation.

v2.10.4

Compare Source

• attributes with null values could cause a NullPointerException.
  Issue #​307
  PR #​309

v2.10.3

Compare Source

• marked OSGi Import-Package optional for javax.xml.bind packages in xmlunit-core.
  Also fixed the Export-Package header of the legacy module.
  Issue #​300
  PR #​301

v2.10.2

Compare Source

• the published POM of xmlunit-legacy lacked the dependency on xmlunit-core.
  Issue #​296

v2.10.1

Compare Source

• placeholders can now also be used inside of the local part of xsi:type attributes.
  PR #​293

• PlaceholderDifferenceEvaluator would cause ClassCastException for documents with
  differences in xsi:type attributes.
  Issue #​276

• updated a bunch of Maven plugins, in particular we now create CylcloneDX files using
  version 1.6 of the schema.
  PR #​292

• updated bytebuddy dependency of xmlunit-assertj to 2.12.23 in order
  to support Java 17 properly

• Migrated form TravisCI to CircleCI
  Issue #​289

• Migrated to Sonatype's Central Portal
  Issue #​287

• added a new BOM artifact xmlunit-bom
  Issue #​269

• Comparison has earned a new convenience constructor.
  PR #​280 by
  @​hiufung-kwok

• Input.from now detects Reader arguments and uses fromReader.
  PR #​281 by
  @​SThomasP

v2.10.0

Compare Source

• add a new ElementSelectors.byNameAndAllAttributes variant that filters attributes before deciding whether elements can
  be compared.
  Inspired by Issue #​259

• By default the TransformerFactorys created will now try to disable extension functions. If you need extension
  functions for your transformations you may want to pass in your own instance of TransformerFactory and
  TransformerFactoryConfigurer may help with that.
  Inspired by Issue #​264
  This is tracked as CVE-2024-31573.

• JAXPXPathEngine will now try to disable the execution of extension functions by default but uses
  XPathFactory#setProperty which is not available prior to Java 18. You may want to enable secure processing on an
  XPathFactory instance you pass to JAXPXPathEngine instead - and XPathFactoryConfigurer may help with that.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud