chore(deps): bump org.apache.opennlp:opennlp-tools from 1.9.1 to 2.5.9

[dependabot]

Bumps org.apache.opennlp:opennlp-tools from 1.9.1 to 2.5.9.

Release notes

Sourced from org.apache.opennlp:opennlp-tools's releases.

OpenNLP 2.5.9

Apache OpenNLP 2.5.9

This is a maintenance and security release on the 2.x line. It backports the security fixes shipped in 3.0.0-M3 and refreshes several dependencies.

Security Fixes

Three security issues are addressed in this release (also fixed in 3.0.0-M3 on the 3.x line).

XXE in DictionaryEntryPersistor (OPENNLP-1819)

The DictionaryEntryPersistor previously used a SAXParserFactory that did not enable secure processing or disable DTD handling, leaving external entity resolution active. A malicious dictionary file could exploit this for local file disclosure or SSRF before any dictionary entry was processed.

The parsing path is now aligned with the project's existing XmlUtil helper, which properly sets FEATURE_SECURE_PROCESSING and disallow-doctype-decl.

Arbitrary Class Instantiation in ExtensionLoader (OPENNLP-1820)

ExtensionLoader.instantiateExtension() performed its isAssignableFrom type check after Class.forName() had already executed the target class's static initializer, allowing a crafted model archive to trigger the static initializer of any class on the classpath.

The fix introduces a package-prefix allowlist consulted before Class.forName() is invoked:

• Classes under opennlp.* remain permitted by default.
• Other packages must be opted in via ExtensionLoader.registerAllowedPackage(String) or the OPENNLP_EXT_ALLOWED_PACKAGES system property (comma-separated list).

OOM via Unbounded Array Allocation in AbstractModelReader (OPENNLP-1821)

getOutcomes(), getOutcomePatterns(), and getPredicates() read attacker-controlled 32-bit count fields from binary model streams and passed them directly to array allocations. A crafted .bin file could trigger an immediate OutOfMemoryError and crash the JVM.

Each count is now bounded (default 10,000,000, configurable via -DOPENNLP_MAX_ENTRIES=<n>), with negative or oversized values failing fast via IllegalArgumentException.

⚠️ For all three issues, users who cannot upgrade immediately should restrict input (dictionary and model files) to trusted sources only.

What's Changed

• Apache OpenNLP 2.5.8 by @​mawiesne in apache/opennlp#1004
• [2.x]: OPENNLP-1817: Update log4j2 to 2.25.4 by @​dependabot[bot] in apache/opennlp#999
• [2.x] Regenerated NOTICE file after dependency changes by @​github-actions[bot] in apache/opennlp#1008
• [2.x]: Bump actions/cache from 5.0.4 to 5.0.5 by @​dependabot[bot] in apache/opennlp#1018
• [2.x]: Bump com.ruleoftech:markdown-page-generator-plugin from 2.4.2 to 2.4.3 by @​dependabot[bot] in apache/opennlp#1015
• [2.x]: Bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 by @​dependabot[bot] in apache/opennlp#1013
• [2.x] OPENNLP-1819: Align DictionaryEntryPersistor XML parsing with XmlUtil by @​rzo1 in apache/opennlp#1020
• [2.x]: OPENNLP-1822: Update ONNX runtime to 1.25.0 by @​dependabot[bot] in apache/opennlp#1023
• [2.x] Regenerated NOTICE file after dependency changes by @​github-actions[bot] in apache/opennlp#1026

Full Changelog: https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12311215&version=12356814

OpenNLP 2.5.8

Summary

Maintenance Infos:

• Bug Fixes:
  • The SentenceDetector got three fixes in handling edge cases with abbreviation dictionaries (OPENNLP-1809, OPENNLP-1810, OPENNLP-1811)
• Improvements:
  • The OpenNLP developer manual (HTML + PDF) got an uplift for the UIMA documentation part, being largely extended (OPENNLP-49)
  • Some updates of dependencies

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

Test Results

396 tests  ±0   371 ✅  - 10   23m 40s ⏱️ - 8m 40s
 53 suites ±0    15 💤 ± 0 
 53 files   ±0     8 ❌ + 8   2 🔥 +2 

For more details on these failures and errors, see this check.

Results for commit 0e0885c. ± Comparison against base commit d5e2cda.

[pdurbin]

As a first pass, I deleted the dependency just to see what part of the code is affected:

[INFO] -------------------------------------------------------------
[ERROR] COMPILATION ERROR : 
[INFO] -------------------------------------------------------------
[ERROR] /Users/pdurbin/github/iqss/dataverse/src/main/java/edu/harvard/iq/dataverse/util/Organizations.java:[10,30] package opennlp.tools.namefind does not exist
[ERROR] /Users/pdurbin/github/iqss/dataverse/src/main/java/edu/harvard/iq/dataverse/util/Organizations.java:[11,30] package opennlp.tools.namefind does not exist
[ERROR] /Users/pdurbin/github/iqss/dataverse/src/main/java/edu/harvard/iq/dataverse/util/Organizations.java:[12,30] package opennlp.tools.tokenize does not exist
[ERROR] /Users/pdurbin/github/iqss/dataverse/src/main/java/edu/harvard/iq/dataverse/util/Organizations.java:[13,30] package opennlp.tools.tokenize does not exist
[ERROR] /Users/pdurbin/github/iqss/dataverse/src/main/java/edu/harvard/iq/dataverse/util/Organizations.java:[14,26] package opennlp.tools.util does not exist
[ERROR] /Users/pdurbin/github/iqss/dataverse/src/main/java/edu/harvard/iq/dataverse/util/Organizations.java:[33,25] cannot find symbol
  symbol:   class NameFinderME
  location: class edu.harvard.iq.dataverse.util.Organizations
[ERROR] /Users/pdurbin/github/iqss/dataverse/src/main/java/edu/harvard/iq/dataverse/util/Organizations.java:[34,25] cannot find symbol
  symbol:   class TokenizerME
  location: class edu.harvard.iq.dataverse.util.Organizations
[ERROR] /Users/pdurbin/github/iqss/dataverse/src/main/java/edu/harvard/iq/dataverse/util/Organizations.java:[145,56] cannot find symbol
  symbol:   class TokenizerME
  location: class edu.harvard.iq.dataverse.util.Organizations
[ERROR] /Users/pdurbin/github/iqss/dataverse/src/main/java/edu/harvard/iq/dataverse/dataaccess/S3AccessIO.java:[37,26] package opennlp.tools.util does not exist
[ERROR] /Users/pdurbin/github/iqss/dataverse/src/main/java/edu/harvard/iq/dataverse/dataverse/DataverseUtil.java:[21,26] package opennlp.tools.util does not exist
[INFO] 10 errors 
[INFO] -------------------------------------------------------------

[pdurbin]

When I bump to 2.5.9 locally, I get the following errors when I run this test:

mvn test -Dtest=OrganizationsTest


[INFO] Results:
[INFO] 
[ERROR] Errors: 
[ERROR]   OrganizationsTest.<init>:16 » IllegalArgument Property 'http://javax.xml.XMLConstants/property/accessExternalDTD' is not recognized.
[ERROR]   OrganizationsTest.<init>:16 » IllegalArgument Property 'http://javax.xml.XMLConstants/property/accessExternalDTD' is not recognized.
[ERROR]   OrganizationsTest.<init>:16 » IllegalArgument Property 'http://javax.xml.XMLConstants/property/accessExternalDTD' is not recognized.
[ERROR]   OrganizationsTest.<init>:16 » IllegalArgument Property 'http://javax.xml.XMLConstants/property/accessExternalDTD' is not recognized.
[ERROR]   OrganizationsTest.<init>:16 » IllegalArgument Property 'http://javax.xml.XMLConstants/property/accessExternalDTD' is not recognized.
[INFO] 
[ERROR] Tests run: 5, Failures: 0, Errors: 5, Skipped: 0
[INFO] 
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------

[pdurbin]

Closing in favor of this PR where unit tests actually pass:

• bump opennlp-tools version #12429

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.