You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@drill.apache.org by "James Turton (Jira)" <ji...@apache.org> on 2022/07/20 06:43:00 UTC

[jira] [Updated] (DRILL-8262) Drop dependency on Xalan which is EOL

     [ https://issues.apache.org/jira/browse/DRILL-8262?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

James Turton updated DRILL-8262:
--------------------------------
    Summary: Drop dependency on Xalan which is EOL  (was: Xalan is EOL and has a never to be fixed CVE)

> Drop dependency on Xalan which is EOL
> -------------------------------------
>
>                 Key: DRILL-8262
>                 URL: https://issues.apache.org/jira/browse/DRILL-8262
>             Project: Apache Drill
>          Issue Type: Improvement
>            Reporter: PJ Fanning
>            Priority: Major
>
> Xalan is no longer supported.
> https://lists.apache.org/thread/s8kjny5270ssfcp46v0fl39lk98987w7
> It is better to use JAXP TransformerFactory than using xalan directly. If you add xalan dependency just to ensure that you have a JAXP compliant transformer on the classpath, this is unnecessary - the Java runtime has a built-in implementation.
> Drill dependency:
> https://mvnrepository.com/artifact/org.apache.drill.exec/drill-java-exec/1.20.0



--
This message was sent by Atlassian Jira
(v8.20.10#820010)