From bd90f8d4409ed9923fabbc7de8f6064963510469 Mon Sep 17 00:00:00 2001
From: Dannes Wessels <dannes@exist-db.org>
Date: Mon, 10 Jul 2023 22:37:50 +0200
Subject: [PATCH] [security] update xalan version including explicit reference
 to serializer

---
 exist-core/pom.xml   | 10 ++++++++--
 exist-parent/pom.xml |  1 +
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/exist-core/pom.xml b/exist-core/pom.xml
index 378cb1bf578..3eb7fa81542 100644
--- a/exist-core/pom.xml
+++ b/exist-core/pom.xml
@@ -364,7 +364,7 @@
         <dependency>
             <groupId>xalan</groupId>
             <artifactId>xalan</artifactId>
-            <version>2.7.3</version> <!-- needed at compile time for various dependencies -->
+            <version>${xalan.version}</version> <!-- needed at compile time for various dependencies -->
             <exclusions>
                 <exclusion> <!-- conflicts with Java 17's javax.xml module -->
                     <groupId>xml-apis</groupId>
@@ -373,6 +373,12 @@
             </exclusions>
         </dependency>
 
+        <dependency>
+            <groupId>xalan</groupId>
+            <artifactId>serializer</artifactId>
+            <version>${xalan.version}</version>
+        </dependency>
+
         <dependency>
             <groupId>net.sf.saxon</groupId>
             <artifactId>Saxon-HE</artifactId>
@@ -989,7 +995,7 @@ The BaseX Team. The original license statement is also included below.]]></pream
                                 <ignoredUnusedDeclaredDependency>org.apache.logging.log4j:log4j-jcl:jar:${log4j.version}</ignoredUnusedDeclaredDependency>
                                 <ignoredUnusedDeclaredDependency>org.apache.logging.log4j:log4j-slf4j2-impl:jar:${log4j.version}</ignoredUnusedDeclaredDependency>
                                 <ignoredUnusedDeclaredDependency>org.apache.logging.log4j:log4j-jul:jar:${log4j.version}</ignoredUnusedDeclaredDependency>
-
+                                <ignoredUnusedDeclaredDependency>xalan:serializer:jar:${xalan.version}</ignoredUnusedDeclaredDependency>
                                 <ignoredUnusedDeclaredDependency>org.eclipse.angus:angus-activation:jar:${eclipse.angus-activation.version}</ignoredUnusedDeclaredDependency>
                                 <ignoredUnusedDeclaredDependency>org.glassfish.jaxb:jaxb-runtime:jar:${jaxb.impl.version}</ignoredUnusedDeclaredDependency>
                                 <ignoredUnusedDeclaredDependency>org.fusesource.jansi:jansi:jar:2.4.0</ignoredUnusedDeclaredDependency>
diff --git a/exist-parent/pom.xml b/exist-parent/pom.xml
index 9b1923908ff..77c3e99d987 100644
--- a/exist-parent/pom.xml
+++ b/exist-parent/pom.xml
@@ -119,6 +119,7 @@
         <milton.version>1.8.1.3</milton.version>
         <milton.servlet.version>1.8.1.3-jakarta5</milton.servlet.version>
         <saxon.version>9.9.1-8</saxon.version>
+        <xalan.version>2.7.3</xalan.version>
         <xmlresolver.version>4.6.4</xmlresolver.version>
         <xmlunit.version>2.9.1</xmlunit.version>
         <junit.version>4.13.2</junit.version>