[dependabot]

Bumps org.eclipse.rdf4j:rdf4j-bom from 5.3.1 to 6.1.0.

Release notes

Sourced from org.eclipse.rdf4j:rdf4j-bom's releases.

RDF4J 6.0.0 released

RDF4J 6.0.0

We are excited to announce the release of RDF4J 6.0.0!

RDF4J 6.0.0 is a major release of the Eclipse RDF4J framework. It brings broad RDF 1.2 and SPARQL 1.2 support, moves the project to Java 25 and Jakarta, and delivers substantial improvements across HTTP, storage, federation, query execution, security, and deployment.

Highlights include:

• RDF 1.2 triple terms, literals with base direction, version announcements, and updated parsers, writers, protocols, and stores
• SPARQL 1.2 grammar and evaluation
• Support for LATERAL joins in SPARQL
• A Java 25 baseline and upgrades to Jakarta Servlet, Spring 7, Jetty 12, Tomcat 11, Lucene 10, Elasticsearch 9, and Jackson 3
• A client-neutral HTTP API with Apache HttpComponents 5 and JDK backends, plus gzip, deflate, Brotli, and Zstandard compression
• LMDB value-ID, data loading, reader-recovery, and cardinality-estimation improvements, together with grouped FedX source selection
• Query circuit breakers, slow-query logging and hardened XML processing

Before upgrading

RDF4J 6.0.0 requires Java 25 and contains backward-incompatible changes. Applications that embed RDF4J Server or Workbench must move from javax.servlet to Jakarta Servlet APIs. Code that supplies a custom Apache HttpClient 4 instance must migrate to the new client-neutral HTTP API and authentication interfaces.

See the release notes for the full list of changes and detailed upgrade guidance.

Links Download RDF4J Release notes All 46 completed issues

RDF4J 5.3.2 is now available. This is a patch release fixing 2 issues, including a security fix for XML parsing.

The security fix is a follow-up to CVE-2018-1000644. Several XML parser entry points were not covered by the earlier fix and could still allow XML External Entity (XXE) style processing in some configurations. RDF4J 5.3.2 hardens these paths so DOCTYPE declarations, external entities, and external DTD loading are rejected or disabled by default.

We recommend that users who parse untrusted XML-based RDF4J data or query results upgrade to this release.

For more details, have a look at the release notes.

Commits

• 46a2d41 release 6.1.0
• d181741 bump rdf4j version in pom (#6030)
• 93c5a90 bump version
• b7f20c8 GH-6020 Hotfix iteration class initialization deadlock for 6.0.2 (#6021)
• edead06 GH-6020 Prevent iteration class initialization deadlock
• a72aa5f GH-5970 Synchronize list to avoid race conditions.
• 654c376 GH-5977 fix resolveURI logic for relative IRIs (#5982)
• 7a7d41c GH-5970 Consider triple terms when calculating nextId and require capacity >= 2.
• eec82de GH-5970 Reserve a reader slot for nested cardinality estimates
• 7ab74b2 GH-5970 Close triple-term reader on all constructor failures
• Additional commits viewable in compare view

[kburger]

⛔ Snyk checks have failed. 13 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (13)
⛔	Open Source Security	1	4	4	0	9 issues
⛔	Licenses	0	0	4	0	4 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[qplevier]

@dependabot rebase

[qplevier]

@dependabot recreate