[TIKA-4135] Remove xerces from Tika 3.x/main branch?

• Type: Wish
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.0.0-BETA
• Assignee: Unassigned
• Reporter: Tim Allison
• Created: 19/Sep/23 14:47
• Updated: 03/Oct/23 19:50
• Resolved: 03/Oct/23 19:50

Description

We've gotten requests over the years to get rid of xerces. Should we do that in 3.x/main?

The one nice thing about including it is that it offers some consistency across java versions and platforms. This can help with securing the parsers (against xxe, etc). This can also make debugging easier.

However, as people have pointed out, the xerces project appears to be in security-fix-only mode.

WDYT?

Issue Links

• links to: GitHub Pull Request #1360