[dependabot]

Bumps org.xmlunit:xmlunit-core from 2.12.0 to 2.14.0.

Release notes

Sourced from org.xmlunit:xmlunit-core's releases.

XMLUnit for Java 2.14.0

With this release the dependency of xmlunit-core on the JAXB API has been marked optional. If you need the JAXB parts of XMLUnit you now must explicitly add a dependency on the API version matching your implementation. There is no other change compared to version 2.13.0.

XMLUnit for Java 2.13.0

This release adds new options allowing people to strengthen the security of the XML parser used during validation or XPath evaluation and adds an option to specify the locale used to parse patterns in the isDateTime placeholder.

Full list of changes:

• added explicit settings to the Validator classes that disable (external) DTD loading during validation. The default remains to allow loading of external content as this is often a requirement during validation.

  PRs #331 and #332 by @​jmestwa-coder

• added constructor overloads to JAXPXPathEngine to allow specifying the DocumentBuilderFactory used for the Source overloads of the selectNodes and evaluate methods.

  PRs #333 by @​jmestwa-coder

• IsDateTimePlaceholderHandler now parses the explicit and ISO date formats using Locale.US rather than the JVM default locale so results no longer depend on the host locale. An optional second argument allows specifying a different locale as a BCP 47 language tag.

  PR #335 by @​jmestwa-coder

Changelog

Sourced from org.xmlunit:xmlunit-core's changelog.

XMLUnit for Java 2.14.0 - /Released 2026-09-18/

• marked jakarta.xml.bind-api as optional in xmlunit-core. PR #340 by @​arimu1

XMLUnit for Java 2.13.0 - /Released 2026-07-31/

• added explicit settings to the Validator classes that disable (external) DTD loading during validation. The default remains to allow loading of external content as this is often a requirement during validation.

  PRs #331 and #332 by @​jmestwa-coder

• added constructor overloads to JAXPXPathEngine to allow specifying the DocumentBuilderFactory used for the Source overloads of the selectNodes and evaluate methods.

  PRs #333 by @​jmestwa-coder

• IsDateTimePlaceholderHandler now parses the explicit and ISO date formats using Locale.US rather than the JVM default locale so results no longer depend on the host locale. An optional second argument allows specifying a different locale as a BCP 47 language tag.

  PR #335 by @​jmestwa-coder

Commits

• c74255f prepare release 2.14.0
• a5dcffe Merge pull request #342 from xmlunit/add-new-key
• 2b3d856 record #340
• 900097f add new key
• dfa47c9 Merge pull request #340 from arimu1/fix/339-optional-jakarta-bind-api
• 00e4ba3 Mark jakarta.xml.bind-api optional in xmlunit-core (#339)
• 963cfe6 Merge pull request #338 from xmlunit/bump-cyclonedx-plugin
• 79c9fed bump cyclonedx plugin
• ed72f1f Merge pull request #337 from xmlunit/release-1.13.0
• 5894610 prepare next iteration
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 034d2b1c-7819-4627-b621-089fd7a99d16

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}