HeroDevs
Visit NES for XMLUnit Home Page

NES for XMLUnit 2.9.x Release Notes

2 versions

Comprehensive release notes and changelog for NES for XMLUnit 2.9.x, including security patches, bug fixes, and feature updates across all supported versions.

Nov 9, 2026
Latest: 2.9.3
1 Patched Vulnerability
VEX Statements

November 2026

2.9.3

Released Nov 9, 2026
CVE-2024-31573
Full Version: 
2.9.1-xmlunit-2.9.3

Security Fixes

  • TransformerFactoryConfigurer.Default and TransformerFactoryConfigurer.NoExternalAccess now ask the TransformerFactory to disable XSLT extension functions (jdk.xml.enableExtensionFunctions=false), as in XMLUnit 2.10.0 (CVE-2024-31573). The JDK's built-in XSLT processor and Apache Xalan ignore that setting, so on them extension functions still run with these configurers. To block extension functions there, use the new TransformerFactoryConfigurer.SecureProcessing (or Builder.withSecureProcessingEnabled()) and pass the configured TransformerFactory to XMLUnit. The new NoDtdButExtensionFunctions and NoExternalAccessButExtensionFunctions configurers keep extension functions available for trusted stylesheets.

October 2026

2.9.2

Released Oct 25, 2026
Full Version: 
2.9.1-xmlunit-2.9.2

Notes

  • This release originates from the open-source XMLUnit for Java 2.9.1 project forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds.

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.