Update dependency org.apache.tika:tika-core to v3 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.apache.tika:tika-core (source)	1.28.5 → 3.2.2

---

Apache Tika has XXE vulnerability

CVE-2025-66516 / GHSA-f58c-gq56-vjjf

More information

Details

Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF.

This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways.

First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable.

Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.

Severity

• CVSS Score: 10.0 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-66516
• https://cve.org/CVERecord?id=CVE-2025-54988
• https://lists.apache.org/thread/s5x3k93nhbkqzztp1olxotoyjpdlps9k
• https://github.com/advisories/GHSA-f58c-gq56-vjjf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

apache/tika (org.apache.tika:tika-core)

v3.2.2

Compare Source

v3.2.1

Compare Source

v3.2.0

Compare Source

v3.1.0

Compare Source

v3.0.0

Compare Source

v2.9.4

Compare Source

v2.9.3

Compare Source

v2.9.2

Compare Source

v2.9.1

Compare Source

v2.9.0

Compare Source

v2.8.0

Compare Source

v2.7.0

Compare Source

v2.6.0

Compare Source

v2.5.0

Compare Source

v2.4.1

Compare Source

v2.4.0

Compare Source

v2.3.0

Compare Source

v2.2.1

Compare Source

v2.2.0

Compare Source

v2.1.0

Compare Source

v2.0.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[timja]

@copilot can you fix the build here?

[Copilot]

@copilot can you fix the build here?

Pushed a fix in f9dc73d that keeps tika-core at 3.2.2 and adds an explicit commons-io:2.20.0 dependency to align Tika 3.x requirements and unblock the build.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.