chore(deps-dev): bump com.helger.maven:ph-schematron-maven-plugin from 10.0.0 to 10.0.1

[dependabot]

Bumps com.helger.maven:ph-schematron-maven-plugin from 10.0.0 to 10.0.1.

Release notes

Sourced from com.helger.maven:ph-schematron-maven-plugin's releases.

v10.0.1

• XInclude processing is now disabled by default in all XSLT-based engines (ph-schematron-isosch, ph-schematron-xslt, ph-schematron-schxslt, ph-schematron-schxslt2). It was unconditionally enabled since #86 and allowed a Schematron file to pull in arbitrary local and remote resources. The new switch SchematronTransformerFactory.setAllowXInclude (boolean) (default false, see SchematronTransformerFactory.DEFAULT_ALLOW_XINCLUDE) re-enables it. Because the created TransformerFactory objects and the XSLT templates derived from them are cached internally, the switch must be set before the first Schematron file is processed.
• Updated to SchXslt2 1.11.2 (from 1.11.1) - affects ph-schematron-schxslt2 only. The upstream release (2026-07-20) fixes the placement of some attributes in the SVRL report and adds a RELAX NG grammar for the generated SVRL:
  • xml:* attributes are no longer copied wholesale into the report. svrl:text now only receives @xml:lang and @xml:space (in addition to @see, @icon and @fpi), and svrl:dir, svrl:emph and svrl:span no longer copy any xml:* attribute at all. Code that evaluated e.g. xml:base or xml:id on these SVRL elements no longer finds them.
  • The schxslt2 JAR now also contains the RELAX NG compact grammars content/svrl.rnc and content/svrl-schxslt.rnc. According to their headers they aim to be equivalent to the official SVRL grammar published in the 2025 edition of ISO Schematron, section D3.
• Remote resource resolution in XSLT processing is denied by default. This is not a change of this release but a consequence of the ph-commons version in use (since ph-commons 12.3.2, so it is effective since ph-schematron v10.0.0) that was so far undocumented: the shared Saxon TransformerFactory of SchematronTransformerFactory.getDefault () uses ph-commons' DefaultTransformURIResolver, which resolves no remote URL scheme at all, to prevent Server Side Request Forgery (SSRF) via XSLT document(), xsl:import or xsl:include. Class path and file based resolution is unaffected, so setups where all XSLT documents reside locally keep working unchanged. A blocked resolution is logged as a warning and returns null, so Saxon applies its own (restricted) default resolution. To allow specific remote schemes again, pass an own resolver to SchematronTransformerFactory.createTransformerFactory (ErrorListener, URIResolver), e.g. new DefaultTransformURIResolver ().setAllowedRemoteSchemes ("http", "https").

Full Changelog: phax/ph-schematron@ph-schematron-parent-pom-10.0.0...ph-schematron-parent-pom-10.0.1

Commits

• 87c0566 [maven-release-plugin] [skip ci] prepare release ph-schematron-parent-pom-10.0.1
• 9a2c72b Applying secure setup by default
• 3f32a8b Make XInclude customizable; #197
• d2585ea Version bump
• d1a8c88 Version bump
• 8d9e3b4 Added comment in generated files
• 557c046 Renamed internal method
• 7f9adeb Added license template
• 7eafc5c Version bump
• 3000753 Renamed file
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
com.helger.maven:ph-schematron-maven-plugin	[>= 8.a, < 9]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)