chore(deps): bump org.eclipse.rdf4j:rdf4j-bom from 5.3.1 to 6.0.1

[dependabot]

Bumps org.eclipse.rdf4j:rdf4j-bom from 5.3.1 to 6.0.1.

Release notes

Sourced from org.eclipse.rdf4j:rdf4j-bom's releases.

RDF4J 6.0.0 released

RDF4J 6.0.0

We are excited to announce the release of RDF4J 6.0.0!

RDF4J 6.0.0 is a major release of the Eclipse RDF4J framework. It brings broad RDF 1.2 and SPARQL 1.2 support, moves the project to Java 25 and Jakarta, and delivers substantial improvements across HTTP, storage, federation, query execution, security, and deployment.

Highlights include:

• RDF 1.2 triple terms, literals with base direction, version announcements, and updated parsers, writers, protocols, and stores
• SPARQL 1.2 grammar and evaluation
• Support for LATERAL joins in SPARQL
• A Java 25 baseline and upgrades to Jakarta Servlet, Spring 7, Jetty 12, Tomcat 11, Lucene 10, Elasticsearch 9, and Jackson 3
• A client-neutral HTTP API with Apache HttpComponents 5 and JDK backends, plus gzip, deflate, Brotli, and Zstandard compression
• LMDB value-ID, data loading, reader-recovery, and cardinality-estimation improvements, together with grouped FedX source selection
• Query circuit breakers, slow-query logging and hardened XML processing

Before upgrading

RDF4J 6.0.0 requires Java 25 and contains backward-incompatible changes. Applications that embed RDF4J Server or Workbench must move from javax.servlet to Jakarta Servlet APIs. Code that supplies a custom Apache HttpClient 4 instance must migrate to the new client-neutral HTTP API and authentication interfaces.

See the release notes for the full list of changes and detailed upgrade guidance.

Links Download RDF4J Release notes All 46 completed issues

RDF4J 5.3.2 is now available. This is a patch release fixing 2 issues, including a security fix for XML parsing.

The security fix is a follow-up to CVE-2018-1000644. Several XML parser entry points were not covered by the earlier fix and could still allow XML External Entity (XXE) style processing in some configurations. RDF4J 5.3.2 hardens these paths so DOCTYPE declarations, external entities, and external DTD loading are rejected or disabled by default.

We recommend that users who parse untrusted XML-based RDF4J data or query results upgrade to this release.

For more details, have a look at the release notes.

Commits

• c8faa0b release 6.0.1
• 4354c1c GH-5963 allow overwriting of writeNodeStartOfStartTag (#5964)
• ae7274a GH-5972 Renamed graphDB company name to Graphwise (#5973)
• 1b89656 Bump org.apache.logging.log4j:log4j-api from 2.25.4 to 2.25.5 (#5976)
• 973e31b Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.2 to 5.6.3 (#5975)
• 819d5a5 GH-5979: Fix TLS system-property fallback in Apache 5 HTTP client (#5980)
• da639aa GH-5979: Fix TLS system-property fallback in Apache 5 HTTP client
• b5d6e94 Bump org.apache.logging.log4j:log4j-api from 2.25.4 to 2.25.5
• 66d8bfd Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.2 to 5.6.3
• 1c2a84c GH-5972 Renamed graphDB company name to Graphwise
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[kburger]

⛔ Snyk checks have failed. 4 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (4)
✅	Open Source Security	0	0	0	0	0 issues
⛔	Licenses	0	0	4	0	4 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.