[dependabot]

Bumps org.apache.tika:tika-core from 3.2.1 to 4.0.0.

Changelog

Sourced from org.apache.tika:tika-core's changelog.

Release 4.2.0 - 10/22/2026

BREAKING CHANGES AND DEPRECATIONS

• Unpack output is a Frictionless Data Package by default on tika-server /unpack, tika-app -z/-Z and pipes UNPACK; unpack-config.outputFormat=REGULAR (--unpack-format=REGULAR) restores the old layout (TIKA-4681). A document without attachments is still a package, so /unpack returns 200, not 204; unpack-config.emptyPackage=SKIP restores the 204 (TIKA-4971).

• The package's metadata.json is now rmeta.json and gets the metadata filters; a package sent to the container's emitter replaces its .json. REGULAR .metadata.json sidecars are the file's row from the metadata list. FrictionlessResource.name() is the resource name (the filename moved to resourceName()); FrictionlessResource.create and DataPackage.addResource are removed (TIKA-4971).

• Config is untrusted unless the operator says so. @​OperatorOnly properties (paths, executables, class names, URLs, credentials, operator-sized limits) are refused wherever a request builds a component; on a class, the request can't build it at all. Java code that sets one through a JsonConfig wraps it in JsonConfig.trusted(json), and JsonConfig constructors now need tika-serialization. Newly locked: pdf-parser imageGraphicsEngineFactoryClass and maxMainMemoryBytes, raw-tiff maxTotalPreviewBytes, VLM completionsPath. The RuntimeConfig subclasses are removed (TIKA-4965, TIKA-4974).

• Per-request limits and timeouts may tighten the operator's but not loosen them. pipes.trustedRequests=true marks requests as the operator's own: no clamp, and they may set @​OperatorOnly properties. PipesForkParser sets it; tika-server and tika-grpc refuse to start with it (TIKA-4978, TIKA-4985).

• A duplicate key in configuration JSON is an error, not last-wins. A request's http-fetcher config may set only httpRequestHeaders, and a file-system emitter's runtime config naming basePath fails as an unknown key. forbidden-apis bans JsonConfig.json() outside ConfigDeserializer and PluginJson, and projects that inherit tika-parent inherit the ban (point json.forbiddenapis.signaturesFile at an empty file to opt out). ExtensionConfig no longer implements JsonConfig (TIKA-4975).

• Dates: Metadata.getDate() reads zone-less values as UTC, not the JVM's zone. Archive-entry and mail-attachment file times move from dcterms:* to fs:created/fs:modified. DateNormalizingMetadataFilter honors offsets, normalizes every value and completes partial dates (2019 -> 2019-01-01T12:00:00Z). MailDateParser is replaced by TikaDates; MailUtil moved to tika-parser-mail-module, leaving tika-parser-mail-commons a deprecated shim (TIKA-4917).

• An OCR engine (tesseract-ocr-parser, tess4j-parser) under "parsers", deprecated in 4.1.0, fails config load: configure it under "engines" and name it in "text-recognizers". A VLM parser may stay under "parsers" as a document parser (ContentEnricher.parsesDocuments()). openai-embedding-filter, jina-embedding-filter and openai-image-embedding-parser, deprecated in 4.1.0, are removed; use an engine

... (truncated)

Commits

• 514e1b3 [maven-release-plugin] prepare release 4.0.0-rc1
• 4e39e07 revert second rc1 attempt
• 7975986 javadocs take 42
• 95d4235 [maven-release-plugin] prepare for next development iteration
• 666289b [maven-release-plugin] prepare release 4.0.0-rc1
• c9f6585 TIKA-4808 - revert aborted 4.0.0-rc1 release commits; fix per-module javadoc ...
• 41183e7 [maven-release-plugin] prepare for next development iteration
• 5dd7fc7 [maven-release-plugin] prepare release 4.0.0-rc1
• 4b231cf TIKA-4808 -- prep CHANGES.txt for release
• 532a685 TIKA-4808 - remove access to the network parser from cli (#3036)
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
org.apache.tika:tika-core	[>= 4.1.a, < 4.2]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

This change is