chore(core-deps): update rdf4j.version to v6

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.eclipse.rdf4j:rdf4j-rio-jsonld (source)	5.3.1 → 6.0.1
org.eclipse.rdf4j:rdf4j-rio-nquads (source)	5.3.1 → 6.0.1
org.eclipse.rdf4j:rdf4j-rio-trix (source)	5.3.1 → 6.0.1

---

Release Notes

eclipse/rdf4j (org.eclipse.rdf4j:rdf4j-rio-jsonld)

v6.0.1

Compare Source

v6.0.0: RDF4J 6.0.0 released

Compare Source

RDF4J 6.0.0

We are excited to announce the release of RDF4J 6.0.0!

RDF4J 6.0.0 is a major release of the Eclipse RDF4J framework. It brings broad RDF 1.2 and
SPARQL 1.2 support, moves the project to Java 25 and Jakarta, and delivers substantial
improvements across HTTP, storage, federation, query execution, security, and deployment.

Highlights include:

• RDF 1.2 triple terms, literals with base direction, version announcements, and updated
  parsers, writers, protocols, and stores
• SPARQL 1.2 grammar and evaluation
• Support for LATERAL joins in SPARQL
• A Java 25 baseline and upgrades to Jakarta Servlet, Spring 7, Jetty 12, Tomcat 11,
  Lucene 10, Elasticsearch 9, and Jackson 3
• A client-neutral HTTP API with Apache HttpComponents 5 and JDK backends, plus gzip,
  deflate, Brotli, and Zstandard compression
• LMDB value-ID, data loading, reader-recovery, and cardinality-estimation improvements, together
  with grouped FedX source selection
• Query circuit breakers, slow-query logging and hardened XML processing

Before upgrading

RDF4J 6.0.0 requires Java 25 and contains backward-incompatible changes. Applications that
embed RDF4J Server or Workbench must move from javax.servlet to Jakarta Servlet APIs. Code
that supplies a custom Apache HttpClient 4 instance must migrate to the new client-neutral
HTTP API and authentication interfaces.

See the release notes for the full list of changes and detailed upgrade guidance.

Links
Download RDF4J
Release notes
All 46 completed issues

v5.3.2: RDF4J 5.3.2

Compare Source

RDF4J 5.3.2 is now available. This is a patch release fixing 2 issues, including a security fix for XML parsing.

The security fix is a follow-up to CVE-2018-1000644. Several XML parser entry points were not covered by the earlier fix and could still allow XML External Entity (XXE) style processing in some configurations. RDF4J 5.3.2 hardens these paths so DOCTYPE declarations, external entities, and external DTD loading are rejected or disabled by default.

We recommend that users who parse untrusted XML-based RDF4J data or query results upgrade to this release.

For more details, have a look at the release notes.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.