v4.6.0 - Security fixes, enhanced-graph Semgrex queries, SemgrexStats, SUTime bugfixes, and dependency upgrades

[AngledLuffa]

CoreNLP release notes

Security fixes, enhanced-graph Semgrex queries, SemgrexStats, SUTime bugfixes, and dependency upgrades

Security

• Deserializing Tree in the LexicalizedParserClient now uses a strict ObjectInputFilter, which will hopefully prevent gadget attacks. (GHSA-8wc5-xrgq-6mgh, b48a3fd)
• Deserializing Annotation now uses an ObjectInputFilter so wide even yo mama could fit through it. (GHSA-376p-57mg-3fc4, 8d5d8b3)
  A future release will remove GenericAnnotationSerializer entirely. If you have serialized annotations, please make sure they use the Protobuf format instead of Java's default serialization.
• A presumably unused SQL interface class, previously part of the patterns package, would have allowed malformed or hostile SQL queries. This class has been removed. (GHSA-x37j-fc4v-fcr9, b80f356)

Breaking and behavior changes

• Interface change: the CoNLL-U reading code has been refactored so that CoNLLUReader is the only publicly available reader. Code that used the other reader classes directly will need to switch to CoNLLUReader. (#1507)
• Semgrex behavior change: optional nodes now accept all possible matches, not just the first one found. Queries with optional nodes may return more matches than in previous releases. (28fadc1)

Semgrex and Ssurgeon

New features

• Enhanced graph queries: Semgrex can now search over the enhanced dependency graph by adding @enhanced to the relation name. This requires input data that includes enhanced graphs. (#1506)
• SemgrexStats: a new tool which outputs a table of statistics for a given Semgrex query (6e6e182, 1cad621)
• New ::sort and ::rsort operations, similar to ::uniq (70f3834, 80d35c9, 2747d8f)
• uniq now works over regex matches (1edb99a) and edge names (4bfb0de)
• Support for optional attributes using the ?: syntax (af4b568)
• VariableStrings are now returned via the protobuf protocol (f1b362f)
• Ssurgeon MergeNodes now handles multiple nodes pointing to one node (4f915f1)

Fixes

• Fixed the Connected relation (adb8b7a)

SUTime

• Fixed the ''h rule (#1513)
• Fixed one character hour markers (0e95333)
• Fixed handling of milliseconds from joda-time (7106a60)
• Fixed subconfigs not properly recursing (de21e7c)

Other fixes

• Tregex GUI fixed! (5ef39a5)
• Resources are now loaded with Thread.currentThread().getContextClassLoader() instead of the system class loader, which helps in environments with custom classloaders (09b8ecd). Thank you @ClemDoum!
• Rewrote an inefficient regular expression for Chinese numbers in Embedding and DVModel which was prone to excessive backtracking (2fccad2)

Dependency upgrades

• joda-time upgraded to a more recent version (c414b5e). A future release is planned to move to threeten-extra.
• jollyday updated to 0.5.10 (#1511). A future release is planned to move to the more recent focus_shift jollyday releases.
• xom upgraded to 1.4.1 (c3dcf38)
• commons-lang3 updated to 3.20 (3c2c6a2, 6d24cf8)

---

This discussion was created from the release v4.6.0 - Security fixes, enhanced-graph Semgrex queries, SemgrexStats, SUTime bugfixes, and dependency upgrades.