Eclipse RDF4J

RDF4J 5.3.2 is now available. This is a patch release fixing 2 issues, including a security fix for XML parsing.

The security fix is a follow-up to CVE-2018-1000644. Several XML parser entry points were not covered by the earlier fix and could still allow XML External Entity (XXE) style processing in some configurations. RDF4J 5.3.2 hardens these paths so DOCTYPE declarations, external entities, and external DTD loading are rejected or disabled by default.

We recommend that users who parse untrusted XML-based RDF4J data or query results upgrade to this release.

For more details, have a look at the release notes.

Links

• Download RDF4J
• release notes.

Milestone number 2 of the upcoming 6.0.0 release of RDF4J is now available for download.

RDF4J 6.0.0 is a major release of the RDF4J framework. This second milestone continues the work from Milestone 1 with RDF 1.2 and SPARQL 1.2 support, new safeguards for long-running queries, query-planning improvements, FedX optimizations, and deployment updates.

Please note that RDF4J 6.0.0-M2 requires Java 25.

Some of the highlights covered in this second milestone:

• RDF 1.2 and SPARQL 1.2 support in parsers, writers, the model API, and query evaluation
• Query circuit breakers that protect server and workbench query execution under unsafe JVM memory pressure
• Configurable slow-query logging for Sail-backed repositories, focused on time to first result
• FedX grouped source selection, reducing remote source-selection requests for larger federations
• Query optimizer work including sketch-based join planning, cascade-style planners, LMDB cardinality-estimation improvements, and plan-comparison tooling
• Updated Docker images for Jetty 12 and Tomcat 11 on Java 25, plus Docker run documentation updates
• New vocabulary modules for EU, annotation, and bibliographic vocabularies, plus additional PROV-O inverse properties

This milestone build is not yet feature-complete, but we are putting it out to receive early feedback on all the improvements we have put in.

Milestone number 1 of the upcoming 6.0.0 release of RDF4J is now available for download.

RDF4J 6.0.0 is a major release of the RDF4J framework, focusing on dependency upgrades, LMDB improvements, and HTTP client improvements.

Please note that RDF4J 6.0.0-M1 requires Java 25.

Some of the highlights covered in this first milestone:

• Upgrade to Java 25 as the minimally-required version of Java
• Introduction of a pluggable HTTP client SPI with Apache HttpComponents 5 and JDK built-in backends
• Migration from Apache HttpComponents 4 to the new HTTP client facade

This milestone build is not yet feature-complete, but we are putting it out to receive early feedback on all the improvements we have put in.