deps(maven): bump org.apache.tika:tika-core from 3.3.2 to 4.1.0

[dependabot]

Bumps org.apache.tika:tika-core from 3.3.2 to 4.1.0.

Changelog

Sourced from org.apache.tika:tika-core's changelog.

Release 4.2.0 - unreleased

• XmlSecurityContractTest pins XMLReaderUtils' XXE and entity-expansion defenses forbidden-apis now rejects building JAXP or Commons Secure XML parsers anywhere but XMLReaderUtils (TIKA-4939).

• Retire Tika's entity expansion limit (default 20) in SAX, DOM and StAX parsing in favor of standard Java configuration methods (TIKA-4940).

• Report the external DTDs and entities a document's XML referenced, which Tika never resolves: tk:xml-external-reference (up to 20 system ids) and tk:xml-external-reference-count on that document's metadata, and tk:xml-external-reference-embedded on a container whose embedded document had any. Every resolver Tika installs answers with an empty stream, never null (TIKA-4941).

• Deprecate XMLReaderUtils.getXMLInputFactory() and use SAX for XFA (TIKA-4938).

Release 4.1.0 - 9/26/2026

HIGHLIGHTS

• OCR and enrichment engines are selected by name in a new "text-recognizers" list ("[]" turns enrichment off; no list resolves one engine per media type at startup); the image and PDF parsers invoke them rather than the composite dispatching to them. The image/ocr-* pseudo-types are retired; a third-party engine still advertising them is a legacy text recognizer with a WARN. VLM parsers gain "textRecognizer" (TIKA-4872, TIKA-4884).

• New "exception-reporting" parse-context config redacts and bounds exception text in metadata, tika-server error bodies and pipes/grpc messages; FileSystemEmitter writes atomically. Compat: tk:exception:* values may now begin with the TikaException wrapper line (TIKA-4848).

PERFORMANCE

• Detection (magic ~35% faster on unmatched input, override keys honored before magic, cached type->parser map), markdown output ~30x faster, .doc cleanup, CSV sniffing, zip legacy-method rewinds, pipes ACK overlap, raw UTF-8 content passback for tika-server (content-bytes-config). Compat: with a Content-Type override set, DefaultDetector no longer lets a more specific magic result overrule it (TIKA-4868).

• PDF incremental-update scanning reads in blocks; ~4x less CPU (TIKA-4898).

• Embedded documents in Office files, PDFs, PST and the zip-family containers are re-opened from their container on rewind instead of cached (TIKA-4878).

• Improve spooling/decrease number of spills to disk. The pipes cache

... (truncated)

Commits

• e8dd07a [maven-release-plugin] prepare release 4.1.0-rc3
• e53a7b4 TIKA-4836: update aws
• 4df21a6 prep for rc3
• e6bc8be TIKA-4933: build the .run-info test fixture at test time; the source release ...
• f0b7ad7 [maven-release-plugin] prepare for next development iteration
• 5a75213 [maven-release-plugin] prepare release 4.1.0-rc2
• bb1f6f2 update CHANGES.txt
• 5c1cda5 TIKA-4932: pipes no longer copies the caller's Content-Type hint back… (#3258)
• ebc845c TIKA-4931: fix overrides in PipesForkParser (#3257)
• 739a9c3 TIKA-4927: overwrite stale NER test models with the verified cache copy (#3256)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)