reporter: Replace the Xalan TransformerFactory with Saxon

The latest Apache Xalan 2.7.2 is 8 years old and does not support the
`accessExternalDTD` attribute that Apache POI requires, so switch to
the actively maintained Saxon TransformerFactory instead. Fixes #4830.

Signed-off-by: Sebastian Schuberth <[email protected]>

gradle.properties

@@ -70,6 +70,7 @@ postgresEmbeddedVersion = 1.0.0
 reflectionsVersion = 0.10.2
 retrofitVersion = 2.9.0
 retrofitKotlinxSerializationConverterVersion = 0.8.0
+saxonHeVersion = 11.1.1
 scanossVersion = 1.1.5
 semverVersion = 3.1.0
 simpleExcelVersion = 1.1
@@ -78,7 +79,6 @@ svnkitVersion = 1.10.4
 sw360ClientVersion = 13.2.0-28
 toml4jVersion = 0.7.2
 wiremockVersion = 2.32.0
-xalanVersion = 2.7.2
 xzVersion = 1.9
 
 org.gradle.caching = true

reporter/build.gradle.kts

@@ -32,8 +32,8 @@ val kotlinxCoroutinesVersion: String by project
 val kotlinxHtmlVersion: String by project
 val mockkVersion: String by project
 val retrofitVersion: String by project
+val saxonHeVersion: String by project
 val simpleExcelVersion: String by project
-val xalanVersion: String by project
 
 plugins {
     // Apply core plugins.
@@ -91,7 +91,7 @@ dependencies {
 
     // This is required to not depend on the version of Apache Xalan bundled with the JDK. Otherwise the formatting of
     // the HTML generated in StaticHtmlReporter is slightly different with different Java versions.
-    implementation("xalan:xalan:$xalanVersion")
+    implementation("net.sf.saxon:Saxon-HE:$saxonHeVersion")
 
     testImplementation("io.mockk:mockk:$mockkVersion")
 }