[elvogel]

Moves PhoenixmlDb.Xslt 2.7.0 -> 2.9.0 (with PhoenixmlDb.XQuery 2.9.0 and PhoenixmlDb.Core 2.2.0 -> 2.5.0).

Why now

GHSA-5697-c8qg-472f (high, published 2026-10-15) names every engine release up to and including 2.7.0 — the pin on main and the pin 0.2.5 shipped. It is patched in 2.8.0. Two of its items are reachable through --stylesheet, which compiles and runs a caller's stylesheet inside docmd's own process:

• A static expression could read our environment. A shadow attribute, a use-when or a static variable is evaluated while the stylesheet compiles, by a second evaluator that read the real process environment. At run time fn:environment-variable() has always answered nothing. No resource policy is needed to reach this.
• An import opened by name. Before compiling, the processor opened the file of each xsl:import / xsl:include directly — without the policy and without the host's resolver — even where a use-when excluded the instruction.

Measured here, not taken from the advisory. The same stylesheet, a shadow attribute reading one variable, run on both engines built in their own worktrees:

Engine	Result
2.7.0	[a-value-no-stylesheet-may-read][][] — the value is in the output
2.9.0	[][][]

What is in the branch

• Directory.Packages.props plus all three packages.lock.json files, regenerated with --force-evaluate.
• A canary in EnginePremiseTests: a stylesheet asks for the environment three ways — a shadow attribute, a runtime call, and the list of names — and must be answered nothing each time. It fails on 2.7.0, so it is not vacuous and the pin cannot slide back under 2.8.0 quietly.
• The changelog entry.

Verification

• Conversion is byte-identical. All 13 corpus documents, each arm from its own worktree with the loaded PhoenixmlDb.Xslt assembly checked against the package of that version first: diff -r over both output trees reports nothing — 52 files, 4,877,492 bytes each side.
• 384 tests: 383 pass, 1 skip (the opt-in corpus audit). Build is clean, 0 warnings.
• Schema-awareness is now the default in 2.9.0. The built-in stylesheet declares no validation and imports no schema, so the built-in path is untouched; a caller's stylesheet that relied on XTSE1660 to refuse type or validation now compiles instead. XsltTransformer.SchemaAware = false asks for a basic processor.
• No performance claim. 373 s vs 358 s for the whole corpus, one run each, inside this machine's same-binary drift. Not benchmarked further: engine timings are secondary to conformance.

Relation to the other open PRs

• fix: bound a caller's stylesheet in time and in what it may read #51 (--stylesheet time limit and resource policy) needs this. Its ResourcePolicy is read at run time, and on 2.7.0 the compile-time paths go around it: imports open by name, and static expressions see the environment. The policy is only enforceable on >= 2.8.0, so this pin is the floor that PR stands on.
• Supersedes deps: Bump the phoenixml-engine group with 1 update #52, Dependabot's 2.8.0 attempt. That build failed on NU1004, not on the engine: it moved src/Docmd.Word/packages.lock.json and left the CentralTransitive entries in the other two lock files at [2.7.0, ), which --locked-mode refuses.
• Does not touch the lines docs: withdraw the 2.7.0 performance regression, which was measurement drift #50 edits.

🤖 Generated with Claude Code

https://claude.ai/code/session_018wZEgtuzaZPswykiGEBxbz