fix(deps): bump the maven smoke fixture's commons-io past GHSA-78wr-2p64-hpwj - #1457
fix(deps): bump the maven smoke fixture's commons-io past GHSA-78wr-2p64-hpwj#1457John-David Dalton (jdalton) wants to merge 1 commit into
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
…p64-hpwj The maven-compat fixture pinned commons-io 2.11.0, which is in the vulnerable range for the XmlStreamReader denial-of-service advisory (>= 2.0, < 2.14.0). Bumped to 2.22.0. The smoke test repeated that version in four places, so a pom-only bump would have left its assertions hunting for a jar the build no longer produces. The assertions now match on groupId:artifactId and ignore the version, and the scoped-materialization run derives its GAV from the records the first run emitted. No version is written in the test at all; the poms are the only place one appears.
71cadc3 to
df960be
Compare
|
Closing — this change is already on the target branch. The fixture now pins The follow-up that replaces those external artifacts with generated stubs is still open and has been rebased so it no longer depends on this branch. |
1 participant
This clears the one open Dependabot alert on the repo. The Maven smoke-test fixture pinned
commons-io2.11.0, which falls in the vulnerable range for GHSA-78wr-2p64-hpwj (a denial-of-service on untrusted input toXmlStreamReader, affecting>= 2.0, < 2.14.0). It is now 2.22.0, the current release.This is test-fixture code, not anything we ship, so there is no runtime exposure — but the alert is real and stays open until the pinned version moves.
While bumping it I noticed the version was written in five places: once in
app/pom.xmland four times insidesmoke-test.sh(the assertion in each of its two Python blocks, and the GAV scope file it writes). A future bump had four chances to go half-done and leave the assertions looking for a version the build no longer produces. The script now reads it from a singleCOMMONS_IO_VERSIONvariable and passes it into both Python blocks as an argument, so a bump is one edit in the pom and one in the script.Validation
bash -n smoke-test.sh— clean.mvn --batch-mode -Dmaven.repo.local=$(mktemp -d) compilein.../maven-compat/projectexits 0, andcommons-io-2.22.0.jarresolves from Central.records.tsvinput: they pass on well-formed records, and still fail correctly when commons-io is absent and when a test dependency wrongly lands in a prod root.smoke-test.shcould not be run here because the Coana extension jar is "built elsewhere". That was wrong —scripts/maven-extension/build-jar.shbuilds it from this repo. The follow-up PR stacked on this branch runs the full smoke test end to end against that jar, and both phases pass.One thing worth knowing if you go looking: after a build, the local repository still contains
commons-io2.11.0. That is not this fixture.maven-resources-pluginandmaven-site-plugindeclare 2.11.0 among their own dependencies, so Maven fetches it to run the build itself. Dependabot alerts on the manifest's declared dependency, which is what this PR changes.Note
Low Risk
Test fixture dependency and script assertions only; no production code or security-sensitive runtime paths.
Overview
Bumps the Maven compatibility smoke fixture’s
commons-iodependency from 2.11.0 to 2.22.0, clearing the Dependabot alert for GHSA-78wr-2p64-hpwj. This is test-only fixture code, not shipped runtime.The smoke script previously hard-coded that version in several places (Python checks and the
populateFilesForGAV file). It now uses a singleCOMMONS_IO_VERSIONvariable (must stay aligned withapp/pom.xml) and passes it into both Python assertion blocks so future bumps need only two edits.Reviewed by Cursor Bugbot for commit 71cadc3. Configure here.
Relationship to the other PRs
Supersedes #1449 (Dependabot's
2.11.0 → 2.14.0). That PR edits only the pom, which would leavesmoke-test.sh's four hardcoded copies of the old version asserting against a jar the build no longer produces. This PR goes to the current release instead of the minimum patched version, and removes the duplication that made the trap possible.Paired with #1458, which ports the same fix to
v1.x. That branch has its own copy of the fixture with the identical pin. Dependabot only scans the default branch, so thev1.xcopy never appeared in the security tab despite the branch being actively developed.