You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@jackrabbit.apache.org by kw...@apache.org on 2026/10/15 08:07:19 UTC
(jackrabbit-filevault) 01/01: JCRVLT-863 Bump minimum required JR2 version to 2.20.18
This is an automated email from the ASF dual-hosted git repository.
kwin pushed a commit to branch feature/bump-jr2-min-2.20.18
in repository https://gitbox.apache.org/repos/asf/jackrabbit-filevault.git
commit 55621f2b097ffc3578bd0e7341437a96d3b46a38
Author: Konrad Windszus <kw...@apache.org>
AuthorDate: Thu Oct 15 10:07:11 2026 +0200
JCRVLT-863 Bump minimum required JR2 version to 2.20.18
Update dependency-check-m-p to 13.0.0
Remove orphan suppressions
---
README.md | 2 +-
parent/pom.xml | 4 ++--
suppressions.xml | 42 ------------------------------------------
3 files changed, 3 insertions(+), 45 deletions(-)
diff --git a/README.md b/README.md
index 398a7333..d8452cfe 100644
--- a/README.md
+++ b/README.md
@@ -33,7 +33,7 @@ Java 11 or higher
Runtime Dependencies
--------------------
-- Jackrabbit 2.20.17+ (JCR Commons, SPI, SPI Commons)
+- Jackrabbit 2.20.18+ (JCR Commons, SPI, SPI Commons)
- Oak Jackrabbit API 1.22.4+
- Commons IO 2.18.0+
- Commons Collections 4.5.0+
diff --git a/parent/pom.xml b/parent/pom.xml
index e26a043b..dc2ae99d 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -93,7 +93,7 @@ Apache Jackrabbit FileVault is a project of the Apache Software Foundation.</des
<!-- CI-friendly version, https://maven.apache.org/maven-ci-friendly.html -->
<revision>4.3.0-SNAPSHOT</revision>
<!-- for dependencies used for calculating OSGi import-package version ranges the minimally supported version should be used to be backwards compatible in OSGi containers -->
- <jackrabbit.min.version>2.20.17</jackrabbit.min.version>
+ <jackrabbit.min.version>2.20.18</jackrabbit.min.version>
<!-- for embedded dependencies the newest version should be used (also used for testing) -->
<jackrabbit.max.version>2.22.5</jackrabbit.max.version>
<!-- for dependencies used for calculating OSGi import-package version ranges the minimally supported version should be used to be backwards compatible in OSGi containers -->
@@ -518,7 +518,7 @@ Bundle-Category: jackrabbit
<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
- <version>12.2.2</version>
+ <version>13.0.0</version>
<executions>
<execution>
<goals>
diff --git a/suppressions.xml b/suppressions.xml
index e84f9807..a2d4ce18 100644
--- a/suppressions.xml
+++ b/suppressions.xml
@@ -29,20 +29,6 @@
<packageUrl regex="true">^pkg:maven/org\.apache\.sling/org\.apache\.sling\.jcr\.api@.*$</packageUrl>
<cve>CVE-2015-2944</cve>
</suppress>
- <suppress>
- <notes><![CDATA[
- file name: h2-2.1.212.jar, only 1.4.197 is affected, see https://github.com/jeremylong/DependencyCheck/issues/4555
- ]]></notes>
- <packageUrl regex="true">^pkg:maven/com\.h2database/h2@.*$</packageUrl>
- <vulnerabilityName>CVE-2018-14335</vulnerabilityName>
- </suppress>
- <suppress>
- <notes><![CDATA[
- false positive for Oak classes e.g. for CVE-2021-40690
- ]]></notes>
- <packageUrl regex="true">^pkg:maven/org\.apache\.jackrabbit/oak-.*@.*$</packageUrl>
- <cpe>cpe:/a:apache:xml_security_for_java</cpe>
- </suppress>
<suppress>
<notes><![CDATA[
false positive: org.apache.sling.jcr.api-2.0.4.jar only Sling API and Sling Commons Logging affected
@@ -50,34 +36,6 @@
<packageUrl regex="true">^pkg:maven/org\.apache\.sling/org\.apache\.sling\.jcr\.api@.*$</packageUrl>
<cve>CVE-2022-32549</cve>
</suppress>
- <suppress>
- <notes><![CDATA[
- file name: h2-2.1.212.jar, usage in FileVault not affected, see https://github.com/h2database/h2database/issues/3686
- ]]></notes>
- <packageUrl regex="true">^pkg:maven/com\.h2database/h2@.*$</packageUrl>
- <cve>CVE-2022-45868</cve>
- </suppress>
- <suppress>
- <notes><![CDATA[
- file name: diffutils-1.2.1.jar, wrong match for pattern cpe:2.3:a:utils_project:utils:1.2.1:*:*:*:*:*:*:*
- ]]></notes>
- <packageUrl regex="true">^pkg:maven/com\.googlecode\.java\-diff\-utils/diffutils@.*$</packageUrl>
- <cve>CVE-2021-4277</cve>
- </suppress>
- <suppress>
- <notes><![CDATA[
- file name: org.apache.felix.utils-1.11.8.jar, wrong match for pattern cpe:2.3:a:utils_project:utils:1.2.1:*:*:*:*:*:*:*
- ]]></notes>
- <packageUrl regex="true">^pkg:maven/org\.apache\.felix/org\.apache\.felix\.utils@.*$</packageUrl>
- <cve>CVE-2021-4277</cve>
- </suppress>
- <suppress>
- <notes><![CDATA[
- file name: plexus-utils-3.3.0.jar, wrong match for pattern cpe:2.3:a:utils_project:utils:1.2.1:*:*:*:*:*:*:*
- ]]></notes>
- <packageUrl regex="true">^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$</packageUrl>
- <cve>CVE-2021-4277</cve>
- </suppress>
<suppress>
<notes><![CDATA[
file name: jackrabbit-jcr-commons-2.20.17.jar with JNDI usage, not used in FileVault