You are viewing a plain text version of this content. The canonical link for it is here.

Posted to notifications@commons.apache.org by GitBox <gi...@apache.org> on 2026/06/27 09:31:51 UTC

[GH] (commons-collections/security/complete-collections-580-fix): Workflow run "Java CI" failed!

The GitHub Actions job "Java CI" on commons-collections.git/security/complete-collections-580-fix has failed.
Run started by GitHub user lucianjohnhouse (triggered by garydgregory).

Head commit for run:
64735916853a5d71fbb909cd387f41e14c971935 / Henry Brand <lo...@Henry-Leone-Pro.local>
[SECURITY] Complete COLLECTIONS-580: remove Serializable from bridge functors

ClosureTransformer, TransformerClosure, and FactoryTransformer bridge
between Closure, Transformer, and Factory type hierarchies. Despite
COLLECTIONS-580 removing Serializable from InvokerTransformer, these
bridge classes remained Serializable, allowing deserialization gadget
chains to survive via ClosureTransformer↔TransformerClosure round-trips.

This patch removes Serializable and serialVersionUID from all three
bridge classes to close the remaining attack surface.

Co-Authored-By: Claude Opus 4.6 <no...@anthropic.com>

Report URL: https://github.com/apache/commons-collections/actions/runs/28282506460

With regards,
GitHub Actions via GitBox