You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@jackrabbit.apache.org by kw...@apache.org on 2025/09/05 17:00:36 UTC
(jackrabbit-filevault) branch master updated: JCRVLT-818 Upgrade embedded vulnerable dependencies
This is an automated email from the ASF dual-hosted git repository.
kwin pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/jackrabbit-filevault.git
The following commit(s) were added to refs/heads/master by this push:
new 983bdec4 JCRVLT-818 Upgrade embedded vulnerable dependencies
983bdec4 is described below
commit 983bdec48b5772d6888d76c1b86899a90de735ef
Author: Konrad Windszus <kw...@apache.org>
AuthorDate: Tue Aug 19 19:30:50 2025 +0200
JCRVLT-818 Upgrade embedded vulnerable dependencies
Fail build when dependency-check finds dependencies with CVSS 4 or
higher. This is severity MEDIUM or above
(https://nvd.nist.gov/vuln-metrics/cvss)
---
parent/pom.xml | 3 ++-
vault-cli/pom.xml | 10 ++++++++--
vault-rcp/pom.xml | 5 ++++-
vault-sync/pom.xml | 5 ++++-
vault-validation/pom.xml | 2 ++
5 files changed, 20 insertions(+), 5 deletions(-)
diff --git a/parent/pom.xml b/parent/pom.xml
index 7707bbf4..c983f6d5 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -275,7 +275,8 @@ Bundle-Category: jackrabbit
<goal>check</goal>
</goals>
<configuration>
- <failBuildOnCVSS>11</failBuildOnCVSS>
+ <!-- fail for CVSS above LOW (https://nvd.nist.gov/vuln-metrics/cvss) -->
+ <failBuildOnCVSS>4</failBuildOnCVSS>
<!-- use the mirror provided by https://github.com/dependency-check/DependencyCheck_Builder which is updated daily -->
<!-- compare with https://jeremylong.github.io/DependencyCheck/data/mirrornvd.html -->
<nvdDatafeedUrl>https://dependency-check.github.io/DependencyCheck_Builder/nvd_cache/</nvdDatafeedUrl>
diff --git a/vault-cli/pom.xml b/vault-cli/pom.xml
index e6e9c23b..a154b79f 100644
--- a/vault-cli/pom.xml
+++ b/vault-cli/pom.xml
@@ -39,7 +39,7 @@
<properties>
<!-- embed the newest JR2 versions -->
- <jackrabbit.min.version>2.20.16</jackrabbit.min.version>
+ <jackrabbit.min.version>${jackrabbit.max.version}</jackrabbit.min.version>
</properties>
<!-- ====================================================================== -->
<!-- B U I L D D E F I N I T I O N -->
@@ -187,6 +187,12 @@
<artifactId>httpclient</artifactId>
<version>4.5.14</version>
</dependency>
+ <!-- minimum SLF4J API supported by non vulnerable logback 1.5-->
+ <dependency>
+ <groupId>org.slf4j</groupId>
+ <artifactId>slf4j-api</artifactId>
+ <version>2.0.17</version>
+ </dependency>
</dependencies>
</dependencyManagement>
@@ -262,7 +268,7 @@
<dependency>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-classic</artifactId>
- <version>1.2.10</version>
+ <version>1.5.18</version>
<scope>compile</scope>
</dependency>
</dependencies>
diff --git a/vault-rcp/pom.xml b/vault-rcp/pom.xml
index bbda8f64..e8d69da8 100644
--- a/vault-rcp/pom.xml
+++ b/vault-rcp/pom.xml
@@ -50,13 +50,16 @@
<artifactId>dependency-check-maven</artifactId>
<configuration>
<suppressionFile>${project.basedir}/../suppressions.xml</suppressionFile>
- <!-- only check embedded dependencies, therefore exclude all external dependencies with vulnerabilities (provided by the container) -->
+ <!-- only check embedded dependencies, therefore exclude all external dependencies (provided by the container) -->
<excludes>
<exclude>*:commons-io</exclude>
<exclude>*:httpclient</exclude>
<exclude>*:jackson-core</exclude>
<exclude>*:jackson-databind</exclude>
<exclude>*:org.apache.sling.api</exclude>
+ <exclude>org.apache.jackrabbit</exclude>
+ <exclude>org.apache.jackrabbit.vault</exclude>
+ <exclude>org.osgi</exclude>
</excludes>
</configuration>
</plugin>
diff --git a/vault-sync/pom.xml b/vault-sync/pom.xml
index 519e98cc..6a98dd4e 100644
--- a/vault-sync/pom.xml
+++ b/vault-sync/pom.xml
@@ -52,10 +52,13 @@
<artifactId>dependency-check-maven</artifactId>
<configuration>
<suppressionFile>${project.basedir}/../suppressions.xml</suppressionFile>
- <!-- only check embedded dependencies, therefore exclude all external dependencies with vulnerabilities (provided by the container) -->
+ <!-- only check embedded dependencies, therefore exclude all external dependencies (provided by the container) -->
<excludes>
<exclude>*:commons-io</exclude>
<exclude>*:guava</exclude>
+ <exclude>org.apache.jackrabbit</exclude>
+ <exclude>org.apache.jackrabbit.vault</exclude>
+ <exclude>org.osgi</exclude>
</excludes>
</configuration>
</plugin>
diff --git a/vault-validation/pom.xml b/vault-validation/pom.xml
index a2e7072f..fd1e3deb 100644
--- a/vault-validation/pom.xml
+++ b/vault-validation/pom.xml
@@ -62,6 +62,8 @@
<exclude>*:commons-io</exclude>
<exclude>*:httpclient</exclude>
<exclude>*:guava</exclude>
+ <exclude>org.apache.commons</exclude>
+ <exclude>org.apache.johnzon</exclude>
</excludes>
</configuration>
</plugin>