MLE-26437 Bumping dependencies to eliminate CVEs#255
Merged
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR updates dependencies to eliminate CVEs by upgrading to Spring 6.2.11 (from Spring 5), Gradle 8.14.3, and NiFi 2.5.0 (from 2.3.0). The changes focus on security improvements through dependency version bumps.
- Updated core dependencies (Spring Framework, NiFi, Gradle) to address security vulnerabilities
- Added Spring BOM for consistent dependency management
- Updated documentation to reflect new NiFi version requirements
Reviewed Changes
Copilot reviewed 10 out of 11 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| pom.xml | Added Spring 6.2.11 BOM and updated NiFi to 2.5.0 with MarkLogic client API to 7.2.0 |
| test-app/gradle/wrapper/gradle-wrapper.properties | Updated Gradle wrapper from 8.13 to 8.14.3 |
| test-app/gradlew | Modified Gradle wrapper script to use -jar flag instead of classpath |
| test-app/gradlew.bat | Updated Windows Gradle wrapper script to use -jar flag |
| test-app/build.gradle | Bumped MarkLogic Data Hub plugin from 6.2.0 to 6.2.1 |
| nifi-marklogic-services-api/pom.xml | Updated ml-javaclient-util from 5.0.0 to 6.0.1 |
| nifi-marklogic-processors/pom.xml | Updated multiple dependencies and added Spring test dependencies with exclusions |
| nifi-marklogic-processors/flows-for-manual-testing.json | Updated NiFi version references from 2.3.0 to 2.5.0 |
| docs/index.md | Updated documentation to reflect NiFi 2.5.0 testing requirement |
| README.md | Updated README to mention NiFi 2.5.0 development and testing |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
| @@ -114,7 +114,7 @@ case "$( uname )" in #( | |||
| NONSTOP* ) nonstop=true ;; | |||
| esac | |||
|
|
|||
| CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar | |||
| CLASSPATH="\\\"\\\"" | |||
There was a problem hiding this comment.
The CLASSPATH is set to an escaped empty string \"\"\"\" which appears incorrect. This should likely be an empty string or properly escaped quotes if intentional.
Suggested change
| CLASSPATH="\\\"\\\"" | |
| CLASSPATH="" |
rjrudin
force-pushed
the
feature/black-duck
branch
from
0f11d59 to
5f8dd0b
Compare
|
Copyright Validation Results ⏭️ Skipped (Excluded) Files
✅ All files have valid copyright headers! |
rjrudin
force-pushed
the
feature/black-duck
branch
4 times, most recently
from
0ebdb0f to
916e2f6
Compare
Main thing is getting onto Spring 6.2.11 instead of Spring 5. Bumped Gradle to 8.14.3 and NiFi from 2.3.0 to 2.5.0 too.
rjrudin
force-pushed
the
feature/black-duck
branch
from
916e2f6 to
40adc84
Compare
BillFarber
approved these changes
Oct 8, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Main thing is getting onto Spring 6.2.11 instead of Spring 5. Bumped Gradle to 8.14.3 and NiFi from 2.3.0 to 2.5.0 too.