Skip to content

Commit 1334c2a

Browse files
meotchwilliamsmeotch
meotchwilliams
authored and
meotch
committed
feat: bump vulnerable dependencies
Update junit/jaxb/spock
1 parent 39720dd commit 1334c2a

39 files changed

Lines changed: 1016 additions & 664 deletions

‎build.gradle‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
plugins {
22
id "idea"
3-
id "com.github.mxenabled.coppuccino" version "4.+" apply false
4-
id "com.github.mxenabled.vogue" version "1.+"
3+
id "com.github.mxenabled.coppuccino" version "4.4.2" apply false
4+
id "com.github.mxenabled.vogue" version "1.1.0"
55
id "io.freefair.lombok" version "8.+" apply false
66
id "io.github.gradle-nexus.publish-plugin" version "1.1.+"
77
}
@@ -29,8 +29,8 @@ allprojects {
2929
group "com.mx.path-core"
3030
description "MX Path Core"
3131
version rootProject.version
32-
sourceCompatibility = 1.8
33-
targetCompatibility = 1.8
32+
sourceCompatibility = JavaVersion.VERSION_11
33+
targetCompatibility = JavaVersion.VERSION_11
3434

3535
repositories {
3636
mavenCentral()
@@ -52,8 +52,8 @@ subprojects {
5252

5353
ext {
5454
mockitoVersion = "[4.0,5.0)"
55-
spockVersion = "2.4-M1-groovy-4.0"
56-
junitVersion = "[5.9.0,5.10.0)"
55+
spockVersion = "2.4-M6-groovy-3.0"
56+
junitVersion = "5.14.0"
5757
}
5858

5959
dependencies {
@@ -80,7 +80,7 @@ subprojects {
8080
}
8181
api("com.google.guava:guava") {
8282
version {
83-
require "[31.0,32.0)"
83+
require "[32.0,33.0)"
8484
}
8585
}
8686
api("com.github.rholder:guava-retrying") {
@@ -101,7 +101,7 @@ subprojects {
101101
api "jakarta.xml.bind:jakarta.xml.bind-api:2.3.3!!"
102102
api "jakarta.xml.soap:jakarta.xml.soap-api:1.4.2!!"
103103
api "com.sun.xml.bind:jaxb-impl:2.3.1!!"
104-
api "org.glassfish.jaxb:jaxb-runtime:2.3.7!!"
104+
api "org.glassfish.jaxb:jaxb-runtime:2.3.9!!"
105105
// -----------------------------------------------------------------
106106
}
107107

@@ -251,6 +251,6 @@ task subdependencies {
251251
project.tasks.getByPath("dependencies").finalizedBy("subdependencies")
252252

253253
wrapper {
254-
gradleVersion = "7.5.1"
255-
distributionType = Wrapper.DistributionType.BIN
254+
gradleVersion = "7.6.3"
255+
distributionType = Wrapper.DistributionType.ALL
256256
}

‎common/build.gradle‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
coppuccino {
22
coverage {
3-
minimumCoverage = 0.69
3+
minimumCoverage = 0.75
44
}
55
}
66

77
dependencies {
88
api "org.apache.commons:commons-text:latest.release" // For string manipulation utilities. There is a very small overlap with Guava's strings class, but adds many more features.
99
api "com.google.guava:guava"
1010
api "com.github.rholder:guava-retrying" // For Request retries
11-
api "com.github.spotbugs:spotbugs-annotations:4.7.2" // For annotating classes and methods to suppress SpotBugs violations
11+
api "com.github.spotbugs:spotbugs-annotations:4.9.8" // For annotating classes and methods to suppress SpotBugs violations
1212
api "com.google.code.gson:gson"
1313
api "org.yaml:snakeyaml:1.33"
1414
implementation "org.slf4j:slf4j-api"

‎common/gradle.lockfile‎

Lines changed: 69 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -1,86 +1,102 @@
11
# This is a Gradle generated file for dependency locking.
22
# Manual edits can break the build and are not advised.
33
# This file is expected to be part of source control.
4-
antlr:antlr:2.7.7=checkstyle
54
com.beust:jcommander:1.48=pmd
65
com.github.rholder:guava-retrying:2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
7-
com.github.spotbugs:spotbugs-annotations:4.7.2=runtimeClasspath,testRuntimeClasspath
8-
com.github.spotbugs:spotbugs-annotations:4.8.2=compileClasspath,spotbugs,testCompileClasspath
9-
com.github.spotbugs:spotbugs:4.8.2=spotbugs
6+
com.github.spotbugs:spotbugs-annotations:4.9.8=compileClasspath,runtimeClasspath,spotbugs,testCompileClasspath,testRuntimeClasspath
7+
com.github.spotbugs:spotbugs:4.9.8=spotbugs
108
com.github.stephenc.jcip:jcip-annotations:1.0-1=spotbugs
119
com.google.code.findbugs:jsr305:3.0.2=checkstyle,compileClasspath,runtimeClasspath,spotbugs,testCompileClasspath,testRuntimeClasspath
12-
com.google.code.gson:gson:2.10.1=spotbugs
10+
com.google.code.gson:gson:2.13.2=spotbugs
1311
com.google.code.gson:gson:2.8.9=pmd
1412
com.google.code.gson:gson:2.9.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
15-
com.google.errorprone:error_prone_annotations:2.11.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
16-
com.google.errorprone:error_prone_annotations:2.3.4=checkstyle
17-
com.google.guava:failureaccess:1.0.1=checkstyle,compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
18-
com.google.guava:guava:28.2-jre=checkstyle
19-
com.google.guava:guava:31.1-jre=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
13+
com.google.errorprone:error_prone_annotations:2.21.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
14+
com.google.errorprone:error_prone_annotations:2.36.0=checkstyle
15+
com.google.errorprone:error_prone_annotations:2.41.0=spotbugs
16+
com.google.guava:failureaccess:1.0.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
17+
com.google.guava:failureaccess:1.0.3=checkstyle
18+
com.google.guava:guava:32.1.3-jre=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
19+
com.google.guava:guava:33.4.8-jre=checkstyle
2020
com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=checkstyle,compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
21-
com.google.j2objc:j2objc-annotations:1.3=checkstyle,compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
22-
com.puppycrawl.tools:checkstyle:8.29=checkstyle
23-
commons-beanutils:commons-beanutils:1.9.4=checkstyle
24-
commons-codec:commons-codec:1.15=spotbugs
21+
com.google.j2objc:j2objc-annotations:2.8=compileClasspath,testCompileClasspath
22+
com.google.j2objc:j2objc-annotations:3.0.0=checkstyle
23+
com.puppycrawl.tools:checkstyle:10.25.0=checkstyle
24+
commons-beanutils:commons-beanutils:1.11.0=checkstyle
25+
commons-codec:commons-codec:1.15=checkstyle
2526
commons-collections:commons-collections:3.2.2=checkstyle
26-
info.picocli:picocli:4.1.4=checkstyle
27+
commons-io:commons-io:2.20.0=spotbugs
28+
info.picocli:picocli:4.7.7=checkstyle
29+
io.leangen.geantyref:geantyref:1.3.16=testRuntimeClasspath
2730
jaxen:jaxen:2.0.0=spotbugs
2831
net.bytebuddy:byte-buddy-agent:1.12.19=testCompileClasspath,testRuntimeClasspath
2932
net.bytebuddy:byte-buddy:1.12.19=testCompileClasspath,testRuntimeClasspath
30-
net.sf.saxon:Saxon-HE:12.3=spotbugs
31-
net.sf.saxon:Saxon-HE:9.9.1-6=checkstyle
32-
net.sourceforge.pmd:pmd-core:6.54.0=pmd
33-
net.sourceforge.pmd:pmd-java:6.54.0=pmd
33+
net.sf.saxon:Saxon-HE:12.5=checkstyle
34+
net.sf.saxon:Saxon-HE:12.9=spotbugs
35+
net.sourceforge.pmd:pmd-core:6.55.0=pmd
36+
net.sourceforge.pmd:pmd-java:6.55.0=pmd
3437
net.sourceforge.saxon:saxon:9.1.0.8=pmd
38+
org.antlr:antlr4-runtime:4.13.2=checkstyle
3539
org.antlr:antlr4-runtime:4.7.2=pmd
36-
org.antlr:antlr4-runtime:4.8-1=checkstyle
37-
org.apache.bcel:bcel:6.6.1=spotbugs
38-
org.apache.commons:commons-lang3:3.13.0=spotbugs
40+
org.apache.bcel:bcel:6.11.0=spotbugs
3941
org.apache.commons:commons-lang3:3.18.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
40-
org.apache.commons:commons-lang3:3.8.1=pmd
41-
org.apache.commons:commons-text:1.10.0=spotbugs
42-
org.apache.commons:commons-text:1.14.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
43-
org.apache.groovy:groovy-bom:4.0.6=testCompileClasspath,testRuntimeClasspath
44-
org.apache.groovy:groovy:4.0.6=testCompileClasspath,testRuntimeClasspath
45-
org.apache.httpcomponents.client5:httpclient5:5.1.3=spotbugs
46-
org.apache.httpcomponents.core5:httpcore5-h2:5.1.3=spotbugs
47-
org.apache.httpcomponents.core5:httpcore5:5.1.3=spotbugs
48-
org.apache.logging.log4j:log4j-api:2.22.0=spotbugs
49-
org.apache.logging.log4j:log4j-core:2.22.0=spotbugs
42+
org.apache.commons:commons-lang3:3.19.0=spotbugs
43+
org.apache.commons:commons-lang3:3.8.1=checkstyle,pmd
44+
org.apache.commons:commons-text:1.14.0=compileClasspath,runtimeClasspath,spotbugs,testCompileClasspath,testRuntimeClasspath
45+
org.apache.commons:commons-text:1.3=checkstyle
46+
org.apache.httpcomponents.client5:httpclient5:5.1.3=checkstyle
47+
org.apache.httpcomponents.core5:httpcore5-h2:5.1.3=checkstyle
48+
org.apache.httpcomponents.core5:httpcore5:5.1.3=checkstyle
49+
org.apache.httpcomponents:httpclient:4.5.13=checkstyle
50+
org.apache.httpcomponents:httpcore:4.4.14=checkstyle
51+
org.apache.logging.log4j:log4j-api:2.25.2=spotbugs
52+
org.apache.logging.log4j:log4j-core:2.25.2=spotbugs
53+
org.apache.maven.doxia:doxia-core:1.12.0=checkstyle
54+
org.apache.maven.doxia:doxia-logging-api:1.12.0=checkstyle
55+
org.apache.maven.doxia:doxia-module-xdoc:1.12.0=checkstyle
56+
org.apache.maven.doxia:doxia-sink-api:1.12.0=checkstyle
57+
org.apache.xbean:xbean-reflect:3.7=checkstyle
5058
org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
51-
org.checkerframework:checker-qual:2.10.0=checkstyle
52-
org.checkerframework:checker-qual:3.12.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
53-
org.dom4j:dom4j:2.1.4=spotbugs
54-
org.hamcrest:hamcrest:2.2=testCompileClasspath,testRuntimeClasspath
59+
org.checkerframework:checker-qual:3.37.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
60+
org.checkerframework:checker-qual:3.49.3=checkstyle
61+
org.codehaus.groovy:groovy:3.0.24=testCompileClasspath,testRuntimeClasspath
62+
org.codehaus.plexus:plexus-classworlds:2.6.0=checkstyle
63+
org.codehaus.plexus:plexus-component-annotations:2.1.0=checkstyle
64+
org.codehaus.plexus:plexus-container-default:2.1.0=checkstyle
65+
org.codehaus.plexus:plexus-utils:3.3.0=checkstyle
66+
org.dom4j:dom4j:2.2.0=spotbugs
67+
org.hamcrest:hamcrest:3.0=testCompileClasspath,testRuntimeClasspath
5568
org.jacoco:org.jacoco.agent:0.8.8=jacocoAgent,jacocoAnt
5669
org.jacoco:org.jacoco.ant:0.8.8=jacocoAnt
5770
org.jacoco:org.jacoco.core:0.8.8=jacocoAnt
5871
org.jacoco:org.jacoco.report:0.8.8=jacocoAnt
59-
org.junit.jupiter:junit-jupiter-api:5.9.3=testCompileClasspath,testRuntimeClasspath
60-
org.junit.platform:junit-platform-commons:1.9.3=testCompileClasspath,testRuntimeClasspath
61-
org.junit.platform:junit-platform-engine:1.9.3=testCompileClasspath,testRuntimeClasspath
62-
org.junit:junit-bom:5.9.0=runtimeClasspath
63-
org.junit:junit-bom:5.9.3=testCompileClasspath,testRuntimeClasspath
72+
org.javassist:javassist:3.28.0-GA=checkstyle
73+
org.jspecify:jspecify:1.0.0=checkstyle
74+
org.junit.jupiter:junit-jupiter-api:5.14.0=testCompileClasspath,testRuntimeClasspath
75+
org.junit.platform:junit-platform-commons:1.14.0=testCompileClasspath,testRuntimeClasspath
76+
org.junit.platform:junit-platform-engine:1.14.0=testCompileClasspath,testRuntimeClasspath
77+
org.junit:junit-bom:5.14.0=runtimeClasspath,spotbugs,testCompileClasspath,testRuntimeClasspath
6478
org.mockito:mockito-core:4.11.0=testCompileClasspath,testRuntimeClasspath
6579
org.mockito:mockito-inline:4.11.0=testCompileClasspath,testRuntimeClasspath
6680
org.objenesis:objenesis:3.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
67-
org.opentest4j:opentest4j:1.2.0=testCompileClasspath,testRuntimeClasspath
81+
org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testRuntimeClasspath
6882
org.ow2.asm:asm-analysis:9.2=jacocoAnt
69-
org.ow2.asm:asm-analysis:9.6=spotbugs
83+
org.ow2.asm:asm-analysis:9.9=spotbugs
7084
org.ow2.asm:asm-commons:9.2=jacocoAnt
71-
org.ow2.asm:asm-commons:9.6=spotbugs
85+
org.ow2.asm:asm-commons:9.9=spotbugs
7286
org.ow2.asm:asm-tree:9.2=jacocoAnt
73-
org.ow2.asm:asm-tree:9.6=spotbugs
74-
org.ow2.asm:asm-util:9.6=spotbugs
87+
org.ow2.asm:asm-tree:9.9=spotbugs
88+
org.ow2.asm:asm-util:9.9=spotbugs
7589
org.ow2.asm:asm:9.2=jacocoAnt
76-
org.ow2.asm:asm:9.3=pmd
77-
org.ow2.asm:asm:9.6=spotbugs
90+
org.ow2.asm:asm:9.4=pmd
91+
org.ow2.asm:asm:9.9=spotbugs
7892
org.projectlombok:lombok:1.18.42=annotationProcessor,compileClasspath,lombok,testAnnotationProcessor,testCompileClasspath
93+
org.reflections:reflections:0.10.2=checkstyle
7994
org.slf4j:slf4j-api:1.7.30=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
80-
org.slf4j:slf4j-api:2.0.0=spotbugsSlf4j
81-
org.slf4j:slf4j-api:2.0.9=spotbugs
82-
org.slf4j:slf4j-simple:2.0.0=spotbugsSlf4j
83-
org.spockframework:spock-core:2.4-M1-groovy-4.0=testCompileClasspath,testRuntimeClasspath
84-
org.xmlresolver:xmlresolver:5.2.0=spotbugs
95+
org.slf4j:slf4j-api:2.0.17=spotbugs,spotbugsSlf4j
96+
org.slf4j:slf4j-simple:2.0.17=spotbugsSlf4j
97+
org.spockframework:spock-bom:2.4-M6-groovy-3.0=testCompileClasspath,testRuntimeClasspath
98+
org.spockframework:spock-core:2.4-M6-groovy-3.0=testCompileClasspath,testRuntimeClasspath
99+
org.xmlresolver:xmlresolver:5.2.2=checkstyle
100+
org.xmlresolver:xmlresolver:5.3.3=spotbugs
85101
org.yaml:snakeyaml:1.33=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
86102
empty=signatures,spotbugsPlugins

‎common/src/main/java/com/mx/path/core/common/connect/Request.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -567,7 +567,7 @@ public final void setTimeout(Duration timeout) {
567567
/**
568568
* Called before the request starts. Sets start time. Override to add behavior. Be sure to call {@code super.start()}
569569
*/
570-
public void start() {
570+
public synchronized void start() {
571571
if (attemptCount < 1) {
572572
attemptCount = 1;
573573
}
@@ -579,7 +579,7 @@ public void start() {
579579
/**
580580
* Called before retrying request. Sets start time. Override to add behavior. Be sure to call {@code super.startRetry()}
581581
*/
582-
public void startRetry() {
582+
public synchronized void startRetry() {
583583
attemptCount++;
584584
startNano = 0;
585585
}

‎common/src/main/java/com/mx/path/core/common/http/MimeType.java‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -277,7 +277,7 @@ private boolean isQuotedString(String s) {
277277
}
278278
}
279279

280-
protected String unquote(String s) {
280+
protected final String unquote(String s) {
281281
return (isQuotedString(s) ? s.substring(1, s.length() - 1) : s);
282282
}
283283

@@ -350,7 +350,7 @@ public Charset getCharset() {
350350
* @return the parameter value, or {@code null} if not present
351351
*/
352352
@Nullable
353-
public String getParameter(String name) {
353+
public final String getParameter(String name) {
354354
return this.parameters.get(name);
355355
}
356356

@@ -611,4 +611,12 @@ private static Map<String, String> addCharsetParameter(Charset charset, Map<Stri
611611
return map;
612612
}
613613

614+
/**
615+
* This has been added to protect against a Finalizer attack (because MimeType constructor can throw an exception)
616+
* See https://wiki.sei.cmu.edu/confluence/display/java/OBJ11-J.+Be+wary+of+letting+constructors+throw+exceptions for more details
617+
*/
618+
@Override
619+
protected final void finalize() {
620+
// Do nothing
621+
}
614622
}

‎common/src/main/java/com/mx/path/core/common/model/ModelList.java‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,6 @@
99
import java.util.ListIterator;
1010
import java.util.Map;
1111

12-
import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
13-
1412
import com.google.gson.reflect.TypeToken;
1513

1614
/**
@@ -22,7 +20,6 @@ public class ModelList<T extends ModelBase<?>> implements List<T>, ModelWrappabl
2220
private static final Map<Class<?>, Class<?>> CACHED_TYPE_TO_LIST_TYPE = new LinkedHashMap<>();
2321
private static final Map<Class<?>, Type> CACHED_TYPE_TO_LIST_TYPETOKEN = new LinkedHashMap<>();
2422

25-
@SuppressFBWarnings("DM_NEW_FOR_GETCLASS")
2623
public static <T extends ModelBase<?>> Class<?> ofClass(Class<T> klass) {
2724
if (!CACHED_TYPE_TO_LIST_TYPE.containsKey(klass)) {
2825
CACHED_TYPE_TO_LIST_TYPE.put(klass, ModelList.class);

‎common/src/main/java/com/mx/path/core/common/serialization/ThrowableTypeAdapter.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ public final void write(JsonWriter out, Throwable value) throws IOException {
9898
}
9999

100100
@Data
101-
private static class ErrorInfo {
101+
private static final class ErrorInfo {
102102
private String throwableType = null;
103103
private String payloadFallbackType = null;
104104
private Throwable cause = null;

0 commit comments

Comments
 (0)