Skip to content

Commit 5159654

Browse files
fvarruiclaude
fvarrui
and
claude
committed
Fix the Dependabot alerts that reach users (#500)
- Bouncy Castle jdk18on 1.86 and log4j-api 2.25.5 declared directly (jsign), so Maven and Gradle consumers get the fixed versions - redline's discontinued bcpg/bcprov-jdk15on replaced by bcpg-jdk18on (same classes, no more duplicates with jsign's) - aircompressor excluded from jdeb (unused by DEB packages) - maven-plugin-api and maven-core are compileOnly, provided in the POM, and org.apache.maven is excluded from mojo-executor and jdeb: Gradle consumers no longer download Maven, Guava or maven-shared-utils - embedded Maven 3.10 for the plugin descriptor (same descriptor as 2.0.0), plugin-publish 2.2.1, GitHub Actions checkout v7, setup-java v6, upload-artifact v6 (Dependabot PRs #492, #493, #495 to #498) - docs site: npm overrides for the vulnerable transitive packages Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 parent b22650b commit 5159654

8 files changed

Lines changed: 97 additions & 259 deletions

File tree

‎.github/workflows/dependency-submission.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,9 @@ jobs:
1515
dependency-submission:
1616
runs-on: ubuntu-latest
1717
steps:
18-
- uses: actions/checkout@v5
18+
- uses: actions/checkout@v7
1919

20-
- uses: actions/setup-java@v5
20+
- uses: actions/setup-java@v6
2121
with:
2222
distribution: temurin
2323
java-version: 17

‎.github/workflows/docs.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626
run:
2727
working-directory: docs
2828
steps:
29-
- uses: actions/checkout@v5
29+
- uses: actions/checkout@v7
3030

3131
- uses: actions/setup-node@v5
3232
with:

‎.github/workflows/smoke-tests.yml‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,9 @@ jobs:
1414
timeout-minutes: 10
1515

1616
steps:
17-
- uses: actions/checkout@v5
17+
- uses: actions/checkout@v7
1818

19-
- uses: actions/setup-java@v5
19+
- uses: actions/setup-java@v6
2020
with:
2121
distribution: temurin
2222
java-version: 17
@@ -52,9 +52,9 @@ jobs:
5252
M2_REPO: ${{ github.workspace }}/build/m2-smoke
5353

5454
steps:
55-
- uses: actions/checkout@v5
55+
- uses: actions/checkout@v7
5656

57-
- uses: actions/setup-java@v5
57+
- uses: actions/setup-java@v6
5858
with:
5959
distribution: temurin
6060
java-version: 17
@@ -90,7 +90,7 @@ jobs:
9090

9191
- name: Upload artifacts
9292
if: always()
93-
uses: actions/upload-artifact@v5
93+
uses: actions/upload-artifact@v6
9494
with:
9595
name: hello-world-${{ matrix.os }}-${{ matrix.tool }}-${{ matrix.macStartup }}${{ matrix.admin && '-admin' || '' }}
9696
path: |
@@ -119,9 +119,9 @@ jobs:
119119
M2_REPO: ${{ github.workspace }}/build/m2-smoke
120120

121121
steps:
122-
- uses: actions/checkout@v5
122+
- uses: actions/checkout@v7
123123

124-
- uses: actions/setup-java@v5
124+
- uses: actions/setup-java@v6
125125
with:
126126
distribution: temurin
127127
java-version: 17
@@ -139,7 +139,7 @@ jobs:
139139

140140
- name: Set up packaging JDK ${{ matrix.java }}
141141
if: matrix.java
142-
uses: actions/setup-java@v5
142+
uses: actions/setup-java@v6
143143
with:
144144
distribution: temurin
145145
java-version: ${{ matrix.java }}
@@ -159,7 +159,7 @@ jobs:
159159

160160
- name: Upload artifacts
161161
if: always()
162-
uses: actions/upload-artifact@v5
162+
uses: actions/upload-artifact@v6
163163
with:
164164
name: hello-world-ubuntu-latest-${{ matrix.tool }}${{ matrix.java && format('-jdk{0}', matrix.java) || '' }}
165165
path: |
@@ -186,9 +186,9 @@ jobs:
186186
shell: bash
187187

188188
steps:
189-
- uses: actions/checkout@v5
189+
- uses: actions/checkout@v7
190190

191-
- uses: actions/setup-java@v5
191+
- uses: actions/setup-java@v6
192192
with:
193193
distribution: temurin
194194
java-version: 17
@@ -230,7 +230,7 @@ jobs:
230230

231231
- name: Upload artifacts
232232
if: always()
233-
uses: actions/upload-artifact@v5
233+
uses: actions/upload-artifact@v6
234234
with:
235235
name: hello-world-windows-latest-${{ matrix.tool }}
236236
path: |

‎.minispec/core/stack.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55
- Java 8 (source and target compatibility).
66
- Gradle 8.14.3 (wrapper), building both the Gradle plugin and the Maven plugin. The plugin supports Gradle 9 consumers.
7-
- Embedded Maven 3.9 + `maven-plugin-plugin` 3.16 to generate the Maven plugin descriptor.
7+
- Embedded Maven 3.10 + `maven-plugin-plugin` 3.16 to generate the Maven plugin descriptor.
88

99
## Libraries
1010

‎.minispec/features/dependabot-alerts.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,14 @@ Clear the Dependabot alerts on `main`: fix the ones that reach users, and fix or
2121
- Prefer `*-jdk18on` over the discontinued `*-jdk15on` Bouncy Castle artifacts.
2222
- Docs site: update Docusaurus, or force fixed versions with `overrides` in `docs/package.json` (then `npm run build`); dismiss the ones with no fix.
2323

24+
## Done (2026-10-11)
25+
26+
- Bouncy Castle `jdk18on` 1.86 (`bcprov`, `bcpkix`, `bcutil`) and `log4j-api` 2.25.5 declared directly (Java 8 bytecode checked); redline's `bcpg`/`bcprov-jdk15on` excluded and replaced by `bcpg-jdk18on` 1.86; `aircompressor` excluded from jdeb.
27+
- `maven-plugin-api` and `maven-core` are `compileOnly` (added as `provided` in `pom.withXml`), and `org.apache.maven` is excluded from mojo-executor and jdeb in Gradle: Gradle consumers no longer get Maven, Guava or `maven-shared-utils`.
28+
- Embedded Maven for the descriptor: 3.10.0, resolver 2.0.24, slf4j-simple 2.0.20; plugin-publish 2.2.1; GitHub Actions `checkout` v7, `setup-java` v6, `upload-artifact` v6 (Dependabot PRs #492, #493, #495 to #498). The descriptor is the same as 2.0.0's (51 parameters, Maven 3.6.0, Java 8).
29+
- Docs site: `overrides` for `tinypool`, `serialize-javascript`, `postcss-selector-parser` and `uuid`; the site builds.
30+
- Left: dismiss the alerts with no fix or not shipped (`maven-core` < 3.8.1, compileOnly; `braces`, already the latest), and close #494/#499 (`maven-plugin-api`/`maven-core` 3.10 would require Maven 3.10, `requiredMavenVersion` comes from it).
31+
2432
## Acceptance
2533

2634
- No open alert for a dependency users download, or each remaining one dismissed with a reason in #500.

‎build.gradle‎

Lines changed: 39 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ plugins {
22
id 'java'
33
id 'maven-publish'
44
id 'java-gradle-plugin'
5-
id 'com.gradle.plugin-publish' version '1.3.1'
5+
id 'com.gradle.plugin-publish' version '2.2.1'
66
id 'eclipse'
77
id 'de.undercouch.download' version '5.7.0'
88
id 'signing'
@@ -39,30 +39,50 @@ configurations {
3939
}
4040

4141
dependencies {
42-
implementation 'org.apache.maven:maven-plugin-api:3.6.0'
43-
implementation 'org.apache.maven:maven-core:3.6.0'
42+
// Maven provides its own API to plugins at runtime (they are 'provided' in the POM, see pom.withXml),
43+
// and the Gradle plugin doesn't use it, so Gradle consumers don't download it
44+
compileOnly 'org.apache.maven:maven-plugin-api:3.6.0'
45+
compileOnly 'org.apache.maven:maven-core:3.6.0'
4446
// jdeb requires plexus-utils 4, which moved Xpp3Dom to plexus-xml (3.x is the Maven 3 compatible line)
4547
implementation 'org.codehaus.plexus:plexus-utils:4.1.0'
4648
implementation 'org.codehaus.plexus:plexus-xml:3.1.0'
47-
implementation 'org.twdata.maven:mojo-executor:2.4.1'
49+
// mojo-executor and jdeb are Maven plugins too: they must not bring other Maven versions
50+
implementation('org.twdata.maven:mojo-executor:2.4.1') {
51+
exclude group: 'org.apache.maven'
52+
}
4853
implementation 'commons-io:commons-io:2.22.0'
4954
implementation 'org.apache.commons:commons-lang3:3.21.0'
5055
implementation 'org.apache.commons:commons-collections4:4.6.0'
5156
implementation 'org.apache.commons:commons-compress:1.28.0'
5257
implementation 'org.apache.velocity:velocity-engine-core:2.4.1'
53-
implementation 'org.vafer:jdeb:1.14'
58+
implementation('org.vafer:jdeb:1.14') {
59+
exclude group: 'org.apache.maven'
60+
// only used by plexus-archiver for formats DEB packages don't use (CVE-2025-67721, #500)
61+
exclude group: 'io.airlift', module: 'aircompressor'
62+
}
5463
implementation 'net.jsign:jsign-core:6.0'
55-
implementation 'org.redline-rpm:redline:1.2.10'
64+
implementation('org.redline-rpm:redline:1.2.10') {
65+
// the discontinued jdk15on Bouncy Castle has unfixed CVEs and duplicates jsign's jdk18on classes (#500)
66+
exclude group: 'org.bouncycastle', module: 'bcpg-jdk15on'
67+
exclude group: 'org.bouncycastle', module: 'bcprov-jdk15on'
68+
}
69+
// fixed versions of transitive dependencies (#500): declared, not constrained, so Maven
70+
// consumers (nearest wins) get the same jars as Gradle ones
71+
implementation 'org.bouncycastle:bcpg-jdk18on:1.86' // redline's PGP, instead of bcpg-jdk15on
72+
implementation 'org.bouncycastle:bcprov-jdk18on:1.86' // jsign
73+
implementation 'org.bouncycastle:bcpkix-jdk18on:1.86' // jsign
74+
implementation 'org.bouncycastle:bcutil-jdk18on:1.86' // jsign
75+
implementation 'org.apache.logging.log4j:log4j-api:2.25.5' // jsign (Apache POI)
5676
implementation 'edu.sc.seis.launch4j:launch4j:4.0.0'
5777

5878
compileOnly 'org.apache.maven.plugin-tools:maven-plugin-annotations:3.16.0'
5979
compileOnly 'javax.inject:javax.inject:1' // provided by Maven at runtime
6080

61-
mavenEmbedder 'org.apache.maven:maven-embedder:3.9.16'
62-
mavenEmbedder 'org.apache.maven:maven-compat:3.9.16'
63-
mavenEmbedder 'org.slf4j:slf4j-simple:1.7.36'
64-
mavenEmbedder 'org.apache.maven.resolver:maven-resolver-connector-basic:1.9.27'
65-
mavenEmbedder 'org.apache.maven.resolver:maven-resolver-transport-wagon:1.9.27'
81+
mavenEmbedder 'org.apache.maven:maven-embedder:3.10.0'
82+
mavenEmbedder 'org.apache.maven:maven-compat:3.10.0'
83+
mavenEmbedder 'org.slf4j:slf4j-simple:2.0.20'
84+
mavenEmbedder 'org.apache.maven.resolver:maven-resolver-connector-basic:2.0.24'
85+
mavenEmbedder 'org.apache.maven.resolver:maven-resolver-transport-wagon:2.0.24'
6686
mavenEmbedder 'org.apache.maven.wagon:wagon-http:3.5.3'
6787
mavenEmbedder 'org.apache.maven.wagon:wagon-provider-api:3.5.3'
6888
}
@@ -121,22 +141,19 @@ publishing {
121141
appendNode('configuration').appendNode('goalPrefix', 'javapackager')
122142
}
123143
}
124-
// Maven provides its own API to plugins: maven-plugin-api and maven-core must be 'provided' and
125-
// mojo-executor and jdeb (also Maven plugins) must not bring other Maven versions.
144+
// Maven provides its own API to plugins: maven-plugin-api and maven-core are compileOnly in Gradle
145+
// and added here as 'provided' (the plugin descriptor generation needs them too).
126146
// The launch4j Gradle library is only used by the Gradle plugin and only published on the
127147
// Gradle Plugin Portal, so it's left out of the POM: Maven users only need Maven Central (#444).
128148
// (Gradle consumers use the .module file, so they are not affected)
129149
def dependencies = asNode().dependencies[0]
130150
dependencies.dependency.findAll { it.groupId.text() == 'edu.sc.seis.launch4j' }.each { dependencies.remove(it) }
131-
dependencies.dependency.each { dep ->
132-
def artifactId = dep.artifactId.text()
133-
if (artifactId in ['maven-plugin-api', 'maven-core']) {
134-
dep.scope[0].value = 'provided'
135-
} else if (artifactId in ['mojo-executor', 'jdeb']) {
136-
dep.appendNode('exclusions').appendNode('exclusion').with {
137-
appendNode('groupId', 'org.apache.maven')
138-
appendNode('artifactId', '*')
139-
}
151+
['maven-plugin-api', 'maven-core'].each { artifactId ->
152+
dependencies.appendNode('dependency').with {
153+
appendNode('groupId', 'org.apache.maven')
154+
appendNode('artifactId', artifactId)
155+
appendNode('version', '3.6.0')
156+
appendNode('scope', 'provided')
140157
}
141158
}
142159
}

0 commit comments

Comments
 (0)