Skip to content

Commit d3a7792

Browse files
thboileauthboileau
committed
Issue #1510: Upgrade libraries to fix CVEs
1 parent 0f20386 commit d3a7792

5 files changed

Lines changed: 62 additions & 2 deletions

File tree

‎org.restlet.java/org.restlet.ext.guice/pom.xml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,22 @@
1919
<groupId>com.google.inject</groupId>
2020
<artifactId>guice</artifactId>
2121
<version>${lib-guice-version}</version>
22+
<exclusions>
23+
<exclusion><!-- fix CVEs CVE-2023-2976 CVE-2020-8908 -->
24+
<groupId>com.google.guava</groupId>
25+
<artifactId>guava</artifactId>
26+
</exclusion>
27+
</exclusions>
28+
</dependency>
29+
<dependency><!-- fix CVEs CVE-2023-2976 CVE-2020-8908 -->
30+
<groupId>com.google.guava</groupId>
31+
<artifactId>guava</artifactId>
32+
<version>${lib-cves-guava-version}</version>
33+
</dependency>
34+
<dependency>
35+
<groupId>jakarta.inject</groupId>
36+
<artifactId>jakarta.inject-api</artifactId>
37+
<version>2.0.1</version>
2238
</dependency>
2339
<dependency>
2440
<groupId>org.restlet</groupId>

‎org.restlet.java/org.restlet.ext.jackson/pom.xml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,16 @@
6060
<artifactId>jackson-module-jsonSchema</artifactId>
6161
<version>${lib-jackson-version}</version>
6262
</dependency>
63+
<dependency>
64+
<groupId>org.codehaus.woodstox</groupId>
65+
<artifactId>stax2-api</artifactId>
66+
<version>4.2.2</version>
67+
</dependency>
68+
<dependency>
69+
<groupId>com.fasterxml.woodstox</groupId>
70+
<artifactId>woodstox-core</artifactId>
71+
<version>7.1.1</version>
72+
</dependency>
6373
<dependency>
6474
<groupId>org.restlet</groupId>
6575
<artifactId>org.restlet</artifactId>

‎org.restlet.java/org.restlet.ext.jetty/pom.xml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,26 @@
7070
<artifactId>jetty-http3-client-transport</artifactId>
7171
<version>${lib-jetty-version}</version>
7272
</dependency>
73+
<dependency>
74+
<groupId>org.eclipse.jetty</groupId>
75+
<artifactId>jetty-util</artifactId>
76+
<version>${lib-jetty-version}</version>
77+
</dependency>
78+
<dependency>
79+
<groupId>org.eclipse.jetty</groupId>
80+
<artifactId>jetty-io</artifactId>
81+
<version>${lib-jetty-version}</version>
82+
</dependency>
83+
<dependency>
84+
<groupId>org.eclipse.jetty</groupId>
85+
<artifactId>jetty-http</artifactId>
86+
<version>${lib-jetty-version}</version>
87+
</dependency>
88+
<dependency>
89+
<groupId>org.eclipse.jetty.quic</groupId>
90+
<artifactId>jetty-quic-client</artifactId>
91+
<version>${lib-jetty-version}</version>
92+
</dependency>
7393
<dependency>
7494
<groupId>org.eclipse.jetty</groupId>
7595
<artifactId>jetty-slf4j-impl</artifactId>

‎org.restlet.java/org.restlet.ext.velocity/pom.xml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,17 @@
1919
<groupId>org.apache.velocity</groupId>
2020
<artifactId>velocity-engine-core</artifactId>
2121
<version>${lib-velocity-version}</version>
22+
<exclusions>
23+
<exclusion><!-- fix CVEs: CVE-2025-48924-->
24+
<groupId>org.apache.commons</groupId>
25+
<artifactId>commons-lang3</artifactId>
26+
</exclusion>
27+
</exclusions>
28+
</dependency>
29+
<dependency><!-- fix CVEs: CVE-2025-48924-->
30+
<groupId>org.apache.commons</groupId>
31+
<artifactId>commons-lang3</artifactId>
32+
<version>${lib-cves-commons-lang3-version}</version>
2233
</dependency>
2334
<dependency>
2435
<groupId>org.restlet</groupId>

‎pom.xml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,8 +53,8 @@
5353
<lib-freemarker-version>2.3.34</lib-freemarker-version>
5454
<lib-gson-version>2.14.0</lib-gson-version>
5555
<lib-guice-version>7.0.0</lib-guice-version>
56-
<lib-gwt-version>2.13.0</lib-gwt-version>
57-
<lib-gwt-server-version>2.13.0</lib-gwt-server-version>
56+
<lib-gwt-version>2.13.1</lib-gwt-version>
57+
<lib-gwt-server-version>2.13.1</lib-gwt-server-version>
5858
<lib-istack-version>3.0.12</lib-istack-version>
5959
<lib-jackson-version>2.19.4</lib-jackson-version>
6060
<lib-jaxb-ri-version>4.0.9</lib-jaxb-ri-version>
@@ -70,6 +70,9 @@
7070
<lib-spring-version>6.2.19</lib-spring-version>
7171
<lib-thymeleaf-version>3.1.5.RELEASE</lib-thymeleaf-version>
7272
<lib-velocity-version>2.4.1</lib-velocity-version>
73+
<!-- fix CVEs -->
74+
<lib-cves-guava-version>33.6.0-jre</lib-cves-guava-version>
75+
<lib-cves-commons-lang3-version>3.20.0</lib-cves-commons-lang3-version>
7376
<!-- tests -->
7477
<lib-junit-version>5.14.4</lib-junit-version>
7578
</properties>

0 commit comments

Comments
 (0)