chore(deps): tier1 dependency upgrades for Java 1.8 (issue #72, 13 of 19 GAVs) - #79
Merged
Merged
Conversation
Bumps 9 GAVs that were on outdated Java 1.8-compatible lines and adds 6
new managed GAVs to dependencyManagement so transitive versions land on
the right patch line. All bumped artifacts verified Java 1.8 compatible
(bytecode major <= 52).
Version bumps (in root pom <properties>):
- jackson: 2.21.1 -> 2.21.5 (closes ~80 CVEs)
- nettyall: 4.2.10.Final -> 4.1.136.Final (downgrade to last Java 8 line)
- poi: 5.2.2 -> 5.4.0
New properties (for the new managed entries):
- httpclient5.version 5.6.3
- httpcore5.version 5.4.3
- httpcore5-h2.version 5.4.3
- jakarta.mail.version 1.6.8
- junrar.version 7.5.10
- snappy.version 1.1.10.4
- zookeeper.version 3.7.2
New <dependencyManagement> entries:
- zookeeper, zookeeper-jute (pinned to 3.7.2)
- snappy-java (pinned to 1.1.10.4)
- junrar (pinned to 7.5.10)
- jakarta.mail (pinned to 1.6.8; pairs with existing javax.mail)
- httpclient5, httpcore5, httpcore5-h2 (pinned to 5.6.3 / 5.4.3 / 5.4.3)
- io.netty:netty-bom (replaces 11 individual netty-* entries; the
BOM does not cover netty-tcnative-* which
remain out of scope)
dependency-check-maven config:
- failBuildOnCVSS=8 kept; failOnError true->false (so an empty NVD feed
in CI does not break the build); formats now also emit JSON/CSV in
addition to HTML; OSS Index + RetireJS analyzers disabled (they pull
unauthenticated feeds that 403 in this environment).
Full list of the 19-GAV tier1 plan (from the dependency analysis in
docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/):
IN THIS PR (9 GAVs / ~95 CVEs):
1. jackson-databind 2.21.1 -> 2.21.5 (jackson.version)
2. jackson-core 2.21.1 -> 2.21.5 (jackson.version)
3. netty-handler via nettyall.version
4. netty-codec via nettyall.version
5. netty-common via nettyall.version
6. zookeeper 3.6.2 -> 3.7.2 (zookeeper.version)
7. junrar 7.5.5 -> 7.5.10 (junrar.version)
8. snappy-java 1.1.10.1 -> 1.1.10.4 (snappy.version)
9. httpclient5 5.4.4 -> 5.6.3 (httpclient5.version)
10. httpcore5 5.3.4 -> 5.4.3 (httpcore5.version)
11. httpcore5-h2 5.3.4 -> 5.4.3 (httpcore5-h2.version)
12. jakarta.mail 1.6.7 -> 1.6.8 (jakarta.mail.version)
13. poi-ooxml 5.2.2 -> 5.4.0 (poi.version)
NOT YET (separate follow-up; tracked in the parent epic):
- snakeyaml 1.23 -> 1.32 or 2.0
- derby 10.14.2.0 -> 10.14.2.1
- protobuf-java 2.5.0 -> 3.25.5
- jsoup 1.22.1 -> 1.23.1
- jetty-webapp 9.4.26 -> 9.4.33
- netty-transport-native-epoll 4.1.99.Final -> 4.1.135.Final
No code changes expected; ./mvn-env.sh clean install -DskipTests on
Java 1.8 passes in 3:43 with no UnsupportedClassVersionError.
Refs #72
> Co-Authored by Mavis v1.0.0 using minimax-m3 with agent mavis.
Pure re-formatting. No semantic changes.
- 5 source files: CodeQL suppression comment lines that crept over the
92-char soft wrap point were wrapped to two lines. The CodeQL
in-source comment text is unchanged.
- VspanFooterAlignmentCssTest.java: spotless collapsed two long
assertTrue(...) calls onto fewer lines and re-flowed an unrelated
Javadoc paragraph.
- README.md: markdown table re-alignment (column widths).
Refs #72
> Co-Authored by Mavis v1.0.0 using minimax-m3 with agent mavis.
…lysis
CodeQL baseline refresh (docs/ai-generated/tasks/8.1.x-codeql-baseline/):
- suppressions.md: re-format / re-align the suppression table
- alerts.md, alerts-stale-cache.md, accepted-risks.md, clusters.md,
codeql-pr-playbook.md, triage.md, README.md: status / doc updates
reflecting the current CodeQL alert set (no alert deltas; pure docs)
New: docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/
- main-vulnerability-report.md: full report from an OSV.dev /
GitHub Advisory DB scan of main (144 GAVs, 657 advisories).
- categorized-final.json: per-(GAV x module) enrichment used to
build the report.
- issues/01-tier1-java8-upgrades.md: the 19-GAV tier1 plan (the one
this PR addresses; 13 of 19 are bumped in this PR, 6 deferred).
- issues/02-epic-non-upgradeable.md: the remaining 117 GAVs that
need a Java 11+ move or no Java 1.8 fix exists.
- issues/03-bouncycastle-shiro-jdk11-bytecode-bug.md: the BC + Shiro
Java 11 bytecode bug; that became issues #74 / #76 / #78 and
PRs #75 / #77 in the repo.
Refs #72
> Co-Authored by Mavis v1.0.0 using minimax-m3 with agent mavis.
natechadwick
approved these changes
Aug 28, 2026
This was referenced Aug 28, 2026
Open
natechadwick
pushed a commit
that referenced
this pull request
Aug 28, 2026
Closes #84. Mechanical migration of every `org.apache.commons.lang.*` import to `org.apache.commons.lang3.*` across the codebase, plus removal of the 2.6 dep from the root pom and 28 module poms. commons-lang 2.6 has been EOL since 2010. The 2.7+ line is also unmaintained, and the project's other analysis (T2.6 hardening, #83) flags the same set of CVEs. The 3.x line is the maintained successor; `commons-lang3:3.20.0` was already in the root pom's dependencyManagement (only the 2.6 line was in active use), so no new dep is added. Scope: - 1,396 .java files: `org.apache.commons.lang.` -> `org.apache.commons.lang3.` - 29 .xml files (root pom + 28 module poms): drop the `commons-lang:commons-lang:2.6` dependency and the `<commons.lang.version>2.6</commons.lang.version>` property - 6 special-case files (see API notes below) API differences between commons-lang 2.x and 3.20.0 that this PR addresses (all behavioural, no semantic change for the call sites involved): 1. CharEncoding was removed (it was a 2.x-only constants holder). Fixed in projects/sitemanage/src/test/java/.../PSRestClient.java by switching to java.nio.charset.StandardCharsets.UTF_8.name(). 2. StrTokenizer (text.* subpackage) was removed in lang3 3.12+. Fixed in modules/ContentUI/.../PSAutoLinkGenerationProperties.java by inlining a StringUtils.split(text, ',') loop (only one call site). 3. WordUtils was moved from top-level `org.apache.commons.lang3.WordUtils` to `org.apache.commons.lang3.text.WordUtils`. 3 call sites fixed via a per-file import path correction (modules/utils, deployer, projects/sitemanage). 4. NullArgumentException was removed entirely. The only call site (projects/sitemanage/.../AssetAdaptor.java) now throws java.lang.NullPointerException with the same custom message. 5. ExceptionUtils.getFullStackTrace(t) was renamed to getStackTrace(t) in lang3 3.0. 49 call sites updated across 24 files (some broken across multiple lines; fixed with a word-bounded sed). 6. Validate.allElementsOfType(coll, type) was removed. The single call site (projects/sitemanage/.../PSResourceInstanceHelper.java) now inlines an instanceof loop with an IllegalArgumentException on mismatch. 7. StringEscapeUtils (text.* subpackage) was moved out of lang3 entirely; the maintained replacement is `org.apache.commons.text.StringEscapeUtils` in commons-text (already a transitive dep at 1.15.0). The 2 call sites in system/business/.../PSMetadataExtractorService.java and projects/sitemanage/.../PSLegacyLinkGenerator.java now import from commons-text. The legacy shortcut `StringEscapeUtils.unescapeHtml("&entity;")` is replaced with `StringEscapeUtils.UNESCAPE_HTML4.translate("&entity;")` in PSMetadataExtractorService (long form `escapeHtml4`/`unescapeHtml4` used elsewhere; both still exist in commons-text 1.15.0). Verification: - ./mvn-env.sh clean install -DskipTests: BUILD SUCCESS in 2:18 (61 modules, Java 1.8.0_504) - ./mvn-env.sh spotless:check: clean (the only spotless violation during the run was a multi-line import comment I had to inline; the project spotless config ran auto-style during the build and fixed everything else) - No UnsupportedClassVersionError in the build log - commons-lang 2.x no longer in the project's own dependency graph (commons-lang 2.5 is still pulled in transitively by axe/caja/ smartgwt-jar, but the project's own declared dep is gone) Out of scope (separate issues under #73): - commons-collections 3.2.2 -> commons-collections4 (next EOL in queue) - commons-beanutils 1.11.0 -> beanutils2 (Jakarta migration) - commons-httpclient 3.1 -> HttpClient 5 (the project already has HttpClient 5 from PR #79) - commons-configuration 1.10 -> commons-configuration2 Refs #84, #73, #72
This was referenced Aug 28, 2026
Closed
natechadwick
pushed a commit
that referenced
this pull request
Aug 28, 2026
…ions4 4.5.0 (issue #86) (#87) Closes #86. Mechanical migration of every `org.apache.commons.collections.*` import to `org.apache.commons.collections4.*` across the codebase, plus removal of the 3.2.2 dep from the root pom and 13 module poms. The `commons-collections4:4.5.0` line was already in the root pom's dependencyManagement (only the 3.x line was in active use), so no new dep is added. Scope: - 71 .java files: `org.apache.commons.collections.` -> `org.apache.commons.collections4.` - 1 root pom + 13 module poms: drop the `commons-collections:commons-collections:3.2.2` dependency and the `<commons.collections3.version>3.2.2</commons.collections3.version>` property - 1 module pom (jcadf-master): add a direct `org.apache.commons:commons-collections4` dep, since the original `commons-collections:commons-collections` direct dep was the sole source of the collections classes in this module - 6 special-case files (see API notes below) API differences between commons-collections 3.x and 4.5.0 that this PR addresses (all behavioural, no semantic change for the call sites involved): 1. `org.apache.commons.collections.MultiHashMap` was **removed** in 4.x. The 3 call sites now use `org.apache.commons.collections4.multimap.ArrayListValuedHashMap`. The `MultiMap` interface (deprecated in 4.x but still present) was replaced with `MultiValuedMap` (the new 4.x interface that replaced it; `ArrayListValuedHashMap` implements `MultiValuedMap`, not `MultiMap`). Files: PSCalendarMonthModel, PSContentRepository, PSItemUtilities + 2 callers (PSActionPanelServlet, PSItemUtilitiesTest). 2. `CollectionUtils.addAll(Collection, Iterator)` was **removed** in 4.x (the new signatures are `addAll(Collection, Iterable)` and `addAll(Collection, Enumeration)` only). The 4 call sites that pass an Iterator are inlined to a `while (it.hasNext()) list.add(it.next())` loop. The 7 sites that pass an Iterable/Collection work unchanged. Files: PSLegacyExtensionUtils, PSContentTypeSetter (iteratorToList), PSContentTypeFieldSetter (excludes loop), PSConditionalCloneHandler. 3. `AbstractListDecorator.getCollection()` / `getList()` were renamed to `decorated()` in 4.x. The 1 call site in PSConcurrentRegionsAssembler.FutureList inlines the override as `decorated()` (and calls it from the iterator/toString overrides that previously used the public `getList()` / `getCollection()`). 4. `MapUtils.getString(Map, String)` (2-arg) and the new 3-arg `getString(Map, String, String)` (default) in 4.x use a generic signature `<K> String getString(Map<? super K, ?>, K)` that does not type-infer when the input is `Map<?, ?>`. The 1 call site in PSPageUtils casts to a raw `Map` to anchor the K-inference to String (with a `@SuppressWarnings({unchecked, rawtypes})` on the line). Verification: - ./mvn-env.sh clean install -DskipTests: BUILD SUCCESS in 3:41 (61 modules, Java 1.8.0_504) - ./mvn-env.sh spotless:check: clean (the build runs spotless:apply during validate; nothing needed reformatting beyond the inline raw-type cast above) - No UnsupportedClassVersionError in the build log - commons-collections 3.x no longer in the project's own dependency graph (only commons-collections4 4.5.0 remains; `commons-collections` 2.5 may still be pulled in transitively by legacy system-scoped jars, but that is independent of this PR) Out of scope (separate issues under #73): - commons-beanutils 1.11.0 -> beanutils2 EOL replacement (Jakarta migration; large blast radius) - commons-httpclient 3.1 -> HttpClient 5 (the project already has HttpClient 5 from #79; just remove the 3.1 dep) - commons-configuration 1.10 -> commons-configuration2 EOL replacement - T2.11 SnakeYAML SafeConstructor hardening (16 CVEs) - T2.6 size caps on the other zip sites (follow-up to #83) Refs #86, #73, #72
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Tier 1 dependency upgrades for Java 1.8 (parent epic #72). This is the first PR of several — it covers 13 of the 19 GAVs that an OSV.dev / GHSA scan of
mainflagged as "drop-in Java 1.8 upgrade with no source change expected."The 19-GAV plan and full report live in
docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/. Six of the 19 are deferred to follow-up PRs (mostly because they need a closer look at the bytecode level of the fix version or they have transitive API risks).What changes (1 functional commit, 2 chore commits)
chore(deps): tier1 dependency version bumpspom.xmldependencyManagemententries + Netty BOM import + dependency-check-maven configchore(spotless): re-wrap long linesREADME.md// codeql[...]comments wrapped, markdown tables re-aligneddocs(codeql,deps): refresh baseline + add tier1 dep vulnerability analysisdocs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/with the full scan report + 3 issue draftsVersion table (tier 1, Java 1.8)
com.fasterxml.jackson.core:jackson-databindcom.fasterxml.jackson.core:jackson-coreio.netty:netty-{handler,codec,common}org.apache.zookeeper:zookeepercom.github.junrar:junrarorg.xerial.snappy:snappy-javaorg.apache.httpcomponents.client5:httpclient5org.apache.httpcomponents.core5:httpcore5{,-h2}com.sun.mail:jakarta.mailorg.apache.poi:poi-ooxmlNetty is a downgrade (4.2.10 → 4.1.136): the 4.2.x line is the next major and is being prepared for Java 11+; the last Java 1.8 compatible line is the 4.1.x patch line. The import of the
io.netty:netty-bompins everyio.netty:netty-*artifact to the same line (exceptnetty-tcnative-*, which BC is intentionally leaving for a separate pass).Deferred to follow-up PRs (6 GAVs)
org.yaml:snakeyaml1.23 → 1.32 or 2.0 — needs decision on whether to stay on 1.x or jump to 2.xorg.apache.derby:derby10.14.2.0 → 10.14.2.1 — patch bump, easy follow-upcom.google.protobuf:protobuf-java2.5.0 → 3.25.5 — 7-year major jump; smoke-test requiredorg.jsoup:jsoup1.22.1 → 1.23.1 — small bump, no risk expectedorg.eclipse.jetty:jetty-webapp9.4.26 → 9.4.33 — also requires bumpingjetty.versionfloorio.netty:netty-transport-native-epoll4.1.99.Final → 4.1.135.Final — covered bynettyall.version, but the tcnative line is a separate classpathVerification
./mvn-env.sh clean install -DskipTests→ BUILD SUCCESS in 3:43 (61 modules, Java 1.8.0_504)UnsupportedClassVersionErroranywhere in the build logapplyruns across all modules duringvalidate; the 5 source-code files in commit 2 are already in spotless format (the commit re-wraps the same content the formatter would have produced)git statusclean after the 3 commits./mvn-env.sh dependency-check:check(OWASP dep-check) — should report a ~13-GAV reduction in the "Dependency with vulnerable components" count. Not run in this environment because it requires a fresh NVD pull, which is the reason the build config in this PR setsfailOnError=false.Out of scope (separate work)
References
01-tier1-java8-upgrades.mdanalysis file)docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/main-vulnerability-report.mddocs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/01-tier1-java8-upgrades.md