Security: weekly scanning, PR vulnerability gate, dependency patch - #25
Merged
Conversation
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
pdfbox 2.0.29->2.0.37, commons-io 2.11.0->2.22.0, jbig2-imageio 3.0.4->3.0.5, opencsv 5.8->5.12.0, jetty 11.0.20->11.0.26, slf4j-simple 1.7.32->1.7.36. All within current majors; jetty 12 / pdfbox 3 migrations are deliberate follow-ups. jackson-core / jackson-dataformat-csv left at 2.13.4 (not bumped): bumping either to 2.22.1 broke BatchMapDeserializerTest with NoSuchMethodError on ParserMinimalBase.<init>(int, StreamReadConstraints). Applied the documented contingency (drop both to 2.19.4) and reran -- same 4 errors. Root-caused: EyesUtilities-1.6.6.jar bundles an unrelocated, partial jackson-core 2.16.1 (com/fasterxml/jackson/core/base/ParserMinimalBase.class only) that shadows the real dependency on the classpath. Any jackson-core >= 2.15 introduces classes (e.g. UTF8StreamJsonParser) that call a ParserMinimalBase constructor overload absent from that embedded 2.16.1 fragment, so the mismatch is unavoidable via version choice alone -- confirmed by isolating: reverting only the jackson pair back to 2.13.4 with the other six bumps in place fully restores the suite (487 tests, 0 failures/errors, 1 pre-existing unrelated skip). Fixing this needs either a rebuilt EyesUtilities without the embedded jackson-core, or a pom exclusion of that transitive class, both out of scope for a version-only patch. Follow-up needed to close out the jackson-core / jackson-databind CVEs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…n order jackson-core / jackson-dataformat-csv (2.13.4->2.22.1) previously failed BatchMapDeserializerTest with NoSuchMethodError on ParserMinimalBase.<init>(int, StreamReadConstraints) -- root cause was EyesUtilities-1.6.6.jar embedding an unrelocated, partial jackson-core 2.16.1 fragment (ParserMinimalBase.class only) under the real com.fasterxml.jackson.core package. Maven/JVM classpath resolution is first-declared-wins for same-named classes, and EyesUtilities was declared before jackson-core/jackson-dataformat-csv in <dependencies>, so its stale embedded class shadowed the real, newer jackson-core whenever other jackson-core classes (e.g. UTF8StreamJsonParser) called the newer constructor. Moving both jackson dependency blocks above EyesUtilities makes the coherent, newer jackson-core win on the classpath (and in the shaded uber jar, for the same first-artifact-wins reason). Verified: full suite passes clean at 2.22.1 with this reordering (487 tests, 0 failures, 0 errors, 1 pre-existing unrelated skip) -- closing out the jackson exception noted in the prior commit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements docs/superpowers/specs/2026-07-27-security-scanning-design.md:
🤖 Generated with Claude Code