From 98affba070f9564c43fd98d276ee33f30198d921 Mon Sep 17 00:00:00 2001 From: Bill Oley Date: Tue, 10 Feb 2026 15:19:00 -0500 Subject: [PATCH 1/2] Address multiple known security vulnerabilities --- .../util/v1/SegmentUtilsJsonTest.java | 2 +- pom.xml | 12 +++---- ...eadSafeClassPathXmlApplicationContext.java | 32 +++++++++++++++++++ web-services/pom.xml | 2 +- 4 files changed, 40 insertions(+), 8 deletions(-) diff --git a/core/annotation/src/test/java/datawave/annotation/util/v1/SegmentUtilsJsonTest.java b/core/annotation/src/test/java/datawave/annotation/util/v1/SegmentUtilsJsonTest.java index 733297ecae4..f7df6d05712 100644 --- a/core/annotation/src/test/java/datawave/annotation/util/v1/SegmentUtilsJsonTest.java +++ b/core/annotation/src/test/java/datawave/annotation/util/v1/SegmentUtilsJsonTest.java @@ -124,7 +124,7 @@ public void testFromMalformedJsonOne() { "Expected an exception from malformed json"); //@formatter:on System.out.println(e.getMessage()); - assertTrue(e.getMessage().contains("Expect an array")); + assertTrue(e.getMessage().contains("Expected an array")); } diff --git a/pom.xml b/pom.xml index 3a5e6425b0f..1c229431ee0 100644 --- a/pom.xml +++ b/pom.xml @@ -59,7 +59,7 @@ 3.1.0 1.9.4 1.4 - 1.12 + 1.17.1 3.2.2 4.3 1.10 @@ -100,7 +100,7 @@ 4.4.8 4.0.4 9.4.21.Final - 2.13.5 + 2.17.2 1.9.13 2.3.3 3.24.0-GA @@ -128,18 +128,18 @@ 1.2 2.23.0 9.3.0 - 4.1.42.Final + 4.1.115.Final 2.1 5.0.3.Final 2.0.9 2.61.0 - 3.16.3 - 3.16.3 + 3.25.5 + 3.25.5 1.6.2 12.4 2.0.17 3.1.5 - 5.2.2.RELEASE + 5.3.39 ${version.spring} 2.9.6 0.17.0 diff --git a/web-services/common/src/main/java/datawave/configuration/spring/ThreadSafeClassPathXmlApplicationContext.java b/web-services/common/src/main/java/datawave/configuration/spring/ThreadSafeClassPathXmlApplicationContext.java index ac9291d0844..bdc4e474bce 100644 --- a/web-services/common/src/main/java/datawave/configuration/spring/ThreadSafeClassPathXmlApplicationContext.java +++ b/web-services/common/src/main/java/datawave/configuration/spring/ThreadSafeClassPathXmlApplicationContext.java @@ -24,6 +24,7 @@ import org.springframework.core.env.ConfigurableEnvironment; import org.springframework.core.io.ProtocolResolver; import org.springframework.core.io.Resource; +import org.springframework.core.metrics.ApplicationStartup; /** * A delegating wrapper around {@link ConfigurableApplicationContext}. This implements all methods of {@link ConfigurableApplicationContext}, delegating each @@ -76,6 +77,16 @@ public ConfigurableEnvironment getEnvironment() { return lockAndRead(configurableApplicationContext::getEnvironment); } + @Override + public void setApplicationStartup(ApplicationStartup applicationStartup) { + lockAndWrite(() -> configurableApplicationContext.setApplicationStartup(applicationStartup)); + } + + @Override + public ApplicationStartup getApplicationStartup() { + return lockAndRead(configurableApplicationContext::getApplicationStartup); + } + @Override public void setEnvironment(ConfigurableEnvironment environment) { lockAndWrite(() -> configurableApplicationContext.setEnvironment(environment)); @@ -116,6 +127,11 @@ public void addApplicationListener(ApplicationListener listener) { lockAndWrite(() -> configurableApplicationContext.addApplicationListener(listener)); } + @Override + public void setClassLoader(ClassLoader classLoader) { + lockAndWrite(() -> configurableApplicationContext.setClassLoader(classLoader)); + } + @Override public void addProtocolResolver(ProtocolResolver protocolResolver) { lockAndWrite(() -> configurableApplicationContext.addProtocolResolver(protocolResolver)); @@ -231,6 +247,16 @@ public String[] getBeanDefinitionNames() { return lockAndRead(configurableApplicationContext::getBeanDefinitionNames); } + @Override + public ObjectProvider getBeanProvider(Class requiredType, boolean allowEagerInit) { + return lockAndRead(() -> configurableApplicationContext.getBeanProvider(requiredType, allowEagerInit)); + } + + @Override + public ObjectProvider getBeanProvider(ResolvableType requiredType, boolean allowEagerInit) { + return lockAndRead(() -> configurableApplicationContext.getBeanProvider(requiredType, allowEagerInit)); + } + @Override public String[] getBeanNamesForType(ResolvableType resolvableType) { return lockAndRead(() -> configurableApplicationContext.getBeanNamesForType(resolvableType)); @@ -276,6 +302,12 @@ public A findAnnotationOnBean(String beanName, Class a return lockAndRead(() -> configurableApplicationContext.findAnnotationOnBean(beanName, annotationType)); } + @Override + public A findAnnotationOnBean(String beanName, Class annotationType, boolean allowFactoryBeanInit) + throws NoSuchBeanDefinitionException { + return lockAndRead(() -> configurableApplicationContext.findAnnotationOnBean(beanName, annotationType, allowFactoryBeanInit)); + } + @Override public BeanFactory getParentBeanFactory() { return lockAndRead(configurableApplicationContext::getParentBeanFactory); diff --git a/web-services/pom.xml b/web-services/pom.xml index d6427d089ff..9da61de54ce 100644 --- a/web-services/pom.xml +++ b/web-services/pom.xml @@ -49,7 +49,7 @@ 1.0.1 1.1 1.0.0 - 3.16.3 + 3.25.5 From c1beb79270b19c5786b5d9f0124f59c8a83ff0d3 Mon Sep 17 00:00:00 2001 From: Bill Oley Date: Tue, 10 Feb 2026 16:29:20 -0500 Subject: [PATCH 2/2] Version spring-security-core separately from spring --- core/utils/common-utils/pom.xml | 1 - docs/pom.xml | 2 +- pom.xml | 1 + 3 files changed, 2 insertions(+), 2 deletions(-) diff --git a/core/utils/common-utils/pom.xml b/core/utils/common-utils/pom.xml index 5026d41cf94..d296e996f00 100644 --- a/core/utils/common-utils/pom.xml +++ b/core/utils/common-utils/pom.xml @@ -10,7 +10,6 @@ ${project.artifactId} ${project.basedir}/src/main/spotbugs/excludes.xml - 5.7.2 diff --git a/docs/pom.xml b/docs/pom.xml index fbbc1afc37a..45d9262002f 100644 --- a/docs/pom.xml +++ b/docs/pom.xml @@ -162,7 +162,7 @@ org.springframework.security spring-security-core - ${version.springframework} + ${version.spring-security-core} org.wildfly diff --git a/pom.xml b/pom.xml index 1c229431ee0..d81e979c712 100644 --- a/pom.xml +++ b/pom.xml @@ -140,6 +140,7 @@ 2.0.17 3.1.5 5.3.39 + 5.8.16 ${version.spring} 2.9.6 0.17.0