Skip to content

[Snyk] Fix for 2 vulnerabilities #5247

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bogarin wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 2 vulnerabilities #5247

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -262,7 +262,7 @@
</goals>
</pluginExecutionFilter>
<action>
<ignore></ignore>
<ignore/>
</action>
</pluginExecution>
<pluginExecution>
Expand All @@ -281,7 +281,7 @@
</goals>
</pluginExecutionFilter>
<action>
<ignore></ignore>
<ignore/>
</action>
</pluginExecution>
</pluginExecutions>
Expand Down Expand Up @@ -1445,7 +1445,7 @@

<!-- logging -->
<org.slf4j.version>1.7.32</org.slf4j.version>
<logback.version>1.2.6</logback.version>
<logback.version>1.5.25</logback.version>
Copy link

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Upgrading logback from 1.2.6 to 1.5.25 introduces a compatibility issue. Logback 1.5.x requires SLF4J 2.0.x or higher, but this project uses SLF4J 1.7.32 (defined at line 1447). This version mismatch will cause runtime errors.

To fix this issue, either:

  1. Update slf4j to version 2.0.0 or higher (e.g., 2.0.16) along with logback 1.5.25, or
  2. Use logback 1.3.x (e.g., 1.3.14) which is compatible with SLF4J 1.7.x and still addresses the security vulnerability

Logback 1.3.x is the maintenance branch for SLF4J 1.7.x compatibility, while 1.4.x and 1.5.x require SLF4J 2.0.x.

Suggested change
<logback.version>1.5.25</logback.version>
<logback.version>1.3.14</logback.version>

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR description indicates that this PR will fix an XXE vulnerability in AssertJ (SNYK-JAVA-ORGASSERTJ-15102413), but the assertj.version property (line 1440) remains at 3.21.0 and is not updated in this PR. The PR description notes "No Path Found" for this vulnerability, suggesting it cannot be automatically fixed.

This creates a discrepancy: the PR claims to fix 2 vulnerabilities but only actually updates dependencies for 1 vulnerability (logback). Consider either:

  1. Updating the PR description to clarify that only the logback vulnerability is being fixed, or
  2. Manually upgrading AssertJ to a version that addresses the XXE vulnerability if such a version exists

Copilot uses AI. Check for mistakes.

<!-- plugins -->
<maven-surefire-plugin.version>2.22.2</maven-surefire-plugin.version>
Expand Down