This is an automated email from the ASF dual-hosted git repository.
delei pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/fesod.git
The following commit(s) were added to refs/heads/main by this push:
new 1f039425 dependency: upgrade assertj-core to 3.27.7 to fix XXE
vulnerability (CVE-2025-NDJSON) (#969)
1f039425 is described below
commit 1f039425a3505a496f0695edaaac759b5873932f
Author: ian zhang <[email protected]>
AuthorDate: Mon Jul 27 10:33:37 2026 +0800
dependency: upgrade assertj-core to 3.27.7 to fix XXE vulnerability
(CVE-2025-NDJSON) (#969)
Fixes apache/fesod#101 (Dependabot security alert)
assertj-core <= 3.27.6 is vulnerable to XML External Entity (XXE) injection
when parsing XML assertions. Upgrade to 3.27.7 which disables external
entity
processing by default.
All 412 unit tests pass with the new version.
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 2a912fb2..c87cc5f5 100644
--- a/pom.xml
+++ b/pom.xml
@@ -111,7 +111,7 @@
<junit.version>5.13.4</junit.version>
<mockito.version>4.11.0</mockito.version>
<jazzer.junit.version>0.25.1</jazzer.junit.version>
- <assertj.version>3.25.3</assertj.version>
+ <assertj.version>3.27.7</assertj.version>
<surefire.jvm.args>-Xmx2g -Xms2g -XX:+HeapDumpOnOutOfMemoryError
-Dfile.encoding=UTF-8</surefire.jvm.args>
<surefire.jdk9plus.args></surefire.jdk9plus.args>
<argLine></argLine>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
