dependabot[bot] opened a new pull request, #3681: URL: https://github.com/apache/cxf/pull/3681
Bumps [net.sourceforge.pmd:pmd-core](https://github.com/pmd/pmd) from 7.28.0 to 7.29.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pmd/pmd/releases";>net.sourceforge.pmd:pmd-core's releases</a>.</em></p> <blockquote> <h2>PMD 7.29.0 (30-October-2026)</h2> <h2>30-October-2026 - 7.29.0</h2> <p>The PMD team is pleased to announce PMD 7.29.0.</p> <p>This is a minor release.</p> <h3>Table Of Contents</h3> <ul> <li><a href="https://github.com/pmd/pmd/blob/HEAD/#new-and-noteworthy";>🚀️ New and noteworthy</a> <ul> <li><a href="https://github.com/pmd/pmd/blob/HEAD/#security-fixes";>Security fixes</a></li> </ul> </li> <li><a href="https://github.com/pmd/pmd/blob/HEAD/#new-and-changed-rules";>🌟️ New and Changed Rules</a> <ul> <li><a href="https://github.com/pmd/pmd/blob/HEAD/#new-rules";>New Rules</a></li> <li><a href="https://github.com/pmd/pmd/blob/HEAD/#changed-rules";>Changed Rules</a></li> <li><a href="https://github.com/pmd/pmd/blob/HEAD/#deprecated-rules";>Deprecated Rules</a></li> </ul> </li> <li><a href="https://github.com/pmd/pmd/blob/HEAD/#fixed-issues";>🐛️ Fixed Issues</a></li> <li><a href="https://github.com/pmd/pmd/blob/HEAD/#api-changes";>🚨️ API Changes</a></li> <li><a href="https://github.com/pmd/pmd/blob/HEAD/#merged-pull-requests";>✨️ Merged pull requests</a></li> <li><a href="https://github.com/pmd/pmd/blob/HEAD/#dependency-updates";>📦️ Dependency updates</a></li> <li><a href="https://github.com/pmd/pmd/blob/HEAD/#stats";>📈️ Stats</a></li> </ul> <h3>🚀️ New and noteworthy</h3> <h4>Security fixes</h4> <p>All known security vulnerabilities are described in full detail on the page <a href="https://docs.pmd-code.org/pmd-doc-7.29.0/pmd_about_security.html";>PMD Security</a>. This release, the following security vulnerabilities were fixed:</p> <ul> <li><a href="https://github.com/pmd/pmd/security/advisories/GHSA-wj6q-xw9m-26p6";>GHSA-wj6q-xw9m-26p6</a>: Arbitrary file disclosure in CPD via symlinks in analyzed sources.<br /> When collecting files, CPD followed symbolic links, even if their targets were outside the scanned directory. This allowed reading any file accessible to the user running CPD. If a CI/CD pipeline runs CPD on untrusted source code (e.g. a pull request from an external contributor), an attacker could commit two symlinks pointing to the same file outside the project. CPD detected them as duplicates and wrote the full content of the target file into the report. If the report was published, e.g. as a CI artifact, the attacker could read it.<br /> With this fix, neither PMD nor CPD follows symbolic links anymore when collecting files to analyze.<br /> Affected versions: PMD >= 6.54.0 and <= 7.28.0. If you run CPD on untrusted source code, it is recommended to upgrade PMD.<br /> Reported by <a href="https://github.com/7alen7";>Dan</a> (<a href="https://github.com/7alen7";><code>@7alen7</code></a>). Independently reported by <a href="https://github.com/ThejasRajamoney";>lapeace</a> (<a href="https://github.com/ThejasRajamoney";><code>@ThejasRajamoney</code></a>).</li> <li><a href="https://github.com/pmd/pmd/security/advisories/GHSA-5x5v-644m-q2qc";>GHSA-5x5v-644m-q2qc</a>: XSS via externalInfoUrl in HTML report formats.<br /> The <code>html</code> and <code>summaryhtml</code> renderers inserted a rule's <code>externalInfoUrl</code> into generated reports without escaping or URL-scheme validation. With a crafted ruleset, this allowed injected markup that runs when the report is opened (with <code>--show-suppressed</code>), or <code>javascript:</code> links that run when clicked. This only affects setups where PMD loads an untrusted ruleset and the resulting HTML report is viewed in a browser.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pmd/pmd/commit/47b3135b2cdd4afa0b4447da91786497b58bc10b";><code>47b3135</code></a> [release] prepare release pmd_releases/7.29.0</li> <li><a href="https://github.com/pmd/pmd/commit/df93eb5de04a35913112e41437ff576ea62db52b";><code>df93eb5</code></a> Prepare pmd release 7.29.0</li> <li><a href="https://github.com/pmd/pmd/commit/7d4b9ad6988815c08de0ba9edd42999a877d80b7";><code>7d4b9ad</code></a> Update contributors for 7.29.0</li> <li><a href="https://github.com/pmd/pmd/commit/cc67aac29ff14a4a0f4d3cb0a86d87635fbb57af";><code>cc67aac</code></a> [doc] Update security.md and attributions</li> <li><a href="https://github.com/pmd/pmd/commit/e79c4e197effa7095bd3b13dcb0d2a2291e67a4f";><code>e79c4e1</code></a> [core] Fix missing escaping in CSV renderers (<a href="https://redirect.github.com/pmd/pmd/issues/7262";>#7262</a>)</li> <li><a href="https://github.com/pmd/pmd/commit/71d38f5471b9831a1aaa46186dd17c1160201754";><code>71d38f5</code></a> [core] Disallow external entity expansions/DTD in XML parsing (<a href="https://redirect.github.com/pmd/pmd/issues/7261";>#7261</a>)</li> <li><a href="https://github.com/pmd/pmd/commit/1e4fd9454c2bbbf56928400d5b86d41591143622";><code>1e4fd94</code></a> [core] HTMLRenderers: Properly escape rule name and externalInfoUrl (<a href="https://redirect.github.com/pmd/pmd/issues/7260";>#7260</a>)</li> <li><a href="https://github.com/pmd/pmd/commit/7aec5c1215046837a64e626e76f2088e0b5679e7";><code>7aec5c1</code></a> [core] Don't follow symlinks in FileCollector (<a href="https://redirect.github.com/pmd/pmd/issues/7259";>#7259</a>)</li> <li><a href="https://github.com/pmd/pmd/commit/c7560e009b4878089dbaf097a063aa08544ea092";><code>c7560e0</code></a> [doc] Improve release notes</li> <li><a href="https://github.com/pmd/pmd/commit/c44b87c8892f5df5126256ab10b76a43a69ab18c";><code>c44b87c</code></a> [java] Fix <a href="https://redirect.github.com/pmd/pmd/issues/7213";>#7213</a>: UnusedPrivateMethod/UnusedPrivateField with qualified Metho...</li> <li>Additional commits viewable in <a href="https://github.com/pmd/pmd/compare/pmd_releases/7.28.0...pmd_releases/7.29.0";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
