Skip to content

Commit 4322579

Browse files
duttonwduttonw
committed
Library updates:
* profile jakartaee11: jakarta-ee from 11.0.0-M5 to 11.0.0 * Spring Version from 6.2.12 to 7.0.7 * struts2-jasperreports-plugin: jasperreports from 6.21.3 to 6.21.5 * struts2-jasperreports7-plugin: jasperreports from 7.0.4 to 7.0.6 * profile jakartaee11: jakarta-ee from 11.0.0-M5 to 11.0.0 Dependancy suppression cleanup
1 parent f4c6349 commit 4322579

6 files changed

Lines changed: 45 additions & 163 deletions

File tree

‎.github/workflows/maven.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ env:
3131

3232
jobs:
3333
build:
34-
name: Build and Test (JDK ${{ matrix.java }})${{ matrix.profile == '-Pjakartaee11' && ' with Jakarta EE 11' || matrix.profile }}
34+
name: Build and Test (JDK ${{ matrix.java }})${{ matrix.profile == '-Pjakartaee11' && ' (Jakarta EE 11)' || matrix.profile }}
3535
runs-on: ubuntu-latest
3636
strategy:
3737
matrix:

‎plugins/jasperreports/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@
3535
<dependency>
3636
<groupId>net.sf.jasperreports</groupId>
3737
<artifactId>jasperreports</artifactId>
38-
<version>6.21.3</version>
38+
<version>6.21.5</version>
3939
<scope>provided</scope>
4040
<exclusions>
4141
<!-- not necessary to compile and it force dependency convergence issues -->

‎plugins/jasperreports7/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@
3333

3434
<properties>
3535
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
36-
<jasperreports7.version>7.0.4</jasperreports7.version>
36+
<jasperreports7.version>7.0.6</jasperreports7.version>
3737
</properties>
3838

3939
<dependencies>

‎plugins/spring/README.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,11 @@ You will find more details in [documentation](https://struts.apache.org/plugins/
44

55
## Installation
66
Just drop this plugin JAR into `WEB-INF/lib` folder or add it as a Maven dependency.
7+
8+
9+
## Struts & Spring Compatibility Matrix
10+
11+
| Struts Plugin Version | Compatible Spring Version | Spring OSS End of Life (EOL) |
12+
|:----------------------|:---------------------------|:-----------------------------|
13+
| **7.1.1** | 6.2.x | 2026-06 |
14+
| **7.1.1** | 7.0.7 (Jakarta EE 11 only) | 2027-06 |

‎pom.xml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,7 @@
125125
<mockito.version>5.23.0</mockito.version>
126126
<ognl.version>3.4.11</ognl.version>
127127
<slf4j.version>2.0.17</slf4j.version>
128-
<spring.version>6.2.12</spring.version>
128+
<spring.version>7.0.7</spring.version>
129129
<struts-annotations.version>2.0</struts-annotations.version>
130130
<velocity-tools.version>3.1</velocity-tools.version>
131131
<weld.version>6.0.4.Final</weld.version>
@@ -157,8 +157,7 @@
157157
<profile>
158158
<id>jakartaee11</id>
159159
<properties>
160-
<jakarta-ee.version>11.0.0-M5</jakarta-ee.version>
161-
<spring.version>7.0.5</spring.version>
160+
<jakarta-ee.version>11.0.0</jakarta-ee.version>
162161
</properties>
163162
</profile>
164163
<profile>

‎src/etc/project-suppression.xml‎

Lines changed: 32 additions & 157 deletions
Original file line numberDiff line numberDiff line change
@@ -18,168 +18,43 @@
1818
under the License.
1919
-->
2020
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
21-
<suppress>
22-
<notes><![CDATA[file name: struts-core-1.3.8.jar]]></notes>
23-
<packageUrl regex="true">^pkg:maven/org\.apache\.struts/struts\-core@.*$</packageUrl>
21+
<suppress until="2026-06-30">
22+
<notes><![CDATA[
23+
file name: jasperreports-7.0.6.jar
24+
https://community.jaspersoft.com/knowledgebase/faq/update-details-about-the-java-vulnerability-r4897/
25+
One way to prevent such an attack would be to make sure the parent Java application runs on Java 17 or later, where this type of attack is blocked by some changes made to the Java platform itself.
26+
]]></notes>
27+
<packageUrl regex="true">^pkg:maven/net\.sf\.jasperreports/jasperreports@.*$</packageUrl>
28+
<cve>CVE-2025-10492</cve>
29+
</suppress>
30+
<suppress>
31+
<notes><![CDATA[false positive due to naming to close to apache tiles
32+
cpe:2.3:a:apache:tiles:*:*:*:*:*:*:*:* versions from (including) 2.0]]></notes>
33+
<cve>CVE-2023-49735</cve>
2434
<cpe>cpe:/a:apache:struts</cpe>
2535
</suppress>
2636
<suppress>
27-
<notes><![CDATA[file name: struts-core-1.3.8.jar]]></notes>
28-
<packageUrl regex="true">^pkg:maven/org\.apache\.struts/struts\-core@.*$</packageUrl>
29-
<vulnerabilityName>CVE-2011-5057</vulnerabilityName>
30-
</suppress>
31-
<suppress>
32-
<notes><![CDATA[file name: struts-core-1.3.8.jar]]></notes>
33-
<packageUrl regex="true">^pkg:maven/org\.apache\.struts/struts\-core@.*$</packageUrl>
34-
<vulnerabilityName>CVE-2012-0391</vulnerabilityName>
35-
</suppress>
36-
<suppress>
37-
<notes><![CDATA[file name: struts-core-1.3.8.jar]]></notes>
38-
<packageUrl regex="true">^pkg:maven/org\.apache\.struts/struts\-core@.*$</packageUrl>
39-
<vulnerabilityName>CVE-2012-0392</vulnerabilityName>
40-
</suppress>
41-
<suppress>
42-
<notes><![CDATA[file name: struts-core-1.3.8.jar]]></notes>
43-
<packageUrl regex="true">^pkg:maven/org\.apache\.struts/struts\-core@.*$</packageUrl>
44-
<vulnerabilityName>CVE-2012-0393</vulnerabilityName>
45-
</suppress>
46-
<suppress>
47-
<notes><![CDATA[file name: struts-core-1.3.8.jar]]></notes>
48-
<packageUrl regex="true">^pkg:maven/org\.apache\.struts/struts\-core@.*$</packageUrl>
49-
<vulnerabilityName>CVE-2012-0394</vulnerabilityName>
50-
</suppress>
51-
<suppress>
52-
<notes><![CDATA[file name: struts-core-1.3.8.jar]]></notes>
53-
<packageUrl regex="true">^pkg:maven/org\.apache\.struts/struts\-core@.*$</packageUrl>
54-
<vulnerabilityName>CVE-2012-0838</vulnerabilityName>
55-
</suppress>
56-
<suppress>
57-
<notes><![CDATA[file name: struts-core-1.3.8.jar]]></notes>
58-
<packageUrl regex="true">^pkg:maven/org\.apache\.struts/struts\-core@.*$</packageUrl>
59-
<vulnerabilityName>CVE-2013-1965</vulnerabilityName>
60-
</suppress>
61-
<suppress>
62-
<notes><![CDATA[file name: struts-core-1.3.8.jar]]></notes>
63-
<packageUrl regex="true">^pkg:maven/org\.apache\.struts/struts\-core@.*$</packageUrl>
64-
<vulnerabilityName>CVE-2013-1966</vulnerabilityName>
65-
</suppress>
66-
<suppress>
67-
<notes><![CDATA[file name: struts-core-1.3.8.jar]]></notes>
68-
<packageUrl regex="true">^pkg:maven/org\.apache\.struts/struts\-core@.*$</packageUrl>
69-
<vulnerabilityName>CVE-2013-2115</vulnerabilityName>
70-
</suppress>
71-
<suppress>
72-
<notes><![CDATA[file name: struts-core-1.3.8.jar]]></notes>
73-
<packageUrl regex="true">^pkg:maven/org\.apache\.struts/struts\-core@.*$</packageUrl>
74-
<vulnerabilityName>CVE-2013-2134</vulnerabilityName>
75-
</suppress>
76-
<suppress>
77-
<notes><![CDATA[file name: struts-core-1.3.8.jar]]></notes>
78-
<packageUrl regex="true">^pkg:maven/org\.apache\.struts/struts\-core@.*$</packageUrl>
79-
<vulnerabilityName>CVE-2013-2135</vulnerabilityName>
80-
</suppress>
81-
<suppress>
82-
<notes><![CDATA[file name: struts-core-1.3.8.jar]]></notes>
83-
<packageUrl regex="true">^pkg:maven/org\.apache\.struts/struts\-core@.*$</packageUrl>
84-
<vulnerabilityName>CVE-2014-0094</vulnerabilityName>
85-
</suppress>
86-
<suppress>
87-
<notes><![CDATA[file name: struts-core-1.3.8.jar]]></notes>
88-
<packageUrl regex="true">^pkg:maven/org\.apache\.struts/struts\-core@.*$</packageUrl>
89-
<vulnerabilityName>CVE-2014-0113</vulnerabilityName>
90-
</suppress>
91-
<suppress>
92-
<notes><![CDATA[file name: struts-core-1.3.8.jar]]></notes>
93-
<packageUrl regex="true">^pkg:maven/org\.apache\.struts/struts\-core@.*$</packageUrl>
94-
<vulnerabilityName>CVE-2015-5169</vulnerabilityName>
95-
</suppress>
96-
<suppress>
97-
<notes><![CDATA[file name: struts-core-1.3.8.jar]]></notes>
98-
<packageUrl regex="true">^pkg:maven/org\.apache\.struts/struts\-core@.*$</packageUrl>
99-
<vulnerabilityName>CVE-2016-0785</vulnerabilityName>
100-
</suppress>
101-
<suppress>
102-
<notes><![CDATA[file name: struts-core-1.3.8.jar]]></notes>
103-
<packageUrl regex="true">^pkg:maven/org\.apache\.struts/struts\-core@.*$</packageUrl>
104-
<vulnerabilityName>CVE-2016-4003</vulnerabilityName>
105-
</suppress>
106-
<suppress>
107-
<notes><![CDATA[file name: struts-annotations-1.0.6.jar]]></notes>
108-
<packageUrl regex="true">^pkg:maven/org\.apache\.struts/struts\-annotations@.*$</packageUrl>
109-
<cpe>cpe:/a:apache:struts</cpe>
110-
</suppress>
111-
<suppress>
112-
<notes><![CDATA[file name: struts-tiles-1.3.8.jar]]></notes>
113-
<gav regex="true">^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$</gav>
114-
<cpe>cpe:/a:apache:struts</cpe>
115-
</suppress>
116-
<suppress>
117-
<notes><![CDATA[file name: struts-taglib-1.3.8.jar]]></notes>
118-
<gav regex="true">^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$</gav>
119-
<cpe>cpe:/a:apache:struts</cpe>
120-
</suppress>
121-
<suppress>
122-
<notes><![CDATA[file name: dom4j-1.1.jar]]></notes>
123-
<packageUrl regex="true">^pkg:maven/dom4j/dom4j@.*$</packageUrl>
124-
<vulnerabilityName>CVE-2018-1000632</vulnerabilityName>
125-
</suppress>
126-
<suppress>
127-
<notes><![CDATA[file name: bsh-2.0b4.jar]]></notes>
128-
<packageUrl regex="true">^pkg:maven/org\.beanshell/bsh@.*$</packageUrl>
129-
<vulnerabilityName>CVE-2016-2510</vulnerabilityName>
130-
</suppress>
131-
<suppress>
132-
<notes><![CDATA[ file name: plexus-utils-1.2.jar]]></notes>
133-
<packageUrl regex="true">^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$</packageUrl>
134-
<cpe>cpe:/a:plexus-utils_project:plexus-utils</cpe>
135-
<cve>CVE-2022-4244</cve>
136-
<cve>CVE-2022-4245</cve>
137-
<cve>CVE-2017-1000487</cve>
138-
</suppress>
139-
<suppress>
140-
<notes><![CDATA[ file name: plexus-container-default-1.0-alpha-10.jar]]></notes>
141-
<packageUrl regex="true">^pkg:maven/org\.codehaus\.plexus\/plexus\-container\-default@.*$</packageUrl>
142-
<cpe>cpe:/a:plexus-utils_project:plexus-utils</cpe>
143-
<cve>CVE-2022-4244</cve>
144-
<cve>CVE-2022-4245</cve>
145-
</suppress>
146-
<!-- TestNG -->
147-
<suppress>
148-
<notes><![CDATA[file name: guava-19.0.jar]]></notes>
149-
<packageUrl regex="true">^pkg:maven/com\.google\.guava/guava@.*$</packageUrl>
150-
<cve>CVE-2018-10237</cve>
151-
</suppress>
152-
<suppress>
153-
<notes><![CDATA[file name: snakeyaml-1.21.jar]]></notes>
154-
<packageUrl regex="true">^pkg:maven/org\.yaml/snakeyaml@.*$</packageUrl>
155-
<cve>CVE-2017-18640</cve>
156-
</suppress>
157-
<suppress>
158-
<notes><![CDATA[file name: testng-7.1.0.jar: jquery-3.4.1.min.js]]></notes>
37+
<notes><![CDATA[apps showcase demos with jquery-2.1.4.min.js]]></notes>
15938
<packageUrl regex="true">^pkg:javascript/jquery@.*$</packageUrl>
16039
<cve>CVE-2020-11022</cve>
161-
</suppress>
162-
<suppress>
163-
<notes><![CDATA[file name: testng-7.1.0.jar: jquery-3.4.1.min.js]]></notes>
164-
<packageUrl regex="true">^pkg:javascript/jquery@.*$</packageUrl>
16540
<cve>CVE-2020-11023</cve>
166-
</suppress>
167-
<suppress>
168-
<notes><![CDATA[file name: testng-7.5.jar]]></notes>
169-
<packageUrl regex="true">^pkg:maven/org\.testng/testng@.*$</packageUrl>
170-
<cve>CVE-2022-4065</cve>
171-
</suppress>
172-
<suppress>
173-
<notes><![CDATA[file name: spring-core-4.3.30.RELEASE.jar, spring-aop-4.3.30.RELEASE.jar]]></notes>
174-
<packageUrl regex="true">^pkg:maven/org\.springframework/spring\-.*@.*$</packageUrl>
175-
<cve>CVE-2022-22965</cve>
176-
<cve>CVE-2022-22950</cve>
177-
<cve>CVE-2022-22968</cve>
178-
<cve>CVE-2022-22970</cve>
179-
</suppress>
180-
<suppress>
181-
<notes><![CDATA[file name: spring-web-5.3.23.jar]]></notes>
182-
<packageUrl regex="true">^pkg:maven/org\.springframework/spring\-web@.*$</packageUrl>
183-
<cve>CVE-2016-1000027</cve>
41+
<cve>CVE-2015-9251</cve>
42+
<cve>CVE-2019-11358</cve>
43+
<vulnerabilityName>jquery issue: 11974</vulnerabilityName>
44+
<vulnerabilityName>jquery issue: 162</vulnerabilityName>
45+
</suppress>
46+
<suppress>
47+
<notes><![CDATA[apps showcase demos with Bootstrap v3.3.4]]></notes>
48+
<!-- <packageUrl regex="true">^pkg:javascript/bootstrap@.*$</packageUrl>-->
49+
<sha1>253711c6d825de55a8360552573be950da180614</sha1>
50+
<cve>CVE-2016-10735</cve>
51+
<cve>CVE-2018-14040</cve>
52+
<cve>CVE-2018-14041</cve>
53+
<cve>CVE-2018-14042</cve>
54+
<cve>CVE-2018-20676</cve>
55+
<cve>CVE-2018-20677</cve>
56+
<cve>CVE-2019-8331</cve>
57+
<cve>CVE-2024-6485</cve>
58+
<vulnerabilityName>Bootstrap before 4.0.0 is end-of-life and no longer maintained.</vulnerabilityName>
18459
</suppress>
18560
</suppressions>

0 commit comments

Comments
 (0)