Skip to content

fix: Critical and High Vulnerability fixes #1286

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
romitshah02 wants to merge 10 commits into
base: master
Choose a base branch
from
Open

fix: Critical and High Vulnerability fixes #1286

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
71fab7e
build(deps): bump the maven group across 9 directories with 6 updates
dependabot[bot] Jul 14, 2026
67578c4
vulnerability fixes
romitshah02 Jul 14, 2026
d224f61
No netty update
romitshah02 Jul 14, 2026
6f6e1f9
Merge pull request #19 from romitshah02/dependabot/maven/maven-883956…
romitshah02 Jul 14, 2026
f0070fb
netty version change
romitshah02 Jul 14, 2026
f0bd39a
XSTL vul fix
romitshah02 Jul 14, 2026
6a7654f
build issue fix
romitshah02 Jul 14, 2026
33a4071
formatting changes
romitshah02 Jul 14, 2026
31f96b8
build(deps): bump org.htmlunit:htmlunit from 3.0.0 to 3.9.0
dependabot[bot] Jul 14, 2026
37af7f7
Merge pull request #22 from romitshah02/dependabot/maven/org.htmlunit…
romitshah02 Jul 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion assessment-api/assessment-controllers/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
<scala.maj.version>2.13</scala.maj.version>
<scala.version>2.13.12</scala.version>
<play2.version>3.0.5</play2.version>
<fasterxml.jackson.version>2.18.6</fasterxml.jackson.version>
<fasterxml.jackson.version>2.18.9</fasterxml.jackson.version>
</properties>

<dependencies>
Expand Down
10 changes: 10 additions & 0 deletions assessment-api/assessment-service/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,8 +175,18 @@
<artifactId>guava</artifactId>
<groupId>com.google.guava</groupId>
</exclusion>
<!-- Security: htmlunit CVE-2023-4218 (XSLT RCE) -->
<exclusion>
<groupId>net.sourceforge.htmlunit</groupId>
<artifactId>htmlunit</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.htmlunit</groupId>
<artifactId>htmlunit</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.joda</groupId>
<artifactId>joda-convert</artifactId>
Expand Down
2 changes: 1 addition & 1 deletion content-api/content-controllers/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
<scala.maj.version>2.13</scala.maj.version>
<scala.version>2.13.12</scala.version>
<play2.version>3.0.5</play2.version>
<fasterxml.jackson.version>2.18.6</fasterxml.jackson.version>
<fasterxml.jackson.version>2.18.9</fasterxml.jackson.version>
</properties>

<dependencies>
Expand Down
12 changes: 11 additions & 1 deletion content-api/content-service/pom.xml
100755 → 100644
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@
<play2.plugin.version>1.0.0-rc5</play2.plugin.version>
<sbt-compiler.plugin.version>1.0.0</sbt-compiler.plugin.version>
<scala.major.version>2.13</scala.major.version>
<netty.version>4.1.133.Final</netty.version>
<netty.version>4.1.135.Final</netty.version>
</properties>

<dependencyManagement>
Expand Down Expand Up @@ -336,8 +336,18 @@
<artifactId>guava</artifactId>
<groupId>com.google.guava</groupId>
</exclusion>
<!-- Security: htmlunit CVE-2023-4218 (XSLT RCE) -->
<exclusion>
<groupId>net.sourceforge.htmlunit</groupId>
<artifactId>htmlunit</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.htmlunit</groupId>
<artifactId>htmlunit</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.joda</groupId>
<artifactId>joda-convert</artifactId>
Expand Down
4 changes: 2 additions & 2 deletions content-api/hierarchy-manager/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,13 +89,13 @@
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-codec</artifactId>
<version>4.1.133.Final</version>
<version>4.1.135.Final</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-handler</artifactId>
<version>4.1.133.Final</version>
<version>4.1.135.Final</version>
<scope>test</scope>
</dependency>
<dependency>
Expand Down
4 changes: 2 additions & 2 deletions knowlg-service/pom.xml
100755 → 100644
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,8 +53,8 @@
<play2.version>3.0.5</play2.version>
<play2.plugin.version>1.0.0-rc5</play2.plugin.version>
<sbt-compiler.plugin.version>1.0.0</sbt-compiler.plugin.version>
<netty.version>4.1.133.Final</netty.version>
<fasterxml.jackson.version>2.18.6</fasterxml.jackson.version>
<netty.version>4.1.135.Final</netty.version>
<fasterxml.jackson.version>2.18.9</fasterxml.jackson.version>
</properties>

<dependencyManagement>
Expand Down
2 changes: 1 addition & 1 deletion platform-core/platform-common/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@
<dependency>
<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
<artifactId>owasp-java-html-sanitizer</artifactId>
<version>20240325.1</version>
<version>20260101.1</version>

@coderabbitai coderabbitai Bot Jul 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Fetch the available versions of owasp-java-html-sanitizer from Maven Central
curl -s "https://search.maven.org/solrsearch/select?q=g:com.googlecode.owasp-java-html-sanitizer+AND+a:owasp-java-html-sanitizer&core=gav&rows=10&wt=json" | jq '.response.docs[].v'

Repository: Sunbird-Knowlg/knowledge-platform

Length of output: 301

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect the dependency declaration around the pinned version
sed -n '80,100p' platform-core/platform-common/pom.xml

echo
echo "----"
# Find all occurrences of the sanitizer artifact/version in the repo
rg -n "owasp-java-html-sanitizer|20260101\.1" -S .

Repository: Sunbird-Knowlg/knowledge-platform

Length of output: 1227

Use a published owasp-java-html-sanitizer version 20260101.1 is not published on Maven Central; the latest available release is 20240325.1. Update this pin to a released version.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@platform-core/platform-common/pom.xml` at line 91, Update the dependency
version for owasp-java-html-sanitizer in the Maven configuration from the
unpublished 20260101.1 pin to the published 20240325.1 release.

</dependency>
<dependency>
<groupId>org.powermock</groupId>
Expand Down
15 changes: 11 additions & 4 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
<scala.maj.version>2.13</scala.maj.version>
<scala.version>2.13.12</scala.version>
<scalatest.version>3.0.8</scalatest.version>
<fasterxml.jackson.version>2.18.6</fasterxml.jackson.version>
<fasterxml.jackson.version>2.18.9</fasterxml.jackson.version>
<logback.version>1.5.25</logback.version>
</properties>
<profiles>
Expand Down Expand Up @@ -54,7 +54,7 @@
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-bom</artifactId>
<version>4.1.133.Final</version>
<version>4.1.135.Final</version>
<type>pom</type>
<scope>import</scope>
</dependency>
Expand Down Expand Up @@ -101,7 +101,7 @@
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-configuration2</artifactId>
<version>2.15.0</version>
<version>2.15.1</version>
</dependency>
<dependency>
<groupId>org.apache.ivy</groupId>
Expand Down Expand Up @@ -182,6 +182,13 @@
<artifactId>cassandra-all</artifactId>
<version>3.11.18</version>
</dependency>
<!-- Security: htmlunit CVE-2023-4218 (XSLT RCE). -->
<dependency>
<groupId>org.htmlunit</groupId>
<artifactId>htmlunit</artifactId>
<version>3.9.0</version>
<scope>test</scope>
</dependency>
</dependencies>
</dependencyManagement>

Expand Down Expand Up @@ -232,4 +239,4 @@
</pluginManagement>
</build>

</project>
</project>
18 changes: 1 addition & 17 deletions search-api/search-core/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,22 +62,6 @@
<artifactId>httpmime</artifactId>
<version>4.5.10</version>
</dependency>
<dependency>
<groupId>net.sf.json-lib</groupId>
<artifactId>json-lib</artifactId>
<version>2.4</version>
<classifier>jdk15</classifier>
<exclusions>
<exclusion>
<groupId>commons-collections</groupId>
<artifactId>commons-collections</artifactId>
</exclusion>
<exclusion>
<groupId>commons-beanutils</groupId>
<artifactId>commons-beanutils</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>commons-beanutils</groupId>
<artifactId>commons-beanutils</artifactId>
Expand Down Expand Up @@ -120,7 +104,7 @@
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>2.18.6</version>
<version>2.18.9</version>

@coderabbitai coderabbitai Bot Jul 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Align Jackson dependency versions.

jackson-databind was updated to 2.18.9, but jackson-dataformat-cbor (at line 96) is still on version 2.18.6. Mixing Jackson module versions can lead to runtime compatibility issues such as NoSuchMethodError. It is highly recommended to use the same version for all Jackson artifacts, ideally managed via jackson-bom.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@search-api/search-core/pom.xml` at line 107, Align the Jackson module
versions in pom.xml by updating jackson-dataformat-cbor to 2.18.9 to match
jackson-databind. Prefer the existing dependency-management approach, such as
jackson-bom if available, so all Jackson artifacts share one version.

</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
Expand Down
14 changes: 13 additions & 1 deletion search-api/search-service/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@
<play2.version>3.0.5</play2.version>
<play2.plugin.version>1.0.0-rc5</play2.plugin.version>
<sbt-compiler.plugin.version>1.0.0</sbt-compiler.plugin.version>
<netty.version>4.1.133.Final</netty.version>
<netty.version>4.1.135.Final</netty.version>
</properties>

<dependencyManagement>
Expand Down Expand Up @@ -262,6 +262,18 @@
<artifactId>play-specs2_${scala.maj.version}</artifactId>
<version>${play2.version}</version>
<scope>test</scope>
<exclusions>
<!-- Security: htmlunit CVE-2023-4218 (XSLT RCE) -->
<exclusion>
<groupId>net.sourceforge.htmlunit</groupId>
<artifactId>htmlunit</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.htmlunit</groupId>
<artifactId>htmlunit</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.joda</groupId>
Expand Down
2 changes: 1 addition & 1 deletion taxonomy-api/taxonomy-controllers/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
<scala.maj.version>2.13</scala.maj.version>
<scala.version>2.13.12</scala.version>
<play2.version>3.0.5</play2.version>
<fasterxml.jackson.version>2.18.6</fasterxml.jackson.version>
<fasterxml.jackson.version>2.18.9</fasterxml.jackson.version>
</properties>

<dependencies>
Expand Down
14 changes: 13 additions & 1 deletion taxonomy-api/taxonomy-service/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
<play2.version>3.0.5</play2.version>
<play2.plugin.version>1.0.0-rc5</play2.plugin.version>
<sbt-compiler.plugin.version>1.0.0</sbt-compiler.plugin.version>
<netty.version>4.1.133.Final</netty.version>
<netty.version>4.1.135.Final</netty.version>
</properties>

<dependencyManagement>
Expand Down Expand Up @@ -255,6 +255,18 @@
<artifactId>play-specs2_${scala.maj.version}</artifactId>
<version>${play2.version}</version>
<scope>test</scope>
<exclusions>
<!-- Security: htmlunit CVE-2023-4218 (XSLT RCE) -->
<exclusion>
<groupId>net.sourceforge.htmlunit</groupId>
<artifactId>htmlunit</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.htmlunit</groupId>
<artifactId>htmlunit</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.joda</groupId>
Expand Down
Loading