Skip to content

Commit 1f03942

Browse files
authored
dependency: upgrade assertj-core to 3.27.7 to fix XXE vulnerability (CVE-2025-NDJSON) (#969)
Fixes #101 (Dependabot security alert) assertj-core <= 3.27.6 is vulnerable to XML External Entity (XXE) injection when parsing XML assertions. Upgrade to 3.27.7 which disables external entity processing by default. All 412 unit tests pass with the new version.
1 parent c36bd52 commit 1f03942

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@
111111
<junit.version>5.13.4</junit.version>
112112
<mockito.version>4.11.0</mockito.version>
113113
<jazzer.junit.version>0.25.1</jazzer.junit.version>
114-
<assertj.version>3.25.3</assertj.version>
114+
<assertj.version>3.27.7</assertj.version>
115115
<surefire.jvm.args>-Xmx2g -Xms2g -XX:+HeapDumpOnOutOfMemoryError -Dfile.encoding=UTF-8</surefire.jvm.args>
116116
<surefire.jdk9plus.args></surefire.jdk9plus.args>
117117
<argLine></argLine>

0 commit comments

Comments
 (0)