bump commons-fileupload to fix CVE-2025-48976 (form-spring) #2956
Conversation
DRoppelt
changed the title
|
duplicate of #2940 |
|
feign-vertx appears to be crunchy, https://app.circleci.com/pipelines/github/OpenFeign/feign/3980/workflows/39943145-aa46-4d8d-ab39-e95da93e0181/jobs/9602 failed where https://app.circleci.com/pipelines/github/OpenFeign/feign/3981/workflows/d64c1fae-3704-4898-9abe-4f05b44c6f2d/jobs/9604 was a re-run done via a squash of two commits Also, bump from commons-fileupload 1.5 to 1.6.0 caused moditect to fail, other modules ignore it too, doing it here as well I tried to configure/tweak moditect-maven-plugin, but found what the plugin does or what kind of config is required confusing and gave up. It sounds like a "form-spring requires portlet.api, because of commons-fileupload" (duh), the plugin docs were not straight forward to declare that module-requirement |
bump from commons-fileupload 1.5 to 1.6.0 caused moditect to fail, other modules ignore it too, doing it here as well ignores: [ERROR] Failed to execute goal org.moditect:moditect-maven-plugin:1.3.0.Final:add-module-info (add-module-infos) on project feign-form-spring: Execution add-module-infos of goal org.moditect:moditect-maven-plugin:1.3.0.Final:add-module-info failed: Module portlet.api not found, required by org.apache.commons.fileupload
|
|
||
| <properties> | ||
| <main.java.version>17</main.java.version> | ||
| <moditect.skip>true</moditect.skip> |
2 participants
fixes GHSA-vv7r-c36w-3prj
It does not seem like form-spring would be affected, but this would fix any of the dumb auditing tools that only look for the presence of libs