Skip to content

Major Security Updates #37

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kal merged 13 commits into from
Dec 5, 2025
Merged

Major Security Updates #37

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
5a95b3b
Update dependencies with major impact
Nov 3, 2025
5232a16
v4 change notes
Nov 3, 2025
e1fd512
Upgrade JUnit 4 to Jupiter
Nov 10, 2025
8596614
Fix RemoteSparqlSource
der Nov 11, 2025
9cdd89b
Merge pull request #35 from epimorphics/fix-illegal-timeouts
der Nov 11, 2025
430ce48
Bump Jena and Tomcat versions
kal Nov 25, 2025
9633e6b
Merge pull request #36 from epimorphics/update-jena-tomcat
kal Nov 25, 2025
11594fa
Merge branch 'main' into tech/major-security-updates
kal Dec 5, 2025
0ff8747
Update lib to 4.0.0
kal Dec 5, 2025
f9ae8ac
Remove commented out sections and reformat for consistency
kal Dec 5, 2025
575095a
Update plugins
kal Dec 5, 2025
55d78e5
Merge 4.0 notes into changelog
kal Dec 5, 2025
290b67c
Implement PR feedback
kal Dec 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,20 @@ Reusable foundation for java RDF applications that provide a web UI or web API o

## Changelog

**4.0.0**
* Appbase is compiled by JDK 21 and is compatible only with Java versions 21 and above.
* This version upgrades the following dependencies with major impact.
This may cause backwards compatibility issues for applications using Appbase:
* Tomcat 9.0 -> 11.0
* Jena 3.9 -> 5.6
* Lib 3.1 -> 4.0
* Jersey 2.25 -> 3.1
* Replaced all usages of javax servlet infrastructure with jakarta.
* Maven artifacts for Appbase version 4.0.0 and onwards are published to the Epimorphics public S3 Maven repository.
* The `DatasetAccessor` interface from Jena 3 is replaced by `com.epimorphics.appbase.data.DatasetAccessor`:
* It is directly implemented by `RDFConnectionDatasetAccessor` and indirectly by various wrapper classes which are unchanged from the previous version.
* It has removed the `containsModel` method since no Jena 5 equivalent exists.

**3.1.12**
* Fix log level in output of RunShell to be ERROR level if process returns failed status

Expand Down
215 changes: 125 additions & 90 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>com.epimorphics</groupId>
<artifactId>appbase</artifactId>
Expand All @@ -12,10 +13,12 @@

<properties>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<tomcat.version>9.0.110</tomcat.version>
<jena.version>3.9.0</jena.version>
<lib.version>3.1.8</lib.version>
<jersey.version>2.25.1</jersey.version>
<maven.compiler.source>21</maven.compiler.source>
<maven.compiler.target>21</maven.compiler.target>
<tomcat.version>11.0.12</tomcat.version>
<jena.version>5.6.0</jena.version>
<lib.version>4.0.0</lib.version>
<jersey.version>3.1.11</jersey.version>
</properties>

<repositories>
Expand All @@ -37,7 +40,7 @@
<enabled>true</enabled>
</snapshots>
</repository>

<repository>
<releases>
<enabled>true</enabled>
Expand All @@ -50,29 +53,37 @@
<url>https://repository.epimorphics.com</url>
</repository>

<repository>
<id>epi-public-s3-release</id>
<name>Epimorphics S3 release repository</name>
<url>https://epi-repository.s3-eu-west-1.amazonaws.com/release</url>
<releases><enabled>true</enabled></releases>
<snapshots><enabled>false</enabled></snapshots>
</repository>

<repository>
<id>epi-public-s3-snapshot</id>
<name>Epimorphics S3 snapshot repository</name>
<url>https://epi-repository.s3-eu-west-1.amazonaws.com/snapshot</url>
<releases><enabled>false</enabled></releases>
<snapshots><enabled>true</enabled></snapshots>
</repository>

<repository>
<id>epi-public-s3-release</id>
<name>Epimorphics S3 release repository</name>
<url>https://epi-repository.s3-eu-west-1.amazonaws.com/release</url>
<releases>
<enabled>true</enabled>
</releases>
<snapshots>
<enabled>false</enabled>
</snapshots>
</repository>

<repository>
<id>epi-public-s3-snapshot</id>
<name>Epimorphics S3 snapshot repository</name>
<url>https://epi-repository.s3-eu-west-1.amazonaws.com/snapshot</url>
<releases>
<enabled>false</enabled>
</releases>
<snapshots>
<enabled>true</enabled>
</snapshots>
</repository>

</repositories>

<dependencies>
<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
<version>4.13.1</version>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter-api</artifactId>
<version>5.12.2</version>
<scope>provided</scope>
</dependency>
<dependency>
Expand All @@ -85,18 +96,6 @@
<groupId>org.apache.jena</groupId>
<artifactId>jena-text</artifactId>
<version>${jena.version}</version>
<!--
<exclusions>
<exclusion>
<groupId>org.apache.httpcomponents</groupId>
<artifactId>httpclient</artifactId>
</exclusion>
<exclusion>
<groupId>org.apache.solr</groupId>
<artifactId>solr-solrj</artifactId>
</exclusion>
</exclusions>
-->
</dependency>

<dependency>
Expand All @@ -106,21 +105,22 @@
</dependency>

<dependency>
<groupId>org.apache.velocity</groupId>
<artifactId>velocity-engine-core</artifactId>
<version>2.4.1</version>
<groupId>org.apache.velocity</groupId>
<artifactId>velocity-engine-core</artifactId>
<version>2.4.1</version>
</dependency>

<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-lang3</artifactId>
<version>3.18.0</version>
</dependency>
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-lang3</artifactId>
<version>3.18.0</version>
</dependency>

<dependency>
<groupId>org.yaml</groupId>
<artifactId>snakeyaml</artifactId>
<version>2.0</version>
</dependency>
<version>2.3</version>
</dependency>

<dependency>
<groupId>org.apache.tomcat.embed</groupId>
Expand All @@ -137,60 +137,66 @@
</dependency>

<dependency>
<groupId>javax.servlet</groupId>
<artifactId>javax.servlet-api</artifactId>
<version>3.1.0</version>
<scope>provided</scope>
<groupId>commons-beanutils</groupId>
<artifactId>commons-beanutils</artifactId>
<version>1.11.0</version>
</dependency>

<dependency>
<groupId>commons-beanutils</groupId>
<artifactId>commons-beanutils</artifactId>
<version>1.11.0</version>
<groupId>org.glassfish.jersey.media</groupId>
<artifactId>jersey-media-multipart</artifactId>
<version>${jersey.version}</version>
</dependency>

<dependency>
<groupId>org.glassfish.jersey.media</groupId>
<artifactId>jersey-media-multipart</artifactId>
<version>${jersey.version}</version>
<groupId>org.glassfish.jersey.core</groupId>
<artifactId>jersey-client</artifactId>
<version>${jersey.version}</version>
</dependency>

<dependency>
<groupId>org.glassfish.jersey.core</groupId>
<artifactId>jersey-client</artifactId>
<version>${jersey.version}</version>
<groupId>org.glassfish.jersey.connectors</groupId>
<artifactId>jersey-apache-connector</artifactId>
<version>${jersey.version}</version>
<exclusions>
<exclusion>
<groupId>org.apache.httpcomponents</groupId>
<artifactId>httpclient</artifactId>
</exclusion>
</exclusions>
</dependency>

<dependency>
<groupId>org.glassfish.jersey.connectors</groupId>
<artifactId>jersey-apache-connector</artifactId>
<version>${jersey.version}</version>
<exclusions>
<exclusion>
<groupId>org.apache.httpcomponents</groupId>
<artifactId>httpclient</artifactId>
</exclusion>
</exclusions>
<groupId>org.apache.jena</groupId>
<artifactId>jena-fuseki-main</artifactId>
<version>${jena.version}</version>
<exclusions>
<exclusion>
<groupId>org.eclipse.jetty.orbit</groupId>
<artifactId>javax.servlet</artifactId>
</exclusion>
</exclusions>
<scope>test</scope>
</dependency>

</dependencies>

<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<version>3.3</version>
<version>3.14.1</version>
<configuration>
<source>1.8</source>
<target>1.8</target>
<source>${maven.compiler.source}</source>
<target>${maven.compiler.target}</target>
</configuration>
</plugin>

<plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-scm-plugin</artifactId>
<version>1.9.4</version>
<version>2.2.1</version>
<configuration>
<connectionType>developerConnection</connectionType>
</configuration>
Expand All @@ -199,23 +205,33 @@
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-release-plugin</artifactId>
<version>2.5.3</version>
<version>3.1.1</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId>
<version>3.5.4</version>
<configuration>
<properties>
<excludeTags>slow</excludeTags>
</properties>
</configuration>
</plugin>

</plugins>

<extensions>
<extension>
<groupId>org.apache.maven.wagon</groupId>
<artifactId>wagon-ftp</artifactId>
<version>2.12</version>
<version>3.5.3</version>
</extension>
<extension>
<groupId>org.springframework.build</groupId>
<artifactId>aws-maven</artifactId>
<version>5.0.0.RELEASE</version>
</extension>
<extension>
<groupId>org.springframework.build</groupId>
<artifactId>aws-maven</artifactId>
<version>5.0.0.RELEASE</version>
</extension>

</extensions>

<pluginManagement>
Expand All @@ -238,7 +254,7 @@
</goals>
</pluginExecutionFilter>
<action>
<ignore />
<ignore/>
</action>
</pluginExecution>
</pluginExecutions>
Expand All @@ -251,9 +267,28 @@

<distributionManagement>
<repository>
<id>epi-public-repo</id>
<url>ftp://epimorphics.com</url>
<id>epi-public-s3-release</id>
<name>Epimorphics S3 release repository</name>
<url>s3://epi-repository/release</url>
<releases>
<enabled>true</enabled>
</releases>
<snapshots>
<enabled>false</enabled>
</snapshots>
</repository>

<snapshotRepository>
<id>epi-public-s3-snapshot</id>
<name>Epimorphics S3 snapshot repository</name>
<url>s3://epi-repository/snapshot</url>
<releases>
<enabled>false</enabled>
</releases>
<snapshots>
<enabled>true</enabled>
</snapshots>
</snapshotRepository>
</distributionManagement>

</project>
4 changes: 2 additions & 2 deletions src/main/java/com/epimorphics/appbase/core/App.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -323,9 +323,9 @@ protected void processConfigLine(int lineNum, String line) {
String name = value.toString();
Object component = null;
if (classLoader == null) {
component = Class.forName(name).newInstance();
component = Class.forName(name).getDeclaredConstructor().newInstance();
} else {
component = Class.forName(name, true, getLoader()).newInstance();
component = Class.forName(name, true, getLoader()).getDeclaredConstructor().newInstance();
}
if (component instanceof Named) {
((Named)component).setName(target);
Expand Down
7 changes: 3 additions & 4 deletions src/main/java/com/epimorphics/appbase/core/AppConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,10 +17,9 @@
import java.util.List;
import java.util.Map;

import javax.servlet.ServletContext;
import javax.servlet.ServletContextEvent;
import javax.servlet.ServletContextListener;

import jakarta.servlet.ServletContext;
import jakarta.servlet.ServletContextEvent;
import jakarta.servlet.ServletContextListener;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

Expand Down
2 changes: 1 addition & 1 deletion src/main/java/com/epimorphics/appbase/core/ComponentBase.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ public static String expandFileLocation(String filename) {

public void require(Object value, String valuename) {
if (value == null) {
log.error(String.format("Missing parameter %s on component %s.%s", valuename, app.getName(), componentName));
log.error("Missing parameter {} on component {}.{}", valuename, app.getName(), componentName);
}
}

Expand Down
Loading
Loading