Skip to content

Bump lang3 and netty versions #636

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
gayaldassanayake wants to merge 3 commits into
base: master
Choose a base branch
from
Draft

Bump lang3 and netty versions #636

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4883935
Bump lang3 and netty
gayaldassanayake Mar 19, 2026
69ed147
Bump Netty to 4.1.129.Final to address CVE-2025-67735
gayaldassanayake Apr 3, 2026
c1ef35c
Fix trivy vulnerabilities
gayaldassanayake Apr 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 30 additions & 4 deletions features/org.wso2.msf4j.feature/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -210,11 +210,37 @@

<build>
<resources>
<resource>
<directory>${project.build.directory}/lib/</directory>
</resource>
<resource>
<directory>resources</directory>
</resource>
</resources>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-dependency-plugin</artifactId>
<executions>
<execution>
<id>copy</id>
<phase>package</phase>
<goals>
<goal>copy</goal>
</goals>
<configuration>
<artifactItems>
<artifactItem>
<groupId>org.apache.commons</groupId>
<artifactId>commons-lang3</artifactId>
<version>${apache.commons.lang3.version}</version>
<outputDirectory>${project.build.directory}/lib/launcher</outputDirectory>
</artifactItem>
</artifactItems>
</configuration>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.wso2.carbon.maven</groupId>
<artifactId>carbon-feature-plugin</artifactId>
Expand Down Expand Up @@ -316,10 +342,10 @@
<symbolicName>javax.validation.api</symbolicName>
<version>${javax.validation.version}</version>
</bundle>
<bundle>
<symbolicName>org.apache.commons.lang3</symbolicName>
<version>${apache.commons.lang3.version}</version>
</bundle>
<!-- commons-lang3 3.18.0 is a Multi-Release JAR which P2/Equinox
cannot index. It is shipped via lib/launcher/ instead (see
maven-dependency-plugin copy above), making it available on
the system classpath. -->
<bundle>
<symbolicName>javax.servlet-api</symbolicName>
<version>${javax.servlet-api.version}</version>
Expand Down
28 changes: 28 additions & 0 deletions poms/msf4j-service/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,14 @@
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">

<modelVersion>4.0.0</modelVersion>

<parent>
<groupId>org.wso2.msf4j</groupId>
<artifactId>msf4j-parent</artifactId>
<version>2.8.14-SNAPSHOT</version>
<relativePath>../parent/pom.xml</relativePath>
</parent>

<groupId>org.wso2.msf4j</groupId>
<artifactId>msf4j-service</artifactId>
<packaging>pom</packaging>
Expand Down Expand Up @@ -379,6 +387,26 @@
</plugins>
</pluginManagement>
<plugins>
<!-- Disable inherited checkstyle and spotbugs executions: samples are example code -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-checkstyle-plugin</artifactId>
<executions>
<execution>
<id>validate</id>
<configuration>
<skip>true</skip>
</configuration>
</execution>
</executions>
</plugin>
<plugin>
<groupId>com.github.spotbugs</groupId>
<artifactId>spotbugs-maven-plugin</artifactId>
<configuration>
<skip>true</skip>
</configuration>
</plugin>
<plugin>
<groupId>org.apache.felix</groupId>
<artifactId>maven-bundle-plugin</artifactId>
Expand Down
92 changes: 80 additions & 12 deletions poms/parent/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -477,6 +477,17 @@
<groupId>org.slf4j</groupId>
<artifactId>slf4j-log4j12</artifactId>
<version>${slf4j.log4j.version}</version>
<exclusions>
<exclusion>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>log4j-over-slf4j</artifactId>
<version>${slf4j.version}</version>
</dependency>
<dependency>
<groupId>com.google.code.gson</groupId>
Expand Down Expand Up @@ -772,6 +783,63 @@
<scope>test</scope>
</dependency>

<!-- Security: BouncyCastle version overrides -->
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcprov-jdk15on</artifactId>
<version>1.78</version>
</dependency>
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcpkix-jdk15on</artifactId>
<version>1.78</version>
</dependency>
<!-- Security: pax-logging-log4j2 version override (Log4Shell) -->
<dependency>
<groupId>org.ops4j.pax.logging</groupId>
<artifactId>pax-logging-log4j2</artifactId>
<version>${pax.logging.log4j2.version}</version>
</dependency>
<!-- Security: Global log4j:log4j suppression — runtime replaced by log4j-over-slf4j -->
<dependency>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
<version>1.2.17</version>
<scope>provided</scope>
</dependency>
<!-- Security: transitive dependency version overrides -->
<dependency>
<groupId>commons-fileupload</groupId>
<artifactId>commons-fileupload</artifactId>
<version>1.6.0</version>
</dependency>
<dependency>
<groupId>org.dom4j</groupId>
<artifactId>dom4j</artifactId>
<version>2.1.4</version>
</dependency>
<dependency>
<groupId>org.json</groupId>
<artifactId>json</artifactId>
<version>20240303</version>
</dependency>
<dependency>
<groupId>commons-collections</groupId>
<artifactId>commons-collections</artifactId>
<version>3.2.2</version>
</dependency>
<dependency>
<groupId>com.h2database</groupId>
<artifactId>h2</artifactId>
<version>2.2.224</version>
</dependency>
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-compress</artifactId>
<version>1.27.1</version>
</dependency>
<!-- Security: transitive dependency version overrides - End -->

</dependencies>
</dependencyManagement>

Expand All @@ -791,7 +859,7 @@
<maven.archetype.version>2.4</maven.archetype.version>

<!-- Dependencies -->
<netty.version>4.1.118.Final</netty.version>
<netty.version>4.1.132.Final</netty.version>
<netty-tcnative.version>2.0.54.Final</netty-tcnative.version>
<netty.version.range>(4,5]</netty.version.range>
<commons.pool.version>1.5.6.wso2v1</commons.pool.version>
Expand All @@ -815,7 +883,7 @@
<org.wso2.carbon.transport.http.netty.version>5.0.1</org.wso2.carbon.transport.http.netty.version>
<javax.websocket.version>1.1</javax.websocket.version>
<javax.websocket.version.range>[1.1, 1.2)</javax.websocket.version.range>
<org.apache.httpcomponents.httpclient.version>4.5.2</org.apache.httpcomponents.httpclient.version>
<org.apache.httpcomponents.httpclient.version>4.5.13</org.apache.httpcomponents.httpclient.version>
<msf4j.version>2.8.14-SNAPSHOT</msf4j.version>
<msf4j.version.range>[2.6.0,3.0.0)</msf4j.version.range>
<zipkin.brave.version>3.9.1</zipkin.brave.version>
Expand All @@ -831,7 +899,7 @@
<commons.pool.version>1.5.6.wso2v1</commons.pool.version>
<javax.ws.rs-api.fragment.version>1.0.0.wso2v1</javax.ws.rs-api.fragment.version>
<feign.version>9.3.1</feign.version>
<httpclient.version>4.5.2</httpclient.version>
<httpclient.version>4.5.13</httpclient.version>
<httpcore.version>4.4.5</httpcore.version>
<javax.websocket.version>1.1</javax.websocket.version>
<javax.annotation.version>1.3.2</javax.annotation.version>
Expand All @@ -842,8 +910,8 @@
<rs-api.version>2.0</rs-api.version>
<slf4j.version>1.7.35</slf4j.version>
<slf4j.version.range>[1.7,2)</slf4j.version.range>
<slf4j.log4j.version>1.6.0</slf4j.log4j.version>
<gson.version>2.9.1</gson.version>
<slf4j.log4j.version>1.7.35</slf4j.log4j.version>
<gson.version>2.10.1</gson.version>
<gson.version.range>[2.2,3)</gson.version.range>
<guava.version>32.1.3-jre</guava.version>
<guava.bundle.version>32.1.3.jre</guava.bundle.version>
Expand All @@ -853,16 +921,16 @@
<beanutils.version>1.8.3_2</beanutils.version>
<beanutils.version.range>[1.8,2)</beanutils.version.range>
<beanutils.osgi.version>1.8.3.2</beanutils.osgi.version>
<logback.version>1.0.9</logback.version>
<nimbus.jose.jwt.version>2.25</nimbus.jose.jwt.version>
<logback.version>1.2.13</logback.version>
<nimbus.jose.jwt.version>9.37.4</nimbus.jose.jwt.version>
<io.swagger.version>1.6.9</io.swagger.version>
<swagger.orbit.version>1.6.9.wso2v2</swagger.orbit.version>
<io.swagger.version.range>[1.5.16,1.7.0)</io.swagger.version.range>
<com.fasterxml.jackson.version>2.18.6</com.fasterxml.jackson.version>
<com.fasterxml.jackson.databind.version>2.18.6</com.fasterxml.jackson.databind.version>
<com.fasterxml.jackson.version.range>[2.15.0,2.18.6]</com.fasterxml.jackson.version.range>
<com.fasterxml.jackson.version.range>[2.15.0,2.20.0)</com.fasterxml.jackson.version.range>
<javax.validation.version>1.1.0.Final</javax.validation.version>
<apache.commons.lang3.version>3.4</apache.commons.lang3.version>
<apache.commons.lang3.version>3.18.0</apache.commons.lang3.version>
<javax.servlet-api.version>3.1.0</javax.servlet-api.version>
<reflections.orbit.version>0.9.11.wso2v4</reflections.orbit.version>
<javassist.version>3.19.0-GA</javassist.version>
Expand All @@ -874,7 +942,7 @@
<!-- Dependencies for OSGi PAX exam tests -->
<!--PAX Logging related dependency versions-->
<pax.logging.api.version>1.8.4</pax.logging.api.version>
<pax.logging.log4j2.version>1.8.4</pax.logging.log4j2.version>
<pax.logging.log4j2.version>1.11.17</pax.logging.log4j2.version>
<org.eclipse.equinox.cm.version>1.1.0.v20131021-1936</org.eclipse.equinox.cm.version>

<!--Pax Exam Versions-->
Expand Down Expand Up @@ -902,12 +970,12 @@
<equinox.simpleconfigurator.manipulator.version>2.0.0.v20131217-1203
</equinox.simpleconfigurator.manipulator.version>
<equinox.util.version>1.0.500.v20130404-1337</equinox.util.version>
<org.snakeyaml.version>2.3</org.snakeyaml.version>
<org.snakeyaml.version>2.4</org.snakeyaml.version>
<equinox.simpleconfigurator.version>1.1.0.v20131217-1203</equinox.simpleconfigurator.version>
<testng.version>6.9.4</testng.version>
<maven.paxexam.plugin.version>1.2.4</maven.paxexam.plugin.version>
<org.jacoco.ant.version>0.7.5.201505241946</org.jacoco.ant.version>
<org.springframework.version>4.2.0.RELEASE</org.springframework.version>
<org.springframework.version>5.3.39</org.springframework.version>

<!--Pax Exam Versions-->
<pax.exam.version>4.8.0</pax.exam.version>
Expand Down
4 changes: 2 additions & 2 deletions samples/interceptor/spring-fatjar-interceptor-service/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@
<parent>
<groupId>org.wso2.msf4j</groupId>
<artifactId>msf4j-service</artifactId>
<version>2.4.2-SNAPSHOT</version>
<version>2.8.14-SNAPSHOT</version>
<relativePath>../../../poms/msf4j-service/pom.xml</relativePath>
</parent>
<modelVersion>4.0.0</modelVersion>
Expand Down Expand Up @@ -66,7 +66,7 @@
</build>

<properties>
<interceptor-common.version>2.4.2-SNAPSHOT</interceptor-common.version>
<interceptor-common.version>2.8.14-SNAPSHOT</interceptor-common.version>
<microservice.mainClass>
org.wso2.msf4j.samples.springfatjarinterceptorservice.Application
</microservice.mainClass>
Expand Down
19 changes: 13 additions & 6 deletions samples/jpa/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,11 +29,7 @@
<artifactId>jpa</artifactId>

<properties>
<hibernate.version>5.0.1.Final</hibernate.version>
<netty.version>4.0.30.Final</netty.version>
<slf4j.version>1.7.5</slf4j.version>
<slf4j.log4j.version>1.6.0</slf4j.log4j.version>
<gson.version>2.2.4</gson.version>
<hibernate.version>5.6.15.Final</hibernate.version>
<rs-api.version>2.0</rs-api.version>
<microservice.mainClass>org.wso2.msf4j.example.Application</microservice.mainClass>
</properties>
Expand All @@ -44,17 +40,28 @@
<groupId>org.hibernate</groupId>
<artifactId>hibernate-core</artifactId>
<version>${hibernate.version}</version>
<exclusions>
<exclusion>
<groupId>dom4j</groupId>
<artifactId>dom4j</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.hibernate</groupId>
<artifactId>hibernate-entitymanager</artifactId>
<version>${hibernate.version}</version>
</dependency>
<dependency>
<groupId>org.dom4j</groupId>
<artifactId>dom4j</artifactId>
<version>2.1.4</version>
</dependency>

<dependency>
<groupId>com.h2database</groupId>
<artifactId>h2</artifactId>
<version>1.2.145</version>
<version>2.2.224</version>
</dependency>

<!--<dependency>-->
Expand Down
1 change: 0 additions & 1 deletion samples/jwt-claims/jwt-sample/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,6 @@
<dependency>
<groupId>com.nimbusds</groupId>
<artifactId>nimbus-jose-jwt</artifactId>
<version>2.25</version>
</dependency>
</dependencies>

Expand Down
4 changes: 2 additions & 2 deletions ...wt-claims/jwt-sample/src/main/java/org/wso2/msf4j/example/CustomJWTClaimsInterceptor.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@

package org.wso2.msf4j.example;

import com.nimbusds.jwt.ReadOnlyJWTClaimsSet;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.SignedJWT;
import org.wso2.msf4j.Request;
import org.wso2.msf4j.Response;
Expand All @@ -39,7 +39,7 @@ public boolean interceptRequest(Request request, Response response) throws Excep
String jwtHeader = headers.getHeaderString(JWT_HEADER);
if (jwtHeader != null) {
SignedJWT signedJWT = SignedJWT.parse(jwtHeader);
ReadOnlyJWTClaimsSet readOnlyJWTClaimsSet = signedJWT.getJWTClaimsSet();
JWTClaimsSet readOnlyJWTClaimsSet = signedJWT.getJWTClaimsSet();
if (readOnlyJWTClaimsSet != null) {
// Do something with claims
return true;
Expand Down
1 change: 0 additions & 1 deletion samples/petstore/microservices/fileserver/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,6 @@
<dependency>
<groupId>com.nimbusds</groupId>
<artifactId>nimbus-jose-jwt</artifactId>
<version>2.25</version>
</dependency>
</dependencies>

Expand Down
1 change: 0 additions & 1 deletion samples/petstore/microservices/pet/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,6 @@
<dependency>
<groupId>com.nimbusds</groupId>
<artifactId>nimbus-jose-jwt</artifactId>
<version>2.25</version>
</dependency>
<dependency>
<groupId>org.wso2.msf4j</groupId>
Expand Down
1 change: 0 additions & 1 deletion samples/petstore/microservices/security/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,6 @@
<dependency>
<groupId>com.nimbusds</groupId>
<artifactId>nimbus-jose-jwt</artifactId>
<version>2.25</version>
</dependency>

<dependency>
Expand Down
13 changes: 7 additions & 6 deletions ...rvices/security/src/main/java/org/wso2/msf4j/examples/petstore/security/JWTGenerator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,12 +50,13 @@ protected String generateJWT(User user) throws Exception {
JWSSigner signer = new RSASSASigner(privateKey);

// Prepare JWT with claims set
JWTClaimsSet claimsSet = new JWTClaimsSet();
claimsSet.setSubject(user.getName());
claimsSet.setClaim("email", user.getEmail());
claimsSet.setClaim("roles", user.getRoles());
claimsSet.setIssuer("wso2.org/products/msf4j");
claimsSet.setExpirationTime(new Date(new Date().getTime() + 60 * 60 * 1000)); //60 min
JWTClaimsSet claimsSet = new JWTClaimsSet.Builder()
.subject(user.getName())
.claim("email", user.getEmail())
.claim("roles", user.getRoles())
.issuer("wso2.org/products/msf4j")
.expirationTime(new Date(new Date().getTime() + 60 * 60 * 1000)) //60 min
.build();

SignedJWT signedJWT = new SignedJWT(new JWSHeader(JWSAlgorithm.RS256), claimsSet);

Expand Down
1 change: 0 additions & 1 deletion samples/petstore/microservices/transaction/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,6 @@
<dependency>
<groupId>com.nimbusds</groupId>
<artifactId>nimbus-jose-jwt</artifactId>
<version>2.25</version>
</dependency>
<dependency>
<groupId>org.wso2.msf4j</groupId>
Expand Down
Loading