bump postgresql + owasp-java-html-sanitizer to clear HIGH advisories (alerts 505, 508) - #1586
Merged
Merged
Conversation
…to clear advisories (Dependabot alerts 505 and 508)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bumps two direct managed dependency versions in
saiku-bom/pom.xmlto clear two HIGH Dependabot advisories:42.7.11->42.7.12(clears Dependabot alert 505). Patch release within the maintained 42.7.x JDBC4-driver line — pure-API drop-in, no code changes.20240325.1->20260101.1(clears Dependabot alert 508). Forward bump on the date-versioned release line.Note: these are Dependabot alert numbers, not issue numbers — referenced in prose only.
Where
Both are declared once, in
saiku-bom/pom.xml:<version>literal on the managed dependency.owasp.html.sanitizer.versionproperty (comment updated to match).Grep across all
pom.xmlconfirms no second declaration or hardcoded old version left behind. Consumers (saiku-webapp,saiku-core/saiku-sqlfor postgres;saiku-core/saiku-webfor the sanitizer) reference the managed version with no local override.Sanitizer API-change risk
Single call site:
saiku-core/saiku-web/.../email/EmailMessageAssembler.javausesSanitizers.FORMATTING/BLOCKS/LINKS/TABLES,PolicyFactory.and(...), and.sanitize(String)— the stable core public API, unchanged across the 2024->2026 releases. Low risk.Build / test
mvn -B -ntp -pl saiku-core/saiku-web,saiku-core/saiku-sql -am test— BUILD SUCCESS.saiku-web: 564 tests, 0 failures — includingEmailMessageAssemblerTest(13/13), which exercises the sanitizer path with the new version.saiku-sql: compiled + tested against postgres 42.7.12.