[dependabot]

Bumps net.sourceforge.pmd:pmd-java from 7.27.0 to 7.29.0.

Release notes

Sourced from net.sourceforge.pmd:pmd-java's releases.

PMD 7.29.0 (30-October-2026)

30-October-2026 - 7.29.0

The PMD team is pleased to announce PMD 7.29.0.

This is a minor release.

Table Of Contents

• 🚀️ New and noteworthy
  • Security fixes
• 🌟️ New and Changed Rules
  • New Rules
  • Changed Rules
  • Deprecated Rules
• 🐛️ Fixed Issues
• 🚨️ API Changes
• ✨️ Merged pull requests
• 📦️ Dependency updates
• 📈️ Stats

🚀️ New and noteworthy

Security fixes

All known security vulnerabilities are described in full detail on the page PMD Security. This release, the following security vulnerabilities were fixed:

• GHSA-wj6q-xw9m-26p6: Arbitrary file disclosure in CPD via symlinks in analyzed sources.
  When collecting files, CPD followed symbolic links, even if their targets were outside the scanned directory. This allowed reading any file accessible to the user running CPD. If a CI/CD pipeline runs CPD on untrusted source code (e.g. a pull request from an external contributor), an attacker could commit two symlinks pointing to the same file outside the project. CPD detected them as duplicates and wrote the full content of the target file into the report. If the report was published, e.g. as a CI artifact, the attacker could read it.
  With this fix, neither PMD nor CPD follows symbolic links anymore when collecting files to analyze.
  Affected versions: PMD >= 6.54.0 and <= 7.28.0. If you run CPD on untrusted source code, it is recommended to upgrade PMD.
  Reported by Dan (@​7alen7). Independently reported by lapeace (@​ThejasRajamoney).
• GHSA-5x5v-644m-q2qc: XSS via externalInfoUrl in HTML report formats.
  The html and summaryhtml renderers inserted a rule's externalInfoUrl into generated reports without escaping or URL-scheme validation. With a crafted ruleset, this allowed injected markup that runs when the report is opened (with --show-suppressed), or javascript: links that run when clicked. This only affects setups where PMD loads an untrusted ruleset and the resulting HTML report is viewed in a browser.

... (truncated)

Commits

• 47b3135 [release] prepare release pmd_releases/7.29.0
• df93eb5 Prepare pmd release 7.29.0
• 7d4b9ad Update contributors for 7.29.0
• cc67aac [doc] Update security.md and attributions
• e79c4e1 [core] Fix missing escaping in CSV renderers (#7262)
• 71d38f5 [core] Disallow external entity expansions/DTD in XML parsing (#7261)
• 1e4fd94 [core] HTMLRenderers: Properly escape rule name and externalInfoUrl (#7260)
• 7aec5c1 [core] Don't follow symlinks in FileCollector (#7259)
• c7560e0 [doc] Improve release notes
• c44b87c [java] Fix #7213: UnusedPrivateMethod/UnusedPrivateField with qualified Metho...
• Additional commits viewable in compare view

[github-actions]

Allure Report Summary

	Environment	Duration	Stats	New	Flaky	Retry
	All tests	44m 9s	⁠ 2694 ⁠ 1	0	0	0
	ubuntu-jdk-17	22m 57s	⁠ 1321 ⁠ 1	0	0	0
	ubuntu-jdk-25	21m 12s	⁠ 1373	0	0	0

Reports: Awesome

Context: 127eb714, Build

Allure TestOps: Allure Java GitHub actions run (2026-11-02T17:20:14.170Z)

Artifacts used (2)

• allure-results-test-jdk-17.zip
• allure-results-test-jdk-25.zip