Update Jettison, adjust scope, and fix test configuration - Jersey 2.x - #6035
Conversation
|
this breaks test for all JDKs that are used for the Jersey CI validation. |
Those are Jettison e2e-entity tests. They say for instance:
|
|
JSON test data has been updated for e2e-entity tests to reflect change in serialisation behaviour when using Jettison 1.5.2. Failure on JaxbTest.generateTests()[96][1] » InvocationTarget has not been resolved. Refer to discussion: #6005 |
0ce5230 to
7cff542
Compare
|
One test is still failing. I tried to rebase and update your PR, but I don't have permissions to push to your branch. |
|
This might narrow our scope to find and fix it: jettison-json/jettison@jettison-1.3.7...jettison-1.3.8 |
…atch from gordillo-ramon applied
|
And here is the fix: jettison-json/jettison#121 @stecurran-est Could you give me permissions to push to your branch, so I could finish it after Jettison merges the fix and releases new version? |
This PR updates Jettison usage and related build configuration to address security issues. Includes fix to resolve Jettison import issue after change of scope. Jersey 2.x branch. Changes uplift org.codehaus.jettison:jettison from 1.3.7 → 1.5.2 to resolve the following CVEs: CVE-2022-40149 CVE-2022-40150 CVE-2022-45685 CVE-2022-45693 CVE-2023-1436 Set Jettison to provided scope to avoid bundling it into artifacts and prevent inclusion of vulnerable versions. Commented out bookmark, bookmark-em, and simple-console from the examples build. These modules import org.codehaus.jettison.json classes directly, which are no longer available at compile time after changing Jettison to provided scope. Add Jettison with test scope in e2e-entity to fix test compilation. Correct pre-existing Surefire config typo: <classpathDependencyExcludes> → <classpathDependencyExclude>.
7cff542 to
8a7de71
Compare
Hi @dmatej Note: I made an additional change where I have commented out bookmark, bookmark-em, and simple-console from the examples build as these modules import org.codehaus.jettison.json classes directly, which are no longer available at compile time after changing Jettison to provided scope. Let me know what you think. |
|
I have reverted the change from compile to provided, not sure why you made it, but it is a breaking change. On the other hand if nothing broke without it, we can just add it to those modules you commented out instead of disabling them. So lets keep it as provided, I will just enable those examples again. My build passed now, so for now I can still create a PR to your branch and we can pause until the Jettison will be released. |
|
@stecurran-est Hmm, unfortunately your repository doesn't allow me to create PRs and I cannot push to this PR too. My branch rebased to your is here, you can merge it on your own, build passed, I just had to use -rf three times as Jetty sometimes doesn't free ports fast enough after tests. You can merge or cherrypick it (maybe better): |
- Until the Jettison is really released, you can override the version with -Djettison.version=1.5.7-SNAPSHOT after you build it locally including the fix. - Colours.getColourListAsJSON has to declare or catch the JSONException now - Enabled and fixed examples disabled in previous commit - Deleted commented out examples which already did not exist - Fixed dependency scopes of jettison Signed-off-by: David Matějček <david.matejcek@omnifish.ee>
|
I will rerun the license check bit later, we have a gitlab issue for this; it will be removed from PR validations, and reviewers will run it manually, or it will be executed on daily basis. There's a problem with the load of endpoints queried by the maven plugin - when we ask too often, we are blacklisted. |
|
@mkarg @arjantijms Can you approve this too? 2.x still requires two approvals. |
- prints ie. this: Jul 23, 2026 7:29:03 PM org.glassfish.jersey.test.spi.TestHelper lambda$toTestContainer$3 INFO: Invoking test jaxbTest (SimpleBean, JsonbTestProvider).test - Before that it was impossible to find out which test failed. - Useful for PR #6035 Signed-off-by: David Matějček <david.matejcek@omnifish.ee>
5 participants
Description
This PR updates Jettison usage and related build configuration to address security issues. Includes fix to resolve Jettison import issue after change of scope. Jersey 2.x branch.
Changes
uplift org.codehaus.jettison:jettison from 1.3.7 → 1.5.2 to resolve the following CVEs:
CVE-2022-40149
CVE-2022-40150
CVE-2022-45685
CVE-2022-45693
CVE-2023-1436
Set Jettison to provided scope to avoid bundling it into artifacts and prevent inclusion of vulnerable versions.
Commented out bookmark, bookmark-em, and simple-console from the examples build. These modules import org.codehaus.jettison.json classes directly, which are no longer available at compile time after changing Jettison to provided scope.
Add Jettison with test scope in e2e-entity to fix test compilation.
Correct pre-existing Surefire config typo:
<classpathDependencyExcludes> → <classpathDependencyExclude>.