From 88e8f01e895726f9374858bf15fd801fc9691616 Mon Sep 17 00:00:00 2001 From: Matt Raible Date: Sat, 14 Nov 2026 13:21:47 -0700 Subject: [PATCH 1/2] Update dependencies before the 7.0.0 release candidate Every dependency is on its latest patch or minor release, and OGNL is pinned past CVE-2026-113730. - Struts 7.3.0 -> 7.4.0, Spring 7.0.9 -> 7.0.10, Spring Security 7.1.1 -> 7.1.2 - Jetty (plugin and db-utils) 12.1.13 -> 12.1.15 - Jackson 2.22.3 -> 2.23.0, Guava 33.7.2 -> 33.8.0, Bouncy Castle 1.86 -> 1.87, ASM 9.10.1 -> 9.11.1 - commons-codec 1.22.1 -> 1.23.0, commons-lang3 3.20.0 -> 3.22.0, commons-secure-xml 1.0.0 -> 1.1.1 - bootstrap-icons 1.13.1 -> 1.13.2, Instancio (tests) 6.0.1 -> 6.2.1 - OGNL 3.4.17 in dependencyManagement. Struts 7.4.0 alone brings 3.4.12, which is still affected. --- CHANGES.md | 3 +++ app/pom.xml | 22 +++++++++++----------- db-utils/pom.xml | 2 +- pom.xml | 11 +++++++++-- 4 files changed, 24 insertions(+), 14 deletions(-) diff --git a/CHANGES.md b/CHANGES.md index 631a2498db..1228636086 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -132,6 +132,9 @@ ### Build and packaging +- Third-party libraries are updated to their latest patch and minor releases, + among them Struts 7.4.0, Spring 7.0.10 and Spring Security 7.1.2. OGNL is + pinned to 3.4.17, which fixes CVE-2026-113730. - The source distribution now extracts to `apache-roller--source/`, matching its file name, instead of `roller-weblogger--source/`. diff --git a/app/pom.xml b/app/pom.xml index 43c8b51ef8..107d4a0e16 100644 --- a/app/pom.xml +++ b/app/pom.xml @@ -37,14 +37,14 @@ limitations under the License. 4.0.0 3.0.2 1.10.18 - 9.10.1 - 1.86 + 9.11.1 + 1.87 1.11.0 1.11.0 - 1.22.1 + 1.23.0 1.15.0 - 3.20.0 - 1.0.0 + 3.22.0 + 1.1.1 5.0.2 7.0.0 2.26.1 @@ -54,12 +54,12 @@ limitations under the License. 1.0b3 1.19.0 2.0.20 - 7.0.9 - 7.1.1 - 7.3.0 + 7.0.10 + 7.1.2 + 7.4.0 6.2.0 5.3.8 - 1.13.1 + 1.13.2 2.4.1 1.0.2 3.1.3 @@ -510,7 +510,7 @@ limitations under the License. com.fasterxml.jackson.core jackson-databind - 2.22.3 + 2.23.0 @@ -591,7 +591,7 @@ limitations under the License. org.instancio instancio-junit - 6.0.1 + 6.2.1 test diff --git a/db-utils/pom.xml b/db-utils/pom.xml index f9dcb92bf1..8ba8fae291 100644 --- a/db-utils/pom.xml +++ b/db-utils/pom.xml @@ -71,7 +71,7 @@ org.apache.commons commons-lang3 - 3.20.0 + 3.22.0 compile diff --git a/pom.xml b/pom.xml index fdf43762b4..0aef435a09 100644 --- a/pom.xml +++ b/pom.xml @@ -41,7 +41,7 @@ limitations under the License. 10.16.1.1 - 12.1.13 + 12.1.15 UTF-8 UTF-8 7.0.0-SNAPSHOT @@ -157,7 +157,14 @@ limitations under the License. com.google.guava guava - 33.7.2-jre + 33.8.0-jre + + + + ognl + ognl + 3.4.17 From e8ce4687723b865c4010ee16e74ec8670e428b9f Mon Sep 17 00:00:00 2001 From: Matt Raible Date: Sat, 14 Nov 2026 14:11:13 -0700 Subject: [PATCH 2/2] Load bootstrap-icons 1.13.2 from its new webjar path The pom moved bootstrap-icons to 1.13.2, but head.jsp still loaded /webjars/bootstrap-icons/1.13.1/font/bootstrap-icons.css. That path now answers 404, so every admin page lost its icon font, and icon-only links such as the entry list's delete link had no size. That is what failed all three UI test jobs. WebjarPathsTest checks that every /webjars/... path in the JSPs and Velocity templates names a file a webjar on the classpath contains, so a version bump that misses a page fails in the unit tests. --- .../main/webapp/WEB-INF/jsps/tiles/head.jsp | 2 +- .../roller/weblogger/ui/WebjarPathsTest.java | 72 +++++++++++++++++++ 2 files changed, 73 insertions(+), 1 deletion(-) create mode 100644 app/src/test/java/org/apache/roller/weblogger/ui/WebjarPathsTest.java diff --git a/app/src/main/webapp/WEB-INF/jsps/tiles/head.jsp b/app/src/main/webapp/WEB-INF/jsps/tiles/head.jsp index 5dd60291f6..6a24dd9d06 100644 --- a/app/src/main/webapp/WEB-INF/jsps/tiles/head.jsp +++ b/app/src/main/webapp/WEB-INF/jsps/tiles/head.jsp @@ -37,7 +37,7 @@ You can override it with your own file via WEB-INF/tiles-def.xml - + diff --git a/app/src/test/java/org/apache/roller/weblogger/ui/WebjarPathsTest.java b/app/src/test/java/org/apache/roller/weblogger/ui/WebjarPathsTest.java new file mode 100644 index 0000000000..f98029dd9c --- /dev/null +++ b/app/src/test/java/org/apache/roller/weblogger/ui/WebjarPathsTest.java @@ -0,0 +1,72 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. The ASF licenses this file to You + * under the Apache License, Version 2.0 (the "License"); you may not + * use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. For additional information regarding + * copyright in this work, please see the NOTICE file in the top level + * directory of this distribution. + */ + +package org.apache.roller.weblogger.ui; + +import java.io.IOException; +import java.nio.charset.StandardCharsets; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.util.ArrayList; +import java.util.List; +import java.util.regex.Matcher; +import java.util.regex.Pattern; +import java.util.stream.Stream; + +import org.junit.jupiter.api.Test; + +import static org.junit.jupiter.api.Assertions.assertTrue; + +/** + * Pages load webjar files by versioned paths such as + * /webjars/bootstrap-icons/1.13.2/font/bootstrap-icons.css. When a + * webjar's version changes in the pom and a path is left behind, the server + * answers 404 and the page loses its styles or scripts. Every such path must + * name a file that a webjar on the classpath actually contains. + */ +public class WebjarPathsTest { + + private static final Path WEBAPP = Paths.get( + System.getProperty("project.basedir", System.getProperty("user.dir")), + "src", "main", "webapp"); + + private static final Pattern WEBJAR_PATH = Pattern.compile("/webjars/([^'\"?#\\s]+)"); + + @Test + public void everyWebjarPathPointsAtAFileInAWebjar() throws IOException { + List missing = new ArrayList<>(); + int checked = 0; + try (Stream files = Files.walk(WEBAPP)) { + for (Path file : (Iterable) files.filter(p -> p.toString().endsWith(".jsp") + || p.toString().endsWith(".vm"))::iterator) { + String text = Files.readString(file, StandardCharsets.UTF_8); + Matcher m = WEBJAR_PATH.matcher(text); + while (m.find()) { + checked++; + String resource = "META-INF/resources/webjars/" + m.group(1); + if (getClass().getClassLoader().getResource(resource) == null) { + missing.add(WEBAPP.relativize(file) + ": /webjars/" + m.group(1)); + } + } + } + } + assertTrue(checked > 0, "no webjar paths found under " + WEBAPP); + assertTrue(missing.isEmpty(), "webjar files that no webjar contains:\n" + String.join("\n", missing)); + } +}