Update dependencies before the 7.0.0 release candidate

CHANGES.md

@@ -132,6 +132,9 @@
 
 ### Build and packaging
 
+- Third-party libraries are updated to their latest patch and minor releases,
+  among them Struts 7.4.0, Spring 7.0.10 and Spring Security 7.1.2. OGNL is
+  pinned to 3.4.17, which fixes CVE-2026-113730.
 - **The WAR no longer includes jcl-over-slf4j.** Roller logs through
   commons-logging 1.4, which sends everything straight to Log4j. A deployment
   that added its own commons-logging bridge should remove it.

app/pom.xml

@@ -37,14 +37,14 @@ limitations under the License.
         <jsp-api.version>4.0.0</jsp-api.version>
         <jstl.version>3.0.2</jstl.version>
         <ant.version>1.10.18</ant.version>
-        <asm.version>9.10.1</asm.version>
-        <bouncycastle.version>1.86</bouncycastle.version>
+        <asm.version>9.11.1</asm.version>
+        <bouncycastle.version>1.87</bouncycastle.version>
         <commons-validator.version>1.11.0</commons-validator.version>
         <commons-beanutils.version>1.11.0</commons-beanutils.version>
-        <commons-codec.version>1.22.1</commons-codec.version>
+        <commons-codec.version>1.23.0</commons-codec.version>
         <commons-text.version>1.15.0</commons-text.version>
-        <commons-lang3.version>3.20.0</commons-lang3.version>
-        <commons-secure-xml.version>1.0.0</commons-secure-xml.version>
+        <commons-lang3.version>3.22.0</commons-lang3.version>
+        <commons-secure-xml.version>1.1.1</commons-secure-xml.version>
         <eclipse-link.version>5.0.2</eclipse-link.version>
         <guice.version>7.0.0</guice.version>
         <log4j2.version>2.26.1</log4j2.version>
@@ -54,12 +54,12 @@ limitations under the License.
         <maven-antrun.version>1.0b3</maven-antrun.version>
         <rome.version>1.19.0</rome.version> <!-- ROME core; used for feeds/planet (AtomPub no longer uses Propono) -->
         <slf4j.version>2.0.20</slf4j.version>
-        <spring.version>7.0.9</spring.version>
-        <spring.security.version>7.1.1</spring.security.version>
-        <struts.version>7.3.0</struts.version>
+        <spring.version>7.0.10</spring.version>
+        <spring.security.version>7.1.2</spring.security.version>
+        <struts.version>7.4.0</struts.version>
         <struts-bootstrap.version>6.2.0</struts-bootstrap.version>
         <bootstrap.version>5.3.8</bootstrap.version>
-        <bootstrap-icons.version>1.13.1</bootstrap-icons.version>
+        <bootstrap-icons.version>1.13.2</bootstrap-icons.version>
         <velocity.version>2.4.1</velocity.version>
         <ws-commons-util.version>1.0.2</ws-commons-util.version>
         <xmlrpc-version>3.1.3</xmlrpc-version>
@@ -503,7 +503,7 @@ limitations under the License.
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>2.22.3</version>
+            <version>2.23.0</version>
         </dependency>
 
         <!-- Other deps include Guice and ROME -->
@@ -584,7 +584,7 @@ limitations under the License.
         <dependency>
             <groupId>org.instancio</groupId>
             <artifactId>instancio-junit</artifactId>
-            <version>6.0.1</version>
+            <version>6.2.1</version>
             <scope>test</scope>
         </dependency>
 

app/src/main/webapp/WEB-INF/jsps/tiles/head.jsp

@@ -37,7 +37,7 @@ You can override it with your own file via WEB-INF/tiles-def.xml
 <script src="<s:url value='/webjars/jquery-validation/1.21.0/jquery.validate.min.js' />"></script>
 
 <link href="<s:url value='/webjars/bootstrap/5.3.8/css/bootstrap.min.css' />" rel="stylesheet" />
-<link href="<s:url value='/webjars/bootstrap-icons/1.13.1/font/bootstrap-icons.css' />" rel="stylesheet" />
+<link href="<s:url value='/webjars/bootstrap-icons/1.13.2/font/bootstrap-icons.css' />" rel="stylesheet" />
 <script src="<s:url value='/webjars/bootstrap/5.3.8/js/bootstrap.bundle.min.js' />"></script>
 
 <script src="<s:url value='/webjars/clipboard.js/2.0.11/clipboard.min.js' />"></script>

app/src/test/java/org/apache/roller/weblogger/ui/WebjarPathsTest.java

@@ -0,0 +1,72 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ *  contributor license agreements.  The ASF licenses this file to You
+ * under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.  For additional information regarding
+ * copyright in this work, please see the NOTICE file in the top level
+ * directory of this distribution.
+ */
+
+package org.apache.roller.weblogger.ui;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import java.util.stream.Stream;
+
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * Pages load webjar files by versioned paths such as
+ * <code>/webjars/bootstrap-icons/1.13.2/font/bootstrap-icons.css</code>. When a
+ * webjar's version changes in the pom and a path is left behind, the server
+ * answers 404 and the page loses its styles or scripts. Every such path must
+ * name a file that a webjar on the classpath actually contains.
+ */
+public class WebjarPathsTest {
+
+    private static final Path WEBAPP = Paths.get(
+            System.getProperty("project.basedir", System.getProperty("user.dir")),
+            "src", "main", "webapp");
+
+    private static final Pattern WEBJAR_PATH = Pattern.compile("/webjars/([^'\"?#\\s]+)");
+
+    @Test
+    public void everyWebjarPathPointsAtAFileInAWebjar() throws IOException {
+        List<String> missing = new ArrayList<>();
+        int checked = 0;
+        try (Stream<Path> files = Files.walk(WEBAPP)) {
+            for (Path file : (Iterable<Path>) files.filter(p -> p.toString().endsWith(".jsp")
+                    || p.toString().endsWith(".vm"))::iterator) {
+                String text = Files.readString(file, StandardCharsets.UTF_8);
+                Matcher m = WEBJAR_PATH.matcher(text);
+                while (m.find()) {
+                    checked++;
+                    String resource = "META-INF/resources/webjars/" + m.group(1);
+                    if (getClass().getClassLoader().getResource(resource) == null) {
+                        missing.add(WEBAPP.relativize(file) + ": /webjars/" + m.group(1));
+                    }
+                }
+            }
+        }
+        assertTrue(checked > 0, "no webjar paths found under " + WEBAPP);
+        assertTrue(missing.isEmpty(), "webjar files that no webjar contains:\n" + String.join("\n", missing));
+    }
+}

db-utils/pom.xml

@@ -68,7 +68,7 @@
         <dependency>
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-lang3</artifactId>
-            <version>3.20.0</version>
+            <version>3.22.0</version>
             <scope>compile</scope>
         </dependency>
     </dependencies>

pom.xml

@@ -41,7 +41,7 @@ limitations under the License.
 
     <properties>
         <derby.version>10.16.1.1</derby.version>
-        <jetty.plugin.version>12.1.13</jetty.plugin.version>
+        <jetty.plugin.version>12.1.15</jetty.plugin.version>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
         <roller.version>7.0.0-SNAPSHOT</roller.version>
@@ -157,7 +157,14 @@ limitations under the License.
             <dependency>
                 <groupId>com.google.guava</groupId>
                 <artifactId>guava</artifactId>
-                <version>33.7.2-jre</version>
+                <version>33.8.0-jre</version>
+            </dependency>
+            <!-- transitive through struts2-core; 3.4.12 lets reflection proxies bypass the
+                 stricter-invocation block list (CVE-2026-113730), fixed in 3.4.13 -->
+            <dependency>
+                <groupId>ognl</groupId>
+                <artifactId>ognl</artifactId>
+                <version>3.4.17</version>
             </dependency>
         </dependencies>
     </dependencyManagement>