Update Info

SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2024-1874


Security update for Java


Type: security
Severity: important
Issued: 2024-05-31
Description:
This update for Java fixes thefollowing issues:

apiguardian was updated to vesion 1.1.2:

- Added LICENSE/NOTICE to the generated jar
- Allow @API to be declared at the package level
- Explain usage of Status.DEPRECATED
- Include OSGi metadata in manifest

assertj-core was implemented at version 3.25.3:

- New package implementation needed by Junit5

byte-buddy was updated to version v1.14.16:

- `byte-buddy` is required by `assertj-core`
- Changes in version v1.14.16:

  * Update ASM and introduce support for Java 23.

- Changes in version v1.14.15:

  * Allow attaching from root on J9.

- Changes of v1.14.14:

  * Adjust type validation to accept additional names that are
    legal in the class file format.
  * Fix dynamic attach on Windows when a service user is active.
  * Avoid failure when using Android's strict mode.

dom4j was updated to version 2.1.4:

- Improvements and potentially breaking changes:

  * Added new factory method org.dom4j.io.SAXReader.createDefault(). It has more secure defaults than new SAXReader(),
    which uses system XMLReaderFactory.createXMLReader() or SAXParserFactory.newInstance().newSAXParser().
  * If you use some optional dependency of dom4j (for example Jaxen, xsdlib etc.), you need to specify an explicit
    dependency on it in your project. They are no longer marked as a mandatory transitive dependency by dom4j.
  * Following SAX parser features are disabled by default in DocumentHelper.parse() for security reasons (they were
    enabled in previous versions):
      
    + http://xml.org/sax/properties/external-general-entities
    + http://xml.org/sax/properties/external-parameter-entities

- Other changes:

  * Do not depend on jtidy, since it is not used during build
  * Fixed license to Plexus
  * JPMS: Add the Automatic-Module-Name attribute to the manifest.
  * Make a separate flavour for a minimal `dom4j-bootstrap` package used to build `jaxen` and full `dom4j`
  * Updated pull-parser version
  * Reuse the writeAttribute method in writeAttributes
  * Support build on OS with non-UTF8 as default charset
  * Gradle: add an automatic module name
  * Use Correct License Name "Plexus"
  * Possible vulnerability of DocumentHelper.parseText() to XML injection
  * CVS directories left in the source tree
  * XMLWriter does not escape supplementary unicode characters correctly
  * writer.writeOpen(x) doesn't write namespaces
  * Fixed concurrency problem with QNameCache
  * All dependencies are optional
  * SAXReader: hardcoded namespace features
  * Validate QNames
  * StringIndexOutOfBoundsException in XMLWriter.writeElementContent()
  * TreeNode has grown some generics
  * QName serialization fix
  * DocumentException initialize with nested exception
  * Accidentally occurring error in a multi-threaded test
  * Added compatibility with W3C DOM Level 3
  * Use Java generics

hamcrest:

-  `hamcrest-core` has been replaced by `hamcrest` (no source changes)

junit had the following change:

- Require hamcrest >= 2.2

junit5 was updated to version 5.10.2:
    
- Conditional execution based on OS architectures
- Configurable cleanup mode for @TempDir
- Configurable thread mode for @Timeout
- Custom class loader support for class/method selectors, @MethodSource, @EnabledIf, and @DisabledIf
- Dry-run mode for test execution
- Failure threshold for @RepeatedTest
- Fixed build with the latest open-test-reporting milestone
- Fixed dependencies in module-info.java files
- Fixed unreported exception error that is fatal with JDK 21
- Improved configurability of parallel execution
- New @SelectMethod support in test @Suite classes.
- New ConsoleLauncher subcommand for test discovery without execution
- New convenience base classes for implementing ArgumentsProvider and ArgumentConverter
- New IterationSelector
- New LauncherInterceptor SPI
- New NamespacedHierarchicalStore for use in third-party test engines
- New TempDirFactory SPI for customizing how temporary directories are created
- New testfeed details mode for ConsoleLauncher
- New TestInstancePreConstructCallback extension API
- Numerous bug fixes and minor improvements
- Parameter injection for @MethodSource methods
- Promotion of various experimental APIs to stable
- Reusable parameter resolution for custom extension methods via ExecutableInvoker
- Stacktrace pruning to hide internal JUnit calls
- The binaries are compatible with java 1.8
- Various improvements to ConsoleLauncher
- XML reports in new Open Test Reporting format

jdom:

- Security issues fixed:

  * CVE-2021-33813: Fixed an XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service
    via a crafted HTTP request (bsc#1187446)

- Other changes and bugs fixed:
    
  * Fixed wrong entries in changelog (bsc#1224410)
  * The packages `jaxen`, `saxpath` and `xom` are now separate standalone packages instead of being part of `jdom`

jaxen was implemented at version 2.0.0:

- New standalone RPM package implementation, originally part of `jdom` source package
- Classpaths are much smaller and less complex, and will suppress a lot of noise from static analysis tools.
- The Jaxen core code is also a little smaller and has fixed a few minor bugs in XPath evaluation
- Despite the major version bump, this should be a drop in replacement for almost every project. 
  The two major possible incompatibilities are:
  
  * The minimum supported Java version is now 1.5, up from 1.4 in 1.2.0 and 1.3 in 1.1.6.
  * dom4j, XOM, and JDOM are now optional dependencies so if a project was depending on them to be loaded transitively
    it will need to add explicit dependencies to build.

jopt-simple:

- Included jopt-simple to Package Hub 15 SP5 (no source changes)

objectweb-asm was updated to version 9.7:

- New Opcodes.V23 constant for Java 23
- Bugs fixed
  * Fixed unit test regression in dex2jar.
  * Fixed 'ClassNode#outerClass' with incorrect JavaDocs.
  * asm-bom packaging should be 'pom'.
  * The Textifier prints a supplementary space at the end of each method that throws at least one exception.


open-test-reporting:

- Included `open-test-reporting-events` and `open-test-reporting-schema` to the channels as they are runtime 
  dependencies of Junit5 (no source changes)

saxpath was implemented at version 1.0 FCS:

- New standalone RPM package implementation, originally part of `jdom` source package (openSUSE Leap 15.5 package only)

xom was implemented at version 1.3.9:

- New standalone RPM package implementation, originally part of `jdom` source package
- The Nodes and Elements classes are iterable so you can use the enhanced for loop syntax on instances of these classes.
- The copy() method is now covariant.
- Adds Automatic-Moduole-Name to jar
- Remove direct dependency on xml-apis:xml-apis artifact since these classes are now available in the core runtime.
- Eliminate usage of com.sun classes to make XOM compatible with JDK 16.
- Replace remaining usages of StringBuffer with StringBuilder to slightly improve performance.


              

Packages


  • apiguardian-1.1.2-150200.3.10.2
  • assertj-core-3.25.3-150200.5.4.3
  • byte-buddy-1.14.16-150200.5.7.1
  • jopt-simple-5.0.4-150200.3.4.3
  • junit5-5.10.2-150200.3.10.3
  • junit5-minimal-5.10.2-150200.3.10.2
  • open-test-reporting-0.1.0~M2-150200.5.7.2