Skip to content

Commit 656d127

Browse files
yumiokayumioka
committed
Merge branch 'release/3.1.0-RC6'
2 parents fda4687 + 2694947 commit 656d127

File tree

8 files changed

+63
-92
lines changed

8 files changed

+63
-92
lines changed

‎core/pom.xml‎

Lines changed: 17 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
<maven.compiler.target>17</maven.compiler.target>
2323
<nemakiware.version>${project.version}</nemakiware.version>
2424
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
25-
<org.springframework.version>6.1.13</org.springframework.version>
25+
<org.springframework.version>6.1.21</org.springframework.version>
2626
<org.apache.chemistry.opencmis.version>1.1.0-nemakiware</org.apache.chemistry.opencmis.version>
2727
<opencmis.github.packages.url>https://maven.pkg.github.com/aegif/chemistry-opencmis-nemakiware</opencmis.github.packages.url>
2828
<opencmis.github.packages.repository.id>github-opencmis</opencmis.github.packages.repository.id>
@@ -186,12 +186,12 @@
186186
<dependency>
187187
<groupId>com.fasterxml.jackson.core</groupId>
188188
<artifactId>jackson-core</artifactId>
189-
<version>2.20.1</version>
189+
<version>2.21.1</version>
190190
</dependency>
191191
<dependency>
192192
<groupId>com.fasterxml.jackson.core</groupId>
193193
<artifactId>jackson-databind</artifactId>
194-
<version>2.20.1</version>
194+
<version>2.21.1</version>
195195
</dependency>
196196
<!-- WebAuthn (Passkey) support -->
197197
<dependency>
@@ -208,14 +208,14 @@
208208
<dependency>
209209
<groupId>com.fasterxml.jackson.core</groupId>
210210
<artifactId>jackson-annotations</artifactId>
211-
<version>2.20</version>
211+
<version>2.21</version>
212212
</dependency>
213213
<dependency>
214214
<groupId>com.fasterxml.jackson.datatype</groupId>
215215
<artifactId>jackson-datatype-jdk8</artifactId>
216-
<version>2.20.1</version>
216+
<version>2.21.1</version>
217217
</dependency>
218-
<!-- SECURITY UPDATE (2025-11-19): Updated Jackson from 2.17.1 to 2.20.x for security fixes -->
218+
<!-- SECURITY UPDATE: Jackson 2.21.1 fixes GHSA-72hv-8253-57qq (async parser DoS) -->
219219
<!-- NOTE: jackson-annotations 2.20+ uses major.minor versioning only (no patch version) -->
220220

221221

@@ -373,7 +373,7 @@
373373
<dependency>
374374
<groupId>org.springframework.ldap</groupId>
375375
<artifactId>spring-ldap-core</artifactId>
376-
<version>3.2.4</version>
376+
<version>3.2.8</version>
377377
</dependency>
378378

379379
<dependency>
@@ -636,17 +636,13 @@
636636
<artifactId>commons-codec</artifactId>
637637
<version>1.20.0</version>
638638
</dependency>
639-
<!-- Previously transitive via cobertura-maven-plugin (now removed) -->
639+
<!-- SECURITY FIX: commons-beanutils 1.11.0 fixes CVE-2025-48734 (CVSS 8.8) -->
640640
<dependency>
641641
<groupId>commons-beanutils</groupId>
642642
<artifactId>commons-beanutils</artifactId>
643-
<version>1.9.4</version>
644-
</dependency>
645-
<dependency>
646-
<groupId>commons-lang</groupId>
647-
<artifactId>commons-lang</artifactId>
648-
<version>2.6</version>
643+
<version>1.11.0</version>
649644
</dependency>
645+
<!-- commons-lang 2.6 removed: migrated to commons-lang3 (see below) -->
650646

651647
<dependency>
652648
<groupId>org.apache.commons</groupId>
@@ -698,16 +694,16 @@
698694
</dependency>
699695

700696
<!-- Apache Tika for full-text content extraction (PDF, Office, etc.) -->
701-
<!-- FEATURE: Full-text search support for NemakiWare 3.0 (2025-11-27) -->
697+
<!-- SECURITY FIX: Tika 3.2.3 fixes CVE-2025-66516 (XXE, CVSS 10.0) -->
702698
<dependency>
703699
<groupId>org.apache.tika</groupId>
704700
<artifactId>tika-core</artifactId>
705-
<version>2.9.2</version>
701+
<version>3.2.3</version>
706702
</dependency>
707703
<dependency>
708704
<groupId>org.apache.tika</groupId>
709705
<artifactId>tika-parsers-standard-package</artifactId>
710-
<version>2.9.2</version>
706+
<version>3.2.3</version>
711707
<exclusions>
712708
<!-- Exclude conflicting logging implementations -->
713709
<exclusion>
@@ -869,10 +865,11 @@
869865
</dependency>
870866

871867
<!-- Cloud Authentication: Microsoft / generic JWKS token verification -->
868+
<!-- SECURITY FIX: 9.37.4 fixes CVE-2025-53864 (nested JSON DoS) -->
872869
<dependency>
873870
<groupId>com.nimbusds</groupId>
874871
<artifactId>nimbus-jose-jwt</artifactId>
875-
<version>9.37.3</version>
872+
<version>9.37.4</version>
876873
</dependency>
877874

878875
<!-- Google Drive API -->
@@ -916,10 +913,11 @@
916913
<artifactId>microsoft-graph</artifactId>
917914
<version>6.5.0</version>
918915
</dependency>
916+
<!-- SECURITY FIX: 1.18.0 fixes CVE-2024-35255 (EoP, affected <1.12.2) + latest MSAL4J -->
919917
<dependency>
920918
<groupId>com.azure</groupId>
921919
<artifactId>azure-identity</artifactId>
922-
<version>1.12.1</version>
920+
<version>1.18.0</version>
923921
</dependency>
924922

925923
<!-- AWS SDK (Bedrock Runtime) for embedding generation -->

‎core/src/main/java/jp/aegif/nemaki/cmis/aspect/impl/CompileServiceImpl.java‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -927,11 +927,14 @@ public AllowableActions compileAllowableActions(CallContext callContext, String
927927
if (Action.CAN_MOVE_OBJECT == convertKeyToAction(key)) {
928928
continue;
929929
}
930-
// CRITICAL CMIS COMPLIANCE FIX: Root folder cannot have CAN_GET_FOLDER_PARENT action
931-
// because root folder has no parent by definition
930+
// CMIS 1.1 §2.2.2.1: Root folder has no parent — both parent navigation
931+
// actions must be excluded from AllowableActions.
932932
if (PermissionMapping.CAN_GET_FOLDER_PARENT_OBJECT.equals(key)) {
933933
continue;
934934
}
935+
if (PermissionMapping.CAN_GET_PARENTS_FOLDER.equals(key)) {
936+
continue;
937+
}
935938
}
936939
if (versionSeries != null) {
937940
Document d = (Document) content;

‎core/src/main/java/jp/aegif/nemaki/cmis/service/impl/NavigationServiceImpl.java‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -438,14 +438,15 @@ public ObjectData getFolderParent(CallContext callContext, String repositoryId,
438438
// //////////////////
439439
// Specific Exception
440440
// //////////////////
441+
// CMIS 1.1 §2.2.3.3: Root folder has no parent — must reject before lock
442+
exceptionService.invalidArgumentRootFolder(repositoryId, folder);
443+
441444
Folder parent = contentService.getParent(repositoryId, folderId);
445+
exceptionService.objectNotFoundParentFolder(repositoryId, folderId, parent);
442446

443447
Lock parentLock = threadLockService.getReadLock(repositoryId, parent.getId());
444448
try{
445449
parentLock.lock();
446-
447-
exceptionService.objectNotFoundParentFolder(repositoryId, folderId, parent);
448-
exceptionService.invalidArgumentRootFolder(repositoryId, folder);
449450

450451
// //////////////////
451452
// Body of the method

‎core/src/main/java/jp/aegif/nemaki/rest/AuthenticationFilter.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@
3737
import org.apache.chemistry.opencmis.commons.enums.CmisVersion;
3838
import org.apache.chemistry.opencmis.commons.server.CallContext;
3939
import org.apache.chemistry.opencmis.server.impl.CallContextImpl;
40-
import org.apache.commons.lang.StringUtils;
40+
import org.apache.commons.lang3.StringUtils;
4141
import org.apache.commons.lang3.ObjectUtils;
4242
import jakarta.servlet.Filter;
4343
import jakarta.servlet.FilterChain;

‎core/src/main/java/jp/aegif/nemaki/rest/GroupItemResource.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@
4040
import org.apache.chemistry.opencmis.commons.impl.dataobjects.PropertyIdImpl;
4141
import org.apache.chemistry.opencmis.commons.impl.dataobjects.PropertyStringImpl;
4242
import org.apache.commons.collections4.CollectionUtils;
43-
import org.apache.commons.lang.StringUtils;
43+
import org.apache.commons.lang3.StringUtils;
4444
import org.apache.commons.lang3.ObjectUtils;
4545
import org.json.simple.JSONArray;
4646
import org.json.simple.JSONObject;

‎core/src/main/webapp/WEB-INF/classes/repositories-default.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,6 @@ default:
66
thinClientUri: http://localhost:8080/core/ui/
77
vendor: aegif
88
product.name: NemakiWare
9-
product.version: 3.0.0
9+
product.version: 3.1.0
1010
namespace: http://www.aegif.jp/NemakiWare/
1111
super.users: bedroom

‎docker/solr/pom.xml‎

Lines changed: 18 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
<maven.dependency.version>3.6.1</maven.dependency.version>
2525
<maven.assembly.version>3.7.1</maven.assembly.version>
2626
<org.apache.chemistry.opencmis.version>1.1.0</org.apache.chemistry.opencmis.version>
27-
<org.apache.solr.version>9.8.0</org.apache.solr.version>
27+
<org.apache.solr.version>9.10.0</org.apache.solr.version>
2828
</properties>
2929

3030
<repositories>
@@ -55,7 +55,7 @@
5555
<enabled>false</enabled>
5656
</snapshots>
5757
</repository>
58-
</repositories>
58+
</repositories>
5959

6060
<dependencies>
6161
<dependency>
@@ -100,47 +100,34 @@
100100
<dependency>
101101
<groupId>ch.qos.logback</groupId>
102102
<artifactId>logback-core</artifactId>
103-
<version>1.4.14</version>
103+
<version>1.5.16</version>
104104
</dependency>
105105
<dependency>
106106
<groupId>ch.qos.logback</groupId>
107107
<artifactId>logback-classic</artifactId>
108-
<version>1.4.14</version>
109-
</dependency>
110-
<dependency>
111-
<groupId>ch.qos.logback.contrib</groupId>
112-
<artifactId>logback-json-core</artifactId>
113-
<version>0.1.5</version>
114-
</dependency>
115-
<dependency>
116-
<groupId>ch.qos.logback.contrib</groupId>
117-
<artifactId>logback-json-classic</artifactId>
118-
<version>0.1.5</version>
119-
</dependency>
120-
<dependency>
121-
<groupId>ch.qos.logback.contrib</groupId>
122-
<artifactId>logback-jackson</artifactId>
123-
<version>0.1.5</version>
108+
<version>1.5.16</version>
124109
</dependency>
110+
<!-- logback-contrib 0.1.5 is incompatible with logback 1.5.x;
111+
JSON logging is provided by logstash-logback-encoder instead -->
125112
<dependency>
126113
<groupId>net.logstash.logback</groupId>
127114
<artifactId>logstash-logback-encoder</artifactId>
128-
<version>7.4</version>
115+
<version>8.0</version>
129116
</dependency>
130117
<dependency>
131118
<groupId>com.fasterxml.jackson.core</groupId>
132119
<artifactId>jackson-core</artifactId>
133-
<version>2.8.11</version>
120+
<version>2.18.6</version>
134121
</dependency>
135122
<dependency>
136123
<groupId>com.fasterxml.jackson.core</groupId>
137124
<artifactId>jackson-databind</artifactId>
138-
<version>2.8.11.6</version>
125+
<version>2.18.6</version>
139126
</dependency>
140127
<dependency>
141128
<groupId>com.fasterxml.jackson.core</groupId>
142129
<artifactId>jackson-annotations</artifactId>
143-
<version>2.8.11</version>
130+
<version>2.18.6</version>
144131
</dependency>
145132

146133

@@ -158,12 +145,12 @@
158145
<dependency>
159146
<groupId>org.apache.tika</groupId>
160147
<artifactId>tika-core</artifactId>
161-
<version>1.28.5</version>
148+
<version>3.2.3</version>
162149
</dependency>
163150
<dependency>
164151
<groupId>org.apache.commons</groupId>
165152
<artifactId>commons-lang3</artifactId>
166-
<version>3.0.1</version>
153+
<version>3.17.0</version>
167154
<optional>false</optional>
168155
</dependency>
169156
<dependency>
@@ -175,27 +162,22 @@
175162
<dependency>
176163
<groupId>junit</groupId>
177164
<artifactId>junit</artifactId>
178-
<version>4.12</version>
165+
<version>4.13.2</version>
179166
</dependency>
180-
<!--dependency>
181-
<groupId>commons-collections</groupId>
182-
<artifactId>commons-collections</artifactId>
183-
<version>[3.2.2,)</version>
184-
</dependency-->
185167
<dependency>
186168
<groupId>org.apache.commons</groupId>
187169
<artifactId>commons-collections4</artifactId>
188-
<version>4.4</version>
170+
<version>4.5.0</version>
189171
</dependency>
190172
<dependency>
191-
<groupId>com.esotericsoftware.yamlbeans</groupId>
173+
<groupId>com.contrastsecurity</groupId>
192174
<artifactId>yamlbeans</artifactId>
193-
<version>1.09</version>
175+
<version>1.17</version>
194176
</dependency>
195177
<dependency>
196178
<groupId>commons-io</groupId>
197179
<artifactId>commons-io</artifactId>
198-
<version>2.11.0</version>
180+
<version>2.18.0</version>
199181
</dependency>
200182
<dependency>
201183
<groupId>org.apache.chemistry.opencmis</groupId>
@@ -217,7 +199,7 @@
217199
<artifactId>jersey-client</artifactId>
218200
<version>1.19</version>
219201
</dependency>
220-
202+
221203

222204
</dependencies>
223205

0 commit comments

Comments
 (0)