Skip to content

#7969 - Bump net.minidev:json-smart from 2.5.1 to 2.5.2#7960

Merged
rzo1 merged 2 commits into
masterfrom
dependabot/maven/net.minidev-json-smart-2.5.2
Feb 17, 2025
Merged

#7969 - Bump net.minidev:json-smart from 2.5.1 to 2.5.2#7960
rzo1 merged 2 commits into
masterfrom
dependabot/maven/net.minidev-json-smart-2.5.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Feb 17, 2025

Copy link
Copy Markdown
Contributor

Bumps net.minidev:json-smart from 2.5.1 to 2.5.2.

Release notes

Sourced from net.minidev:json-smart's releases.

2.5.2

About CVE-2024-57699

Thanks for @​ccudennec-otto Some remarks on the CVE, more discussions in #236

  • as mentioned here it is quite unlikely that the vulnerability is exploited if you come here because of Spring Security / com.nimbusds:oauth2-oidc-sdk
  • the code changes for the upcoming release will "only" fix the default modes provided by JSONParser, e.g. MODE_RFC4627
  • if you create the JSONParser manually / with custom options, make sure you set option LIMIT_JSON_DEPTH
    • since that's what "connect2id" is doing in their library, they were responsible for fixing it. They've already provided a new 11.x release that fixes the JSONParser setup on their side, i.e. you rather need their fixed version and not version 2.5.2 of json-smart
    • as stated here, they would also need to backport the fix to the versions that Spring Security needs IMHO

What's Changed

... (truncated)

Commits
  • d4f7fa4 migrate to s01.oss.sonatype.org
  • 9ca093d docs: mark v2.5.2 not released now
  • 55fa105 update maintainer github id and email (#234)
  • 7ecb1d3 bump to version 2.5.2.
  • 852caf6 Merge pull request #233 from ccudennec-otto/fix-CVE-2024-57699
  • d1f4645 Merge pull request #228 from netplex/dependabot/maven/json-smart/junit.versio...
  • 19a787e Merge pull request #230 from netplex/dependabot/maven/json-smart-action/junit...
  • f2be4c1 Merge pull request #229 from netplex/dependabot/maven/json-smart/org.apache.m...
  • 224943a Merge pull request #231 from netplex/dependabot/maven/json-smart-action/org.a...
  • c21d854 fix CVE-2024-57699 for predefined parsers
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Feb 17, 2025
Bumps [net.minidev:json-smart](https://github.com/netplex/json-smart-v2) from 2.5.1 to 2.5.2.
- [Release notes](https://github.com/netplex/json-smart-v2/releases)
- [Commits](netplex/json-smart-v2@2.5.1...2.5.2)

---
updated-dependencies:
- dependency-name: net.minidev:json-smart
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/maven/net.minidev-json-smart-2.5.2 branch from 439bb61 to 252f96f Compare February 17, 2025 19:21
@rzo1 rzo1 changed the title Bump net.minidev:json-smart from 2.5.1 to 2.5.2 #7969 - Bump net.minidev:json-smart from 2.5.1 to 2.5.2 Feb 17, 2025
@rzo1 rzo1 merged commit e49a3a8 into master Feb 17, 2025
@dependabot dependabot Bot deleted the dependabot/maven/net.minidev-json-smart-2.5.2 branch February 17, 2025 19:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant