-
Notifications
You must be signed in to change notification settings - Fork 18
Replace tika lib and update project dependencies #1878
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Member
jonathanaustin
commented
Jan 16, 2026
- Replaced org.apache.tika:tika library with org.overviewproject:mime-types in FileUtil to validate uploaded file mime types. Closes Please provide WComponents compatible with Java 8 that removes susceptibility to critical Apache Tika vulnerability CVE-2025-66516 #1876
- Updated FileUtil to make file extension and mime type validation case insensitive. Closes File upload extension testing should be case insensitive #1877
- Consistent use of try-with-resources when handling streams
- Updated AbstractRequest to remove deprecated methods uploadFileItems and readBytes (were protected static). Use StreamUtils instead.
- Updated the following dependencies:
- wcomponents-core:
- com.google.code.gson:gson from 2.13.1 to 2.13.2
- org.apache.commons:commons-lang3 from 3.18.0 to 3.20.0
- commons-io:commons-io from 2.19.0 to 2.21.0
- com.google.errorprone:error_prone_annotations from 2.39.0 to 2.46.0
- org.apache.httpcomponents.client5:httpclient5 from 5.5 to 5.6
- org.apache.httpcomponents.core5:httpcore5 from 5.3.4 to 5.4
- wcomponents-test-lib:
- io.github.bonigarcia:webdrivermanager from 6.1.0 to 6.3.3
- org.apache.commons:commons-compress from 1.27.1 to 1.28.0
- commons-codec:commons-codec from 1.18.0 to 1.20.0
- com.google.guava:guava from 33.4.8-jre to 33.5.0-jre
- net.java.dev.jna:jna from 5.17.0 to 5.18.1
- wcomponents-bundle:
- org.ehcache:ehcahce from 3.10.8 to 3.11.1
- org.glassfish.jaxb:jaxb-runtime from 4.0.5 to 4.0.6
- wcomponents-core:
…and readBytes (were protected static)
…ypes in FileUtil to validate uploaded file mime types
Member
Author
|
Fix coverage before merging |
ricksbrown
reviewed
Jan 19, 2026
code-coverage/pom.xml
Outdated
|
|
||
| </build> | ||
|
|
||
| </project> No newline at end of file |
Member
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
no newline here, add one?
ricksbrown
approved these changes
Jan 19, 2026
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.


