-
Notifications
You must be signed in to change notification settings - Fork 15
MLE-23227 - Force v3.18 of commons-lang to fix CVE #203
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR updates a dependency to force the use of commons-lang version 3.18 to address a security vulnerability (CVE). However, the only visible change in the provided diff is a documentation update that corrects a database name reference in the CONTRIBUTING.md file.
- Updates documentation to reference the correct database name (
data-hub-FINALinstead ofkafka-test-content)
|
|
||
| You can then verify that data is being written to MarkLogic by using MarkLogic's qconsole application to inspect the | ||
| contents of the `kafka-test-content` database. | ||
| contents of the `data-hub-FINAL` database. |
Copilot
AI
Aug 4, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The PR title indicates this change is about forcing commons-lang v3.18 to fix a CVE, but the only visible change is a database name correction in documentation. This creates confusion about the actual purpose of the PR. Consider updating the PR title to reflect the documentation fix, or ensure the dependency changes are included in the diff.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is this because we switched the test-app to be a DHF test app? If so, there are a few more references to "kafka-test-content" in the codebase to change.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks ok.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Note that there are a few dozen more issues reported by Black Duck. Can you open a ticket to address those as well? We'll need all of them addressed or to have an exception for them in order to get a release out with this fix.
|
|
||
| You can then verify that data is being written to MarkLogic by using MarkLogic's qconsole application to inspect the | ||
| contents of the `kafka-test-content` database. | ||
| contents of the `data-hub-FINAL` database. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is this because we switched the test-app to be a DHF test app? If so, there are a few more references to "kafka-test-content" in the codebase to change.
Updates some old references to kafka-test-content.
ef9420b to
327f545
Compare
I ran the automated tests as well as the manual tests with the Docker containers running the Confluence environment.