Skip to content

Conversation

@rgrunber
Copy link
Contributor

  • Update Apache Commons IO from 2.11.0 to 2.19.0

java-debug is a bundle contributed into the JDT-LS runtime. This means that it has no control over any dependencies it dos not contribute into the runtime itself (all of them). So when java-debug defines a target platform with dependencies that don't reference the same ones JDT-LS does, it is masking any potential runtime problems. This is the same issue we ran into on LSP4MP / quarkus-ls. The project will compile just fine and fail at runtime because the target platform is not reflective of runtime.

The solution is to reference the exact bundles JDT-LS is using (ie. the latest ones), at https://download.eclipse.org/jdtls/snapshots/repository/latest/plugins/ .

  • Need to verify this by running it but it compiles and tests seem to run just fine.

- Update Apache Commons IO from 2.11.0 to 2.19.0

Signed-off-by: Roland Grunberg <rgrunber@redhat.com>
Copy link
Contributor

@testforstephen testforstephen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. thanks for contribution.

@testforstephen testforstephen merged commit b98d493 into microsoft:main Apr 17, 2025
4 checks passed
@rgrunber rgrunber deleted the update-tp branch April 17, 2025 12:24
@svor
Copy link

svor commented Apr 17, 2025

Hi! 👋
@rgrunber thanks for the upgrading Apache Commons IO library, the old version contains high severity CVE problem.

@testforstephen Since this patch is important for the OpenShift Dev Spaces product and directly affects our delivery timeline, could I please ask for a new release of java-debug and vscode-java-debug with this change included? It would really help us move forward and integrate the fix promptly.

@testforstephen
Copy link
Contributor

@svor sure, I will make some test tomorrow. if everything is fine and I will trigger a release for this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants