CVE-2026-55760 handlebars.java FileTemplateLoader Path Traversal (#194)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Valera V Harseko <vharseko@3a-systems.ru>
Co-authored-by: Maxim Thomas <maxim.thomas@gmail.com>

Author: 3 people

custom-scripted-connector-bundler/pom.xml

@@ -94,7 +94,7 @@
         <dependency>
             <groupId>com.github.jknack</groupId>
             <artifactId>handlebars</artifactId>
-            <version>4.4.0</version>
+            <version>4.5.2</version>
         </dependency>
         <dependency>
             <groupId>org.slf4j</groupId>

legal/THIRDPARTYREADME.txt

@@ -59,9 +59,12 @@ Copyright: Copyright 2002-2013 The Apache Software Foundation
 Version: commons-io-2.4.jar
 Copyright: Copyright 2002-2012 The Apache Software Foundation
 
-Version: commons-lang3-3.18.jar
+Version: commons-lang3-3.20.jar
 Copyright: Copyright 2001-2013 The Apache Software Foundation
 
+Version: commons-text-1.15.jar
+Copyright: Copyright 2014-2024 The Apache Software Foundation
+
 Version: commons-beanutils-1.8.0.jar
 Copyright: Copyright 2000-2008 The Apache Software Foundation
 

pom.xml

@@ -393,7 +393,7 @@
             <dependency>
                 <groupId>org.openidentityplatform</groupId>
                 <artifactId>openicf</artifactId>
-                <version>2.0.3</version>
+                <version>2.0.3</version> <!--after openicf version update, check commons-lang3 and commons-text versions from commons -->
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
@@ -403,6 +403,19 @@
                 <artifactId>commons-codec</artifactId>
                 <version>${apache.commons-codec.version}</version>
             </dependency>
+            <!-- handlebars 4.5.x requires commons-lang3 >= 3.20.0 (OSGi import [3.20.0,4.0.0)) -->
+            <dependency>
+                <groupId>org.apache.commons</groupId>
+                <artifactId>commons-lang3</artifactId>
+                <version>3.20.0</version>
+            </dependency>
+            <!-- handlebars 4.5.x requires commons-text >= 1.15.0 (OSGi import [1.15.0,2.0.0));
+                 the commons parent manages it to 1.12.0, so pin it up to satisfy the bundle -->
+            <dependency>
+                <groupId>org.apache.commons</groupId>
+                <artifactId>commons-text</artifactId>
+                <version>1.15.0</version>
+            </dependency>
 
             <!-- Java EE -->
             <dependency>