Skip to content

Commit 5b5dfee

Browse files
authored
fix(common): Bump assertj-core from 3.9.1 to 3.27.7 (opensearch-project#5294)
Addresses CVE-2026-24400 (GHSA-rqfh-9r24-8c9r), an XXE vulnerability in AssertJ's isXmlEqualTo assertion when parsing untrusted XML. While the vulnerable method is not used in this codebase and assertj-core is test-scoped only, this bump resolves the security scanner finding on the 2.19 branch. Signed-off-by: Chen Dai <daichen@amazon.com>
1 parent 9d35e71 commit 5b5dfee

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

common/build.gradle

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ dependencies {
4545
implementation "com.github.seancfoley:ipaddress:5.4.2"
4646

4747
testImplementation group: 'junit', name: 'junit', version: '4.13.2'
48-
testImplementation group: 'org.assertj', name: 'assertj-core', version: '3.9.1'
48+
testImplementation group: 'org.assertj', name: 'assertj-core', version: '3.27.7'
4949
testImplementation group: 'com.google.guava', name: 'guava', version: "${guava_version}"
5050
testImplementation group: 'org.hamcrest', name: 'hamcrest-library', version: '2.1'
5151
testImplementation('org.junit.jupiter:junit-jupiter:5.9.3')

0 commit comments

Comments
 (0)