[GHSA-6hgm-866r-3cjv] Insecure Deserialization in Apache Commons Collection

[joshbressers]

Updates

• Affected products

Comments
This removes overlap and simplifies the versions affected

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the GHSA advisory metadata for GHSA-6hgm-866r-3cjv (Apache Commons Collections insecure deserialization) by narrowing/cleaning affected package/version ranges and removing overlap.

Changes:

• Updated the advisory modified timestamp.
• Narrowed the affected range start from 0 to 4.0 for the remaining Maven package entry.
• Removed additional Maven package coordinates previously listed as affected.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This change removes multiple affected package coordinates (e.g., collections-generic and ServiceMix bundle GAVs). If those artifacts are still published/used independently, dropping them will stop downstream tooling from flagging vulnerable dependencies for those coordinates. If the intent is only to de-duplicate overlapping coverage, consider retaining these affected entries (with corrected/non-overlapping ranges) or documenting why they’re safe to remove (e.g., never shipped within the vulnerable range, aliases to the remaining coordinate, or superseded/retracted artifacts).

Suggested change

	]
	]
	},
	{
	"package": {
	"ecosystem": "Maven",
	"name": "collections-generic:collections-generic"
	},
	"ranges": [
	{
	"type": "ECOSYSTEM",
	"events": [
	{
	"introduced": "0"
	}
	]
	}
	]
	},
	{
	"package": {
	"ecosystem": "Maven",
	"name": "org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections"
	},
	"ranges": [
	{
	"type": "ECOSYSTEM",
	"events": [
	{
	"introduced": "0"
	},
	{
	"fixed": "3.2.2_1"
	}
	]
	}
	]
	},
	{
	"package": {
	"ecosystem": "Maven",
	"name": "org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections4"
	},
	"ranges": [
	{
	"type": "ECOSYSTEM",
	"events": [
	{
	"introduced": "4.0_1"
	},
	{
	"fixed": "4.1_1"
	}
	]
	}
	]