(cxf) branch main updated: Bump org.apache.commons:commons-jexl3 from 3.6.4 to 3.7.0 (#3292)

[reta]

This is an automated email from the ASF dual-hosted git repository.

reta pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cxf.git


The following commit(s) were added to refs/heads/main by this push:
     new 2a90ce2ca43 Bump org.apache.commons:commons-jexl3 from 3.6.4 to 3.7.0 
(#3292)
2a90ce2ca43 is described below

commit 2a90ce2ca43fa67e67e31a2fc47b8b10ebc20a34
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
AuthorDate: Mon Aug 17 21:37:42 2026 -0400

    Bump org.apache.commons:commons-jexl3 from 3.6.4 to 3.7.0 (#3292)
    
    * Bump org.apache.commons:commons-jexl3 from 3.6.4 to 3.7.0
    
    Bumps org.apache.commons:commons-jexl3 from 3.6.4 to 3.7.0.
    
    ---
    updated-dependencies:
    - dependency-name: org.apache.commons:commons-jexl3
      dependency-version: 3.7.0
      dependency-type: direct:production
      update-type: version-update:semver-minor
    ...
    
    Signed-off-by: dependabot[bot] <supp...@github.com>
    
    * Fix JexlClaimsMapper test cases
    
    ---------
    
    Signed-off-by: dependabot[bot] <supp...@github.com>
    Co-authored-by: dependabot[bot] 
<49699333+dependabot[bot]@users.noreply.github.com>
    Co-authored-by: Andriy Redko <drr...@gmail.com>
---
 parent/pom.xml                                                 |  2 +-
 .../org/apache/cxf/sts/claims/mapper/JexlClaimsMapper.java     | 10 ++++++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/parent/pom.xml b/parent/pom.xml
index 7eddcbb5fcb..829984f3c8d 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -166,7 +166,7 @@
         <cxf.jettison.version>1.5.7</cxf.jettison.version>
         <cxf.jetty12.version>12.1.12</cxf.jetty12.version>
         <cxf.jetty.version>${cxf.jetty12.version}</cxf.jetty.version>
-        <cxf.jexl.version>3.6.4</cxf.jexl.version>
+        <cxf.jexl.version>3.7.0</cxf.jexl.version>
         <cxf.joda.time.version>2.10.10</cxf.joda.time.version>
         <cxf.johnzon.version>2.2.0</cxf.johnzon.version>
         <cxf.jspecify.version>1.0.0</cxf.jspecify.version>
diff --git 
a/services/sts/sts-core/src/main/java/org/apache/cxf/sts/claims/mapper/JexlClaimsMapper.java
 
b/services/sts/sts-core/src/main/java/org/apache/cxf/sts/claims/mapper/JexlClaimsMapper.java
index dffa1f6a005..d3ccfb5c482 100644
--- 
a/services/sts/sts-core/src/main/java/org/apache/cxf/sts/claims/mapper/JexlClaimsMapper.java
+++ 
b/services/sts/sts-core/src/main/java/org/apache/cxf/sts/claims/mapper/JexlClaimsMapper.java
@@ -30,6 +30,7 @@ import java.util.logging.Logger;
 import org.apache.commons.jexl3.JexlBuilder;
 import org.apache.commons.jexl3.JexlContext;
 import org.apache.commons.jexl3.JexlEngine;
+import org.apache.commons.jexl3.JexlFeatures;
 import org.apache.commons.jexl3.JexlScript;
 import org.apache.commons.jexl3.MapContext;
 import org.apache.commons.jexl3.introspection.JexlPermissions.ClassPermissions;
@@ -56,6 +57,15 @@ public class JexlClaimsMapper implements ClaimsMapper {
         jexlEngine = new JexlBuilder()
                 .silent(false)
                 .namespaces(functions)
+                .features(JexlFeatures.createNone()
+                        .newInstance(true)
+                        .localVar(true)
+                        .sideEffect(true)
+                        .sideEffectGlobal(true)
+                        .structuredLiteral(true)
+                        .methodCall(true)
+                        .loops(true)
+                        .script(true))
                 .permissions(new ClassPermissions(java.net.URI.class)
                     .compose("org.apache.cxf.*"))
                 .create();