dependabot[bot] opened a new pull request, #960: URL: https://github.com/apache/aries/pull/960
Bumps [org.jline:jline](https://github.com/jline/jline3) from 4.4.8 to 4.5.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jline/jline3/releases";>org.jline:jline's releases</a>.</em></p> <blockquote> <p>JLine 4.5.0 brings four security fixes, two new features, twenty bug fixes, and a batch of maintenance improvements.</p> <p>This release addresses four moderate-severity vulnerabilities: a heap overflow in the native <code>CLibrary.ioctl()</code> binding, world-readable editor temp files, history expansion applied to masked (password) input, and a multi-frame bypass of the NEW-ENVIRON variable limit in the Telnet server. It also hardens <code>WebTerminal</code> against DNS rebinding and clickjacking, and fixes a broad set of reader/terminal correctness issues contributed by the community.</p> <h2>🔒 Security Fixes</h2> <ul> <li><strong>GHSA-p73x-fv3x-mvv6</strong> — Prevent heap overflow in <code>CLibrary.ioctl(int, long, int[])</code> (<a href="https://redirect.github.com/jline/jline3/issues/2412";>#2412</a>) <a href="https://github.com/gnodet";><code>@gnodet</code></a></li> <li><strong>GHSA-7whq-538g-8928</strong> — Create editor temp files with owner-only permissions (<a href="https://redirect.github.com/jline/jline3/issues/2343";>#2343</a>) <a href="https://github.com/uchiha-bug-hunter";><code>@uchiha-bug-hunter</code></a></li> <li><strong>GHSA-rcc3-r7r7-qvg2</strong> — Skip history expansion for masked input (<a href="https://redirect.github.com/jline/jline3/issues/2346";>#2346</a>) <a href="https://github.com/uchiha-bug-hunter";><code>@uchiha-bug-hunter</code></a></li> <li><strong>GHSA-7qh2-r6cc-r47w</strong> — Enforce NEW-ENVIRON variable limit across frames to prevent memory exhaustion (<a href="https://redirect.github.com/jline/jline3/issues/2415";>#2415</a>) <a href="https://github.com/gnodet";><code>@gnodet</code></a></li> </ul> <h2>✨ New Features</h2> <ul> <li>Allow disabling the JLine shutdown hook (<a href="https://redirect.github.com/jline/jline3/issues/2325";>#2325</a>) <a href="https://github.com/ItsDeadlyProgrammer";><code>@ItsDeadlyProgrammer</code></a></li> <li>Use detailed command description via <code>describe()</code> in command help (<a href="https://redirect.github.com/jline/jline3/issues/2318";>#2318</a>) <a href="https://github.com/FSeidinger";><code>@FSeidinger</code></a></li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li>Resolve the Nano overwrite check against the editor root (<a href="https://redirect.github.com/jline/jline3/issues/2414";>#2414</a>) <a href="https://github.com/uchiha-bug-hunter";><code>@uchiha-bug-hunter</code></a></li> <li>Add <code>mach_absolute_time()</code> fallback for <code>clock_gettime</code> on macOS and mac-x86 target (<a href="https://redirect.github.com/jline/jline3/issues/2410";>#2410</a>) <a href="https://github.com/gnodet";><code>@gnodet</code></a></li> <li>Match multi-line history entries against <code>history-ignore</code> (<a href="https://redirect.github.com/jline/jline3/issues/2406";>#2406</a>) <a href="https://github.com/uchiha-bug-hunter";><code>@uchiha-bug-hunter</code></a></li> <li>Keep text killed at masked prompts out of the shared kill ring (<a href="https://redirect.github.com/jline/jline3/issues/2356";>#2356</a>) <a href="https://github.com/uchiha-bug-hunter";><code>@uchiha-bug-hunter</code></a></li> <li>Buffer the output of dumb system terminals (<a href="https://redirect.github.com/jline/jline3/issues/2353";>#2353</a>) <a href="https://github.com/Pankraz76";><code>@Pankraz76</code></a></li> <li><code>AnsiConsole</code> asks the terminal's own provider whether the other stream is a TTY (<a href="https://redirect.github.com/jline/jline3/issues/2352";>#2352</a>) <a href="https://github.com/knutwannheden";><code>@knutwannheden</code></a></li> <li>Forbid framing of the <code>WebTerminal</code> page (<a href="https://redirect.github.com/jline/jline3/issues/2351";>#2351</a>) <a href="https://github.com/uchiha-bug-hunter";><code>@uchiha-bug-hunter</code></a></li> <li>Drop 8-bit C1 control sequences in <code>ansiAppend</code> (<a href="https://redirect.github.com/jline/jline3/issues/2350";>#2350</a>) <a href="https://github.com/uchiha-bug-hunter";><code>@uchiha-bug-hunter</code></a></li> <li>Skip history expansion for masked input (<a href="https://redirect.github.com/jline/jline3/issues/2346";>#2346</a>) <a href="https://github.com/uchiha-bug-hunter";><code>@uchiha-bug-hunter</code></a></li> <li>Reject DNS-rebound Host headers in <code>WebTerminal</code> (<a href="https://redirect.github.com/jline/jline3/issues/2345";>#2345</a>) <a href="https://github.com/uchiha-bug-hunter";><code>@uchiha-bug-hunter</code></a></li> <li>Stop treating ambiguous and neutral symbols as wide in <code>WCWidth</code> (<a href="https://redirect.github.com/jline/jline3/issues/2344";>#2344</a>) <a href="https://github.com/wleeaf";><code>@wleeaf</code></a></li> <li>Use <code>Locale.ROOT</code> when converting terminal flag and OS names (<a href="https://redirect.github.com/jline/jline3/issues/2342";>#2342</a>) <a href="https://github.com/vidhan843426";><code>@vidhan843426</code></a></li> <li><code>NonBlockingReader.available()</code> always returns 0 (<a href="https://redirect.github.com/jline/jline3/issues/2339";>#2339</a>) <a href="https://github.com/gnodet";><code>@gnodet</code></a></li> <li>Honor buffer ranges and cached EOF in nonblocking readers (<a href="https://redirect.github.com/jline/jline3/issues/2337";>#2337</a>) <a href="https://github.com/PHJ2000";><code>@PHJ2000</code></a></li> <li>Honor echo flags for line discipline signal characters (<a href="https://redirect.github.com/jline/jline3/issues/2336";>#2336</a>) <a href="https://github.com/PHJ2000";><code>@PHJ2000</code></a></li> <li>Preserve incremental search prompts with autosuggestions (<a href="https://redirect.github.com/jline/jline3/issues/2335";>#2335</a>) <a href="https://github.com/PHJ2000";><code>@PHJ2000</code></a></li> <li>Clear tail tips when <code>setTailTip</code> receives null (<a href="https://redirect.github.com/jline/jline3/issues/2334";>#2334</a>) <a href="https://github.com/PHJ2000";><code>@PHJ2000</code></a></li> <li>Retain reader cursor tracking on status resize (<a href="https://redirect.github.com/jline/jline3/issues/2326";>#2326</a>) <a href="https://github.com/snowyukitty";><code>@snowyukitty</code></a></li> <li><code>AnsiConsole.systemInstall()</code> no longer redirects the non-terminal stream to the wrong fd (<a href="https://redirect.github.com/jline/jline3/issues/2317";>#2317</a>) <a href="https://github.com/gnodet";><code>@gnodet</code></a></li> </ul> <h2>🧰 Maintenance</h2> <ul> <li>Make history trimming linear instead of quadratic (<a href="https://redirect.github.com/jline/jline3/issues/2413";>#2413</a>) <a href="https://github.com/ptweezy";><code>@ptweezy</code></a></li> <li>Rework native library generation: Docker cross-compilation infrastructure with automated CI rebuild workflow and macOS crossbuild images (<a href="https://redirect.github.com/jline/jline3/issues/2411";>#2411</a>) <a href="https://github.com/gnodet";><code>@gnodet</code></a></li> <li>Unify OSC/non-OSC string states with <code>belTerminatesString</code> flag (<a href="https://redirect.github.com/jline/jline3/issues/2372";>#2372</a>) <a href="https://github.com/gnodet";><code>@gnodet</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jline/jline3/commit/c8ecc113a69e1d591f83d221f993318e15265081";><code>c8ecc11</code></a> fix: enforce NEW-ENVIRON variable limit across frames to prevent memory exhau...</li> <li><a href="https://github.com/jline/jline3/commit/e720d5d0660ecaff86a21657a25027eeb29527fa";><code>e720d5d</code></a> fix: resolve the Nano overwrite check against the editor root (<a href="https://redirect.github.com/jline/jline3/issues/2414";>#2414</a>)</li> <li><a href="https://github.com/jline/jline3/commit/5293d4ae106a1bb8632a159e21ecd3bf286091ee";><code>5293d4a</code></a> fix: add mach_absolute_time() fallback for clock_gettime on macOS and mac-x86...</li> <li><a href="https://github.com/jline/jline3/commit/53663231c74f42c712d9b3ab5d49900a980bb4c1";><code>5366323</code></a> fix: make history trimming linear instead of quadratic (<a href="https://redirect.github.com/jline/jline3/issues/2413";>#2413</a>)</li> <li><a href="https://github.com/jline/jline3/commit/a8e3ac6eb04d586723d5538b13c550be22146a25";><code>a8e3ac6</code></a> test: assert AnsiTest results on the test thread (<a href="https://redirect.github.com/jline/jline3/issues/2408";>#2408</a>)</li> <li><a href="https://github.com/jline/jline3/commit/155b8c898d6492bccd4cd9aba3abe3dab1a30f0e";><code>155b8c8</code></a> fix: prevent heap overflow in CLibrary.ioctl(int, long, int[]) (GHSA-p73x-fv3...</li> <li><a href="https://github.com/jline/jline3/commit/9cf5a8f7c4ef8ad5649c22476e7691f332eb8dfa";><code>9cf5a8f</code></a> chore: Docker cross-compilation infrastructure and CI native rebuild workflow</li> <li><a href="https://github.com/jline/jline3/commit/036174b8e8990bc58df5c13c8a1d7aa246a3b4c3";><code>036174b</code></a> fix: match multi-line history entries against history-ignore (<a href="https://redirect.github.com/jline/jline3/issues/2406";>#2406</a>)</li> <li><a href="https://github.com/jline/jline3/commit/5f734145141a0c5186a8c43b6642293781c496c8";><code>5f73414</code></a> chore: bump org.apache.felix:org.apache.felix.gogo.runtime (<a href="https://redirect.github.com/jline/jline3/issues/2388";>#2388</a>)</li> <li><a href="https://github.com/jline/jline3/commit/0852c631aeac0ca6312d6d1c1c40b317664eaa86";><code>0852c63</code></a> chore: bump com.palantir.javaformat:palantir-java-format (<a href="https://redirect.github.com/jline/jline3/issues/2393";>#2393</a>)</li> <li>Additional commits viewable in <a href="https://github.com/jline/jline3/compare/4.4.8...4.5.0";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
