dependabot[bot] opened a new pull request, #734: URL: https://github.com/apache/directory-kerby/pull/734
Bumps [org.jline:jline](https://github.com/jline/jline3) from 3.30.6 to 4.4.8. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jline/jline3/releases";>org.jline:jline's releases</a>.</em></p> <blockquote> <p>JLine 4.4.8 is a bugfix and enhancement release addressing an <code>AnsiConsole</code> stream-routing bug and improving command help output.</p> <p>The <code>AnsiConsole</code> fix corrects a long-standing issue where <code>ansiStream()</code> used <code>terminal.output()</code> for both stdout and stderr, causing the non-terminal-backed stream to be silently redirected to the wrong file descriptor (for example, stderr output going to stdout when the terminal was selected via <code>SysOut</code>). The fix routes each stream to its correct fd: the terminal-backed stream goes through <code>terminal.output()</code>, while the other writes to the original system stream. ANSI mode for the non-terminal-backed stream is now auto-detected per-fd (preserving colors when it is a tty, stripping when redirected), with <code>jansi.out.mode</code>/<code>jansi.err.mode</code> properties still honoured as overrides. The enhancement from <a href="https://github.com/FSeidinger";><code>@FSeidinger</code></a> makes detailed command help richer: it now displays every non-empty line of the main description via <code>CommandDescription#describ e()</code>, argument descriptions appear alongside argument names, and additional description lines are indented beneath the first for easier reading.</p> <h2>🐛 Bug Fixes</h2> <ul> <li>fix: AnsiConsole.systemInstall() no longer redirects the non-terminal stream to the wrong fd (<a href="https://redirect.github.com/jline/jline3/pull/2317";>#2317</a>) <a href="https://github.com/gnodet";><code>@gnodet</code></a></li> </ul> <h2>✨ Enhancements</h2> <ul> <li>feat: use detailed command description via describe() in command help (<a href="https://redirect.github.com/jline/jline3/pull/2318";>#2318</a>) <a href="https://github.com/FSeidinger";><code>@FSeidinger</code></a></li> </ul> <h2>📦 Dependency Updates</h2> <ul> <li>chore: bump release-drafter/release-drafter from 7.7.0 to 7.9.0 (<a href="https://redirect.github.com/jline/jline3/pull/2313";>#2313</a>) <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot]</li> <li>chore: bump com.palantir.javaformat:palantir-java-format from 2.101.0 to 2.102.0 (<a href="https://redirect.github.com/jline/jline3/pull/2314";>#2314</a>, <a href="https://redirect.github.com/jline/jline3/pull/2315";>#2315</a>) <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot]</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jline/jline3/compare/4.4.7...4.4.8";>https://github.com/jline/jline3/compare/4.4.7...4.4.8</a></p> <p>JLine 4.4.7 is a security and bug fix release addressing two security vulnerabilities and one rendering correctness bug.</p> <p>The history <code>/PATTERN</code> search in <code>HistoryCommands</code> was compiling user-supplied regex patterns with a raw <code>Pattern.compile</code> + <code>Matcher.find()</code> call, with no execution-time guard — the only unprotected regex path in the project. A pathological pattern like <code>(a+)+z</code> would hang the session thread indefinitely via catastrophic backtracking (GHSA-vrw4-fppg-3rhf). The fix routes through <code>SafeRegex</code>, consistent with all other regex call sites. The telnet NEW-ENVIRON handler (<code>TelnetIO.readNEVariables</code>) enforced its 100-variable limit only within a single subnegotiation frame via a local counter that reset on each call. An unauthenticated client could send multiple frames to accumulate an unbounded number of environment entries and exhaust server heap (GHSA-7qh2-r6cc-r47w, bypassing the incomplete fix for CVE-2026-56740); the fix also checks the persistent connection-level map size. Finally, <code>AttributedS tringBuilder.setLength</code> did not recompute <code>lastLineLength</code> after truncation, causing subsequent tab stops to be calculated against the wrong position; three regression tests covering cleared builder, newline removal, and last-line shortening were added by the contributor.</p> <h2>🐛 Bug Fixes</h2> <ul> <li>fix: guard history /pattern regex search against ReDoS via SafeRegex (<a href="https://redirect.github.com/jline/jline3/pull/2286";>#2286</a>) <a href="https://github.com/gnodet";><code>@gnodet</code></a></li> <li>fix: enforce NEW-ENVIRON variable limit across frames to prevent memory exhaustion (<a href="https://redirect.github.com/jline/jline3/pull/2287";>#2287</a>) <a href="https://github.com/gnodet";><code>@gnodet</code></a></li> <li>fix: recompute tab position after truncation (<a href="https://redirect.github.com/jline/jline3/pull/2305";>#2305</a>) <a href="https://github.com/PHJ2000";><code>@PHJ2000</code></a></li> </ul> <h2>📦 Dependency Updates</h2> <ul> <li>chore: bump sshd.version from 2.19.0 to 2.20.0</li> <li>chore: bump com.diffplug.spotless:spotless-maven-plugin from 3.10.2 to 3.10.3</li> <li>chore: bump com.palantir.javaformat:palantir-java-format from 2.98.0 to 2.100.0</li> <li>chore: bump slf4j.version from 2.0.19 to 2.0.20 (<a href="https://redirect.github.com/jline/jline3/pull/2289";>#2289</a>)</li> <li>chore: bump org.graalvm.sdk:graal-sdk from 25.3.4.1 to 25.4.4.1.1 (<a href="https://redirect.github.com/jline/jline3/pull/2292";>#2292</a>)</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jline/jline3/compare/4.4.6...4.4.7";>https://github.com/jline/jline3/compare/4.4.6...4.4.7</a></p> <p>JLine 4.4.6 is a bugfix release addressing two correctness issues and updating several dependencies.</p> <p>The main fix resolves a boot layer initialization failure (<code>InvalidModuleDescriptorException</code>) that affected Java 17+ projects with <code>jline-terminal-ffm</code> on the module path: the <code>module-info.class</code> was compiled at Java 22 and placed at the jar root, causing the JVM to reject it. The module is now packaged as a proper Multi-Release JAR, with the module descriptor in <code>META-INF/versions/22/</code>, so Java 17 consumers load the jar without issues while Java 22+ still gets the full JPMS module. The second fix corrects <code>codePointAt</code>/<code>codePointBefore</code> in <code>AttributedString</code> to respect subsequence bounds, preventing surrogates from being combined with characters outside the logical range.</p> <h2>🐛 Bug Fixes</h2> <ul> <li>fix: make jline-terminal-ffm a Multi-Release JAR to fix Java 17 boot layer failure (<a href="https://redirect.github.com/jline/jline3/pull/2285";>#2285</a>) <a href="https://github.com/gnodet";><code>@gnodet</code></a></li> <li>fix: respect attributed sequence bounds when reading code points (<a href="https://redirect.github.com/jline/jline3/pull/2278";>#2278</a>) <a href="https://github.com/jakezwang";><code>@jakezwang</code></a></li> </ul> <h2>📦 Dependency Updates</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jline/jline3/commit/72c9a4cd180362d73b198681a6a41f7ed8f28fda";><code>72c9a4c</code></a> chore: bump release-drafter/release-drafter from 7.7.0 to 7.9.0 (<a href="https://redirect.github.com/jline/jline3/issues/2313";>#2313</a>)</li> <li><a href="https://github.com/jline/jline3/commit/325273db4f20281d075fc9aa6869f53def330c4f";><code>325273d</code></a> chore: bump com.palantir.javaformat:palantir-java-format (<a href="https://redirect.github.com/jline/jline3/issues/2314";>#2314</a>)</li> <li><a href="https://github.com/jline/jline3/commit/4317b63a81668b96da50e6526a78e576ecce335f";><code>4317b63</code></a> feat: use detailed command description via describe() in command help</li> <li><a href="https://github.com/jline/jline3/commit/f5a5c5350539894918a2d2d51ace8939b12dcc89";><code>f5a5c53</code></a> fix: AnsiConsole.systemInstall() no longer redirects the non-terminal stream ...</li> <li><a href="https://github.com/jline/jline3/commit/d1bffae6f0f8a0bfab8748dc96d238782c020223";><code>d1bffae</code></a> chore: bump com.palantir.javaformat:palantir-java-format (<a href="https://redirect.github.com/jline/jline3/issues/2312";>#2312</a>)</li> <li><a href="https://github.com/jline/jline3/commit/71607ededdae13ca8fa9338b8158b633e2eebf4d";><code>71607ed</code></a> chore: upgrade Docusaurus from 3.7.0 to 3.10.2 to fix website build with webp...</li> <li><a href="https://github.com/jline/jline3/commit/78a846dfb181c965e7d3f92277d84ab8def5f1b9";><code>78a846d</code></a> chore: pin webpackbar to ^6.0.0 to fix website build with webpack 5.106+</li> <li><a href="https://github.com/jline/jline3/commit/29e069d71b7862cc85b6bce9c3a19a11e841c6f2";><code>29e069d</code></a> docs: fix web-swing-terminals demo section to reference Launcher (fixes <a href="https://redirect.github.com/jline/jline3/issues/2301";>#2301</a>)</li> <li><a href="https://github.com/jline/jline3/commit/26920f0b10fe012fdc2482084a789bb8c03300e8";><code>26920f0</code></a> fix: recompute tab position after truncation</li> <li><a href="https://github.com/jline/jline3/commit/fb1cd2784096888be0587ca31ea6be33d6362e71";><code>fb1cd27</code></a> chore: bump com.palantir.javaformat:palantir-java-format from 2.98.0 to 2.100.0</li> <li>Additional commits viewable in <a href="https://github.com/jline/jline3/compare/jline-3.30.6...4.4.8";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
