charangowdamd-cmd opened a new pull request, #13082:
URL: https://github.com/apache/maven/pull/13082
Following this checklist to help us incorporate your contribution quickly
and easily:
- [x] Make sure there is a [JIRA
issue](https://issues.apache.org/jira/browse/MNG) filed for the change:
[MNG-10928](https://issues.apache.org/jira/browse/MNG-10928)
- [x] Each commit in the pull request should have a meaningful subject line
and body.
- [x] Format the pull request title like `[MNG-XXX] SUMMARY`.
- [x] Write a pull request description that is detailed enough to
understand what the pull request does, how, and why.
- [x] Run `mvn clean verify` to make sure basic checks pass.
- [x] I hereby declare this contribution to be licenced under the [Apache
License Version 2.0, January 2004](http://www.apache.org/licenses/LICENSE-2.0)
---
### Description
This PR upgrades `org.apache.commons:commons-lang3` from `3.8.1` to `3.18.0`
in the `maven-3.8.x` branch to remediate CVE-2025-48924.
### Key Changes
1. **Dependency Upgrade**: Bumped `<commonsLangVersion>` from `3.8.1` to
`3.18.0` in root `pom.xml`.
2. **Enforcer Rule Exemption**: `commons-lang3` >= 3.9 targets Java 8 (class
file version 52.0), which triggers the `enforce-bytecode-version` enforcer
check in `maven-3.8.x` (`<maxJdkVersion>1.7</maxJdkVersion>`). We added an
`<exclude>org.apache.commons:commons-lang3</exclude>` under
`enforceBytecodeVersion` to whitelist the security-patched artifact without
weakening bytecode checks for all other dependencies.
3. **Compatibility Preserved**: `animal-sniffer-maven-plugin` continues
enforcing Java 1.7 API compatibility for all Maven source classes.
### Verification
- Executed `mvn clean verify` across all 15 reactor modules with success (0
errors, 0 test failures).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
