The GitHub Actions job "Java CI" on commons-collections.git/security/complete-collections-580-fix has failed. Run started by GitHub user lucianjohnhouse (triggered by garydgregory).
Head commit for run: 64735916853a5d71fbb909cd387f41e14c971935 / Henry Brand <[email protected]> [SECURITY] Complete COLLECTIONS-580: remove Serializable from bridge functors ClosureTransformer, TransformerClosure, and FactoryTransformer bridge between Closure, Transformer, and Factory type hierarchies. Despite COLLECTIONS-580 removing Serializable from InvokerTransformer, these bridge classes remained Serializable, allowing deserialization gadget chains to survive via ClosureTransformer↔TransformerClosure round-trips. This patch removes Serializable and serialVersionUID from all three bridge classes to close the remaining attack surface. Co-Authored-By: Claude Opus 4.6 <[email protected]> Report URL: https://github.com/apache/commons-collections/actions/runs/28282506460 With regards, GitHub Actions via GitBox
