kp-forks / grobid / 27466529377

39%

push

github

Dependency update to solve the security CVE reported by Trivvy  (#1449)

We made a general bump-up for all dependencies, we fixed:

- openNLP Apache OpenNLP: Apache OpenNLP: Arbitrary Class Loading via Model Manifest, upgraded from 1.9.4 to 2.5.
- jetty org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing
- the BouncyCastle library cannot be solved at the moment (no usable version of Jruby with the BC patch), however that part is not used by Grobid (bouncycastle: BC-JAVA: private key leakage via non-constant time comparisons) -- jruby-complete update was left at 9.4.12.1

Deferred:

- PDFBox 2.x → 3.x — API changes (PDDocument.load → Loader, etc.); touches PDF parsing core. Heavy.
- slf4j 1.7.36 → 2.x + logback 1.2.13 → 1.5.x — must move together; binding model changed.
- Apache HttpClient 4.5.14 → 5.x — different package/API (org.apache.hc.*).
- Saxon-HE 9.6.0-9 → 12.x, commons-pool 1.6 → 2.x, prometheus simpleclient 0.16.0 → client_java 1.x,
- PowerMock removal (already flagged TODO at build.gradle:239) — each independent, API-breaking.
- Jruby-complete was left at 9.4.12.1

---------

Signed-off-by: Luca Foppiano <luca@foppiano.org>

8332 of 24001 branches covered (34.72%)

Branch coverage included in aggregate %.

17894 of 43854 relevant lines covered (40.8%)

4.93 hits per line