Skip to content

Update Jettison, adjust scope, and fix test configuration - Jersey 2.x #6035

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 4 commits into
base: 2.x
Choose a base branch
from
Open

Update Jettison, adjust scope, and fix test configuration - Jersey 2.x #6035

wants to merge 4 commits into from

Conversation

@stecurran-est-tech
Copy link

@stecurran-est-tech stecurran-est-tech commented Nov 14, 2025 •
edited
Loading

This PR updates Jettison usage and related build configuration to address security issues. Includes fix to resolve Jettison import issue after change of scope. Jersey 2.x branch.

Changes
uplift org.codehaus.jettison:jettison from 1.3.7 → 1.5.2 to resolve the following CVEs:
CVE-2022-40149
CVE-2022-40150
CVE-2022-45685
CVE-2022-45693
CVE-2023-1436

Set Jettison to provided scope to avoid bundling it into artifacts and prevent inclusion of vulnerable versions.

Add Jettison with test scope in e2e-entity to fix test compilation.

Correct pre-existing Surefire config typo:
<classpathDependencyExcludes> → <classpathDependencyExclude>.

@stecurran-est-tech
updating jettison from 1.3.7 to 1.5.2
c05d508 
Resolves CVE-2022-40149
CVE-2022-40150
CVE-2022-45685
CVE-2022-45693
CVE-2023-1436
@stecurran-est-tech
adding 'provided' scope for jettison in Jersey 2.x
1f9b781 
This avoids bundling Jettison in the artifact, eliminating direct dependency and preventing known CVEs from being included in the package
@stecurran-est-tech
updating pom.xml in root and e2e-entity
e6880dd 
- Add Jettison with <scope>test</scope> in e2e-entity to restore test compilation
- Fix typo in root Surefire config: <classpathDependencyExcludes> → <classpathDependencyExclude>

This will ensure all Jettison-specific tests continue to run and validate behavior

Signed-off-by: stecurran-est-tech <[email protected]>
@senivam
Copy link
Contributor

senivam commented Nov 17, 2025

this breaks

INFO: Stopped listener bound to [localhost:44729]
[INFO] Tests run: 3, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 1.770 s -- in org.glassfish.jersey.tests.e2e.sse.SseEventSinkToEventSourceTest
[INFO] 
[INFO] Results:
[INFO] 
[ERROR] Errors: 
[ERROR]   JaxbTest.generateTests()[61][1] » InvocationTarget
[ERROR]   JaxbTest.generateTests()[62][1] » InvocationTarget
[ERROR]   JaxbTest.generateTests()[79][1] » InvocationTarget
[ERROR]   JaxbTest.generateTests()[81][1] » InvocationTarget
[ERROR]   JaxbTest.generateTests()[96][1] » InvocationTarget
[INFO] 
[ERROR] Tests run: 645, Failures: 0, Errors: 5, Skipped: 8

test for all JDKs that are used for the Jersey CI validation.

@jansupol
Copy link
Contributor

jansupol commented Nov 17, 2025

this breaks

Those are Jettison e2e-entity tests. They say for instance:

java.lang.NoSuchMethodException: Cannot instantiate org.glassfish.jersey.tests.e2e.entity.EmptyRequestWithJaxbTest$MappedJettisonCRTest$MappedJettisonCR class. Instantiation of non-static member classes is not supported.

@stecurran-est-tech
Copy link
Author

stecurran-est-tech commented Nov 19, 2025

JSON test data has been updated for e2e-entity tests to reflect change in serialisation behaviour when using Jettison 1.5.2.
The following tests now pass:
JaxbTest.generateTests()[61][1] » InvocationTarget
JaxbTest.generateTests()[62][1] » InvocationTarget
JaxbTest.generateTests()[79][1] » InvocationTarget
JaxbTest.generateTests()[81][1] » InvocationTarget

Failure on JaxbTest.generateTests()[96][1] » InvocationTarget has not been resolved. Refer to discussion: #6005

@stecurran-est-tech
Updating JSON data for e2e-entity tests
7cff542 
Jettison upgrade 1.3.7 to 1.5.2 alters JSON serialisation - integers are no longer output as Strings. Updates to test data correspond to change in behaviour.

Signed-off-by: stecurran-est-tech <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@stecurran-est-tech @senivam @jansupol