From 97f8946c9a48f7123e11686882a6f4c83aa20a13 Mon Sep 17 00:00:00 2001 From: Bob Wei Date: Wed, 8 Jul 2026 17:47:40 +0000 Subject: [PATCH] fix(deps): Bump vulnerable dependencies to address CVEs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bump jackson 2.14.1→2.17.2 (4 High CVEs), commons-lang3 3.9→3.14.0 (1 High), aws-java-sdk-core/sts/kms 1.12.367→1.12.770 (1 High via ion-java), aws-lambda-java-log4j2 1.5.1→1.6.0 (2 High), aws-encryption-sdk-java 2.2.0→2.4.1 (3 Medium via bouncycastle), spotless-maven-plugin 2.28.0→2.40.0 (2 High via jgit, build-time). Also fixes Jackson 2.17 deprecations (getCurrentLocation→currentLocation, getCurrentName→currentName) and re-enables INCLUDE_SOURCE_IN_LOCATION to preserve existing error message format for customers. Closes #438 --- pom.xml | 18 +++++++++--------- .../proxy/StdCallbackContext.java | 7 +++---- .../proxy/aws/SdkPojoDeserializer.java | 6 +++--- .../cloudformation/resource/Serializer.java | 6 ++++-- 4 files changed, 19 insertions(+), 18 deletions(-) diff --git a/pom.xml b/pom.xml index d06fc51f..e1f2bc21 100644 --- a/pom.xml +++ b/pom.xml @@ -3,7 +3,7 @@ 4.0.0 software.amazon.cloudformation aws-cloudformation-rpdk-java-plugin - 2.2.4 + 2.2.5 AWS CloudFormation RPDK Java Plugin The CloudFormation Resource Provider Development Kit (RPDK) allows you to author your own resource providers that can be used by CloudFormation. This plugin library helps to provide runtime bindings for the execution of your providers by CloudFormation. @@ -40,11 +40,11 @@ 2.19.0 8.36.2 2.14.0 - 2.14.1 + 2.17.2 3.1.1 3.12.4 4.5.3.0 - 2.28.0 + 2.40.0 3.2.0 3.2.1 @@ -118,7 +118,7 @@ com.amazonaws aws-java-sdk-core - 1.12.367 + 1.12.770 @@ -130,19 +130,19 @@ com.amazonaws aws-lambda-java-log4j2 - 1.5.1 + 1.6.0 com.amazonaws aws-encryption-sdk-java - 2.2.0 + 2.4.1 com.amazonaws aws-java-sdk-sts - 1.12.368 + 1.12.770 @@ -154,7 +154,7 @@ com.amazonaws aws-java-sdk-kms - 1.12.368 + 1.12.770 @@ -206,7 +206,7 @@ org.apache.commons commons-lang3 - 3.9 + 3.14.0 diff --git a/src/main/java/software/amazon/cloudformation/proxy/StdCallbackContext.java b/src/main/java/software/amazon/cloudformation/proxy/StdCallbackContext.java index c555ee19..f6d4896f 100644 --- a/src/main/java/software/amazon/cloudformation/proxy/StdCallbackContext.java +++ b/src/main/java/software/amazon/cloudformation/proxy/StdCallbackContext.java @@ -151,8 +151,7 @@ private Map readMap(Class type, JsonParser p, Deserialization } return value; } catch (InstantiationException | IllegalAccessException | NoSuchMethodException | InvocationTargetException e) { - throw new JsonMappingException(p, "Can not create empty map for class " + type + " @ " + p.getCurrentLocation(), - e); + throw new JsonMappingException(p, "Can not create empty map for class " + type + " @ " + p.currentLocation(), e); } } @@ -237,8 +236,8 @@ private Object readCollection(Class type, JsonParser p, DeserializationContex } while (p.nextToken() != JsonToken.END_ARRAY); return value; } catch (IllegalAccessException | InstantiationException | NoSuchMethodException | InvocationTargetException e) { - throw new IOException("Can not create empty constructor collection class " + type + " @ " - + p.getCurrentLocation(), e); + throw new IOException("Can not create empty constructor collection class " + type + " @ " + p.currentLocation(), + e); } } } diff --git a/src/main/java/software/amazon/cloudformation/proxy/aws/SdkPojoDeserializer.java b/src/main/java/software/amazon/cloudformation/proxy/aws/SdkPojoDeserializer.java index 30d1d9e6..7cf805ea 100644 --- a/src/main/java/software/amazon/cloudformation/proxy/aws/SdkPojoDeserializer.java +++ b/src/main/java/software/amazon/cloudformation/proxy/aws/SdkPojoDeserializer.java @@ -82,7 +82,7 @@ private SdkPojo readPojo(final SdkPojo pojo, JsonParser p, DeserializationContex * if (next != JsonToken.FIELD_NAME) { throw new JsonMappingException(p, * "Expecting to get FIELD_NAME token, got " + next); } */ - String fieldName = p.getCurrentName(); + String fieldName = p.currentName(); SdkField sdkField = fieldMap.get(fieldName); if (sdkField == null) { if (codec.isEnabled(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES)) { @@ -187,7 +187,7 @@ private Map readMap(SdkField field, JsonParser p, Deserializa if (p.currentToken() != JsonToken.FIELD_NAME) { throw new JsonMappingException(p, "Expecting String key for map got " + p.currentToken()); } - String fieldName = p.getCurrentName(); + String fieldName = p.currentName(); // progress to next token p.nextToken(); value.put(fieldName, readObject(valueType, p, ctxt)); @@ -229,7 +229,7 @@ private Document readDocument(SdkField field, JsonParser p, DeserializationCo case START_OBJECT: MapBuilder builder = Document.mapBuilder(); while (p.nextToken() != JsonToken.END_OBJECT) { - String fieldName = p.getCurrentName(); + String fieldName = p.currentName(); p.nextToken(); builder.putDocument(fieldName, readDocument(field, p, ctxt)); } diff --git a/src/main/java/software/amazon/cloudformation/resource/Serializer.java b/src/main/java/software/amazon/cloudformation/resource/Serializer.java index be4243dd..b5a51f6c 100644 --- a/src/main/java/software/amazon/cloudformation/resource/Serializer.java +++ b/src/main/java/software/amazon/cloudformation/resource/Serializer.java @@ -53,7 +53,8 @@ public class Serializer { static { STRICT_OBJECT_MAPPER = JsonMapper.builder().configure(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS, true) .configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, true) - .configure(MapperFeature.ACCEPT_CASE_INSENSITIVE_PROPERTIES, true).build(); + .configure(MapperFeature.ACCEPT_CASE_INSENSITIVE_PROPERTIES, true) + .configure(com.fasterxml.jackson.core.StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION, true).build(); STRICT_OBJECT_MAPPER.setSerializationInclusion(JsonInclude.Include.NON_ABSENT); STRICT_OBJECT_MAPPER.setSerializationInclusion(JsonInclude.Include.NON_DEFAULT); STRICT_OBJECT_MAPPER.setSerializationInclusion(JsonInclude.Include.NON_EMPTY); @@ -74,7 +75,8 @@ public class Serializer { static { OBJECT_MAPPER = JsonMapper.builder().configure(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS, true) .configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false) - .configure(MapperFeature.ACCEPT_CASE_INSENSITIVE_PROPERTIES, true).build(); + .configure(MapperFeature.ACCEPT_CASE_INSENSITIVE_PROPERTIES, true) + .configure(com.fasterxml.jackson.core.StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION, true).build(); OBJECT_MAPPER.setSerializationInclusion(JsonInclude.Include.NON_ABSENT); OBJECT_MAPPER.setSerializationInclusion(JsonInclude.Include.NON_DEFAULT); OBJECT_MAPPER.setSerializationInclusion(JsonInclude.Include.NON_EMPTY);