Skip to content

fix(deps): Bump vulnerable dependencies to address CVEs #455

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
thehungryturnip merged 1 commit into from
Jul 8, 2026
Merged

fix(deps): Bump vulnerable dependencies to address CVEs #455

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 9 additions & 9 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
<modelVersion>4.0.0</modelVersion>
<groupId>software.amazon.cloudformation</groupId>
<artifactId>aws-cloudformation-rpdk-java-plugin</artifactId>
<version>2.2.4</version>
<version>2.2.5</version>
<name>AWS CloudFormation RPDK Java Plugin</name>
<description>The CloudFormation Resource Provider Development Kit (RPDK) allows you to author your own resource providers that can be used by CloudFormation. This plugin library helps to provide runtime bindings for the execution of your providers by CloudFormation.
</description>
Expand Down Expand Up @@ -40,11 +40,11 @@
<awssdk.version>2.19.0</awssdk.version>
<checkstyle.version>8.36.2</checkstyle.version>
<commons-io.version>2.14.0</commons-io.version>
<jackson.version>2.14.1</jackson.version>
<jackson.version>2.17.2</jackson.version>
<maven-checkstyle-plugin.version>3.1.1</maven-checkstyle-plugin.version>
<mockito.version>3.12.4</mockito.version>
<spotbugs.version>4.5.3.0</spotbugs.version>
<spotless.version>2.28.0</spotless.version>
<spotless.version>2.40.0</spotless.version>
<maven-javadoc-plugin.version>3.2.0</maven-javadoc-plugin.version>
<maven-source-plugin.version>3.2.1</maven-source-plugin.version>
</properties>
Expand Down Expand Up @@ -118,7 +118,7 @@
<dependency>
<groupId>com.amazonaws</groupId>
<artifactId>aws-java-sdk-core</artifactId>
<version>1.12.367</version>
<version>1.12.770</version>
</dependency>
<!-- https://mvnrepository.com/artifact/com.amazonaws/aws-lambda-java-core -->
<dependency>
Expand All @@ -130,19 +130,19 @@
<dependency>
<groupId>com.amazonaws</groupId>
<artifactId>aws-lambda-java-log4j2</artifactId>
<version>1.5.1</version>
<version>1.6.0</version>
</dependency>
<!--https://mvnrepository.com/artifact/com.amazonaws/aws-encryption-sdk-java -->
<dependency>
<groupId>com.amazonaws</groupId>
<artifactId>aws-encryption-sdk-java</artifactId>
<version>2.2.0</version>
<version>2.4.1</version>
</dependency>
<!-- https://mvnrepository.com/artifact/com.amazonaws/aws-java-sdk-sts -->
<dependency>
<groupId>com.amazonaws</groupId>
<artifactId>aws-java-sdk-sts</artifactId>
<version>1.12.368</version>
<version>1.12.770</version>
</dependency>
<!-- https://mvnrepository.com/artifact/com.google.code.findbugs/annotations -->
<dependency>
Expand All @@ -154,7 +154,7 @@
<dependency>
<groupId>com.amazonaws</groupId>
<artifactId>aws-java-sdk-kms</artifactId>
<version>1.12.368</version>
<version>1.12.770</version>
</dependency>
<!-- AWS Java SDK v2 Dependencies -->
<dependency>
Expand Down Expand Up @@ -206,7 +206,7 @@
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-lang3</artifactId>
<version>3.9</version>
<version>3.14.0</version>
</dependency>
<!-- https://mvnrepository.com/artifact/org.apache.commons/commons-collections4 -->
<dependency>
Expand Down
7 changes: 3 additions & 4 deletions src/main/java/software/amazon/cloudformation/proxy/StdCallbackContext.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,8 +151,7 @@ private Map<String, Object> readMap(Class<?> type, JsonParser p, Deserialization
}
return value;
} catch (InstantiationException | IllegalAccessException | NoSuchMethodException | InvocationTargetException e) {
throw new JsonMappingException(p, "Can not create empty map for class " + type + " @ " + p.getCurrentLocation(),
e);
throw new JsonMappingException(p, "Can not create empty map for class " + type + " @ " + p.currentLocation(), e);
}
}

Expand Down Expand Up @@ -237,8 +236,8 @@ private Object readCollection(Class<?> type, JsonParser p, DeserializationContex
} while (p.nextToken() != JsonToken.END_ARRAY);
return value;
} catch (IllegalAccessException | InstantiationException | NoSuchMethodException | InvocationTargetException e) {
throw new IOException("Can not create empty constructor collection class " + type + " @ "
+ p.getCurrentLocation(), e);
throw new IOException("Can not create empty constructor collection class " + type + " @ " + p.currentLocation(),
e);
}
}
}
Expand Down
6 changes: 3 additions & 3 deletions src/main/java/software/amazon/cloudformation/proxy/aws/SdkPojoDeserializer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,7 @@ private SdkPojo readPojo(final SdkPojo pojo, JsonParser p, DeserializationContex
* if (next != JsonToken.FIELD_NAME) { throw new JsonMappingException(p,
* "Expecting to get FIELD_NAME token, got " + next); }
*/
String fieldName = p.getCurrentName();
String fieldName = p.currentName();
SdkField<?> sdkField = fieldMap.get(fieldName);
if (sdkField == null) {
if (codec.isEnabled(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES)) {
Expand Down Expand Up @@ -187,7 +187,7 @@ private Map<String, Object> readMap(SdkField<?> field, JsonParser p, Deserializa
if (p.currentToken() != JsonToken.FIELD_NAME) {
throw new JsonMappingException(p, "Expecting String key for map got " + p.currentToken());
}
String fieldName = p.getCurrentName();
String fieldName = p.currentName();
// progress to next token
p.nextToken();
value.put(fieldName, readObject(valueType, p, ctxt));
Expand Down Expand Up @@ -229,7 +229,7 @@ private Document readDocument(SdkField<?> field, JsonParser p, DeserializationCo
case START_OBJECT:
MapBuilder builder = Document.mapBuilder();
while (p.nextToken() != JsonToken.END_OBJECT) {
String fieldName = p.getCurrentName();
String fieldName = p.currentName();
p.nextToken();
builder.putDocument(fieldName, readDocument(field, p, ctxt));
}
Expand Down
6 changes: 4 additions & 2 deletions src/main/java/software/amazon/cloudformation/resource/Serializer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,8 @@ public class Serializer {
static {
STRICT_OBJECT_MAPPER = JsonMapper.builder().configure(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS, true)
.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, true)
.configure(MapperFeature.ACCEPT_CASE_INSENSITIVE_PROPERTIES, true).build();
.configure(MapperFeature.ACCEPT_CASE_INSENSITIVE_PROPERTIES, true)
.configure(com.fasterxml.jackson.core.StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION, true).build();
STRICT_OBJECT_MAPPER.setSerializationInclusion(JsonInclude.Include.NON_ABSENT);
STRICT_OBJECT_MAPPER.setSerializationInclusion(JsonInclude.Include.NON_DEFAULT);
STRICT_OBJECT_MAPPER.setSerializationInclusion(JsonInclude.Include.NON_EMPTY);
Expand All @@ -74,7 +75,8 @@ public class Serializer {
static {
OBJECT_MAPPER = JsonMapper.builder().configure(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS, true)
.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false)
.configure(MapperFeature.ACCEPT_CASE_INSENSITIVE_PROPERTIES, true).build();
.configure(MapperFeature.ACCEPT_CASE_INSENSITIVE_PROPERTIES, true)
.configure(com.fasterxml.jackson.core.StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION, true).build();
OBJECT_MAPPER.setSerializationInclusion(JsonInclude.Include.NON_ABSENT);
OBJECT_MAPPER.setSerializationInclusion(JsonInclude.Include.NON_DEFAULT);
OBJECT_MAPPER.setSerializationInclusion(JsonInclude.Include.NON_EMPTY);
Expand Down
Loading