Upgrade vulnerable dependencies flagged in security scan (netty, commons-fileupload, grpc)
@mbiuki is already working on this.
Since Jul 13, 2026.
- Dominant language
- Java
- Stars
- 970
- Forks
- 486
- Avg merge
- 3d 33m
- Merged PRs (30d)
- 170
Description
Context
A customer security scan (internal ref: helpdesk ticket 38243) flagged a list of packages. Each was verified against the dotCMS codebase to determine whether it ships in the dotCMS stack and whether a fix is actionable here.
Verified classification
In dotCMS stack — fixable now (this issue)
| Package | Current | Fixed in | Notes |
|---|---|---|---|
io.netty:netty-codec (+5 sibling artifacts) |
4.1.118.Final | 4.1.136.Final | Pinned in bom/application/pom.xml; 4.1.124/125 fixed CVE-2025-55163, CVE-2025-58057 |
commons-fileupload:commons-fileupload |
1.5 | 1.6.0 | Direct dep; 1.6.0 fixes CVE-2025-48976 (multipart header DoS) |
io.grpc:grpc-netty-shaded |
1.71.0 (transitive via langchain4j → Vertex AI) | 1.82.x | Bundles a vulnerable shaded netty; pin via grpc-bom |
In dotCMS stack — not fixable by a version bump (documented, needs separate work)
| Package | Current | Why not now |
|---|---|---|
org.jdom:jdom |
1.1.3 | CVE-2021-33813 (XXE). No patched 1.x exists; fix is migrating to org.jdom:jdom2 (different package namespace). The dep was removed once before and had to be restored because WebDAV breaks without it at runtime (#29882 / 6d026d77f9). Requires a WebDAV/milton-scoped migration effort. |
org.elasticsearch:* / elastic/elasticsearch |
7.10.2 | Deliberate pin — last Apache-2.0-licensed version; dotCMS runs against OpenSearch. Upgrading means migrating off elasticsearch-rest-high-level-client, a separate project. |
com.dotcms.lib:dot.commons-fileupload |
1.3.3_1 | Legacy repackaged fork still declared in dotCMS/pom.xml; no direct code usage found — candidate for removal after runtime verification (same risk pattern as jdom). |
In dotCMS Docker image — OS layer (fixed by image rebuild, not code)
imagemagick, libmagickcore-6.q16-7t64, openexr, libopenexr-3-1-30 — verified as hard Depends of libvips42 on Ubuntu 24.04 (installed in dotCMS/src/main/docker/original/Dockerfile for the optional libvips image engine). The imagemagick/openexr names are the source packages for the two installed shared libraries. These are patched automatically on image rebuild once Canonical publishes fixed packages (apt upgrade runs at build time). Note: the libvips engine is off by default (IMAGE_API_USE_LIBVIPS).
Not in dotCMS core at all
| Package | Verified |
|---|---|
org.cryptacular:cryptacular |
Not present in any Maven module dependency tree nor the repo. Ships with the SAML OSGi plugin (separate artifact) if installed — or originates outside the dotCMS stack. |
Scope of this issue
Bump netty 4.1.118.Final → 4.1.136.Final, commons-fileupload 1.5 → 1.6.0, and pin grpc via grpc-bom to a patched release in bom/application/pom.xml.
🤖 Generated with Claude Code
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.