Fix for Security Violations #432
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bhanurp
approved these changes
Dec 16, 2025
- Virtual repositories now use child repositories with matching package types - Fixes test failures for CustomPropertiesRepositoryTests, P2PackageTypeRepositoryTests, and TerraformPackageTypeRepositoryTests - Resolves issue where virtual repos tried to include Generic repos when they had specific package types (Composer, P2, Terraform)
- Creates a separate repository for virtual repos to avoid naming conflicts
- Prevents "Case insensitive repository key already exists" error
- Repository key is now "rt-client-java-for-virtual-{id}" instead of reusing "rt-client-java-local-{id}"
- When LOCAL settings are null, use VIRTUAL settings to ensure correct package type - Create SEPARATE remote repo for virtual (rt-client-java-remote-for-virtual-*) to avoid conflicts with test methods - Add dedicated repoForVirtual field for proper tracking and cleanup - Fixes TerraformVirtualRepo, P2RemoteRepo, and other package type mismatch issues
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fix: Update Dependencies to Address Security Vulnerabilities
Summary
Updated test dependencies to fix CVE-2025-11226 and documented CVE-2024-6763.
Changes
Test Fix Changes
Updated
BaseRepositoryTests.groovyto handle Artifactory's stricter virtual repository package type validation:getRepositorySettings(LOCAL)returns null (e.g., Terraform), the fix usesgetRepositorySettings(VIRTUAL)settings instead to ensure correct package type.rt-client-java-remote-for-virtual-*) is now created to avoid conflicts with test methods that create their own repos.tearDown().Tests Fixed
TerraformPackageTypeRepositoryTests > testTerraformVirtualRepoP2PackageTypeRepositoryTests > testP2RemoteRepoCustomPropertiesRepositoryTests > testVirtualRepoNotes
CVE-2024-6763 (Jetty) requires Jetty 12.x which is incompatible with Java 8 support.
Since this is test-only and doesn't affect production, the risk is documented and accepted.