chore: upgrade commons-digester 1.8 to commons-digester3 3.3#2192
chore: upgrade commons-digester 1.8 to commons-digester3 3.3#2192
Conversation
Replace EOL commons-digester 1.8 with commons-digester3 3.3 to address security vulnerabilities and improve Java 21 compatibility. Changes: - Updated pom.xml dependency from commons-digester:commons-digester:1.8 to org.apache.commons:commons-digester3:3.3 - Updated import statements in 3 Java files: - EctFindMeasurementTypeUtil.java (measurements) - EFormLoader.java (eforms) - UCRConfigurationManager.java (custom reports) This addresses a critical security issue with a 19-year-old library that has known XML parsing vulnerabilities. Fixes #2145 Co-authored-by: Michael Yingbull <yingbull@users.noreply.github.com>
📝 WalkthroughWalkthroughThis pull request upgrades the outdated Apache Commons Digester library from version 1.8 (released 2006) to the actively maintained Commons Digester3 version 3.3. The change involves updating the Maven dependency coordinates and adjusting three Java import statements to reference the new package namespace. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
Comment |
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@pom.xml`:
- Around line 269-274: The pom currently declares commons-digester3 version 3.3
which does not exist and will break builds; change the commons-digester3
dependency (artifactId commons-digester3) to the published 3.2 release or remove
the dependency if unused, and if you keep it explicitly manage the transitive
commons-beanutils vulnerability by either excluding beanutils from
commons-digester3 and adding a direct commons-beanutils dependency pinned to a
secure version (>=1.11.0, e.g., 1.11.1) in your
dependencyManagement/dependencies, or add a direct commons-beanutils override to
ensure the safe version is used; update any related tests/imports when removing
the dependency.
|
@claude make an issue ticket to review refactoring out this library if possible (digester3). |
|
@claude review the feedback from coderabbitai and confirm if it is correct. If so, propose the best course of action. |
|
Claude finished @yingbull's task in 1m 29s —— View job Creating issue ticket for digester3 refactoring investigationTasks
Analysis SummaryI've analyzed how digester3 is being used in the codebase and created issue #2195 to track the investigation of refactoring out this dependency. Current Usage Patterns:
All three use cases follow the same pattern: XML configuration files → JavaBean objects via declarative mapping rules. Next Steps: Issue #2195 includes investigation tasks to evaluate:
Related: #2195 |
|
Claude finished @yingbull's task in 2m 5s —— View job Reviewing CodeRabbit Feedback
AnalysisCodeRabbit's feedback is CORRECT. I've verified the following: 1. Version 3.3 Does Not Exist on Maven CentralFrom the CI build logs (line 1217): And from line 1857: Maven Central only has version 3.2, not 3.3. The build didn't fail because CodeQL's autobuild process continued despite the warning, but this will cause actual build failures when running 2. Security Vulnerabilities Are RealCodeRabbit correctly identified that commons-digester3 3.x (even 3.2) has transitive security vulnerabilities through its
Note that the old pom.xml already excluded Recommended Course of ActionI recommend Option 2 below: Option 1: Downgrade to 3.2 and Add Security Exclusions (Not Recommended)<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-digester3</artifactId>
<version>3.2</version>
<exclusions>
<exclusion>
<groupId>commons-beanutils</groupId>
<artifactId>commons-beanutils</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>commons-beanutils</groupId>
<artifactId>commons-beanutils</artifactId>
<version>1.11.1</version>
</dependency>Problem: This still leaves you with an unmaintained library (last updated 2011). Option 2: Remove Digester Entirely (Recommended) ⭐Digester is only used in 3 files:
Modern alternatives:
This would:
Next StepsWould you like me to:
I recommend option 1 (create issue) + option 2 (revert/close PR), then tackle the refactoring properly. |
|
Claude finished @yingbull's task in 1m 44s —— View job Completed: Fixed digester3 dependency and created tracking issueTasks
SummarySuccessfully addressed CodeRabbit's review feedback:
The build should now succeed, and the transitive security vulnerabilities are mitigated by excluding the vulnerable beanutils version and using our own secure version (1.11.1). Next Steps
|
- Change version from 3.3 (doesn't exist) to 3.2 (latest available) - Exclude commons-beanutils from digester3 to avoid transitive CVEs - Update commons-beanutils to 1.11.1 for better security - Addresses CodeRabbit review feedback Related: #2196 Co-authored-by: Michael Yingbull <yingbull@users.noreply.github.com>
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 1 file (changes from recent commits).
Prompt for AI agents (all issues)
Check if these issues are valid — if so, understand the root cause of each and fix them.
<file name="pom.xml">
<violation number="1" location="pom.xml:273">
P2: This change downgrades commons-digester3 to 3.2, which skips the 3.3 maintenance fixes listed in the Apache release notes. If the goal is to upgrade from 1.8, keep the dependency at 3.3 to avoid missing those bug fixes.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
|
@claude review |
|
Claude finished @yingbull's task in 2m 51s —— View job Code ReviewTasks
SummaryThis PR successfully upgrades commons-digester from the 19-year-old version 1.8 to commons-digester3 3.2. The changes are functionally correct but have one dependency issue that should be addressed before merging. Review Findings✅ Code Changes - APPROVEDThe three Java files have clean, straightforward import updates: Files changed:
All three files correctly changed from: import org.apache.commons.digester.Digester;to: import org.apache.commons.digester3.Digester;No other code changes required - the Digester API is compatible between versions.
|
|
@claude make the recommended change in a commit |
There was a problem hiding this comment.
Pull request overview
This PR upgrades the Apache Commons Digester library from the end-of-life version 1.8 (last updated December 2006) to the modern commons-digester3 version, addressing critical XML parsing security vulnerabilities and improving Java 21 compatibility. The upgrade is primarily a package namespace change from org.apache.commons.digester to org.apache.commons.digester3, with the API methods remaining compatible.
Changes:
- Updated Maven dependency from
commons-digester:commons-digester:1.8toorg.apache.commons:commons-digester3:3.2 - Updated Java package imports from
org.apache.commons.digestertoorg.apache.commons.digester3in 3 files that use Digester for XML parsing - Bumped commons-beanutils from 1.11.0 to 1.11.1 (transitive dependency)
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| pom.xml | Updated dependency from commons-digester 1.8 to commons-digester3 3.2, excluded transitive commons-beanutils, and upgraded explicit commons-beanutils to 1.11.1 |
| EctFindMeasurementTypeUtil.java | Updated import statement from org.apache.commons.digester.Digester to org.apache.commons.digester3.Digester for measurement type XML parsing |
| EFormLoader.java | Updated import statement from org.apache.commons.digester.Digester to org.apache.commons.digester3.Digester for eform configuration XML parsing |
| UCRConfigurationManager.java | Updated import statement from org.apache.commons.digester.Digester to org.apache.commons.digester3.Digester for custom report configuration XML parsing |
|
Claude finished @yingbull's task in 1m 12s —— View job Recommended change applied ✅Tasks
SummarySuccessfully reverted Commit: Rationale:
Note regarding conflicting feedback: Both cubic-dev-ai and copilot-reviewer suggested using version 3.3, but this is incorrect. As CodeRabbit correctly identified:
The current configuration (digester3 3.2 with beanutils 1.11.0) is the correct approach until the library can be fully removed. |
Reverted commons-beanutils from 1.11.1 to 1.11.0 to avoid Maven warning. Version 1.11.0 is proven to work without dependency resolution issues. Co-authored-by: Michael Yingbull <yingbull@users.noreply.github.com>
There was a problem hiding this comment.
1 issue found across 1 file (changes from recent commits).
Prompt for AI agents (all issues)
Check if these issues are valid — if so, understand the root cause of each and fix them.
<file name="pom.xml">
<violation number="1">
P2: The dependency is downgraded to 1.11.0 even though the comment indicates a higher version is required to address a security issue. Either keep the higher version or update the comment if a downgrade is intentional.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Snapshot WarningsEnsure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice. OpenSSF Scorecard
Scanned Files
|
|
@claude review |
|
Claude finished @yingbull's task in 2m 11s —— View job Code ReviewTasks
SummaryThis PR successfully upgrades commons-digester from the 19-year-old version 1.8 to commons-digester3, but has a critical dependency version issue that must be fixed before merging. Review Findings✅ Code Changes - APPROVEDAll three Java files have correct, clean import updates: Files changed:
All changed from: import org.apache.commons.digester.Digester;to: import org.apache.commons.digester3.Digester;No other code changes required - the Digester API is compatible between versions. ❌ Dependency Configuration - CRITICAL ISSUEpom.xml:273 - Version 3.3 does not exist on Maven Central: Current state (INCORRECT): <dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-digester3</artifactId>
<version>3.3</version>
<exclusions>
<exclusion>
<groupId>commons-beanutils</groupId>
<artifactId>commons-beanutils</artifactId>
</exclusion>
</exclusions>
</dependency>Required fix: <version>3.2</version> Evidence:
|
|
@claude do the required change to fix the version number and commit it |
|
Claude finished @yingbull's task in 1m 36s —— View job Version number fixed ✅Tasks
SummarySuccessfully changed Rationale:
Commit: Note about conflicting reviewer feedback: Both cubic-dev-ai and copilot-reviewer suggested using version 3.3, but this is incorrect:
The current configuration (digester3 3.2 with beanutils 1.11.0 exclusion) is correct and will allow builds to succeed. |
Version 3.3 is not published to Maven Central Repository. Only version 3.2 (released in 2011) is available. This fixes the build to use the correct version that can be resolved by Maven. Co-authored-by: Michael Yingbull <yingbull@users.noreply.github.com>
|
@claude make an issue ticket to investigate possible cve with beanutils |
|
Claude finished @yingbull's task in 1m 6s —— View job Created issue ticket for commons-beanutils CVE investigation ✅Tasks
SummarySuccessfully created issue #2202 to track the investigation of commons-beanutils CVE exposure and mitigation strategy. Current Situation
CVEs of ConcernThe new issue tracks investigation of three CVEs:
Key Investigation QuestionsThe issue includes tasks to:
Why This MattersFor a healthcare EMR system handling PHI (Patient Health Information), security vulnerabilities in dependencies must be thoroughly investigated and properly mitigated. This issue ensures we have a comprehensive understanding of the risk and appropriate mitigation strategy. Related: #2202 (new issue), #2196 (digester3 refactoring investigation) |
There was a problem hiding this comment.
1 issue found across 1 file (changes from recent commits).
Prompt for AI agents (all issues)
Check if these issues are valid — if so, understand the root cause of each and fix them.
<file name="pom.xml">
<violation number="1" location="pom.xml:273">
P2: This change downgrades commons-digester3 to 3.2, which predates the 3.3 maintenance fixes in the Apache release notes. Consider keeping 3.3 to avoid missing those fixes.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
Summary
Replace EOL commons-digester 1.8 with commons-digester3 3.3 to address critical security vulnerabilities and improve Java 21 compatibility.
Changes
commons-digester:commons-digester:1.8toorg.apache.commons:commons-digester3:3.3org.apache.commons.digestertoorg.apache.commons.digester3in 3 files:EctFindMeasurementTypeUtil.java(measurement type parsing)EFormLoader.java(eform configuration parsing)UCRConfigurationManager.java(custom report configuration)Security Impact
This upgrade addresses:
Testing Requirements
Manual testing required for:
Migration Notes
This is a breaking change at the package level:
org.apache.commons.digestertoorg.apache.commons.digester3Fixes #2145
Generated with Claude Code
Summary by cubic
Upgraded Apache Commons Digester from 1.8 to Digester3 3.2 to fix XML parsing vulnerabilities and improve Java 21 support. Touches measurement, eform, and custom report parsing. Addresses #2145.
Dependencies
Migration
Written for commit 4cd38ba. Summary will update on new commits.
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.