Updated and removed some dependencies for security purpose by kateyang1998 · Pull Request #324 · openo-beta/Open-O

kateyang1998 · 2025-06-26T20:16:04Z

Issue described in #322

Summary by Sourcery

Secure project dependencies by bumping library versions, adding security-focused libraries, and excluding vulnerable transitive dependencies

New Features:

Add commons-beanutils 1.11.0, dom4j 2.1.4, and OWASP ESAPI 2.6.2.0 as direct dependencies

Enhancements:

Upgrade HAPI FHIR to 6.4.0, MySQL Connector/J to 9.3.0, WebDriverManager to 6.1.0, and Apache CXF HTTP transport to 3.3.0
Exclude commons-beanutils from multiple dependencies to mitigate security vulnerabilities
Exclude xalan, serializer, Bouncy Castle, and ESAPI transitive libraries from specific dependencies

sourcery-ai · 2025-06-26T20:16:09Z

Reviewer's Guide

This PR strengthens security by upgrading several dependencies to safer versions, adding direct management of vulnerable libraries, and systematically excluding risky transitive dependencies in the Maven configuration.

File-Level Changes

Change	Details	Files
Upgraded primary dependencies to newer, secure versions	Bumped HAPI FHIR from 5.4.0 to 6.4.0 Updated MySQL connector to com.mysql:mysql-connector-j 9.3.0 Advanced WebDriverManager from 3.8.1 to 6.1.0 Set CXF transports HTTP to 3.3.0 and added CXF WS-Security 3.2.0	`pom.xml`
Introduced direct dependency declarations for better control	Added commons-beanutils 1.11.0 Added dom4j 2.1.4 Added OWASP ESAPI 2.6.2.0	`pom.xml`
Excluded vulnerable transitive dependencies	Excluded commons-beanutils variants from multiple Apache Commons and third-party modules Excluded Xalan and serializer from XML-related dependencies Excluded BouncyCastle and ESAPI from CXF and Woodstox configurations	`pom.xml`
Removed obsolete or insecure artifacts	Replaced old mysql-connector-java entry with com.mysql connector Commented unnecessary dependency link causing 404 when removed	`pom.xml`

Possibly linked issues

Update dependencies by Dependabot suggestion #322: The PR updates and removes dependencies in pom.xml to fix security vulnerabilities as described in the issue.

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

sourcery-ai

Hey @kateyang1998 - I've reviewed your changes - here's some feedback:

Consider consolidating repeated transitive exclusions and version overrides into a dependencyManagement section to reduce duplication.
Align CXF module versions—cxf-rt-ws-security is still at 3.2.0 while transport is 3.3.0—to avoid incompatibilities.
Remove redundant exclusions for libraries now included directly (e.g., ESAPI, dom4j, Beanutils) to simplify your POM.

Prompt for AI Agents

Please address the comments from this code review:
## Overall Comments
- Consider consolidating repeated transitive exclusions and version overrides into a dependencyManagement section to reduce duplication.
- Align CXF module versions—cxf-rt-ws-security is still at 3.2.0 while transport is 3.3.0—to avoid incompatibilities.
- Remove redundant exclusions for libraries now included directly (e.g., ESAPI, dom4j, Beanutils) to simplify your POM.

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

- Added commons-httpclient and jersey-client dependencies since these are not included in axis2 1.8.0

- Modified some relevant classes to make them fully compatible

yingbull · 2025-07-03T18:25:10Z

pom.xml

                    <groupId>com.fasterxml.woodstox</groupId>
                    <artifactId>woodstox-core</artifactId>
                </exclusion>
+                <exclusion>


can you explain this? we are excluding cxf?

Overall we need more documentation; it helps reviewers and further people working on the code.

@yingbull, these are the libraries that triggered the security issues, but are not being used. Excluding them won't impact cxf's functionality in our project, I will add some comments.

@yingbull added comments.

yingbull · 2025-07-17T18:55:19Z

@kateyang1998 could you resolve the conflicts and test this is still good and working when merged in with current coyote, and I will finish the review? Change it from draft to ready to review when that is the case.

socket-security · 2025-07-17T19:23:52Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		`com.ibm.icu/icu4j@72.1` has Obfuscated code. Confidence: 0.90 Location: Package overview From: pom.xml → `maven/ca.uhn.hapi.fhir/hapi-fhir-structures-dstu3@6.4.0` → `maven/com.ibm.icu/icu4j@72.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore maven/com.ibm.icu/icu4j@72.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

kateyang1998 · 2025-07-17T19:30:14Z

@kateyang1998 could you resolve the conflicts and test this is still good and working when merged in with current coyote, and I will finish the review? Change it from draft to ready to review when that is the case.

There are 46 compilation errors after merged with coyote, resolving now

kateyang1998 · 2025-07-17T19:46:38Z

@yingbull all good now.

- Replaced net.sf.json with jackson-databind in CaseloadContent2Action - Updated StringEscapeUtils usage Co-Authored-By: aider (deepseek/deepseek-chat) <aider@aider.chat>

kateyang1998 · 2025-08-08T19:03:36Z

@yingbull there are some error after resolve the conflict, I'm looking into them now.

This reverts commit b779114.

sourcery-ai

Sorry @kateyang1998, you have reached your 24-hour rate limit for Sourcery. Please try again later

socket-security · 2025-08-28T17:29:51Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
org.apache.ant/ant@1.10.15
org.apache.santuario/xmlsec@2.3.4
org.owasp.esapi/esapi@2.6.2.0
commons-net/commons-net@3.6 ⏵ 3.11.1		⁺²
io.github.bonigarcia/webdrivermanager@3.8.1 ⏵ 6.1.0		⁺⁷⁵
org.apache.cxf/cxf-core@3.5.10 ⏵ 3.5.11		⁺²
org.apache.cxf/cxf-rt-rs-client@3.5.10 ⏵ 3.5.11
commons-beanutils/commons-beanutils@1.7.0 ⏵ 1.11.0		⁺²²
org.apache.commons/commons-lang3@3.17.0 ⏵ 3.18.0		⁺²
org.apache.cxf/cxf-rt-frontend-jaxws@3.5.10 ⏵ 3.5.11
org.apache.cxf/cxf-rt-rs-extension-providers@3.5.10 ⏵ 3.5.11
ca.uhn.hapi.fhir/hapi-fhir-structures-dstu2@5.4.0 ⏵ 6.4.0	^-61		^-11
org.jdom/jdom2@2.0.6.1
org.dom4j/dom4j@2.1.4
org.glassfish.jersey.core/jersey-client@2.39.1
org.apache.cxf/cxf-rt-transports-http@3.5.10 ⏵ 3.5.11
ca.uhn.hapi.fhir/hapi-fhir-base@5.4.0 ⏵ 6.4.0	⁺³		⁺¹	⁺¹
javax.servlet.jsp/javax.servlet.jsp-api@2.3.3
org.apache.axis2/axis2@1.5.4 ⏵ 1.8.0	⁺⁷⁴	⁺⁴			⁺²⁰
commons-fileupload/commons-fileupload@1.5 ⏵ 1.6.0		⁺¹⁶
org.apache.cxf/apache-cxf@3.5.10 ⏵ 3.5.11
ca.uhn.hapi.fhir/hapi-fhir-structures-dstu3@5.4.0 ⏵ 6.4.0	^-5		^-11
org.apache.axis2/axis2-transport-http@1.5.4 ⏵ 1.8.0
org.apache.axis2/axis2-adb@1.8.0

View full report

yingbull · 2025-08-29T21:44:43Z

Thanks for the work on this! It is generating JSP errors on compile though.

@LiamStanziani can you review this when you start back, and see what we've learned here we can apply to a new branch/pr against Dogfish?

recall

yingbull

many compile errors on jsps.

…arioMD, will need to review CodeQL fail on rebuild

src/main/java/oscar/oscarBilling/ca/bc/Teleplan/TeleplanCodesManager.java

src/main/java/oscar/oscarBilling/ca/bc/Teleplan/TeleplanResponse.java

src/main/java/oscar/oscarBilling/ca/bc/pageUtil/ManageTeleplan2Action.java

…d, even though it should be

LiamStanziani · 2025-09-01T15:50:11Z

PR is fully passing now (fixed up remaining jsp compilation errors, CodeQL, and test failures). I would like to test this to ensure nothing is breaking with these changes.

@yingbull would you like me to still move the changes over to a develop/dogfish branch? or would you like this to be merged into develop/coyote and then moved over through a merge?

yingbull · 2025-09-01T16:51:12Z

if this is targeting coyote, confirm it is working well and we can merge to coyote.

If you can cleanly enough merge to dogfish, I am okay with it - depending on what files are touched that may be fine, or ugly.

In generally my approach here on would be to be pr to just dogfish.

LiamStanziani · 2025-09-01T17:40:09Z

I think the PR is working well, although after further review I think the merge to dogfish will be quite ugly. I am going to create a branch off dogfish and move it over as you said before

LiamStanziani · 2025-09-02T18:23:34Z

Closing this PR since it has been moved and merged to a branch based off of develop/dogfish, merging this would probably cause issues as well.

PR: #494

kateyang1998 requested a review from yingbull June 26, 2025 20:16

sourcery-ai bot reviewed Jun 26, 2025

View reviewed changes

kateyang1998 force-pushed the issue-322 branch from cdb7e4f to 05bd978 Compare June 27, 2025 18:42

update: updated and removed some dependencies for security purpose

2a03390

kateyang1998 force-pushed the issue-322 branch from 05bd978 to 2a03390 Compare June 30, 2025 20:08

kateyang1998 added 2 commits July 2, 2025 10:43

update: updated axis2 to 1.8.0

b6f8d3d

- Added commons-httpclient and jersey-client dependencies since these are not included in axis2 1.8.0

update: updated commons-client to httpclient 4.5.14

b3f93f2

- Modified some relevant classes to make them fully compatible

yingbull suggested changes Jul 3, 2025

View reviewed changes

update: added comments in pom.xml for future development

15b5fb4

yingbull self-requested a review July 16, 2025 17:14

yingbull previously approved these changes Jul 16, 2025

View reviewed changes

yingbull marked this pull request as draft July 16, 2025 17:18

yingbull marked this pull request as ready for review July 17, 2025 18:54

yingbull marked this pull request as draft July 17, 2025 18:55

Merge branch 'develop/coyote' into issue-322

529f34f

update: updated the pom dependencies to solve compilation errors.

9b22058

kateyang1998 force-pushed the issue-322 branch from 2192cc6 to 9b22058 Compare July 17, 2025 19:51

update: updated and excluded some dependencies by Dependabot suggestion

39ff1d4

kateyang1998 force-pushed the issue-322 branch from 59b125b to 39ff1d4 Compare July 18, 2025 15:12

kateyang1998 and others added 3 commits July 18, 2025 14:57

update: removed commons-lang, and refactored relative classes

b779114

- Replaced net.sf.json with jackson-databind in CaseloadContent2Action - Updated StringEscapeUtils usage Co-Authored-By: aider (deepseek/deepseek-chat) <aider@aider.chat>

Merge branch 'develop/coyote' into issue-322

dc75ba8

Merge branch 'develop/coyote' into issue-322

665ac18

kateyang1998 added 2 commits August 12, 2025 13:01

Revert "update: removed commons-lang, and refactored relative classes"

69eae9e

This reverts commit b779114.

fix: added missing import org.apache.commons.lang.StringUtils

04c74c1

kateyang1998 marked this pull request as ready for review August 12, 2025 17:44

Merge branch 'develop/coyote' into issue-322

8ac1559

sourcery-ai bot reviewed Aug 12, 2025

View reviewed changes

Merge branch 'develop/coyote' into issue-322

5f59887

update: updated some dependencies to higher version

5806745

yingbull self-requested a review August 29, 2025 21:45

yingbull suggested changes Aug 29, 2025

View reviewed changes

kateyang1998 and others added 5 commits August 31, 2025 11:49

fix: fixed some jsp compilation errors

ce2f444

fix: fixed 500 error caused in some patients' EChart -> encounter note

d78175e

Fixed jsp compilation errors, removed some unused libraraies from Ont…

ca300ca

…arioMD, will need to review CodeQL fail on rebuild

Merge branch 'develop/coyote' into issue-322

29598c4

Potential fixes for the new CodeQL security failures

2ace7be

github-advanced-security bot found potential problems Sep 1, 2025

View reviewed changes

LiamStanziani added 2 commits September 1, 2025 10:51

Added path conversion of path and allowed paths instead of strings

9716b31

Added into failing test class to include table that isnt being create…

8822ca0

…d, even though it should be

LiamStanziani linked an issue Sep 1, 2025 that may be closed by this pull request

Update dependencies by Dependabot suggestion #322

Closed

LiamStanziani mentioned this pull request Sep 1, 2025

Updated and removed some dependencies for security purpose (develop/dogfish version) #494

Merged

LiamStanziani removed a link to an issue Sep 2, 2025

Update dependencies by Dependabot suggestion #322

Closed

LiamStanziani closed this Sep 2, 2025

yingbull deleted the issue-322 branch January 8, 2026 19:24

Conversation

kateyang1998 commented Jun 26, 2025 • edited by sourcery-ai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by Sourcery

Uh oh!

sourcery-ai bot commented Jun 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer's Guide

File-Level Changes

Possibly linked issues

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

sourcery-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

yingbull Jul 3, 2025

Choose a reason for hiding this comment

Uh oh!

yingbull Jul 3, 2025

Choose a reason for hiding this comment

Uh oh!

kateyang1998 Jul 3, 2025

Choose a reason for hiding this comment

Uh oh!

kateyang1998 Jul 3, 2025

Choose a reason for hiding this comment

Uh oh!

yingbull commented Jul 17, 2025

Uh oh!

socket-security bot commented Jul 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kateyang1998 commented Jul 17, 2025

Uh oh!

kateyang1998 commented Jul 17, 2025

Uh oh!

kateyang1998 commented Aug 8, 2025

Uh oh!

sourcery-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

socket-security bot commented Aug 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yingbull commented Aug 29, 2025

Uh oh!

yingbull left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

LiamStanziani commented Sep 1, 2025

Uh oh!

yingbull commented Sep 1, 2025

Uh oh!

LiamStanziani commented Sep 1, 2025

Uh oh!

LiamStanziani commented Sep 2, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

kateyang1998 commented Jun 26, 2025 •

edited by sourcery-ai bot

Loading

sourcery-ai bot commented Jun 26, 2025 •

edited

Loading

socket-security bot commented Jul 17, 2025 •

edited

Loading

socket-security bot commented Aug 28, 2025 •

edited

Loading