Skip to content

Fix GHSA-6fmv-xxpf-w3cw: pin plexus-utils 3.6.1 and suppress false positive#1138

Merged
timtebeek merged 1 commit intomainfrom
tim/bump-plexus-utils
Apr 8, 2026
Merged

Fix GHSA-6fmv-xxpf-w3cw: pin plexus-utils 3.6.1 and suppress false positive#1138
timtebeek merged 1 commit intomainfrom
tim/bump-plexus-utils

Conversation

@timtebeek
Copy link
Copy Markdown
Member

@timtebeek timtebeek commented Apr 8, 2026 •
edited
Loading

Summary

Addresses GHSA-6fmv-xxpf-w3cw (Zip Slip in plexus-utils Expand class).

  • Move plexus-utils from a direct compile dependency to <dependencyManagement>, pinned at 3.6.1 which contains the fix. The only classes used (Xpp3Dom, MXSerializer) are already provided by the existing plexus-xml:4.1.1 dependency.
  • Add a temporary OWASP dependency-check suppression (expires 2026-05-08) for CVE-2025-67030, since the advisory currently lists all versions below 4.0.3 as affected — a false positive for 3.6.1. A correction has been submitted to the advisory.

Test plan

  • mvn compile passes
  • All 15 tests pass

@github-project-automation github-project-automation Bot moved this to In Progress in OpenRewrite Apr 8, 2026
@timtebeek timtebeek requested a review from Jenson3210 April 8, 2026 16:16
@Jenson3210
Copy link
Copy Markdown
Contributor

Jenson3210 commented Apr 8, 2026

Are we confident about this change? Shannon added this back. 3.6.1 is a backpatch which is not vulnerable but just not known by the vulnerability database.

Kevin mentioned maven3 is not compatible with 4.x

@timtebeek
Copy link
Copy Markdown
Member Author

timtebeek commented Apr 8, 2026

Was that not for a different vulnerability? Since this lists anything below 4.0.3 as vulnerable:

My plan was to merge this and run the scan again to verify we don't pull in this version anymore transitively.

@Jenson3210
Copy link
Copy Markdown
Contributor

Jenson3210 commented Apr 8, 2026

AFAICS,

@timtebeek timtebeek force-pushed the tim/bump-plexus-utils branch from 586819a to 7bfb2a5 Compare April 8, 2026 16:51
@timtebeek timtebeek changed the title Remove plexus-utils dependency (GHSA-6fmv-xxpf-w3cw) Remove direct plexus-utils dependency; pin to 4.0.3 via dependencyManagement Apr 8, 2026
@timtebeek timtebeek force-pushed the tim/bump-plexus-utils branch from 7bfb2a5 to 62e7589 Compare April 8, 2026 16:52
@timtebeek timtebeek changed the title Remove direct plexus-utils dependency; pin to 4.0.3 via dependencyManagement Remove direct plexus-utils dependency; pin to 3.6.1 via dependencyManagement Apr 8, 2026
@github-project-automation github-project-automation Bot moved this from In Progress to Ready to Review in OpenRewrite Apr 8, 2026
@timtebeek timtebeek force-pushed the tim/bump-plexus-utils branch from 62e7589 to e863e42 Compare April 8, 2026 16:55
@timtebeek timtebeek changed the title Remove direct plexus-utils dependency; pin to 3.6.1 via dependencyManagement Fix GHSA-6fmv-xxpf-w3cw: pin plexus-utils 3.6.1 and suppress false positive Apr 8, 2026
@timtebeek
Copy link
Copy Markdown
Member Author

timtebeek commented Apr 8, 2026

Hmm; thanks! So then the issue appears to be slightly different: 3.6.1 already contains the fix, and we should continue to have that here to override the 3.6.0 coming in transitively.

I've proposed an upstream fix as well then

@timtebeek
Copy link
Copy Markdown
Member Author

timtebeek commented Apr 8, 2026

mvn dependency:tree now shows 3.6.1 as provided, instead of as bundled previously:

[INFO] +- org.apache.maven:maven-plugin-api:jar:3.9.14:provided
[INFO] |  +- org.apache.maven:maven-artifact:jar:3.9.14:provided
[INFO] |  +- org.eclipse.sisu:org.eclipse.sisu.plexus:jar:1.0.0:provided
[INFO] |  +- org.codehaus.plexus:plexus-utils:jar:3.6.1:provided
[INFO] |  \- org.codehaus.plexus:plexus-classworlds:jar:2.9.0:provided

@timtebeek timtebeek merged commit 030f345 into main Apr 8, 2026
1 check passed
@timtebeek timtebeek deleted the tim/bump-plexus-utils branch April 8, 2026 17:09
@github-project-automation github-project-automation Bot moved this from Ready to Review to Done in OpenRewrite Apr 8, 2026
mergify Bot added a commit to robfrank/linklift that referenced this pull request May 3, 2026
@mergify
chore(deps-dev): bump org.openrewrite.maven:rewrite-maven-plugin from…
a849795 
… 6.34.0 to 6.38.0 [skip ci]

Bumps [org.openrewrite.maven:rewrite-maven-plugin](https://github.com/openrewrite/rewrite-maven-plugin) from 6.34.0 to 6.38.0.
Release notes

*Sourced from [org.openrewrite.maven:rewrite-maven-plugin's releases](https://github.com/openrewrite/rewrite-maven-plugin/releases).*

> 6.38.0
> ------
>
> **Full Changelog**: <openrewrite/rewrite-maven-plugin@v6.37.0...v6.38.0>
>
> 6.37.0
> ------
>
> What's Changed
> --------------
>
> * Fix GHSA-6fmv-xxpf-w3cw: pin plexus-utils 3.6.1 and suppress false positive by [`@​timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-maven-plugin#1138](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1138)
> * Validate DEVELOCITY\_ACCESS\_KEY format before build by [`@​timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-maven-plugin#1141](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1141)
> * Add Slack notification for scheduled CI failures by [`@​timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-maven-plugin#1140](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1140)
> * Resolve Maven user properties (-D) in YAML configuration by [`@​timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-maven-plugin#1139](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1139)
> * Skip parsing generated sources; use compiled classes instead by [`@​timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-maven-plugin#1142](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1142)
> * chore(ci): bump org.owasp:dependency-check-maven from 12.2.0 to 12.2.1 by [`@​dependabot`](https://github.com/dependabot)[bot] in [openrewrite/rewrite-maven-plugin#1143](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1143)
> * Fix plexus-utils CVE-2025-67030 suppression by [`@​Jenson3210`](https://github.com/Jenson3210) in [openrewrite/rewrite-maven-plugin#1144](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1144)
> * Move dependency-check-maven plugin from reporting to build by [`@​Jenson3210`](https://github.com/Jenson3210) in [openrewrite/rewrite-maven-plugin#1145](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1145)
> * chore(ci): bump actions/upload-pages-artifact from 4 to 5 by [`@​dependabot`](https://github.com/dependabot)[bot] in [openrewrite/rewrite-maven-plugin#1146](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1146)
> * chore(ci): bump io.micrometer:micrometer-core from 1.16.4 to 1.16.5 by [`@​dependabot`](https://github.com/dependabot)[bot] in [openrewrite/rewrite-maven-plugin#1148](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1148)
> * chore(ci): bump maven-dependencies.version from 3.9.14 to 3.9.15 by [`@​dependabot`](https://github.com/dependabot)[bot] in [openrewrite/rewrite-maven-plugin#1147](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1147)
>
> **Full Changelog**: <openrewrite/rewrite-maven-plugin@v6.36.0...v6.37.0>
>
> 6.36.0
> ------
>
> **Full Changelog**: <openrewrite/rewrite-maven-plugin@v6.35.1...v6.36.0>
>
> 6.35.1
> ------
>
> What's Changed
> --------------
>
> * Fix datatable\_export test for updated CSV column headers by [`@​timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-maven-plugin#1132](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1132)
> * chore(ci): bump actions/configure-pages from 5 to 6 by [`@​dependabot`](https://github.com/dependabot)[bot] in [openrewrite/rewrite-maven-plugin#1129](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1129)
> * chore(ci): bump actions/deploy-pages from 4 to 5 by [`@​dependabot`](https://github.com/dependabot)[bot] in [openrewrite/rewrite-maven-plugin#1130](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1130)
> * Fix files falsely marked as changed by migration recipes by [`@​timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-maven-plugin#1134](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1134)
> * Pass null properties when resolvePropertiesInYaml=false by [`@​timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-maven-plugin#1133](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1133)
> * Fix isExcluded gitignore handling using shared GitIgnore utility by [`@​pdelagrave`](https://github.com/pdelagrave) in [openrewrite/rewrite-maven-plugin#1135](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1135)
> * bump vulnerabilities by [`@​Jenson3210`](https://github.com/Jenson3210) in [openrewrite/rewrite-maven-plugin#1136](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1136)
>
> New Contributors
> ----------------
>
> * [`@​pdelagrave`](https://github.com/pdelagrave) made their first contribution in [openrewrite/rewrite-maven-plugin#1135](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1135)
>
> **Full Changelog**: <openrewrite/rewrite-maven-plugin@v6.35.0...v6.35.1>
>
> 6.35.0
> ------
>
> What's Changed
> --------------
>
> * Add optional version input to publish workflow by [`@​timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-maven-plugin#1124](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1124)
> * Use CsvDataTableStore for data table export by [`@​jkschneider`](https://github.com/jkschneider) in [openrewrite/rewrite-maven-plugin#1125](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1125)
> * chore(ci): bump com.fasterxml.jackson:jackson-bom from 2.17.3 to 2.21.2 by [`@​dependabot`](https://github.com/dependabot)[bot] in [openrewrite/rewrite-maven-plugin#1126](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1126)
> * Load proxy settings from Maven settings.xml by [`@​timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-maven-plugin#1127](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1127)
>
> **Full Changelog**: <openrewrite/rewrite-maven-plugin@v6.34.0...v6.35.0>


Commits

* [`4fe065c`](openrewrite/rewrite-maven-plugin@4fe065c) [maven-release-plugin] prepare release v6.38.0
* [`446bc8a`](openrewrite/rewrite-maven-plugin@446bc8a) Bump rewrite.version property
* [`f3d983c`](openrewrite/rewrite-maven-plugin@f3d983c) Bump rewrite.version property
* [`b5565ff`](openrewrite/rewrite-maven-plugin@b5565ff) Bump rewrite.version property
* [`b7d7640`](openrewrite/rewrite-maven-plugin@b7d7640) [maven-release-plugin] prepare for next development iteration
* [`caecb2f`](openrewrite/rewrite-maven-plugin@caecb2f) [maven-release-plugin] prepare release v6.37.0
* [`68bab02`](openrewrite/rewrite-maven-plugin@68bab02) Bump rewrite.version property
* [`841ed61`](openrewrite/rewrite-maven-plugin@841ed61) chore(ci): bump maven-dependencies.version from 3.9.14 to 3.9.15 ([#1147](https://redirect.github.com/openrewrite/rewrite-maven-plugin/issues/1147))
* [`4b191ed`](openrewrite/rewrite-maven-plugin@4b191ed) chore(ci): bump io.micrometer:micrometer-core from 1.16.4 to 1.16.5 ([#1148](https://redirect.github.com/openrewrite/rewrite-maven-plugin/issues/1148))
* [`e8cb166`](openrewrite/rewrite-maven-plugin@e8cb166) chore(ci): bump actions/upload-pages-artifact from 4 to 5 ([#1146](https://redirect.github.com/openrewrite/rewrite-maven-plugin/issues/1146))
* Additional commits viewable in [compare view](openrewrite/rewrite-maven-plugin@v6.34.0...v6.38.0)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Jenson3210 Jenson3210 Jenson3210 approved these changes

Assignees

@timtebeek timtebeek

Labels

None yet

Projects

OpenRewrite
Archived in project

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@timtebeek @Jenson3210