Skip to content

Comments

Update commons-text to 1.14.0 (CVE-2025-48924)#1505

Merged
WilliamBergamin merged 1 commit intoslackapi:mainfrom
sic2:security/commons-text
Oct 6, 2025
Merged

Update commons-text to 1.14.0 (CVE-2025-48924)#1505
WilliamBergamin merged 1 commit intoslackapi:mainfrom
sic2:security/commons-text

Conversation

@sic2
Copy link
Contributor

@sic2 sic2 commented Sep 29, 2025

Changes

This PR updates the commons-text from 1.13.0 to 1.14.0.

Version 1.13.0 includes commons-lang3:3.17 which contains a security vulnerability.
See: https://mvnrepository.com/artifact/org.apache.commons/commons-text/1.13.0

Version 1.14.0 patches this, by updating to commons-lang3:3.18.
See: https://mvnrepository.com/artifact/org.apache.commons/commons-text/1.14.0

Short description of vulnerability

Uncontrolled Recursion vulnerability in Apache Commons Lang. 
This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, 
from org.apache.commons:commons-lang3 3.0 before 3.18.0. 
The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. 
Because an Error is usually not handled by applications and libraries, 
a StackOverflowError could cause an application to stop. 
Users are recommended to upgrade to version 3.18.0, which fixes the issue. 
Mend Note: The description of this vulnerability differs from MITRE.

For additional info, see CVE-2025-48924.

Category (place an x in each of the [ ])

  • bolt (Bolt for Java)
  • bolt-{sub modules} (Bolt for Java - optional modules)
  • slack-api-client (Slack API Clients)
  • slack-api-model (Slack API Data Models)
  • slack-api-*-kotlin-extension (Kotlin Extensions for Slack API Clients)
  • slack-app-backend (The primitive layer of Bolt for Java)

@salesforce-cla
Copy link

salesforce-cla bot commented Sep 29, 2025

Thanks for the contribution! Before we can merge this, we need @sic2 to sign the Salesforce Inc. Contributor License Agreement.

@mwbrooks mwbrooks added dependencies Pull requests that update a dependency file java This is a label that @dependabot automatically creates. We don't use it. labels Sep 29, 2025
@mwbrooks mwbrooks added this to the 1.45.5 milestone Sep 29, 2025
@mwbrooks
Copy link
Member

mwbrooks commented Sep 29, 2025

Hi @sic2 👋🏻 Thanks for the PR to bump our dependency. When you have a moment, can you sign our CLA to allow us to move forward? Thanks!

@codecov
Copy link

codecov bot commented Sep 29, 2025 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.21%. Comparing base (fb3770e) to head (b587b53).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files 
@@             Coverage Diff              @@
##               main    #1505      +/-   ##
============================================
+ Coverage     73.12%   73.21%   +0.09%     
- Complexity     4384     4385       +1     
============================================
  Files           475      475              
  Lines         14245    14256      +11     
  Branches       1447     1451       +4     
============================================
+ Hits          10416    10438      +22     
+ Misses         2972     2960      -12     
- Partials        857      858       +1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@sic2
Copy link
Contributor Author

sic2 commented Oct 6, 2025

@mwbrooks @WilliamBergamin apologies, I was out for a few days last week. I have signed the CLA now.

Screenshot 2025-10-06 at 11 31 07

@WilliamBergamin WilliamBergamin merged commit a8f837f into slackapi:main Oct 6, 2025
9 of 11 checks passed
@sic2 sic2 deleted the security/commons-text branch October 7, 2025 08:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@WilliamBergamin WilliamBergamin WilliamBergamin approved these changes

Assignees

No one assigned

Labels

cla:signed dependencies Pull requests that update a dependency file java This is a label that @dependabot automatically creates. We don't use it.

Projects

None yet

Milestone

1.46.0

Development

Successfully merging this pull request may close these issues.

3 participants

@sic2 @mwbrooks @WilliamBergamin