dependabot[bot] opened a new pull request, #27622: URL: https://github.com/apache/camel/pull/27622
Bumps `jline-version` from 4.4.6 to 4.4.7. Updates `org.jline:jline` from 4.4.6 to 4.4.7 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jline/jline3/releases";>org.jline:jline's releases</a>.</em></p> <blockquote> <p>JLine 4.4.7 is a security and bug fix release addressing two security vulnerabilities and one rendering correctness bug.</p> <p>The history <code>/PATTERN</code> search in <code>HistoryCommands</code> was compiling user-supplied regex patterns with a raw <code>Pattern.compile</code> + <code>Matcher.find()</code> call, with no execution-time guard — the only unprotected regex path in the project. A pathological pattern like <code>(a+)+z</code> would hang the session thread indefinitely via catastrophic backtracking (GHSA-vrw4-fppg-3rhf). The fix routes through <code>SafeRegex</code>, consistent with all other regex call sites. The telnet NEW-ENVIRON handler (<code>TelnetIO.readNEVariables</code>) enforced its 100-variable limit only within a single subnegotiation frame via a local counter that reset on each call. An unauthenticated client could send multiple frames to accumulate an unbounded number of environment entries and exhaust server heap (GHSA-7qh2-r6cc-r47w, bypassing the incomplete fix for CVE-2026-56740); the fix also checks the persistent connection-level map size. Finally, <code>AttributedS tringBuilder.setLength</code> did not recompute <code>lastLineLength</code> after truncation, causing subsequent tab stops to be calculated against the wrong position; three regression tests covering cleared builder, newline removal, and last-line shortening were added by the contributor.</p> <h2>🐛 Bug Fixes</h2> <ul> <li>fix: guard history /pattern regex search against ReDoS via SafeRegex (<a href="https://redirect.github.com/jline/jline3/pull/2286";>#2286</a>) <a href="https://github.com/gnodet";><code>@gnodet</code></a></li> <li>fix: enforce NEW-ENVIRON variable limit across frames to prevent memory exhaustion (<a href="https://redirect.github.com/jline/jline3/pull/2287";>#2287</a>) <a href="https://github.com/gnodet";><code>@gnodet</code></a></li> <li>fix: recompute tab position after truncation (<a href="https://redirect.github.com/jline/jline3/pull/2305";>#2305</a>) <a href="https://github.com/PHJ2000";><code>@PHJ2000</code></a></li> </ul> <h2>📦 Dependency Updates</h2> <ul> <li>chore: bump sshd.version from 2.19.0 to 2.20.0</li> <li>chore: bump com.diffplug.spotless:spotless-maven-plugin from 3.10.2 to 3.10.3</li> <li>chore: bump com.palantir.javaformat:palantir-java-format from 2.98.0 to 2.100.0</li> <li>chore: bump slf4j.version from 2.0.19 to 2.0.20 (<a href="https://redirect.github.com/jline/jline3/pull/2289";>#2289</a>)</li> <li>chore: bump org.graalvm.sdk:graal-sdk from 25.3.4.1 to 25.4.4.1.1 (<a href="https://redirect.github.com/jline/jline3/pull/2292";>#2292</a>)</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jline/jline3/compare/4.4.6...4.4.7";>https://github.com/jline/jline3/compare/4.4.6...4.4.7</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jline/jline3/commit/29e069d71b7862cc85b6bce9c3a19a11e841c6f2";><code>29e069d</code></a> docs: fix web-swing-terminals demo section to reference Launcher (fixes <a href="https://redirect.github.com/jline/jline3/issues/2301";>#2301</a>)</li> <li><a href="https://github.com/jline/jline3/commit/26920f0b10fe012fdc2482084a789bb8c03300e8";><code>26920f0</code></a> fix: recompute tab position after truncation</li> <li><a href="https://github.com/jline/jline3/commit/fb1cd2784096888be0587ca31ea6be33d6362e71";><code>fb1cd27</code></a> chore: bump com.palantir.javaformat:palantir-java-format from 2.98.0 to 2.100.0</li> <li><a href="https://github.com/jline/jline3/commit/46f07078c72f51225d61d2913ba556d2a02deeca";><code>46f0707</code></a> chore: bump com.diffplug.spotless:spotless-maven-plugin from 3.10.2 to 3.10.3</li> <li><a href="https://github.com/jline/jline3/commit/1607c5ea82740b208168ca9e1e9227d77f892061";><code>1607c5e</code></a> chore: bump sshd.version from 2.19.0 to 2.20.0</li> <li><a href="https://github.com/jline/jline3/commit/632c696f43765971dcf98c2a2adf5a780d36fcae";><code>632c696</code></a> fix: handle ^? as DEL (127) in Curses.tputs (fixes <a href="https://redirect.github.com/jline/jline3/issues/1445";>#1445</a>)</li> <li><a href="https://github.com/jline/jline3/commit/30a0df09f55f6d32cbbe3b041206a7fc3e15e184";><code>30a0df0</code></a> chore: bump org.graalvm.sdk:graal-sdk from 25.3.4.1 to 25.4.4.1.1 (<a href="https://redirect.github.com/jline/jline3/issues/2292";>#2292</a>)</li> <li><a href="https://github.com/jline/jline3/commit/b65fbe72876c150012353a2783d5baa3c46cb9e3";><code>b65fbe7</code></a> chore: bump slf4j.version from 2.0.19 to 2.0.20 (<a href="https://redirect.github.com/jline/jline3/issues/2289";>#2289</a>)</li> <li><a href="https://github.com/jline/jline3/commit/66662bd07b9f8a30540e69bc31cd850b757111bc";><code>66662bd</code></a> fix: enforce NEW-ENVIRON variable limit across frames to prevent memory exhau...</li> <li><a href="https://github.com/jline/jline3/commit/2287554c0dfb5ae7d1cc81427db03080a10cd978";><code>2287554</code></a> fix: guard history /pattern regex search against ReDoS via SafeRegex</li> <li>See full diff in <a href="https://github.com/jline/jline3/compare/4.4.6...4.4.7";>compare view</a></li> </ul> </details> <br /> Updates `org.jline:jline-picocli` from 4.4.6 to 4.4.7 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jline/jline3/releases";>org.jline:jline-picocli's releases</a>.</em></p> <blockquote> <p>JLine 4.4.7 is a security and bug fix release addressing two security vulnerabilities and one rendering correctness bug.</p> <p>The history <code>/PATTERN</code> search in <code>HistoryCommands</code> was compiling user-supplied regex patterns with a raw <code>Pattern.compile</code> + <code>Matcher.find()</code> call, with no execution-time guard — the only unprotected regex path in the project. A pathological pattern like <code>(a+)+z</code> would hang the session thread indefinitely via catastrophic backtracking (GHSA-vrw4-fppg-3rhf). The fix routes through <code>SafeRegex</code>, consistent with all other regex call sites. The telnet NEW-ENVIRON handler (<code>TelnetIO.readNEVariables</code>) enforced its 100-variable limit only within a single subnegotiation frame via a local counter that reset on each call. An unauthenticated client could send multiple frames to accumulate an unbounded number of environment entries and exhaust server heap (GHSA-7qh2-r6cc-r47w, bypassing the incomplete fix for CVE-2026-56740); the fix also checks the persistent connection-level map size. Finally, <code>AttributedS tringBuilder.setLength</code> did not recompute <code>lastLineLength</code> after truncation, causing subsequent tab stops to be calculated against the wrong position; three regression tests covering cleared builder, newline removal, and last-line shortening were added by the contributor.</p> <h2>🐛 Bug Fixes</h2> <ul> <li>fix: guard history /pattern regex search against ReDoS via SafeRegex (<a href="https://redirect.github.com/jline/jline3/pull/2286";>#2286</a>) <a href="https://github.com/gnodet";><code>@gnodet</code></a></li> <li>fix: enforce NEW-ENVIRON variable limit across frames to prevent memory exhaustion (<a href="https://redirect.github.com/jline/jline3/pull/2287";>#2287</a>) <a href="https://github.com/gnodet";><code>@gnodet</code></a></li> <li>fix: recompute tab position after truncation (<a href="https://redirect.github.com/jline/jline3/pull/2305";>#2305</a>) <a href="https://github.com/PHJ2000";><code>@PHJ2000</code></a></li> </ul> <h2>📦 Dependency Updates</h2> <ul> <li>chore: bump sshd.version from 2.19.0 to 2.20.0</li> <li>chore: bump com.diffplug.spotless:spotless-maven-plugin from 3.10.2 to 3.10.3</li> <li>chore: bump com.palantir.javaformat:palantir-java-format from 2.98.0 to 2.100.0</li> <li>chore: bump slf4j.version from 2.0.19 to 2.0.20 (<a href="https://redirect.github.com/jline/jline3/pull/2289";>#2289</a>)</li> <li>chore: bump org.graalvm.sdk:graal-sdk from 25.3.4.1 to 25.4.4.1.1 (<a href="https://redirect.github.com/jline/jline3/pull/2292";>#2292</a>)</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jline/jline3/compare/4.4.6...4.4.7";>https://github.com/jline/jline3/compare/4.4.6...4.4.7</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jline/jline3/commit/29e069d71b7862cc85b6bce9c3a19a11e841c6f2";><code>29e069d</code></a> docs: fix web-swing-terminals demo section to reference Launcher (fixes <a href="https://redirect.github.com/jline/jline3/issues/2301";>#2301</a>)</li> <li><a href="https://github.com/jline/jline3/commit/26920f0b10fe012fdc2482084a789bb8c03300e8";><code>26920f0</code></a> fix: recompute tab position after truncation</li> <li><a href="https://github.com/jline/jline3/commit/fb1cd2784096888be0587ca31ea6be33d6362e71";><code>fb1cd27</code></a> chore: bump com.palantir.javaformat:palantir-java-format from 2.98.0 to 2.100.0</li> <li><a href="https://github.com/jline/jline3/commit/46f07078c72f51225d61d2913ba556d2a02deeca";><code>46f0707</code></a> chore: bump com.diffplug.spotless:spotless-maven-plugin from 3.10.2 to 3.10.3</li> <li><a href="https://github.com/jline/jline3/commit/1607c5ea82740b208168ca9e1e9227d77f892061";><code>1607c5e</code></a> chore: bump sshd.version from 2.19.0 to 2.20.0</li> <li><a href="https://github.com/jline/jline3/commit/632c696f43765971dcf98c2a2adf5a780d36fcae";><code>632c696</code></a> fix: handle ^? as DEL (127) in Curses.tputs (fixes <a href="https://redirect.github.com/jline/jline3/issues/1445";>#1445</a>)</li> <li><a href="https://github.com/jline/jline3/commit/30a0df09f55f6d32cbbe3b041206a7fc3e15e184";><code>30a0df0</code></a> chore: bump org.graalvm.sdk:graal-sdk from 25.3.4.1 to 25.4.4.1.1 (<a href="https://redirect.github.com/jline/jline3/issues/2292";>#2292</a>)</li> <li><a href="https://github.com/jline/jline3/commit/b65fbe72876c150012353a2783d5baa3c46cb9e3";><code>b65fbe7</code></a> chore: bump slf4j.version from 2.0.19 to 2.0.20 (<a href="https://redirect.github.com/jline/jline3/issues/2289";>#2289</a>)</li> <li><a href="https://github.com/jline/jline3/commit/66662bd07b9f8a30540e69bc31cd850b757111bc";><code>66662bd</code></a> fix: enforce NEW-ENVIRON variable limit across frames to prevent memory exhau...</li> <li><a href="https://github.com/jline/jline3/commit/2287554c0dfb5ae7d1cc81427db03080a10cd978";><code>2287554</code></a> fix: guard history /pattern regex search against ReDoS via SafeRegex</li> <li>See full diff in <a href="https://github.com/jline/jline3/compare/4.4.6...4.4.7";>compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
