From 9c5d703ddae4fd8343769f7709004319fcf466fb Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 10 Jun 2026 18:56:32 +0300 Subject: [PATCH 1/3] build(deps): bump ch.qos.logback:logback-classic from 1.5.18 to 1.5.34 (#3517) Bumps [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) from 1.5.18 to 1.5.34. - [Release notes](https://github.com/qos-ch/logback/releases) - [Commits](https://github.com/qos-ch/logback/compare/v_1.5.18...v_1.5.34) --- updated-dependencies: - dependency-name: ch.qos.logback:logback-classic dependency-version: 1.5.34 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- polling-publisher/pom.xml | 2 +- pom.xml | 2 +- rate-limiting-pattern/pom.xml | 2 +- subclass-sandbox/pom.xml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/polling-publisher/pom.xml b/polling-publisher/pom.xml index 7cf4c83bae7d..2e5f7e8f35cb 100644 --- a/polling-publisher/pom.xml +++ b/polling-publisher/pom.xml @@ -98,7 +98,7 @@ ch.qos.logback logback-classic - 1.5.18 + 1.5.34 diff --git a/pom.xml b/pom.xml index 87aa35d6aa1e..7835110c008e 100644 --- a/pom.xml +++ b/pom.xml @@ -42,7 +42,7 @@ 3.4.5 5.11.4 5.14.2 - 1.5.18 + 1.5.34 2.0.17 diff --git a/rate-limiting-pattern/pom.xml b/rate-limiting-pattern/pom.xml index 2d8d12fdc886..c6529d809d58 100644 --- a/rate-limiting-pattern/pom.xml +++ b/rate-limiting-pattern/pom.xml @@ -43,7 +43,7 @@ ch.qos.logback logback-classic - 1.4.11 + 1.5.34 diff --git a/subclass-sandbox/pom.xml b/subclass-sandbox/pom.xml index a22acb7f716f..07aea8423443 100644 --- a/subclass-sandbox/pom.xml +++ b/subclass-sandbox/pom.xml @@ -35,7 +35,7 @@ subclass-sandbox 2.0.17 - 1.5.19 + 1.5.34 From 39dce8eedf3ffe64daea35b8d2b52307f8530d53 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 10 Jun 2026 19:02:44 +0300 Subject: [PATCH 2/3] build(deps): bump org.springframework.boot:spring-boot-starter-thymeleaf (#3520) Bumps [org.springframework.boot:spring-boot-starter-thymeleaf](https://github.com/spring-projects/spring-boot) from 3.4.4 to 4.0.6. - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](https://github.com/spring-projects/spring-boot/compare/v3.4.4...v4.0.6) --- updated-dependencies: - dependency-name: org.springframework.boot:spring-boot-starter-thymeleaf dependency-version: 4.0.6 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- page-controller/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/page-controller/pom.xml b/page-controller/pom.xml index c314459e9d14..564f73418ded 100644 --- a/page-controller/pom.xml +++ b/page-controller/pom.xml @@ -56,7 +56,7 @@ org.springframework.boot spring-boot-starter-thymeleaf - 3.4.4 + 4.0.6 org.junit.jupiter From fcdf639b15f09acb163e2f0d7772f13f184b52da Mon Sep 17 00:00:00 2001 From: OrbisAI Security Date: Wed, 10 Jun 2026 21:39:13 +0530 Subject: [PATCH 3/3] fix: remove unsafe exec() in page controller App.java (#3471) * fix: V-002 security vulnerability Automated security fix generated by Orbis Security AI * adding cross-platform support * fixing sonarqube hotspots * fixing the formating for java windows * fix: address PR review comments - Windows title bug, Unix paths, and consistency - Add empty string title arg to cmd /c start to fix paths-with-spaces bug - Revert Unix commands to bare names (open, xdg-open) with NOSONAR since xdg-open location varies by distro; absolute paths broke portability - Apply same ProcessBuilder fix to page-object/src App.java for consistency Co-Authored-By: Claude Sonnet 4.6 * fix: resolve Windows path via SystemRoot env var instead of hardcoding C:\Windows\System32\cmd.exe fails when Windows is installed on a non-C drive. Use System.getenv("SystemRoot") with a C:\Windows fallback to locate cmd.exe portably in both App.java files. Co-Authored-By: Claude Sonnet 4.6 --------- Co-authored-by: Claude Sonnet 4.6 --- .../java/com/iluwatar/pageobject/App.java | 25 ++++++++++++++++-- .../java/com/iluwatar/pageobject/App.java | 26 ++++++++++++++++--- 2 files changed, 46 insertions(+), 5 deletions(-) diff --git a/page-object/sample-application/src/main/java/com/iluwatar/pageobject/App.java b/page-object/sample-application/src/main/java/com/iluwatar/pageobject/App.java index aaf19fb0cee2..feac06124a7e 100644 --- a/page-object/sample-application/src/main/java/com/iluwatar/pageobject/App.java +++ b/page-object/sample-application/src/main/java/com/iluwatar/pageobject/App.java @@ -27,6 +27,7 @@ import java.awt.Desktop; import java.io.File; import java.io.IOException; +import java.util.Locale; import lombok.extern.slf4j.Slf4j; /** @@ -77,8 +78,28 @@ public static void main(String[] args) { Desktop.getDesktop().open(applicationFile); } else { - // java Desktop not supported - above unlikely to work for Windows so try instead... - Runtime.getRuntime().exec("cmd.exe start " + applicationFile); + // java Desktop not supported - use ProcessBuilder for cross-platform support + var os = System.getProperty("os.name").toLowerCase(Locale.ROOT); + ProcessBuilder pb; + if (os.contains("win")) { + // Empty string title arg prevents cmd start treating a quoted path as the window title + var systemRoot = System.getenv("SystemRoot"); + if (systemRoot == null) { + systemRoot = "C:\\Windows"; + } + pb = + new ProcessBuilder( + systemRoot + "\\System32\\cmd.exe", + "/c", + "start", + "", + applicationFile.getAbsolutePath()); + } else if (os.contains("mac")) { + pb = new ProcessBuilder("open", applicationFile.getAbsolutePath()); // NOSONAR + } else { + pb = new ProcessBuilder("xdg-open", applicationFile.getAbsolutePath()); // NOSONAR + } + pb.start(); } } catch (IOException ex) { diff --git a/page-object/src/main/java/com/iluwatar/pageobject/App.java b/page-object/src/main/java/com/iluwatar/pageobject/App.java index 214858cdcb53..2b104a583edb 100644 --- a/page-object/src/main/java/com/iluwatar/pageobject/App.java +++ b/page-object/src/main/java/com/iluwatar/pageobject/App.java @@ -27,6 +27,7 @@ import java.awt.Desktop; import java.io.File; import java.io.IOException; +import java.util.Locale; /** * Page Object pattern wraps an UI component with an application specific API allowing you to @@ -75,9 +76,28 @@ public static void main(String[] args) { Desktop.getDesktop().open(applicationFile); } else { - // Java Desktop not supported - above unlikely to work for Windows so try the - // following instead... - new ProcessBuilder("cmd.exe", "/c", "start", "", applicationFile.getAbsolutePath()).start(); + // java Desktop not supported - use ProcessBuilder for cross-platform support + var os = System.getProperty("os.name").toLowerCase(Locale.ROOT); + ProcessBuilder pb; + if (os.contains("win")) { + // Empty string title arg prevents cmd start treating a quoted path as the window title + var systemRoot = System.getenv("SystemRoot"); + if (systemRoot == null) { + systemRoot = "C:\\Windows"; + } + pb = + new ProcessBuilder( + systemRoot + "\\System32\\cmd.exe", + "/c", + "start", + "", + applicationFile.getAbsolutePath()); + } else if (os.contains("mac")) { + pb = new ProcessBuilder("open", applicationFile.getAbsolutePath()); // NOSONAR + } else { + pb = new ProcessBuilder("xdg-open", applicationFile.getAbsolutePath()); // NOSONAR + } + pb.start(); } } catch (IOException ex) {