fix(deps): update dependency junit:junit to v4.13.1 [security] by renovate[bot] · Pull Request #376 · OpenIntegrationEngine/engine

renovate · 2026-07-24T13:13:26Z

This PR contains the following updates:

Package	Change	Age	Confidence
junit:junit (source)	`4.8.1` → `4.13.1`

TemporaryFolder on unix-like systems does not limit access to created files

CVE-2020-15250 / GHSA-269g-pwp5-87pp

More information

Details

Vulnerability

The JUnit4 test rule TemporaryFolder contains a local information disclosure vulnerability.

Example of vulnerable code:

public static class HasTempFolder {
    @&#8203;Rule
    public TemporaryFolder folder = new TemporaryFolder();

    @&#8203;Test
    public void testUsingTempFolder() throws IOException {
        folder.getRoot(); // Previous file permissions: `drwxr-xr-x`; After fix:`drwx------`
        File createdFile= folder.newFile("myfile.txt"); // unchanged/irrelevant file permissions
        File createdFolder= folder.newFolder("subfolder"); // unchanged/irrelevant file permissions
        // ...
    }
}

Impact

On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system.

This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability.

When analyzing the impact of this vulnerability, here are the important questions to ask:

Do the JUnit tests write sensitive information, like API keys or passwords, into the temporary folder?
- If yes, this vulnerability impacts you, but only if you also answer 'yes' to question 2.
- If no, this vulnerability does not impact you.
Do the JUnit tests ever execute in an environment where the OS has other untrusted users.
This may apply in CI/CD environments but normally won't be 'yes' for personal developer machines.
- If yes, and you answered 'yes' to question 1, this vulnerability impacts you.
- If no, this vulnerability does not impact you.

Patches

Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using.

Java 1.7 and higher users: this vulnerability is fixed in 4.13.1.
Java 1.6 and lower users: no patch is available, you must use the workaround below.

Workarounds

If you are unable to patch, or are stuck running on Java 1.6, specifying the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability.

References

Similar Vulnerabilities

Google Guava - https://github.com/google/guava/issues/4011
Apache Ant - https://nvd.nist.gov/vuln/detail/CVE-2020-1945
JetBrains Kotlin Compiler - https://nvd.nist.gov/vuln/detail/CVE-2020-15824

For more information

If you have any questions or comments about this advisory, please pen an issue in junit-team/junit4.

Severity

CVSS Score: 4.4 / 10 (Medium)
Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Configuration

📅 Schedule: (in timezone America/New_York)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-07-24T13:14:48Z

Test Results

3 tests 0 ✅ 0s ⏱️
3 suites 0 💤
3 files 3 ❌

For more details on these failures, see this check.

Results for commit 88d8ddb.

♻️ This comment has been updated with latest results.

jonbartels

build failure

jbeckers · 2026-07-24T18:05:28Z

https://github.com/junit-team/junit4/wiki/Use-with-Gradle#junit-411-and-later implies the explicit dependency on hamcrest is no longer needed
Indeed: https://mvnrepository.com/artifact/junit/junit/4.13.2/dependencies vs https://mvnrepository.com/artifact/junit/junit/4.8.1/dependencies shows the dependency on hamcrest is now added recursively.

Maybe the explicit dependency pulls in the wrong version?

renovate · 2026-07-28T13:30:02Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: gradle/libs.versions.toml

Command failed: ./gradlew -Dorg.gradle.jvmargs=-Xms512m -Xmx512m --console=plain --dependency-verification lenient -q --write-verification-metadata sha256 dependencies

FAILURE: Build completed with 2 failures.

1: Task failed with an exception.
-----------
* What went wrong:
A problem occurred configuring root project 'open-integration-engine'.
> Could not resolve all artifacts for configuration 'classpath'.
   > Could not resolve org.owasp:dependency-check-core:12.2.2.
     Required by:
         root project : > org.owasp.dependencycheck:org.owasp.dependencycheck.gradle.plugin:12.2.2 > org.owasp:dependency-check-gradle:12.2.2
      > Could not resolve org.owasp:dependency-check-core:12.2.2.
         > Could not get resource 'https://plugins.gradle.org/m2/org/owasp/dependency-check-core/12.2.2/dependency-check-core-12.2.2.pom'.
            > Could not GET 'https://repo.maven.apache.org/maven2/org/owasp/dependency-check-core/12.2.2/dependency-check-core-12.2.2.pom'. Received status code 429 from server: Too Many Requests
   > Could not resolve org.owasp:dependency-check-utils:12.2.2.
     Required by:
         root project : > org.owasp.dependencycheck:org.owasp.dependencycheck.gradle.plugin:12.2.2 > org.owasp:dependency-check-gradle:12.2.2
      > Could not resolve org.owasp:dependency-check-utils:12.2.2.
         > Could not get resource 'https://plugins.gradle.org/m2/org/owasp/dependency-check-utils/12.2.2/dependency-check-utils-12.2.2.pom'.
            > Could not GET 'https://repo.maven.apache.org/maven2/org/owasp/dependency-check-utils/12.2.2/dependency-check-utils-12.2.2.pom'. Received status code 429 from server: Too Many Requests
   > Could not resolve net.gpedro.integrations.slack:slack-webhook:1.4.0.
     Required by:
         root project : > org.owasp.dependencycheck:org.owasp.dependencycheck.gradle.plugin:12.2.2 > org.owasp:dependency-check-gradle:12.2.2
      > Could not resolve net.gpedro.integrations.slack:slack-webhook:1.4.0.
         > Could not get resource 'https://plugins.gradle.org/m2/net/gpedro/integrations/slack/slack-webhook/1.4.0/slack-webhook-1.4.0.pom'.
            > Could not GET 'https://repo.maven.apache.org/maven2/net/gpedro/integrations/slack/slack-webhook/1.4.0/slack-webhook-1.4.0.pom'. Received status code 429 from server: Too Many Requests

* Try:
> Run with --stacktrace option to get the stack trace.
> Run with --info or --debug option to get more log output.
> Run with --scan to get full insights.
> Get more help at https://help.gradle.org.
==============================================================================

2: Task failed with an exception.
-----------
* What went wrong:
A problem occurred configuring root project 'open-integration-engine'.
> Could not resolve all artifacts for configuration 'classpath'.
   > Could not resolve org.owasp:dependency-check-core:12.2.2.
     Required by:
         root project : > org.owasp.dependencycheck:org.owasp.dependencycheck.gradle.plugin:12.2.2 > org.owasp:dependency-check-gradle:12.2.2
      > Could not resolve org.owasp:dependency-check-core:12.2.2.
         > Could not get resource 'https://plugins.gradle.org/m2/org/owasp/dependency-check-core/12.2.2/dependency-check-core-12.2.2.pom'.
            > Could not GET 'https://repo.maven.apache.org/maven2/org/owasp/dependency-check-core/12.2.2/dependency-check-core-12.2.2.pom'. Received status code 429 from server: Too Many Requests
   > Could not resolve org.owasp:dependency-check-utils:12.2.2.
     Required by:
         root project : > org.owasp.dependencycheck:org.owasp.dependencycheck.gradle.plugin:12.2.2 > org.owasp:dependency-check-gradle:12.2.2
      > Could not resolve org.owasp:dependency-check-utils:12.2.2.
         > Could not get resource 'https://plugins.gradle.org/m2/org/owasp/dependency-check-utils/12.2.2/dependency-check-utils-12.2.2.pom'.
            > Could not GET 'https://repo.maven.apache.org/maven2/org/owasp/dependency-check-utils/12.2.2/dependency-check-utils-12.2.2.pom'. Received status code 429 from server: Too Many Requests
   > Could not resolve net.gpedro.integrations.slack:slack-webhook:1.4.0.
     Required by:
         root project : > org.owasp.dependencycheck:org.owasp.dependencycheck.gradle.plugin:12.2.2 > org.owasp:dependency-check-gradle:12.2.2
      > Could not resolve net.gpedro.integrations.slack:slack-webhook:1.4.0.
         > Could not get resource 'https://plugins.gradle.org/m2/net/gpedro/integrations/slack/slack-webhook/1.4.0/slack-webhook-1.4.0.pom'.
            > Could not GET 'https://repo.maven.apache.org/maven2/net/gpedro/integrations/slack/slack-webhook/1.4.0/slack-webhook-1.4.0.pom'. Received status code 429 from server: Too Many Requests

* Try:
> Run with --stacktrace option to get the stack trace.
> Run with --info or --debug option to get more log output.
> Run with --scan to get full insights.
> Get more help at https://help.gradle.org.
==============================================================================

BUILD FAILED in 33s

renovate Bot requested a review from a team July 24, 2026 13:13

renovate Bot added dependencies Dependency updates java Java / Gradle dependencies labels Jul 24, 2026

renovate Bot requested review from NicoPiel, gibson9583, jonbartels, kayyagari, kpalang, mgaffigan and ssrowe July 24, 2026 13:13

jonbartels approved these changes Jul 24, 2026

View reviewed changes

jbeckers approved these changes Jul 24, 2026

View reviewed changes

jonbartels requested changes Jul 24, 2026

View reviewed changes

renovate Bot force-pushed the renovate/maven-junit-junit-vulnerability branch from c884eae to e1ce08e Compare July 24, 2026 23:08

mgaffigan marked this pull request as draft July 24, 2026 23:09

renovate Bot force-pushed the renovate/maven-junit-junit-vulnerability branch 3 times, most recently from 5106058 to 68c9b20 Compare July 28, 2026 13:30

renovate Bot force-pushed the renovate/maven-junit-junit-vulnerability branch from 68c9b20 to 5fe33d2 Compare July 28, 2026 20:30

fix(deps): update dependency junit:junit to v4.13.1 [security]

88d8ddb

renovate Bot force-pushed the renovate/maven-junit-junit-vulnerability branch from 5fe33d2 to 88d8ddb Compare July 31, 2026 00:34

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): update dependency junit:junit to v4.13.1 [security] - #376

fix(deps): update dependency junit:junit to v4.13.1 [security]#376
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/maven-junit-junit-vulnerability

renovate Bot commented Jul 24, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 24, 2026 •

edited

Loading

Uh oh!

jonbartels left a comment

Uh oh!

jbeckers commented Jul 24, 2026

Uh oh!

renovate Bot commented Jul 28, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

renovate Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

TemporaryFolder on unix-like systems does not limit access to created files

Details

Vulnerability

Impact

Patches

Workarounds

References

Similar Vulnerabilities

For more information

Severity

References

Configuration

Uh oh!

github-actions Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Results

Uh oh!

jonbartels left a comment

Choose a reason for hiding this comment

Uh oh!

jbeckers commented Jul 24, 2026

Uh oh!

renovate Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: gradle/libs.versions.toml

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

renovate Bot commented Jul 24, 2026 •

edited

Loading

github-actions Bot commented Jul 24, 2026 •

edited

Loading

renovate Bot commented Jul 28, 2026 •

edited

Loading