dependabot[bot] opened a new pull request, #123: URL: https://github.com/apache/tomcat-jakartaee-migration/pull/123
Bumps [org.apache.bcel:bcel](https://github.com/apache/commons-bcel) from 6.12.0 to 6.13.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/apache/commons-bcel/blob/master/RELEASE-NOTES.txt";>org.apache.bcel:bcel's changelog</a>.</em></p> <blockquote> <p>Apache Commons BCEL Version 6.13.0 RELEASE NOTES</p> <h2>Introduction</h2> <p>The Apache Commons BCEL team is pleased to announce the release of Apache Commons BCEL 6.13.0.</p> <p>The Commons Byte Code Engineering Library (BCEL) is designed to provide users with a convenient way to analyze, create, and manipulate compiled .class files.</p> <p>This is a feature and maintenance release. Java 8 or later is required.</p> <h2>New Features</h2> <ul> <li> <pre><code> Add support for permitted subclasses [#493](https://github.com/apache/commons-bcel/issues/493). Thanks to nbauma109, Gary Gregory. </code></pre> </li> <li> <pre><code> Add RecordComponentInfo.getAttribute(byte tag)[#494](https://github.com/apache/commons-bcel/issues/494). Thanks to nbauma109, Gary Gregory. </code></pre> </li> <li> <pre><code> Add Const.MAJOR_27. Thanks to Gary Gregory. </code></pre> </li> <li> <pre><code> Add Const.MINOR_27. Thanks to Gary Gregory. </code></pre> </li> <li> <pre><code> Add and use ArrayType.isElementType(Type). Thanks to Gary Gregory. </code></pre> </li> <li> <pre><code> Add Const.MAJOR_28. Thanks to Gary Gregory. </code></pre> </li> <li> <pre><code> Add Const.MINOR_28. Thanks to Gary Gregory. </code></pre> </li> </ul> <h2>Fixed Bugs</h2> <ul> <li> <pre><code> Fix constant pool module access test on Java 26 and above [#492](https://github.com/apache/commons-bcel/issues/492). Thanks to nbauma109. </code></pre> </li> <li> <pre><code> Deprecate org.apache.bcel.classfile.Utility.Utility(). Thanks to Gary Gregory. </code></pre> </li> <li> <pre><code> Deprecate org.apache.bcel.verifier.exc.Utility.getStackTrace(Throwable). Thanks to Gary Gregory. </code></pre> </li> <li> <pre><code> Fix all Javadoc warnings and enforce checks by default. Thanks to Gary Gregory. </code></pre> </li> <li> <pre><code> Escape constant pool names in generated HTML ([#500](https://github.com/apache/commons-bcel/issues/500)). Thanks to Dexter.k. </code></pre> </li> <li> <pre><code> Escape referenced names in BCELFactory Java output ([#501](https://github.com/apache/commons-bcel/issues/501)). Thanks to Dexter.k, Gary Gregory. </code></pre> </li> <li> <pre><code> Make wide flag thread-local in Utility.codeToString ([#502](https://github.com/apache/commons-bcel/issues/502)). Thanks to Dexter.k, Gary Gregory. </code></pre> </li> <li> <pre><code> Read multianewarray dimensions as unsigned byte ([#504](https://github.com/apache/commons-bcel/issues/504)). Thanks to Dexter.k, Gary Gregory. </code></pre> </li> <li> <pre><code> Site docs: clarify security model ([#503](https://github.com/apache/commons-bcel/issues/503)). Thanks to Arnout Engelen. </code></pre> </li> <li> <pre><code> Read ConstantDynamic indices as unsigned shorts ([#505](https://github.com/apache/commons-bcel/issues/505)). Thanks to Dexter.k, Gary Gregory. </code></pre> </li> <li> <pre><code> Validate index upper bound in CPInstruction, IINC and RET setIndex ([#506](https://github.com/apache/commons-bcel/issues/506)). Thanks to Dexter.k, Gary Gregory. </code></pre> </li> <li> <pre><code> Use correct attribute tag in NestHost and ModuleMainClass ([#507](https://github.com/apache/commons-bcel/issues/507)). Thanks to Dexter.k, Gary Gregory. </code></pre> </li> <li> <pre><code> Propagate runtime-visible flag when parsing parameter annotations ([#509](https://github.com/apache/commons-bcel/issues/509)). Thanks to Dexter.k, Gary Gregory. </code></pre> </li> <li> <pre><code> Use fixedLength for parsed LOOKUPSWITCH length ([#499](https://github.com/apache/commons-bcel/issues/499)). Thanks to Digiscrypt Technologies, Gary Gregory. </code></pre> </li> <li> <pre><code> Fix ConstantPoolGen dedup key collisions for names with delimiters ([#510](https://github.com/apache/commons-bcel/issues/510)). Thanks to Dexter.k, Gary Gregory. </code></pre> </li> <li> <pre><code> Read unsigned bytecode operands in CodeHTML disassembler ([#511](https://github.com/apache/commons-bcel/issues/511)). Thanks to Dexter.k, Gary Gregory. </code></pre> </li> <li> <pre><code> Deep-copy bootstrap arguments array in BootstrapMethod.copy() ([#516](https://github.com/apache/commons-bcel/issues/516)). Thanks to Dexter.k, Gary Gregory. </code></pre> </li> <li> <pre><code> Use exclusive live-range end in LocalVariableTable.getLocalVariable ([#517](https://github.com/apache/commons-bcel/issues/517)). Thanks to Dexter.k, Gary Gregory. </code></pre> </li> <li> <pre><code> Build TABLESWITCH from sorted arrays in SWITCH ([#518](https://github.com/apache/commons-bcel/issues/518)). Thanks to Naveed Khan, Gary Gregory. </code></pre> </li> <li> <pre><code> Use array element type not basic type for primitive array access ([#520](https://github.com/apache/commons-bcel/issues/520)). Thanks to Naveed Khan, Gary Gregory. </code></pre> </li> <li> <pre><code> Set length in INVOKEDYNAMIC constructor ([#521](https://github.com/apache/commons-bcel/issues/521)). Thanks to Naveed Khan, Gary Gregory. </code></pre> </li> <li> <pre><code> Reject CALOAD on non-char arrays in structural verification ([#522](https://github.com/apache/commons-bcel/issues/522)). Thanks to Naveed Khan, Gary Gregory. </code></pre> </li> <li> <pre><code> Add negative verifier tests for remaining array load/store component type checks ([#524](https://github.com/apache/commons-bcel/issues/524)). Thanks to Naveed Khan, Gary Gregory. </code></pre> </li> <li> <pre><code> Validate u1 count bound in INVOKEINTERFACE and MULTIANEWARRAY ([#523](https://github.com/apache/commons-bcel/issues/523)). Thanks to Naveed Khan, Gary Gregory. </code></pre> </li> <li> <pre><code> Match wide local variable instruction length to dumped bytes ([#525](https://github.com/apache/commons-bcel/issues/525)). Thanks to Naveed Khan, Gary Gregory. </code></pre> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/apache/commons-bcel/commit/be4bc45e5ee623b4d074a0b0888da828822dd9b3";><code>be4bc45</code></a> Prepare for the release candidate 6.13.0 RC1</li> <li><a href="https://github.com/apache/commons-bcel/commit/13fe5d9142a43250f33e7f636cb44e3e18f974e6";><code>13fe5d9</code></a> Prepare for the release candidate</li> <li><a href="https://github.com/apache/commons-bcel/commit/a6d4655d0e39a2aff7e7bb78eb5161e53696911e";><code>a6d4655</code></a> Javadoc</li> <li><a href="https://github.com/apache/commons-bcel/commit/279ec2300c1d9757061454c200d5e19090bee39e";><code>279ec23</code></a> Sort members</li> <li><a href="https://github.com/apache/commons-bcel/commit/bdaca417da39c49ae98c85c6a0a46831fd24aa24";><code>bdaca41</code></a> Utility.JavaReader escape decoding: OOB table index, bad-hex crash,</li> <li><a href="https://github.com/apache/commons-bcel/commit/972dfb6c4706ff4f102657a261d77af019c63f96";><code>972dfb6</code></a> Static WIDE ThreadLocal survives exceptions, corrupting the next class's</li> <li><a href="https://github.com/apache/commons-bcel/commit/4a4b7577a1bc9f871f2c31ea8113656264127165";><code>4a4b757</code></a> org.apache.bcel.verifier.VerifierFactory.DEFAULT_MAX_CACHE_SIZE doesn't</li> <li><a href="https://github.com/apache/commons-bcel/commit/0d86e866ff0bffa701ff1dae54f0fdd014abcc2c";><code>0d86e86</code></a> Verifier cache grows unboundedly with attacker-chosen class names</li> <li><a href="https://github.com/apache/commons-bcel/commit/b0c3e6a11bc32be316eadcd16a24c3811259e78b";><code>b0c3e6a</code></a> Verifier pass 3a delayed checks are quadratic in attribute and code size</li> <li><a href="https://github.com/apache/commons-bcel/commit/7fe29408bd6e04705f02edbec1ffbd6bd50d938f";><code>7fe2940</code></a> BCELifier interpolates attacker class/package names into generated Java</li> <li>Additional commits viewable in <a href="https://github.com/apache/commons-bcel/compare/rel/commons-bcel-6.12.0...rel/commons-bcel-6.13.0";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
