You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The vulnerable Java libraries flagged against mta-cli-rhel9 and mta-java-external-provider-rhel9 are bundled by the jdtls tarball this image downloads (confirmed: plugins/org.jsoup_1.19.1.jar, plugins/com.google.guava_33.5.0.jre.jar, plugins/org.apache.ant_1.10.17.jar), not by this project's poms.
Bumps jdtls 1.60.0 → 1.63.0 in Dockerfile, Dockerfile.test, and the Tycho target platform (java-analyzer-bundle.target):
CVE-2026-102554 needs guava ≥ 33.7.2. Even the latest jdtls (1.63.0) bundles 33.7.1, and no OSGi-packaged guava ≥33.7.2 exists in Eclipse Orbit yet, so a plain Maven jar can't be dropped in without breaking OSGi resolution. This CVE can't be closed by a jdtls bump and is tracked separately (upstream-blocked).
The jdtls tarball bundled in the image ships the vulnerable Java libraries
flagged against mta-cli-rhel9 and mta-java-external-provider-rhel9:
- jsoup 1.19.1 -> 1.23.2 fixes CVE-2026-75140 (and CVE-2026-71497)
- apache ant 1.10.17 -> 1.10.18 (1.10.17 was already past the CVE-2026-78254 fix)
Bumps the jdtls download URL (Dockerfile, Dockerfile.test) and the Tycho
build target platform (java-analyzer-bundle.target) from 1.60.0 to 1.63.0.
Known gap: guava is still vulnerable to CVE-2026-102554 (needs >= 33.7.2);
jdtls 1.63.0 ships 33.7.1 and no OSGi-packaged 33.7.2 exists upstream yet, so
that one cannot be resolved by a jdtls bump and is tracked separately.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Dylan Murray <dymurray@redhat.com>
The version references are aligned, with no identified merge-blocking regression. Merge after normal build and test checks; the separately tracked Guava issue remains outside this fix.
Pre-merge checks: 5
Check name
Status
Explanation
Description Check
Check skipped - CodeRabbit’s high-level summary is enabled.
Title check
The title states the primary change: bumping the JDT LS version from 1.60.0 to 1.63.0. The raw summary confirms this version bump in Dockerfile, Dockerfile.test, and java-analyzer-bundle.target. The p…
Docstring Coverage
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Title check
Explanation
The title states the primary change: bumping the JDT LS version from 1.60.0 to 1.63.0. The raw summary confirms this version bump in Dockerfile, Dockerfile.test, and java-analyzer-bundle.target. The parenthetical names the motivation, a bundled jsoup CVE, which the PR objectives confirm (jsoup moves from 1.19.1 to 1.23.2). The title does not mention the open Guava gap, but it does not need to cover every detail. The title is specific and accurate, so the check passes.
Full details: Docstring Coverage
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)
Finishing Touches
Generate unit tests (beta)
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
JDT.LS 1.63.0 is built on Eclipse 2026-09, whose bundles (e.g.
org.eclipse.core.filesystem) require a JavaSE-25 runtime. Running the
server on Java 21 fails OSGi resolution and the application aborts at
initialize with "An error has occurred. See the log file", which breaks
the Phase 2 integration tests.
Bump the runtime JDK in the final image to java-25-openjdk. The Tycho
build stage stays on Java 21 since ECJ compiles against the Java 25
bundles without issue.
Signed-off-by: Juanma Leflet Estrada <jleflete@redhat.com>
…228) (#230)
* 🐛 Bump JDT LS 1.60.0 -> 1.63.0 to pick up fixed jsoup
The jdtls tarball bundled in the image ships the vulnerable Java libraries
flagged against mta-cli-rhel9 and mta-java-external-provider-rhel9:
- jsoup 1.19.1 -> 1.23.2 fixes CVE-2026-75140 (and CVE-2026-71497)
- apache ant 1.10.17 -> 1.10.18 (1.10.17 was already past the CVE-2026-78254 fix)
Bumps the jdtls download URL (Dockerfile, Dockerfile.test) and the Tycho
build target platform (java-analyzer-bundle.target) from 1.60.0 to 1.63.0.
Known gap: guava is still vulnerable to CVE-2026-102554 (needs >= 33.7.2);
jdtls 1.63.0 ships 33.7.1 and no OSGi-packaged 33.7.2 exists upstream yet, so
that one cannot be resolved by a jdtls bump and is tracked separately.
* Run JDT.LS on Java 25
JDT.LS 1.63.0 is built on Eclipse 2026-09, whose bundles (e.g.
org.eclipse.core.filesystem) require a JavaSE-25 runtime. Running the
server on Java 21 fails OSGi resolution and the application aborts at
initialize with "An error has occurred. See the log file", which breaks
the Phase 2 integration tests.
Bump the runtime JDK in the final image to java-25-openjdk. The Tycho
build stage stays on Java 21 since ECJ compiles against the Java 25
bundles without issue.
---------
Signed-off-by: Dylan Murray <dymurray@redhat.com>
Signed-off-by: Juanma Leflet Estrada <jleflete@redhat.com>
Signed-off-by: Cherry Picker <noreply@github.com>
Co-authored-by: Dylan Murray <dymurray@redhat.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Juanma Leflet Estrada <jleflete@redhat.com>
jmle
added a commit
that referenced
this pull request
Nov 6, 2026
…228) (#229)
* 🐛 Bump JDT LS 1.60.0 -> 1.63.0 to pick up fixed jsoup
The jdtls tarball bundled in the image ships the vulnerable Java libraries
flagged against mta-cli-rhel9 and mta-java-external-provider-rhel9:
- jsoup 1.19.1 -> 1.23.2 fixes CVE-2026-75140 (and CVE-2026-71497)
- apache ant 1.10.17 -> 1.10.18 (1.10.17 was already past the CVE-2026-78254 fix)
Bumps the jdtls download URL (Dockerfile, Dockerfile.test) and the Tycho
build target platform (java-analyzer-bundle.target) from 1.60.0 to 1.63.0.
Known gap: guava is still vulnerable to CVE-2026-102554 (needs >= 33.7.2);
jdtls 1.63.0 ships 33.7.1 and no OSGi-packaged 33.7.2 exists upstream yet, so
that one cannot be resolved by a jdtls bump and is tracked separately.
* Run JDT.LS on Java 25
JDT.LS 1.63.0 is built on Eclipse 2026-09, whose bundles (e.g.
org.eclipse.core.filesystem) require a JavaSE-25 runtime. Running the
server on Java 21 fails OSGi resolution and the application aborts at
initialize with "An error has occurred. See the log file", which breaks
the Phase 2 integration tests.
Bump the runtime JDK in the final image to java-25-openjdk. The Tycho
build stage stays on Java 21 since ECJ compiles against the Java 25
bundles without issue.
---------
Signed-off-by: Dylan Murray <dymurray@redhat.com>
Signed-off-by: Juanma Leflet Estrada <jleflete@redhat.com>
Signed-off-by: Cherry Picker <noreply@github.com>
Co-authored-by: Dylan Murray <dymurray@redhat.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Juanma Leflet Estrada <jleflete@redhat.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The vulnerable Java libraries flagged against mta-cli-rhel9 and mta-java-external-provider-rhel9 are bundled by the jdtls tarball this image downloads (confirmed:
plugins/org.jsoup_1.19.1.jar,plugins/com.google.guava_33.5.0.jre.jar,plugins/org.apache.ant_1.10.17.jar), not by this project's poms.Bumps jdtls 1.60.0 → 1.63.0 in
Dockerfile,Dockerfile.test, and the Tycho target platform (java-analyzer-bundle.target):Known gap: guava
CVE-2026-102554 needs guava ≥ 33.7.2. Even the latest jdtls (1.63.0) bundles 33.7.1, and no OSGi-packaged guava ≥33.7.2 exists in Eclipse Orbit yet, so a plain Maven jar can't be dropped in without breaking OSGi resolution. This CVE can't be closed by a jdtls bump and is tracked separately (upstream-blocked).
Jira: MTA-7624, MTA-7625 (jsoup) · MTA-7688, MTA-7689 (ant) · MTA-8093, MTA-8092 (guava, remains open).
🤖 Generated with Claude Code
Summary by CodeRabbit