From 4f31526ca11ccf147b9f7cd42009f3a76c2e35c6 Mon Sep 17 00:00:00 2001
From: Brian Johnson <219879755+RakenBrian@users.noreply.github.com>
Date: Fri, 24 Jul 2026 08:54:53 -0700
Subject: [PATCH] Upgrade commons-codec 1.11 -> 1.22.0 to remediate
 WS-2019-0379
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

httpclient 4.5.13 pulls in commons-codec 1.11 transitively (the only path
to it in the dependency tree). Bumping httpclient within the 4.5.x line
does not help — 4.5.14 still hard-codes commons-codec 1.11 — so the
version must be overridden explicitly.

Add a dependencyManagement entry pinning commons-codec to 1.22.0 (the
current release) via a new commons-codec.version property. This upgrades
the version tree-wide without adding a direct compile dependency or
touching httpclient.

Remediates the non-CVE advisory WS-2019-0379 / SNYK-JAVA-COMMONSCODEC-561518
(Apache CODEC-134: improper input validation in Base32/Base64 decoding,
information disclosure; affects < 1.13, fixed in 1.13). No CVE is assigned;
it is a vendor-tracked advisory (flagged by Mend against the transitive
1.11). The project's 1.11 is in range; 1.22.0 contains the fix.

Verified:
- dependency:tree shows commons-codec 1.22.0 (version managed from 1.11)
- unit tests: 113/113 pass
- integration tests (excl. webhook creation, blocked by an unrelated
  429 rate limit on the shared sandbox key): 38/38 pass
---
 pom.xml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pom.xml b/pom.xml
index e117cff..cacbfb0 100644
--- a/pom.xml
+++ b/pom.xml
@@ -47,6 +47,8 @@
         <httpasyncclient.version>4.1.4</httpasyncclient.version>
         <httpmime.version>4.5.12</httpmime.version>
         <tika-core.version>1.28.3</tika-core.version>
+        <!-- Override the commons-codec 1.11 pulled in transitively by httpclient -->
+        <commons-codec.version>1.22.0</commons-codec.version>
 
         <jackson-databind.version>2.22.1</jackson-databind.version>
 
@@ -158,6 +160,17 @@
         </dependency>
     </dependencies>
 
+    <dependencyManagement>
+        <dependencies>
+            <!-- Force commons-codec above the vulnerable 1.11 that httpclient pulls in transitively -->
+            <dependency>
+                <groupId>commons-codec</groupId>
+                <artifactId>commons-codec</artifactId>
+                <version>${commons-codec.version}</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
     <profiles>
         <profile>
             <id>unit-tests</id>