Skip to content

Commit 94a11f7

Browse files
authored
chore(deps): Bump org.codehaus.plexus:plexus-utils from 3.6.0 to 3.6.1 (#27471)
## Description This change upgrades plexus-utils to version 3.6.1 to address a recently disclosed Directory Traversal vulnerability in the extractFile method (CVE-2025-67030). ## Motivation and Context Our current dependency version falls within the vulnerable range. Upgrading to 3.6.1 ensures we are aligned with the patched version and removes the security risk flagged by Dependabot and the GitHub Advisory Database. ## Impact Mitigates a high-severity directory traversal vulnerability that could allow arbitrary code execution during archive extraction. ## Test Plan <img width="1223" height="425" alt="image" src="https://github.com/user-attachments/assets/3fcf2489-8958-44a9-a48b-518629af4e26" /> <img width="1223" height="425" alt="image" src="https://github.com/user-attachments/assets/930b1c47-e4dc-48e2-913a-9ca3c72c3d3a" /> ## Contributor checklist - [ ] Please make sure your submission complies with our [contributing guide](https://github.com/prestodb/presto/blob/master/CONTRIBUTING.md), in particular [code style](https://github.com/prestodb/presto/blob/master/CONTRIBUTING.md#code-style) and [commit standards](https://github.com/prestodb/presto/blob/master/CONTRIBUTING.md#commit-standards). - [ ] PR description addresses the issue accurately and concisely. If the change is non-trivial, a GitHub Issue is referenced. - [ ] Documented new properties (with its default value), SQL syntax, functions, or other functionality. - [ ] If release notes are required, they follow the [release notes guidelines](https://github.com/prestodb/presto/wiki/Release-Notes-Guidelines). - [ ] Adequate tests were added if applicable. - [ ] CI passed. - [ ] If adding new dependencies, verified they have an [OpenSSF Scorecard](https://securityscorecards.dev/#the-checks) score of 5.0 or higher (or obtained explicit TSC approval for lower scores). ## Release Notes Please follow [release notes guidelines](https://github.com/prestodb/presto/wiki/Release-Notes-Guidelines) and fill in the release notes below. ``` == NO RELEASE NOTE == ```
1 parent 231fd12 commit 94a11f7

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -264,7 +264,7 @@
264264
<dependency>
265265
<groupId>org.codehaus.plexus</groupId>
266266
<artifactId>plexus-utils</artifactId>
267-
<version>3.6.0</version>
267+
<version>3.6.1</version>
268268
</dependency>
269269

270270
<dependency>

0 commit comments

Comments
 (0)