Skip to content

Bump pmd.version from 7.28.0 to 7.29.0 - #1503

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/main/pmd.version-7.29.0
Open

Bump pmd.version from 7.28.0 to 7.29.0#1503
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/main/pmd.version-7.29.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor

Bumps pmd.version from 7.28.0 to 7.29.0.
Updates net.sourceforge.pmd:pmd-core from 7.28.0 to 7.29.0

Release notes

Sourced from net.sourceforge.pmd:pmd-core's releases.

PMD 7.29.0 (30-October-2026)

30-October-2026 - 7.29.0

The PMD team is pleased to announce PMD 7.29.0.

This is a minor release.

Table Of Contents

🚀️ New and noteworthy

Security fixes

All known security vulnerabilities are described in full detail on the page PMD Security. This release, the following security vulnerabilities were fixed:

  • GHSA-wj6q-xw9m-26p6: Arbitrary file disclosure in CPD via symlinks in analyzed sources.
    When collecting files, CPD followed symbolic links, even if their targets were outside the scanned directory. This allowed reading any file accessible to the user running CPD. If a CI/CD pipeline runs CPD on untrusted source code (e.g. a pull request from an external contributor), an attacker could commit two symlinks pointing to the same file outside the project. CPD detected them as duplicates and wrote the full content of the target file into the report. If the report was published, e.g. as a CI artifact, the attacker could read it.
    With this fix, neither PMD nor CPD follows symbolic links anymore when collecting files to analyze.
    Affected versions: PMD >= 6.54.0 and <= 7.28.0. If you run CPD on untrusted source code, it is recommended to upgrade PMD.
    Reported by Dan (@​7alen7). Independently reported by lapeace (@​ThejasRajamoney).
  • GHSA-5x5v-644m-q2qc: XSS via externalInfoUrl in HTML report formats.
    The html and summaryhtml renderers inserted a rule's externalInfoUrl into generated reports without escaping or URL-scheme validation. With a crafted ruleset, this allowed injected markup that runs when the report is opened (with --show-suppressed), or javascript: links that run when clicked. This only affects setups where PMD loads an untrusted ruleset and the resulting HTML report is viewed in a browser.

... (truncated)

Commits
  • 47b3135 [release] prepare release pmd_releases/7.29.0
  • df93eb5 Prepare pmd release 7.29.0
  • 7d4b9ad Update contributors for 7.29.0
  • cc67aac [doc] Update security.md and attributions
  • e79c4e1 [core] Fix missing escaping in CSV renderers (#7262)
  • 71d38f5 [core] Disallow external entity expansions/DTD in XML parsing (#7261)
  • 1e4fd94 [core] HTMLRenderers: Properly escape rule name and externalInfoUrl (#7260)
  • 7aec5c1 [core] Don't follow symlinks in FileCollector (#7259)
  • c7560e0 [doc] Improve release notes
  • c44b87c [java] Fix #7213: UnusedPrivateMethod/UnusedPrivateField with qualified Metho...
  • Additional commits viewable in compare view

Updates net.sourceforge.pmd:pmd-java from 7.28.0 to 7.29.0

Release notes

Sourced from net.sourceforge.pmd:pmd-java's releases.

PMD 7.29.0 (30-October-2026)

30-October-2026 - 7.29.0

The PMD team is pleased to announce PMD 7.29.0.

This is a minor release.

Table Of Contents

🚀️ New and noteworthy

Security fixes

All known security vulnerabilities are described in full detail on the page PMD Security. This release, the following security vulnerabilities were fixed:

  • GHSA-wj6q-xw9m-26p6: Arbitrary file disclosure in CPD via symlinks in analyzed sources.
    When collecting files, CPD followed symbolic links, even if their targets were outside the scanned directory. This allowed reading any file accessible to the user running CPD. If a CI/CD pipeline runs CPD on untrusted source code (e.g. a pull request from an external contributor), an attacker could commit two symlinks pointing to the same file outside the project. CPD detected them as duplicates and wrote the full content of the target file into the report. If the report was published, e.g. as a CI artifact, the attacker could read it.
    With this fix, neither PMD nor CPD follows symbolic links anymore when collecting files to analyze.
    Affected versions: PMD >= 6.54.0 and <= 7.28.0. If you run CPD on untrusted source code, it is recommended to upgrade PMD.
    Reported by Dan (@​7alen7). Independently reported by lapeace (@​ThejasRajamoney).
  • GHSA-5x5v-644m-q2qc: XSS via externalInfoUrl in HTML report formats.
    The html and summaryhtml renderers inserted a rule's externalInfoUrl into generated reports without escaping or URL-scheme validation. With a crafted ruleset, this allowed injected markup that runs when the report is opened (with --show-suppressed), or javascript: links that run when clicked. This only affects setups where PMD loads an untrusted ruleset and the resulting HTML report is viewed in a browser.

... (truncated)

Commits
  • 47b3135 [release] prepare release pmd_releases/7.29.0
  • df93eb5 Prepare pmd release 7.29.0
  • 7d4b9ad Update contributors for 7.29.0
  • cc67aac [doc] Update security.md and attributions
  • e79c4e1 [core] Fix missing escaping in CSV renderers (#7262)
  • 71d38f5 [core] Disallow external entity expansions/DTD in XML parsing (#7261)
  • 1e4fd94 [core] HTMLRenderers: Properly escape rule name and externalInfoUrl (#7260)
  • 7aec5c1 [core] Don't follow symlinks in FileCollector (#7259)
  • c7560e0 [doc] Improve release notes
  • c44b87c [java] Fix #7213: UnusedPrivateMethod/UnusedPrivateField with qualified Metho...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump pmd.version from 7.28.0 to 7.29.0
6c5b0a4 
Bumps `pmd.version` from 7.28.0 to 7.29.0.

Updates `net.sourceforge.pmd:pmd-core` from 7.28.0 to 7.29.0
- [Release notes](https://github.com/pmd/pmd/releases)
- [Commits](pmd/pmd@pmd_releases/7.28.0...pmd_releases/7.29.0)

Updates `net.sourceforge.pmd:pmd-java` from 7.28.0 to 7.29.0
- [Release notes](https://github.com/pmd/pmd/releases)
- [Commits](pmd/pmd@pmd_releases/7.28.0...pmd_releases/7.29.0)

---
updated-dependencies:
- dependency-name: net.sourceforge.pmd:pmd-core
  dependency-version: 7.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: net.sourceforge.pmd:pmd-java
  dependency-version: 7.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Nov 2, 2026
@spring-builds spring-builds added this to the 5.1.0-RC2 milestone Nov 3, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

2026.0.0-RC2
Status: Todo

Milestone

5.1.0-RC2

Development

Successfully merging this pull request may close these issues.

1 participant

@spring-builds