Skip to content

build(deps): bump pmd.version from 7.26.0 to 7.29.0 - #1179

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/pmd.version-7.28.0
Open

build(deps): bump pmd.version from 7.26.0 to 7.29.0#1179
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/pmd.version-7.28.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps pmd.version from 7.26.0 to 7.29.0.
Updates net.sourceforge.pmd:pmd-core from 7.26.0 to 7.29.0

Release notes

Sourced from net.sourceforge.pmd:pmd-core's releases.

PMD 7.29.0 (30-October-2026)

30-October-2026 - 7.29.0

The PMD team is pleased to announce PMD 7.29.0.

This is a minor release.

Table Of Contents

🚀️ New and noteworthy

Security fixes

All known security vulnerabilities are described in full detail on the page PMD Security. This release, the following security vulnerabilities were fixed:

  • GHSA-wj6q-xw9m-26p6: Arbitrary file disclosure in CPD via symlinks in analyzed sources.
    When collecting files, CPD followed symbolic links, even if their targets were outside the scanned directory. This allowed reading any file accessible to the user running CPD. If a CI/CD pipeline runs CPD on untrusted source code (e.g. a pull request from an external contributor), an attacker could commit two symlinks pointing to the same file outside the project. CPD detected them as duplicates and wrote the full content of the target file into the report. If the report was published, e.g. as a CI artifact, the attacker could read it.
    With this fix, neither PMD nor CPD follows symbolic links anymore when collecting files to analyze.
    Affected versions: PMD >= 6.54.0 and <= 7.28.0. If you run CPD on untrusted source code, it is recommended to upgrade PMD.
    Reported by Dan (@​7alen7). Independently reported by lapeace (@​ThejasRajamoney).
  • GHSA-5x5v-644m-q2qc: XSS via externalInfoUrl in HTML report formats.
    The html and summaryhtml renderers inserted a rule's externalInfoUrl into generated reports without escaping or URL-scheme validation. With a crafted ruleset, this allowed injected markup that runs when the report is opened (with --show-suppressed), or javascript: links that run when clicked. This only affects setups where PMD loads an untrusted ruleset and the resulting HTML report is viewed in a browser.

... (truncated)

Commits
  • 47b3135 [release] prepare release pmd_releases/7.29.0
  • df93eb5 Prepare pmd release 7.29.0
  • 7d4b9ad Update contributors for 7.29.0
  • cc67aac [doc] Update security.md and attributions
  • e79c4e1 [core] Fix missing escaping in CSV renderers (#7262)
  • 71d38f5 [core] Disallow external entity expansions/DTD in XML parsing (#7261)
  • 1e4fd94 [core] HTMLRenderers: Properly escape rule name and externalInfoUrl (#7260)
  • 7aec5c1 [core] Don't follow symlinks in FileCollector (#7259)
  • c7560e0 [doc] Improve release notes
  • c44b87c [java] Fix #7213: UnusedPrivateMethod/UnusedPrivateField with qualified Metho...
  • Additional commits viewable in compare view

Updates net.sourceforge.pmd:pmd-java from 7.26.0 to 7.29.0

Release notes

Sourced from net.sourceforge.pmd:pmd-java's releases.

PMD 7.29.0 (30-October-2026)

30-October-2026 - 7.29.0

The PMD team is pleased to announce PMD 7.29.0.

This is a minor release.

Table Of Contents

🚀️ New and noteworthy

Security fixes

All known security vulnerabilities are described in full detail on the page PMD Security. This release, the following security vulnerabilities were fixed:

  • GHSA-wj6q-xw9m-26p6: Arbitrary file disclosure in CPD via symlinks in analyzed sources.
    When collecting files, CPD followed symbolic links, even if their targets were outside the scanned directory. This allowed reading any file accessible to the user running CPD. If a CI/CD pipeline runs CPD on untrusted source code (e.g. a pull request from an external contributor), an attacker could commit two symlinks pointing to the same file outside the project. CPD detected them as duplicates and wrote the full content of the target file into the report. If the report was published, e.g. as a CI artifact, the attacker could read it.
    With this fix, neither PMD nor CPD follows symbolic links anymore when collecting files to analyze.
    Affected versions: PMD >= 6.54.0 and <= 7.28.0. If you run CPD on untrusted source code, it is recommended to upgrade PMD.
    Reported by Dan (@​7alen7). Independently reported by lapeace (@​ThejasRajamoney).
  • GHSA-5x5v-644m-q2qc: XSS via externalInfoUrl in HTML report formats.
    The html and summaryhtml renderers inserted a rule's externalInfoUrl into generated reports without escaping or URL-scheme validation. With a crafted ruleset, this allowed injected markup that runs when the report is opened (with --show-suppressed), or javascript: links that run when clicked. This only affects setups where PMD loads an untrusted ruleset and the resulting HTML report is viewed in a browser.

... (truncated)

Commits
  • 47b3135 [release] prepare release pmd_releases/7.29.0
  • df93eb5 Prepare pmd release 7.29.0
  • 7d4b9ad Update contributors for 7.29.0
  • cc67aac [doc] Update security.md and attributions
  • e79c4e1 [core] Fix missing escaping in CSV renderers (#7262)
  • 71d38f5 [core] Disallow external entity expansions/DTD in XML parsing (#7261)
  • 1e4fd94 [core] HTMLRenderers: Properly escape rule name and externalInfoUrl (#7260)
  • 7aec5c1 [core] Don't follow symlinks in FileCollector (#7259)
  • c7560e0 [doc] Improve release notes
  • c44b87c [java] Fix #7213: UnusedPrivateMethod/UnusedPrivateField with qualified Metho...
  • Additional commits viewable in compare view

Updates net.sourceforge.pmd:pmd-xml from 7.26.0 to 7.29.0

Release notes

Sourced from net.sourceforge.pmd:pmd-xml's releases.

PMD 7.29.0 (30-October-2026)

30-October-2026 - 7.29.0

The PMD team is pleased to announce PMD 7.29.0.

This is a minor release.

Table Of Contents

🚀️ New and noteworthy

Security fixes

All known security vulnerabilities are described in full detail on the page PMD Security. This release, the following security vulnerabilities were fixed:

  • GHSA-wj6q-xw9m-26p6: Arbitrary file disclosure in CPD via symlinks in analyzed sources.
    When collecting files, CPD followed symbolic links, even if their targets were outside the scanned directory. This allowed reading any file accessible to the user running CPD. If a CI/CD pipeline runs CPD on untrusted source code (e.g. a pull request from an external contributor), an attacker could commit two symlinks pointing to the same file outside the project. CPD detected them as duplicates and wrote the full content of the target file into the report. If the report was published, e.g. as a CI artifact, the attacker could read it.
    With this fix, neither PMD nor CPD follows symbolic links anymore when collecting files to analyze.
    Affected versions: PMD >= 6.54.0 and <= 7.28.0. If you run CPD on untrusted source code, it is recommended to upgrade PMD.
    Reported by Dan (@​7alen7). Independently reported by lapeace (@​ThejasRajamoney).
  • GHSA-5x5v-644m-q2qc: XSS via externalInfoUrl in HTML report formats.
    The html and summaryhtml renderers inserted a rule's externalInfoUrl into generated reports without escaping or URL-scheme validation. With a crafted ruleset, this allowed injected markup that runs when the report is opened (with --show-suppressed), or javascript: links that run when clicked. This only affects setups where PMD loads an untrusted ruleset and the resulting HTML report is viewed in a browser.

... (truncated)

Commits
  • 47b3135 [release] prepare release pmd_releases/7.29.0
  • df93eb5 Prepare pmd release 7.29.0
  • 7d4b9ad Update contributors for 7.29.0
  • cc67aac [doc] Update security.md and attributions
  • e79c4e1 [core] Fix missing escaping in CSV renderers (#7262)
  • 71d38f5 [core] Disallow external entity expansions/DTD in XML parsing (#7261)
  • 1e4fd94 [core] HTMLRenderers: Properly escape rule name and externalInfoUrl (#7260)
  • 7aec5c1 [core] Don't follow symlinks in FileCollector (#7259)
  • c7560e0 [doc] Improve release notes
  • c44b87c [java] Fix #7213: UnusedPrivateMethod/UnusedPrivateField with qualified Metho...
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies java Pull requests that update java code labels Oct 19, 2026
@dependabot
dependabot Bot force-pushed the dependabot/maven/pmd.version-7.28.0 branch 2 times, most recently from a906d23 to 2c22de2 Compare October 22, 2026 12:54
@dependabot
dependabot Bot force-pushed the dependabot/maven/pmd.version-7.28.0 branch from 2c22de2 to 827cb68 Compare October 29, 2026 13:34
@dependabot
build(deps): bump pmd.version from 7.26.0 to 7.29.0
ba9c9c9 
Bumps `pmd.version` from 7.26.0 to 7.29.0.

Updates `net.sourceforge.pmd:pmd-core` from 7.26.0 to 7.29.0
- [Release notes](https://github.com/pmd/pmd/releases)
- [Commits](pmd/pmd@pmd_releases/7.26.0...pmd_releases/7.29.0)

Updates `net.sourceforge.pmd:pmd-java` from 7.26.0 to 7.29.0
- [Release notes](https://github.com/pmd/pmd/releases)
- [Commits](pmd/pmd@pmd_releases/7.26.0...pmd_releases/7.29.0)

Updates `net.sourceforge.pmd:pmd-xml` from 7.26.0 to 7.29.0
- [Release notes](https://github.com/pmd/pmd/releases)
- [Commits](pmd/pmd@pmd_releases/7.26.0...pmd_releases/7.29.0)

---
updated-dependencies:
- dependency-name: net.sourceforge.pmd:pmd-core
  dependency-version: 7.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: net.sourceforge.pmd:pmd-java
  dependency-version: 7.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: net.sourceforge.pmd:pmd-xml
  dependency-version: 7.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title build(deps): bump pmd.version from 7.26.0 to 7.28.0 build(deps): bump pmd.version from 7.26.0 to 7.29.0 Nov 2, 2026
@dependabot
dependabot Bot force-pushed the dependabot/maven/pmd.version-7.28.0 branch from 827cb68 to ba9c9c9 Compare November 2, 2026 14:07

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants