Sync Collecting Fix Commits: Thu Sep 10 17:12:51 UTC 2026

Signed-off-by: AboutCode Automation <automation@aboutcode.org>

Author: aboutcode-automation

data/fix-commits/advisory-database-b78f1d41.json

@@ -2,6 +2,7 @@
   "vcs_url": "https://github.com/apache/camel",
   "vulnerabilities": {
     "CVE-2026-45799": {
+      "79075eccf01e1b56ed2a0ec504b626cfcaad8aa5": "[backport camel-4.22.x] Pin com.squareup.wire:wire-runtime to 6.4.7 to remediate CVE-2026-45799 (#26252)\n\nPin com.squareup.wire:wire-runtime to 6.4.7 to remediate CVE-2026-45799 (#26243)\n\namazon-kinesis-client pulls software.amazon.glue:schema-registry-serde, which\npins Square Wire at 5.2.0. skipGroup() before Wire 6.3.0 does not reject a\nnegative LENGTH_DELIMITED length, so a crafted payload makes\nProtoAdapter.decode(byte[]) throw an unchecked ArrayIndexOutOfBoundsException\ninstead of the documented IOException. schema-registry-serde 1.1.27 is the\nlatest release and is still on Wire 5.2.0, so the version is managed here.\n\nOnly wire-runtime is bumped. wire-schema, wire-compiler and the Wire code\ngenerators stay at 5.2.0 because the Glue serde binds to\ncom.squareup.wire.schema.internal.parser.ProtoFileElement, whose constructor\ngained a parameter in Wire 5.3.0 - aligning every Wire artifact breaks\nFileDescriptorUtils with a NoSuchMethodError. No Wire release has both the\n9-arg constructor and the CVE fix, so splitting the versions is the only\ncombination that satisfies both.\n\nwire-runtime is an empty Kotlin-Multiplatform metadata artifact; wire-runtime-jvm\ncarries all the classes and is the entry that applies the fix. Both are pinned\nbecause the advisory lists both coordinates.\n\nCamel itself never reaches the vulnerable code: the Glue serde uses Wire only as\na .proto schema-text parser, and the KCL consumer never enables the Glue schema\nregistry. This removes a recurring false positive for downstream consumers.\n\n\n(cherry picked from commit 76a4eef4a6ba912df31bfc1ee3a7936336b419b6)\n\nCo-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>",
       "76a4eef4a6ba912df31bfc1ee3a7936336b419b6": "Pin com.squareup.wire:wire-runtime to 6.4.7 to remediate CVE-2026-45799 (#26243)\n\namazon-kinesis-client pulls software.amazon.glue:schema-registry-serde, which\npins Square Wire at 5.2.0. skipGroup() before Wire 6.3.0 does not reject a\nnegative LENGTH_DELIMITED length, so a crafted payload makes\nProtoAdapter.decode(byte[]) throw an unchecked ArrayIndexOutOfBoundsException\ninstead of the documented IOException. schema-registry-serde 1.1.27 is the\nlatest release and is still on Wire 5.2.0, so the version is managed here.\n\nOnly wire-runtime is bumped. wire-schema, wire-compiler and the Wire code\ngenerators stay at 5.2.0 because the Glue serde binds to\ncom.squareup.wire.schema.internal.parser.ProtoFileElement, whose constructor\ngained a parameter in Wire 5.3.0 - aligning every Wire artifact breaks\nFileDescriptorUtils with a NoSuchMethodError. No Wire release has both the\n9-arg constructor and the CVE fix, so splitting the versions is the only\ncombination that satisfies both.\n\nwire-runtime is an empty Kotlin-Multiplatform metadata artifact; wire-runtime-jvm\ncarries all the classes and is the entry that applies the fix. Both are pinned\nbecause the advisory lists both coordinates.\n\nCamel itself never reaches the vulnerable code: the Glue serde uses Wire only as\na .proto schema-text parser, and the KCL consumer never enables the Glue schema\nregistry. This removes a recurring false positive for downstream consumers.\n\nCo-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>"
     },
     "CVE-2025-27636": {

data/fix-commits/buildroot-0b809119.json

@@ -1,6 +1,9 @@
 {
   "vcs_url": "https://github.com/langchain-ai/langchainjs",
   "vulnerabilities": {
+    "GHSA-82FW-GWWQ-J7X9": {
+      "b0a0d3f73608674818e4ad6c12adde622c90afa5": "fix(deps): upgrade Vitest to address GHSA-82fw-gwwq-j7x9 (#11599)\n\n## Summary\n\nAddresses the three open Dependabot alerts for\n[GHSA-82fw-gwwq-j7x9](https://github.com/advisories/GHSA-82fw-gwwq-j7x9),\nan arbitrary-file-read vulnerability in Vitest redirect mocks.\n\n- Require Vitest `^4.1.11` across test workspaces and the isolated\nCloudflare exports fixture.\n- Align the private `@langchain/standard-tests` optional peer dependency\nwith the patched runner, removing the remaining Vitest 3 dependency\npath.\n- Refresh the lockfile to Vitest and `@vitest/mocker` 4.1.11, align\ncoverage peers, and prune obsolete runner dependencies. Preserve\nunrelated dependency versions and resolutions.\n\nNo production code or new dependencies; no package-release changeset\nneeded for development tooling and private fixtures.\n\n## Validation\n\n- `pnpm install --frozen-lockfile --ignore-scripts` passed.\n- `pnpm format`, `pnpm format:check`, and `pnpm lint` passed.\n- Model-profiles `src/tests/config.test.ts`: 8 tests passed.\n- Core `src/messages/tests/message_utils.test.ts`: 24 tests passed.\n- Verified every locked `vitest` and `@vitest/mocker` version is 4.1.11\nand manifest edits only raise Vitest minimum versions.\n- Cloudflare Workers environment test was not run; its isolated fixture\nis outside the root pnpm workspace.\n\nGitHub will reassess the Dependabot alerts after this change reaches the\ndefault branch.\n\nMade by [Open\nSWE](https://openswe.vercel.app/agents/5e90dc8c-73ed-5d94-99e7-580b0b8ed921)\n\u00b7 openai:gpt-6-astra (medium)\n\nCo-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>"
+    },
     "GHSA-5JGF-P345-68V8": {
       "3c03d16da6b17bfa9c07bd86284bdd2c88258db0": "fix(deps): update vulnerable transitive dependencies (#11545)\n\n## Summary\n\n- raise the `fast-uri` transitive override to `>=4.1.3` (resolves\nGHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, and\nGHSA-jqff-g426-hqxp)\n- raise the `qs` transitive override to `>=6.16.0` (resolves\nGHSA-x5fp-wj9c-mxmx and GHSA-4mjr-xmp4-gh2g)\n- add a `mysql2` transitive override at `>=3.23.1` (resolves\nGHSA-rgwj-5xj2-c3m3 and GHSA-3f6p-5ww8-9rcr)\n- regenerate the pnpm lockfile with `fast-uri` 4.1.4, `qs` 6.16.0, and\n`mysql2` 3.24.3\n\n## Test Plan\n\n- [x] `CI=true corepack pnpm@9.15.9 install --frozen-lockfile\n--ignore-scripts`\n- [x] `corepack pnpm@9.15.9 exec oxfmt --check package.json`\n- [x] `git diff --check`\n\nScoped to the affected security overrides and lockfile resolutions.\n\nCo-authored-by: langsmith-fleet[bot] <langsmith-fleet[bot]@users.noreply.github.com>"
     },

data/fix-commits/camel-36fc325a.json

@@ -2,6 +2,7 @@
   "vcs_url": "https://github.com/netty/netty",
   "vulnerabilities": {
     "CVE-2025-59419": {
+      "0e97c9db5e723a8376d6de922a7827d5225cf0bd": "Validate SMTP command name for CRLF to prevent command injection\n\nMotivation:\n\nCVE-2025-59419 added CR/LF validation for SMTP request parameters but\nleft the command name unvalidated: neither SmtpCommand.valueOf nor the\nSmtpCommand constructor nor SmtpRequestEncoder checks it. A command name\nwith embedded CR/LF (e.g. \"NOOP\\r\\nMAIL FROM:<...>\") therefore encodes\nto several smuggled commands on the wire \u2014 the same injection class\n(CWE-93) the parent CVE set out to close, on a field it did not cover.\n\nModification:\n\n- Validate CR/LF in the private SmtpCommand(AsciiString) constructor,\nthe single construction path for all commands (cached constants and\nvalueOf alike).\n- Widen SmtpUtils.validateSMTPParameter to package-private for reuse.\n- Add a regression test asserting valueOf rejects CR/LF in the command\nname.\n\nResult:\n\nA command name with CR/LF can no longer be constructed, so the encoder\ncannot emit smuggled commands. This completes the CVE-2025-59419 fix\nacross both parameters and the command-name field.",
       "ec581bcd25acfb34e75aebdb826a2982f2faf272": "Validate SMTP command name for CRLF to prevent command injection\n\nMotivation:\n\nCVE-2025-59419 added CR/LF validation for SMTP request parameters but\nleft the command name unvalidated: neither SmtpCommand.valueOf nor the\nSmtpCommand constructor nor SmtpRequestEncoder checks it. A command name\nwith embedded CR/LF (e.g. \"NOOP\\r\\nMAIL FROM:<...>\") therefore encodes\nto several smuggled commands on the wire \u2014 the same injection class\n(CWE-93) the parent CVE set out to close, on a field it did not cover.\n\nModification:\n\n- Validate CR/LF in the private SmtpCommand(AsciiString) constructor,\nthe single construction path for all commands (cached constants and\nvalueOf alike).\n- Widen SmtpUtils.validateSMTPParameter to package-private for reuse.\n- Add a regression test asserting valueOf rejects CR/LF in the command\nname.\n\nResult:\n\nA command name with CR/LF can no longer be constructed, so the encoder\ncannot emit smuggled commands. This completes the CVE-2025-59419 fix\nacross both parameters and the command-name field.",
       "8cf6b03f8a1f421f0181d61e1768e6c9e32eb856": "Validate SMTP command name for CRLF to prevent command injection\n\nMotivation:\n\nCVE-2025-59419 added CR/LF validation for SMTP request parameters but\nleft the command name unvalidated: neither SmtpCommand.valueOf nor the\nSmtpCommand constructor nor SmtpRequestEncoder checks it. A command name\nwith embedded CR/LF (e.g. \"NOOP\\r\\nMAIL FROM:<...>\") therefore encodes\nto several smuggled commands on the wire \u2014 the same injection class\n(CWE-93) the parent CVE set out to close, on a field it did not cover.\n\nModification:\n\n- Validate CR/LF in the private SmtpCommand(AsciiString) constructor,\nthe single construction path for all commands (cached constants and\nvalueOf alike).\n- Widen SmtpUtils.validateSMTPParameter to package-private for reuse.\n- Add a regression test asserting valueOf rejects CR/LF in the command\nname.\n\nResult:\n\nA command name with CR/LF can no longer be constructed, so the encoder\ncannot emit smuggled commands. This completes the CVE-2025-59419 fix\nacross both parameters and the command-name field."
     },