Skip to content

fix(deps): update dependency junit:junit to v4.13.1 [security]#376

Draft
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/maven-junit-junit-vulnerability
Draft

fix(deps): update dependency junit:junit to v4.13.1 [security]#376
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/maven-junit-junit-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
junit:junit (source) 4.8.1 → 4.13.1 age confidence

TemporaryFolder on unix-like systems does not limit access to created files

CVE-2020-15250 / GHSA-269g-pwp5-87pp

More information

Details

Vulnerability

The JUnit4 test rule TemporaryFolder contains a local information disclosure vulnerability.

Example of vulnerable code:

public static class HasTempFolder {
    @​Rule
    public TemporaryFolder folder = new TemporaryFolder();

    @​Test
    public void testUsingTempFolder() throws IOException {
        folder.getRoot(); // Previous file permissions: `drwxr-xr-x`; After fix:`drwx------`
        File createdFile= folder.newFile("myfile.txt"); // unchanged/irrelevant file permissions
        File createdFolder= folder.newFolder("subfolder"); // unchanged/irrelevant file permissions
        // ...
    }
}
Impact

On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system.

This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability.

When analyzing the impact of this vulnerability, here are the important questions to ask:

  1. Do the JUnit tests write sensitive information, like API keys or passwords, into the temporary folder?
    • If yes, this vulnerability impacts you, but only if you also answer 'yes' to question 2.
    • If no, this vulnerability does not impact you.
  2. Do the JUnit tests ever execute in an environment where the OS has other untrusted users.
    This may apply in CI/CD environments but normally won't be 'yes' for personal developer machines.
    • If yes, and you answered 'yes' to question 1, this vulnerability impacts you.
    • If no, this vulnerability does not impact you.
Patches

Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using.

  • Java 1.7 and higher users: this vulnerability is fixed in 4.13.1.
  • Java 1.6 and lower users: no patch is available, you must use the workaround below.
Workarounds

If you are unable to patch, or are stuck running on Java 1.6, specifying the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability.

References
Similar Vulnerabilities
For more information

If you have any questions or comments about this advisory, please pen an issue in junit-team/junit4.

Severity

  • CVSS Score: 4.4 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team July 24, 2026 13:13
@renovate renovate Bot added dependencies Dependency updates java Java / Gradle dependencies labels Jul 24, 2026
@github-actions

github-actions Bot commented Jul 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Test Results

3 tests   - 651   0 ✅  - 654   0s ⏱️ - 2m 42s
3 suites  - 105   0 💤 ±  0 
3 files    - 105   3 ❌ +  3 

For more details on these failures, see this check.

Results for commit d54e248. ± Comparison against base commit ac47cc8.

This pull request removes 654 and adds 3 tests. Note that renamed tests count towards both. 
com.mirth.commons.encryption.test.DigesterTest ‑ testArgon2d
com.mirth.commons.encryption.test.DigesterTest ‑ testArgon2i
com.mirth.commons.encryption.test.DigesterTest ‑ testArgon2id
com.mirth.commons.encryption.test.DigesterTest ‑ testFallback1
com.mirth.commons.encryption.test.DigesterTest ‑ testFallback2
com.mirth.commons.encryption.test.DigesterTest ‑ testFallback3
com.mirth.commons.encryption.test.DigesterTest ‑ testFallback4
com.mirth.commons.encryption.test.DigesterTest ‑ testPBKDF2
com.mirth.commons.encryption.test.DigesterTest ‑ testSHA256
com.mirth.commons.encryption.test.EncryptionTest ‑ testDigest
…

com.mirth.connect.donkey.server.channel.ChannelTest ‑ initializationError
com.mirth.connect.donkey.server.channel.StatisticsTest ‑ initializationError
com.mirth.connect.donkey.server.data.jdbc.JdbcDaoTest ‑ initializationError

♻️ This comment has been updated with latest results.

jonbartels
jonbartels requested changes Jul 24, 2026
View reviewed changes

@jonbartels jonbartels left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

build failure

@jbeckers

jbeckers commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

https://github.com/junit-team/junit4/wiki/Use-with-Gradle#junit-411-and-later implies the explicit dependency on hamcrest is no longer needed
Indeed: https://mvnrepository.com/artifact/junit/junit/4.13.2/dependencies vs https://mvnrepository.com/artifact/junit/junit/4.8.1/dependencies shows the dependency on hamcrest is now added recursively.

Maybe the explicit dependency pulls in the wrong version?

@renovate
renovate Bot force-pushed the renovate/maven-junit-junit-vulnerability branch from c884eae to e1ce08e Compare July 24, 2026 23:08
@mgaffigan
mgaffigan marked this pull request as draft July 24, 2026 23:09
@renovate
renovate Bot force-pushed the renovate/maven-junit-junit-vulnerability branch from e1ce08e to d54e248 Compare July 24, 2026 23:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jonbartels jonbartels jonbartels requested changes
@kayyagari kayyagari Awaiting requested review from kayyagari kayyagari is a code owner automatically assigned from OpenIntegrationEngine/maintainers
@gibson9583 gibson9583 Awaiting requested review from gibson9583 gibson9583 is a code owner automatically assigned from OpenIntegrationEngine/maintainers
@ssrowe ssrowe Awaiting requested review from ssrowe ssrowe is a code owner automatically assigned from OpenIntegrationEngine/maintainers
@kpalang kpalang Awaiting requested review from kpalang kpalang is a code owner automatically assigned from OpenIntegrationEngine/maintainers
@mgaffigan mgaffigan Awaiting requested review from mgaffigan mgaffigan is a code owner automatically assigned from OpenIntegrationEngine/maintainers
@NicoPiel NicoPiel Awaiting requested review from NicoPiel NicoPiel is a code owner automatically assigned from OpenIntegrationEngine/maintainers
+1 more reviewer
@jbeckers jbeckers jbeckers approved these changes
Reviewers whose approvals may not affect merge requirements

Requested changes must be addressed to merge this pull request.

Assignees

No one assigned

Labels

dependencies Dependency updates java Java / Gradle dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jbeckers @jonbartels