fix: critical CVE 2025-70952 fix#41673
Merged
sondermanish merged 1 commit intoreleasefrom Mar 30, 2026
Merged
Conversation
Contributor
WalkthroughUpdated three Maven dependency version declarations across the project: upgraded Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
app/server/appsmith-server/pom.xml (1)
41-41: 🛠️ Refactor suggestion | 🟠 MajorConsider the correct version to address CVE-2025-70952.
Since PF4J 3.15.0 doesn't exist and the CVE fix is in commit 20c2f80, you should either:
- Use PF4J 3.14.0 (if it contains the fix), or
- Wait for the official release that includes commit 20c2f80, or
- Build from source with the commit included
Also ensure pf4j-spring version is compatible with whichever PF4J version you choose.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@app/server/appsmith-server/pom.xml` at line 41, The PF4J dependency in pom.xml points to a non-existent 3.15.0 to address CVE-2025-70952; replace it by either (A) pinning to a known released version that includes commit 20c2f80 (e.g., verify and use PF4J 3.14.0 if that commit/fix is present) or (B) building PF4J from source with commit 20c2f80 and referencing the built artifact in your local/remote repo, and in either case ensure the pf4j-spring dependency version is updated to a compatible release (or built together) so PF4J API/ABI matches; update the pom.xml dependency entries for artifactId pf4j and pf4j-spring accordingly (or replace with the built coordinates) and run mvn verify to confirm no dependency conflicts.
♻️ Duplicate comments (1)
app/server/appsmith-server/pom.xml (1)
258-258:⚠️ Potential issue | 🟠 MajorSame version mismatch issue: pf4j-spring 0.10.0 expects PF4J 3.13.0.
This dependency has the same version mismatch as in
app/server/appsmith-plugins/pom.xml. The relevant code snippet shows thatCustomPluginManagerextendsSpringPluginManagerwith a no-arg constructor. API changes between pf4j-spring versions may affect this inheritance.Verify SpringPluginManager constructor compatibility:
#!/bin/bash # Check SpringPluginManager constructor compatibility between versions echo "=== Checking CustomPluginManager implementation ===" cat app/server/appsmith-server/src/main/java/com/appsmith/server/configurations/PluginConfiguration.java echo "" echo "=== Searching for SpringPluginManager usage patterns ===" rg -n "extends.*SpringPluginManager" --type java -C 5 echo "" echo "=== Check if SpringPluginManager constructors changed ===" echo "Need to verify pf4j-spring 0.8.0 vs 0.10.0 constructor signatures"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@app/server/appsmith-server/pom.xml` at line 258, The pf4j-spring dependency version is mismatched (0.10.0 expects a different PF4J API) and may break your CustomPluginManager that extends SpringPluginManager; update either the pf4j-spring version to the one compatible with the PF4J core you use or adapt the CustomPluginManager constructor/usage to the new SpringPluginManager API. Specifically, inspect PluginConfiguration.java and the CustomPluginManager class (search for "extends SpringPluginManager") and reconcile constructors/signatures: if SpringPluginManager removed the no-arg constructor in 0.10.0, add a matching constructor call (e.g., calling super(...) with required parameters) or downgrade/align pf4j-spring in the pom.xml to the version that matches your PF4J core. Ensure the pom.xml <version> entry for pf4j-spring is consistent with PF4J core and update the CustomPluginManager constructor to compile against the chosen pf4j-spring version.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@app/server/appsmith-plugins/pom.xml`:
- Line 56: The project POM overrides pf4j.version to 3.15.0 while pf4j-spring
0.10.0 expects PF4J 3.13.0; either set the pf4j.version property back to 3.13.0
in the app/server pom.xml (match pf4j.version property) or upgrade pf4j-spring
to a version that officially supports PF4J 3.15.0 — update the pf4j.version
property or the pf4j-spring dependency accordingly and run a full build/test to
verify compatibility.
---
Outside diff comments:
In `@app/server/appsmith-server/pom.xml`:
- Line 41: The PF4J dependency in pom.xml points to a non-existent 3.15.0 to
address CVE-2025-70952; replace it by either (A) pinning to a known released
version that includes commit 20c2f80 (e.g., verify and use PF4J 3.14.0 if that
commit/fix is present) or (B) building PF4J from source with commit 20c2f80 and
referencing the built artifact in your local/remote repo, and in either case
ensure the pf4j-spring dependency version is updated to a compatible release (or
built together) so PF4J API/ABI matches; update the pom.xml dependency entries
for artifactId pf4j and pf4j-spring accordingly (or replace with the built
coordinates) and run mvn verify to confirm no dependency conflicts.
---
Duplicate comments:
In `@app/server/appsmith-server/pom.xml`:
- Line 258: The pf4j-spring dependency version is mismatched (0.10.0 expects a
different PF4J API) and may break your CustomPluginManager that extends
SpringPluginManager; update either the pf4j-spring version to the one compatible
with the PF4J core you use or adapt the CustomPluginManager constructor/usage to
the new SpringPluginManager API. Specifically, inspect PluginConfiguration.java
and the CustomPluginManager class (search for "extends SpringPluginManager") and
reconcile constructors/signatures: if SpringPluginManager removed the no-arg
constructor in 0.10.0, add a matching constructor call (e.g., calling super(...)
with required parameters) or downgrade/align pf4j-spring in the pom.xml to the
version that matches your PF4J core. Ensure the pom.xml <version> entry for
pf4j-spring is consistent with PF4J core and update the CustomPluginManager
constructor to compile against the chosen pf4j-spring version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 4f6012cd-69da-4930-ad0c-68cd1e9ea371
📒 Files selected for processing (3)
app/server/appsmith-plugins/pom.xmlapp/server/appsmith-server/pom.xmlapp/server/pom.xml
Contributor
Author
|
/build-deploy-preview skip-tests=true |
|
Deploying Your Preview: https://github.com/appsmithorg/appsmith/actions/runs/23736849353. |
|
Deploy-Preview-URL: https://ce-41673.dp.appsmith.com |
subrata71
approved these changes
Mar 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Upgrade PF4J plugin framework dependencies to address known vulnerabilities.
3.10.0→3.15.0(latest release)0.8.0→0.10.0(latest release)What changed
app/server/pom.xml— Bumporg.pf4j.versionproperty from 3.10.0 to 3.15.0. This property is referenced via${org.pf4j.version}in:app/server/appsmith-server/pom.xmlapp/server/appsmith-plugins/pom.xmlapp/server/appsmith-interfaces/pom.xmlapp/server/appsmith-server/pom.xml— Bumppf4j-springfrom 0.8.0 to 0.10.0app/server/appsmith-plugins/pom.xml— Bumppf4j-springfrom 0.8.0 to 0.10.0Compatibility
jakarta.annotation-api), fully compatible with our Spring Boot 3.5.12 parent.Fixes: https://linear.app/appsmith/issue/APP-15065/address-cve-2025-70952-vulnerability-in-appsmith-images
Automation
/ok-to-test tags="@tag.Datasource"
🔍 Cypress test results
Tip
🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉
Workflow run: https://github.com/appsmithorg/appsmith/actions/runs/23736830870
Commit: a5a2ef1
Cypress dashboard.
Tags:
@tag.DatasourceSpec:
Mon, 30 Mar 2026 09:48:15 UTC
Communication
Should the DevRel and Marketing teams inform users about this change?