diff --git a/build.gradle b/build.gradle index 1b494c88d..ecd82a69f 100644 --- a/build.gradle +++ b/build.gradle @@ -18,6 +18,9 @@ subprojects { resolutionStrategy { // Forcing the latest commons-lang3 version to eliminate CVEs. force "org.apache.commons:commons-lang3:3.20.0" + // Force kotlin-stdlib to the version matching the Kotlin JVM plugin, overriding the + // vulnerable 2.2.21 version that okhttp brings in transitively. + force "org.jetbrains.kotlin:kotlin-stdlib:2.4.10" } } } diff --git a/ml-development-tools/build.gradle b/ml-development-tools/build.gradle index b6d4a60f5..2e3a8ed40 100644 --- a/ml-development-tools/build.gradle +++ b/ml-development-tools/build.gradle @@ -9,7 +9,7 @@ plugins { id 'maven-publish' id "com.gradle.plugin-publish" version "1.2.1" id "java-gradle-plugin" - id 'org.jetbrains.kotlin.jvm' version '2.4.0' + id 'org.jetbrains.kotlin.jvm' version '2.4.10' } dependencies { @@ -23,7 +23,10 @@ dependencies { // additional work during development, though we rarely modify the code in this plugin anymore. implementation "com.marklogic:marklogic-client-api:${version}" - implementation 'org.jetbrains.kotlin:kotlin-stdlib:2.2.21' + // kotlin-stdlib is intentionally not declared here; the Kotlin JVM plugin (version 2.4.10) + // automatically adds the matching kotlin-stdlib to the compile and runtime classpath. + // Declaring it explicitly with an older version (e.g. to match okhttp's transitive dep) + // would re-introduce CVE risk. implementation "com.fasterxml.jackson.module:jackson-module-kotlin:${jacksonVersion}" // Sticking with this older version for now as the latest 1.x version introduces breaking changes. diff --git a/ml-development-tools/src/main/kotlin/com/marklogic/client/tools/fnclassgen.kt b/ml-development-tools/src/main/kotlin/com/marklogic/client/tools/fnclassgen.kt index 833c58a56..9f88a4f04 100644 --- a/ml-development-tools/src/main/kotlin/com/marklogic/client/tools/fnclassgen.kt +++ b/ml-development-tools/src/main/kotlin/com/marklogic/client/tools/fnclassgen.kt @@ -1,16 +1,14 @@ /* - * Copyright (c) 2010-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved. + * Copyright (c) 2010-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved. */ package com.marklogic.client.tools import com.marklogic.client.tools.proxy.Generator -import kotlin.system.exitProcess fun main(args: Array) { if (args.size == 2) { Generator().serviceBundleToJava(args[0], args[1]) } else { - System.err.println("usage: fnclassgen serviceDeclarationFile javaBaseDir") - exitProcess(-1) + throw IllegalArgumentException("usage: fnclassgen serviceDeclarationFile javaBaseDir") } } diff --git a/ml-development-tools/src/main/kotlin/com/marklogic/client/tools/fnmodinit.kt b/ml-development-tools/src/main/kotlin/com/marklogic/client/tools/fnmodinit.kt index 3498268a1..37a8aa4c6 100644 --- a/ml-development-tools/src/main/kotlin/com/marklogic/client/tools/fnmodinit.kt +++ b/ml-development-tools/src/main/kotlin/com/marklogic/client/tools/fnmodinit.kt @@ -1,16 +1,14 @@ /* - * Copyright (c) 2010-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved. + * Copyright (c) 2010-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved. */ package com.marklogic.client.tools import com.marklogic.client.tools.proxy.Generator -import kotlin.system.exitProcess fun main(args: Array) { if (args.size == 2) { Generator().endpointDeclToModStubImpl(args[0], args[1]) } else { - System.err.println("usage: fnmodinit endpointDeclarationFile moduleExtension") - exitProcess(-1) + throw IllegalArgumentException("usage: fnmodinit endpointDeclarationFile moduleExtension") } } diff --git a/ml-development-tools/src/test/kotlin/com/marklogic/client/test/dbfunction/fntestgen.kt b/ml-development-tools/src/test/kotlin/com/marklogic/client/test/dbfunction/fntestgen.kt index 63eb383cb..d7ed7cb37 100644 --- a/ml-development-tools/src/test/kotlin/com/marklogic/client/test/dbfunction/fntestgen.kt +++ b/ml-development-tools/src/test/kotlin/com/marklogic/client/test/dbfunction/fntestgen.kt @@ -1,5 +1,5 @@ /* - * Copyright (c) 2010-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved. + * Copyright (c) 2010-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved. */ package com.marklogic.client.test.dbfunction @@ -18,7 +18,6 @@ import java.io.File import java.lang.Exception import java.lang.IllegalStateException -import kotlin.system.exitProcess const val TEST_PACKAGE = "com.marklogic.client.test.dbfunction.generated" @@ -515,10 +514,7 @@ fun main(args: Array) { when (args.size) { 1 -> dbfTestGenerate(args[0], "latest") 2 -> dbfTestGenerate(args[0], args[1]) - else -> { - System.err.println("usage: fntestgen testDir [release]") - exitProcess(-1) - } + else -> throw IllegalArgumentException("usage: fntestgen testDir [release]") } } catch (e: Exception) { e.printStackTrace() @@ -529,11 +525,7 @@ fun getExtensions(release: String) : List { "release4" -> listOf("sjs", "xqy") "release5", "latest" -> listOf("mjs", "sjs", "xqy") - else -> { - System.err.println("unknown release: $release") - System.err.println("valid releases are one of release4, release5, or latest") - exitProcess(-1) - } + else -> throw IllegalArgumentException("unknown release: $release; valid releases are one of release4, release5, or latest") } }