From 7f0b7a8ebdf61b752489cd721336b057758dc7a4 Mon Sep 17 00:00:00 2001 From: Jonathan Miller Date: Wed, 29 Jul 2026 15:47:58 -0400 Subject: [PATCH 1/3] MLE-31109 Bump kotlin plugin and remove kotlin.system.exitProcess Bump kotlin plugin from 2.4.0 to 2.4.10 Removed imported instances of kotlin.system.exitProcess from com.squareup.okhttp3:okhttp:5.4.0 vulnerable dependency org.jetbrains.kotlin:kotlin-stdlib:2.2.21 --- build.gradle | 3 +++ ml-development-tools/build.gradle | 7 +++++-- .../kotlin/com/marklogic/client/tools/fnclassgen.kt | 4 +--- .../kotlin/com/marklogic/client/tools/fnmodinit.kt | 4 +--- .../src/test/example-project/build.gradle | 4 ++-- .../marklogic/client/test/dbfunction/fntestgen.kt | 12 ++---------- 6 files changed, 14 insertions(+), 20 deletions(-) diff --git a/build.gradle b/build.gradle index 1b494c88d2..ecd82a69f4 100644 --- a/build.gradle +++ b/build.gradle @@ -18,6 +18,9 @@ subprojects { resolutionStrategy { // Forcing the latest commons-lang3 version to eliminate CVEs. force "org.apache.commons:commons-lang3:3.20.0" + // Force kotlin-stdlib to the version matching the Kotlin JVM plugin, overriding the + // vulnerable 2.2.21 version that okhttp brings in transitively. + force "org.jetbrains.kotlin:kotlin-stdlib:2.4.10" } } } diff --git a/ml-development-tools/build.gradle b/ml-development-tools/build.gradle index b6d4a60f5b..2e3a8ed402 100644 --- a/ml-development-tools/build.gradle +++ b/ml-development-tools/build.gradle @@ -9,7 +9,7 @@ plugins { id 'maven-publish' id "com.gradle.plugin-publish" version "1.2.1" id "java-gradle-plugin" - id 'org.jetbrains.kotlin.jvm' version '2.4.0' + id 'org.jetbrains.kotlin.jvm' version '2.4.10' } dependencies { @@ -23,7 +23,10 @@ dependencies { // additional work during development, though we rarely modify the code in this plugin anymore. implementation "com.marklogic:marklogic-client-api:${version}" - implementation 'org.jetbrains.kotlin:kotlin-stdlib:2.2.21' + // kotlin-stdlib is intentionally not declared here; the Kotlin JVM plugin (version 2.4.10) + // automatically adds the matching kotlin-stdlib to the compile and runtime classpath. + // Declaring it explicitly with an older version (e.g. to match okhttp's transitive dep) + // would re-introduce CVE risk. implementation "com.fasterxml.jackson.module:jackson-module-kotlin:${jacksonVersion}" // Sticking with this older version for now as the latest 1.x version introduces breaking changes. diff --git a/ml-development-tools/src/main/kotlin/com/marklogic/client/tools/fnclassgen.kt b/ml-development-tools/src/main/kotlin/com/marklogic/client/tools/fnclassgen.kt index 833c58a56d..5f5fcc0210 100644 --- a/ml-development-tools/src/main/kotlin/com/marklogic/client/tools/fnclassgen.kt +++ b/ml-development-tools/src/main/kotlin/com/marklogic/client/tools/fnclassgen.kt @@ -4,13 +4,11 @@ package com.marklogic.client.tools import com.marklogic.client.tools.proxy.Generator -import kotlin.system.exitProcess fun main(args: Array) { if (args.size == 2) { Generator().serviceBundleToJava(args[0], args[1]) } else { - System.err.println("usage: fnclassgen serviceDeclarationFile javaBaseDir") - exitProcess(-1) + throw IllegalArgumentException("usage: fnclassgen serviceDeclarationFile javaBaseDir") } } diff --git a/ml-development-tools/src/main/kotlin/com/marklogic/client/tools/fnmodinit.kt b/ml-development-tools/src/main/kotlin/com/marklogic/client/tools/fnmodinit.kt index 3498268a12..4590b7e39e 100644 --- a/ml-development-tools/src/main/kotlin/com/marklogic/client/tools/fnmodinit.kt +++ b/ml-development-tools/src/main/kotlin/com/marklogic/client/tools/fnmodinit.kt @@ -4,13 +4,11 @@ package com.marklogic.client.tools import com.marklogic.client.tools.proxy.Generator -import kotlin.system.exitProcess fun main(args: Array) { if (args.size == 2) { Generator().endpointDeclToModStubImpl(args[0], args[1]) } else { - System.err.println("usage: fnmodinit endpointDeclarationFile moduleExtension") - exitProcess(-1) + throw IllegalArgumentException("usage: fnmodinit endpointDeclarationFile moduleExtension") } } diff --git a/ml-development-tools/src/test/example-project/build.gradle b/ml-development-tools/src/test/example-project/build.gradle index 0ec53c4701..d9e56a15e2 100644 --- a/ml-development-tools/src/test/example-project/build.gradle +++ b/ml-development-tools/src/test/example-project/build.gradle @@ -4,7 +4,7 @@ buildscript { mavenCentral() } dependencies { - classpath "com.marklogic:ml-development-tools:8.0.0" + classpath "com.marklogic:ml-development-tools:8.2-SNAPSHOT" } } @@ -23,7 +23,7 @@ repositories { } dependencies { - implementation 'com.marklogic:marklogic-client-api:8.0.0' + implementation 'com.marklogic:marklogic-client-api:8.2-SNAPSHOT' } tasks.register("testFullPath", com.marklogic.client.tools.gradle.EndpointProxiesGenTask) { diff --git a/ml-development-tools/src/test/kotlin/com/marklogic/client/test/dbfunction/fntestgen.kt b/ml-development-tools/src/test/kotlin/com/marklogic/client/test/dbfunction/fntestgen.kt index 63eb383cb3..59c4efd4a4 100644 --- a/ml-development-tools/src/test/kotlin/com/marklogic/client/test/dbfunction/fntestgen.kt +++ b/ml-development-tools/src/test/kotlin/com/marklogic/client/test/dbfunction/fntestgen.kt @@ -18,7 +18,6 @@ import java.io.File import java.lang.Exception import java.lang.IllegalStateException -import kotlin.system.exitProcess const val TEST_PACKAGE = "com.marklogic.client.test.dbfunction.generated" @@ -515,10 +514,7 @@ fun main(args: Array) { when (args.size) { 1 -> dbfTestGenerate(args[0], "latest") 2 -> dbfTestGenerate(args[0], args[1]) - else -> { - System.err.println("usage: fntestgen testDir [release]") - exitProcess(-1) - } + else -> throw IllegalArgumentException("usage: fntestgen testDir [release]") } } catch (e: Exception) { e.printStackTrace() @@ -529,11 +525,7 @@ fun getExtensions(release: String) : List { "release4" -> listOf("sjs", "xqy") "release5", "latest" -> listOf("mjs", "sjs", "xqy") - else -> { - System.err.println("unknown release: $release") - System.err.println("valid releases are one of release4, release5, or latest") - exitProcess(-1) - } + else -> throw IllegalArgumentException("unknown release: $release; valid releases are one of release4, release5, or latest") } } From 646dd0b154c55e113ed7cff2aadd067cdbcb8f4b Mon Sep 17 00:00:00 2001 From: Jonathan Miller Date: Wed, 29 Jul 2026 15:52:53 -0400 Subject: [PATCH 2/3] MLE-31109 Copyright Update --- .../src/main/kotlin/com/marklogic/client/tools/fnclassgen.kt | 2 +- .../src/main/kotlin/com/marklogic/client/tools/fnmodinit.kt | 2 +- .../kotlin/com/marklogic/client/test/dbfunction/fntestgen.kt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/ml-development-tools/src/main/kotlin/com/marklogic/client/tools/fnclassgen.kt b/ml-development-tools/src/main/kotlin/com/marklogic/client/tools/fnclassgen.kt index 5f5fcc0210..9f88a4f049 100644 --- a/ml-development-tools/src/main/kotlin/com/marklogic/client/tools/fnclassgen.kt +++ b/ml-development-tools/src/main/kotlin/com/marklogic/client/tools/fnclassgen.kt @@ -1,5 +1,5 @@ /* - * Copyright (c) 2010-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved. + * Copyright (c) 2010-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved. */ package com.marklogic.client.tools diff --git a/ml-development-tools/src/main/kotlin/com/marklogic/client/tools/fnmodinit.kt b/ml-development-tools/src/main/kotlin/com/marklogic/client/tools/fnmodinit.kt index 4590b7e39e..37a8aa4c61 100644 --- a/ml-development-tools/src/main/kotlin/com/marklogic/client/tools/fnmodinit.kt +++ b/ml-development-tools/src/main/kotlin/com/marklogic/client/tools/fnmodinit.kt @@ -1,5 +1,5 @@ /* - * Copyright (c) 2010-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved. + * Copyright (c) 2010-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved. */ package com.marklogic.client.tools diff --git a/ml-development-tools/src/test/kotlin/com/marklogic/client/test/dbfunction/fntestgen.kt b/ml-development-tools/src/test/kotlin/com/marklogic/client/test/dbfunction/fntestgen.kt index 59c4efd4a4..d7ed7cb377 100644 --- a/ml-development-tools/src/test/kotlin/com/marklogic/client/test/dbfunction/fntestgen.kt +++ b/ml-development-tools/src/test/kotlin/com/marklogic/client/test/dbfunction/fntestgen.kt @@ -1,5 +1,5 @@ /* - * Copyright (c) 2010-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved. + * Copyright (c) 2010-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved. */ package com.marklogic.client.test.dbfunction From 4be2d6d6cfc39a1a039bda0d68aaa524980ec2a5 Mon Sep 17 00:00:00 2001 From: Jonathan Miller Date: Wed, 29 Jul 2026 15:56:27 -0400 Subject: [PATCH 3/3] MLE-31109 Removed changes to example-project/build.gradle --- ml-development-tools/src/test/example-project/build.gradle | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ml-development-tools/src/test/example-project/build.gradle b/ml-development-tools/src/test/example-project/build.gradle index d9e56a15e2..0ec53c4701 100644 --- a/ml-development-tools/src/test/example-project/build.gradle +++ b/ml-development-tools/src/test/example-project/build.gradle @@ -4,7 +4,7 @@ buildscript { mavenCentral() } dependencies { - classpath "com.marklogic:ml-development-tools:8.2-SNAPSHOT" + classpath "com.marklogic:ml-development-tools:8.0.0" } } @@ -23,7 +23,7 @@ repositories { } dependencies { - implementation 'com.marklogic:marklogic-client-api:8.2-SNAPSHOT' + implementation 'com.marklogic:marklogic-client-api:8.0.0' } tasks.register("testFullPath", com.marklogic.client.tools.gradle.EndpointProxiesGenTask) {