Repository navigation
Update shipped libraries with known vulnerabilities (4/4) - #129
Open
miguelnieto wants to merge 4 commits into
Open
miguelnieto wants to merge 4 commits into
miguelnieto wants to merge 4 commits into
Conversation
This was referenced Nov 7, 2026
BREAKING: requires MAT 1.17.0+ and Java 21. org.eclipse.mat.api 1.17.0 declares Bundle-RequiredExecutionEnvironment: JavaSE-21, so the execution environment cannot go lower. Users on older MAT must stay on 1.6.x. Platform - Target platform moved from Eclipse 2022-12 to Eclipse 4.40, matching the Eclipse release MAT 1.17.0 builds against. - MAT bundles come from the MAT 1.17.0 update site rather than an Eclipse simultaneous release, so the MAT API version matches the MAT users run. Only the units this plugin needs are listed; the full org.eclipse.mat.feature.feature.group would drag in mat.chart and therefore BIRT and Rhino, which are unused. - Java 21: BREE, executionEnvironment, compiler source/target, CI matrix, README requirements. Calcite 1.36 -> 1.42.0 - Aligned Calcite/Guava versions between MatCalcitePlugin/pom.xml and MatCalciteTargetPlatform.target (Guava 33.7.2-jre in both, after Renovate updated the pom only). They had drifted apart (1.41.0 vs 1.36.0) because Renovate only updates poms, not Tycho target definitions. - Avatica 1.29.0 instead of the 1.28.0 Calcite 1.42.0 asks for: Avatica before 1.29.0 has CVE-2026-70410 (unsafe reflection in plugin instantiation, CVSS 8.8). Declared before calcite-core so Maven compiles against the Jackson 2.22.2 it brings, which the target ships. - Added httpclient5/httpcore5 (new Avatica 1.28 dependencies) and org.jooq:joou-java-6 to the target platform and to Import-Package. Without them: NoClassDefFoundError for org/apache/hc/core5/util/Timeout and org/joou/UInteger. - Excluded jakarta.transaction:jakarta.transaction-api from commons-dbcp2: it has an unsatisfiable Import-Package (javax.enterprise.context) and blocked geronimo-jta_1.1_spec from supplying javax.transaction. ORDER BY and joins on heap objects - Calcite 1.37+ sorts Map-typed values with Functions.compareMaps(), which calls entrySet(); HeapReference is a Map only for this['field'] and threw from entrySet(), so every ORDER BY over a heap object failed. entrySet() now returns one entry that orders like compareTo. - Calcite sorts merge-join inputs through entrySet() but merges them with compareTo, so both must give the same order, or matches are dropped (the class/class loader join counted 469 instead of 985). Both now order by address, which is also constant time: ordering by label rebuilt the label on every comparison (ORDER BY this on 4M objects: about 2 min vs 10 s). ORDER BY toString(this) gives label order. SQL functions - getHexAddress(x): the object address as 0x..., as MAT shows it. - getDominator(x) returned an error for objects dominated by the virtual root; it now returns null. Tests - testStackTraces tolerates MAT's own stack frame formatting, which changed in MAT commit 0c72944e ("Bug 581644"): "(Native Method)" became "(Object.java(Native Method))". - New: ORDER BY this in both directions, a merge join over a strict subset, the class/class loader join phrased three ways (985 each). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…r, date functions Editor - Right-click menu (Run, Explain, Undo/Redo, Cut/Copy/Paste, Delete, Select All, Toggle Comment); keys are workbench commands in their own context, so F5, Ctrl+Enter and Ctrl+Space no longer go to MAT's OQL commands. - Schema browser beside the editor: classes by package, instanceof, thread stacks and functions, with columns and sizes; double-click inserts the name, quoted where SQL needs it. The filter is debounced and uses cached sorted names. - "SQL Reference" tab; theme colors (with dark theme defaults); completion pops up after '.' and '"'; object icons in results; navigation history restores and reruns a query. - Error underline at the right place for a selection and for Explain, and cleared on the next run. Cancel in the progress view and closing the tab stop a running query (QueryCancellation, checked by the heap scan). - Fixes: keys lost after a table result on GTK/Wayland (no active shell), editor scroll jump on a transient resize, Undo/Redo keys, leaked title image and colors, closed-tab cleanup, debug output on stdout. Open in SQL Editor - On MAT's object menus: a query for the selected objects (by address, one statement per class) or for a class row (all instances, or the row's objects for a partial histogram), added to the SQL tab of the objects' own dump. SQL - Date and time functions: toDateTime, toEpochMillis, millisToDateTime, secondsToDateTime, toDuration. - instanceof."java.lang.ref.Reference" (full class name as one identifier); identifiers quoted by Calcite's reserved words, not only SQL-92's. - CALCITE-1.42-QUERIES.md: what Calcite 1.37-1.42 adds to heap queries. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
MemoryAnalyzer -nosplash -application MatCalcitePlugin.mcp serves the Model Context Protocol on stdio (JSON-RPC with json-smart, already bundled; no new dependencies). Dumps stay open between calls. Tools - Dumps and schema: open/list/close, list_tables, describe_table. - SQL: sql_query (markdown, row limit), explain_sql, sql_reference, export_query (CSV, no row limit). - Per object, as on MAT's context menu: object_info, list_references, retained_set, path_to_gc_roots, immediate_dominators; mat_query for other MAT commands. - Analyses: heap_overview, histogram, leak_suspects (as data: class loader, accumulation point, path from a GC root, thread stack locals), compare_dumps, collection_contents, duplicate_strings, wasteful_collections. Cancellation - notifications/cancelled, cancel_query and timeout_seconds. A flag per call (QueryCancellation), never Thread.interrupt: MAT reads its indexes through a FileChannel, which an interrupt closes for good. A cancelled open deletes the index files it created. Security - The assistant reads heap contents, which can hold text written to steer it. mat_query refuses commands that read or write files, open other dumps or run reports; export_query writes .csv only inside the export directory (MAT_MCP_EXPORT_DIR or the dump's), atomically, with formula cells defused. Slow regular expressions in histogram filters stop on timeout. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The update site bundled versions with published CVEs, which security scanners flag: - httpclient5 5.5 -> 5.6.5: CVE-2026-71290 (CVSS 9.1, async client skips the TLS hostname check), CVE-2026-64607 - jackson-core 2.22.2 -> 2.22.4: CVE-2026-89407, CVE-2026-89425 (7.5) - commons-lang3 3.1 -> 3.21.0 (Calcite gets 3.1 through uzaygezen-core 0.2): CVE-2025-48924 - json-smart, accessors-smart 2.6.0 -> 2.6.1: CVE-2026-113602 Guava's CVE-2026-102554 (NVD 8.2) is already fixed by 33.7.2-jre, which main has since Renovate's update and vlsi#121 aligns in the target. httpcore5 in the target moves to 5.4.4 to match httpclient5 5.6.5; MAT provides httpcore5 at runtime. Pinned in both MatCalcitePlugin/pom.xml and the target definition; the target takes the highest version of each library, so the old versions no longer ship. Only jackson-core is reachable from the plugin (Calcite's JSON functions). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
miguelnieto
force-pushed
the
04_security-updates
branch
from
November 7, 2026 21:51
a21b538 to
b867ece
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Updates the third-party libraries the plugin's update site ships that have published vulnerabilities, so that security scanners stop flagging the plugin.
Updates
uzaygezen-core0.2mainalready has 33.7.2-jre, which fixes CVE-2026-102554 (NVD 8.2), and Upgrade to MAT 1.17.0, Java 21, Eclipse 4.40 and Calcite 1.42.0 (1/4) #121 sets the same version in the target.MatCalcitePlugin/pom.xmland the target definition, which must stay in sync.What the plugin can actually reach. Of these, only jackson-core is reachable from the plugin's code paths, through Calcite's JSON SQL functions applied to heap strings, and only as a denial of service. The rest:
Scanners flag all of them by version anyway.
Libraries that appear in the Maven dependency tree but aren't shipped, such as jackson-databind and httpcore5, are left alone in this PR.
Testing
./mvnw verifywith JDK 21: 101 tests pass, 1 skipped (@Ignoreonmaintoo).🤖 Generated with Claude Code