Bump JEXL version from jexl-3.0 to jexl-3.3#1033
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the Apache Commons JEXL dependency version from 3.0 to 3.3 in pom.xml. The reviewer correctly highlights that this upgrade introduces a breaking change starting in JEXL 3.2, where restricted permissions are applied by default. To prevent runtime failures in existing expressions, it is recommended to configure the JexlBuilder in EL.java with appropriate permissions, such as UNRESTRICTED or a custom safe set.
| <commons-io.version>2.16.1</commons-io.version> | ||
| <commons-csv.version>1.4</commons-csv.version> | ||
| <commons-jexl.version>3.0</commons-jexl.version> | ||
| <commons-jexl.version>3.3</commons-jexl.version> |
There was a problem hiding this comment.
Upgrading Apache Commons JEXL from 3.0 to 3.3 introduces a major breaking change regarding security permissions. Starting in JEXL 3.2, JEXL uses restricted permissions (JexlPermissions.RESTRICTED) by default if none are explicitly configured on the JexlBuilder. This will block access to many standard Java classes, packages, and methods in existing user expressions, leading to runtime JexlException failures. To prevent breaking existing pipelines and maintain backward compatibility, you must configure the JexlBuilder in EL.java (line 84) to use appropriate permissions, such as .permissions(org.apache.commons.jexl3.introspection.JexlPermissions.UNRESTRICTED) or define a safe, custom set of permissions.
1 participant
This PR is for quick testing of version upgrade.