Description of the patch:
This update for apache-commons-configuration2, apache-commons-text fixes the following issues
- CVE-2026-45205: uncontrolled recursion leads to
StackOverflowError when processing specially crafted configuration
files (bsc#1265299).
Changes for apache-commons-configuration2:
- Upgrade to version 2.15.0:
- Disable include schemes http[s] by default, see
AbstractFileLocationStrategy
- Detect and avoid processing cycles in YAML input
(YAMLConfiguration) (bsc#1265299, CVE-2026-45205)
- Extend scheme validation to inner schemes of jar: URLs
- Add XMLConfiguration.read(Element)
- Add ConfigurationException.ConfigurationException(String,
Object...)
- Add ConfigurationException.ConfigurationException(Throwable,
String, Object...)
- Add ConversionException.ConversionException(String, Object...)
- Add ConversionException.ConversionException(Throwable, String,
- Add ConfigurationRuntimeException
.ConfigurationRuntimeException(Throwable, String, Object...)
- Fix Apache RAT plugin console warnings
- Migrate from deprecated APIs
- Add org.apache.commons.configuration2.ImmutableConfiguration
.entrySet()
.forEach(BiConsumer<String, Object>)
- Add VEX entry for CVE-2025-48924
- Shared primitive variable 'throwExceptionOnMissing' in one
thread may not yield the value of the most recent write from
another thread [org.apache.commons.configuration2
.AbstractConfiguration] At AbstractConfiguration.java:
[line 1493] AT_STALE_THREAD_WRITE_OF_PRIMITIVE
- Shared primitive variable 'forceSingleLine' in one thread may
not yield the value of the most recent write from another
thread [org.apache.commons.configuration2
.PropertiesConfigurationLayout]
At PropertiesConfigurationLayout.java:[line 821]
AT_STALE_THREAD_WRITE_OF_PRIMITIVE
- CONFIGURATION-849: Fix undoubling of strings
- CONFIGURATION-852: Mark the package jakarta.servlet.* import
as optional in OSGi
- Fix build [WARNING] Parameter 'forkMode' is...