From efaeef8cbdfddbb08e6ce27c32ab1bbbc9d63c36 Mon Sep 17 00:00:00 2001
From: Daniel Radeau <daniel.radeau.ext@culture.gouv.fr>
Date: Tue, 22 Sep 2026 15:48:34 +0200
Subject: [PATCH] Story #16471: update droid to 6.9.14

Droid 6.8.0 is the last source of known vulnerabilities in the dependency
tree: it depends on commons-lang 2.6 (CVE-2025-48924) and commons-configuration
1.10 (CVE-2025-46392), two end-of-life branches with no upstream fix. Droid
6.9.14 moves to commons-lang3 and commons-configuration2, which clears both.

No source change is needed: the droid API sedalib relies on is unchanged, and
the DROID_SignatureFile / container-signature resources are runtime data
independent of the droid version.

Two side effects of the bump are handled in sedalib:

  - jwat-common 1.2.1 brings bcprov-jdk15to18 1.65, another end-of-life
    bouncycastle branch carrying eleven CVEs including one critical. It is
    excluded, like bcprov-jdk15on already was, in favour of bcprov-jdk18on.

  - droid-core-interfaces 6.9 added S3 profile support, dragging in the AWS
    SDK v2 and, through netty-nio-client, netty. It declares eight artifacts
    of the software.amazon.awssdk group, so the whole group is excluded:
    excluding s3 alone still left netty 4.1.137.Final reachable through sso,
    carrying seven high-severity CVEs. Sedatools only identifies files on the
    local filesystem, so none of it is used. This brings the resip shaded jar
    down from 84.1 MB to 68.7 MB.

Droid 6.9 ships class file version 65, so this cannot be merged before the
Java 21 migration. It also builds on the bouncycastle pin and the
bcprov-jdk18on replacement introduced by the dependency update.
---
 pom.xml         |  2 +-
 sedalib/pom.xml | 19 ++++++++++++++++---
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/pom.xml b/pom.xml
index 9fae352a..2da4f6e6 100644
--- a/pom.xml
+++ b/pom.xml
@@ -29,7 +29,7 @@
         <!--    For HTML manipulation-->
         <jsoup.version>1.23.2</jsoup.version>
         <!--    For format identification (DROID from the UK National Archives)-->
-        <droid.version>6.8.0</droid.version>
+        <droid.version>6.9.14</droid.version>
         <droidjaxb-impl.version>2.3.8</droidjaxb-impl.version>
         <!--    For Windows shortcut manipulation TODO: exotic library to replace-->
         <mslinks.version>1.0.6.2</mslinks.version>
diff --git a/sedalib/pom.xml b/sedalib/pom.xml
index 5aa134a4..a13c7770 100644
--- a/sedalib/pom.xml
+++ b/sedalib/pom.xml
@@ -44,13 +44,26 @@
                     <groupId>org.apache.logging.log4j</groupId>
                     <artifactId>log4j-slf4j2-impl</artifactId>
                 </exclusion>
-                <!--bcprov-jdk15on is an end-of-life branch stuck on 1.68 with unpatched CVEs.
-                    truevfs-comp-zip only needs the org.bouncycastle.crypto classes, which the
-                    maintained bcprov-jdk18on artifact provides under the same package names.-->
+                <!--bcprov-jdk15on and bcprov-jdk15to18 are end-of-life branches stuck on old
+                    versions with unpatched CVEs. truevfs-comp-zip and jwat-common only need the
+                    org.bouncycastle classes, which the maintained bcprov-jdk18on artifact provides
+                    under the same package names.-->
                 <exclusion>
                     <groupId>org.bouncycastle</groupId>
                     <artifactId>bcprov-jdk15on</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>org.bouncycastle</groupId>
+                    <artifactId>bcprov-jdk15to18</artifactId>
+                </exclusion>
+                <!--Droid 6.9 added S3 profile support, which drags in the whole AWS SDK and, through
+                    netty-nio-client, netty. droid-core-interfaces declares eight artifacts of that
+                    group, so excluding s3 alone left netty reachable through sso. Sedatools only
+                    identifies files on the local filesystem, so the whole group is kept out.-->
+                <exclusion>
+                    <groupId>software.amazon.awssdk</groupId>
+                    <artifactId>*</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
         <!--Replacement for the excluded, end-of-life bcprov-jdk15on needed by truevfs-comp-zip-->