[Snyk] Upgrade commons-logging:commons-logging from 1.0.4 to 1.3.6 by karencapiiro · Pull Request #15 · Rashdamada/WebGoat

karencapiiro · 2026-04-28T03:45:06Z

Snyk has created this PR to upgrade commons-logging:commons-logging from 1.0.4 to 1.3.6.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 12 versions ahead of your current version.
The recommended version was released 2 months ago.

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Important

Check the changes in this PR to ensure they won't cause issues with your project.
This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

📜 Customise PR templates

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade commons-logging:commons-logging from 1.0.4 to 1.3.6. See this package in maven: commons-logging:commons-logging See this project in Snyk: https://app.snyk.io/org/apiiro-snyk/project/327b76ff-10d3-4b11-87a0-cfc9b3390d14?utm_source=github&utm_medium=referral&page=upgrade-pr

karencapiiro · 2026-04-28T03:45:07Z

This upgrade spans a significant number of releases, from version 1.0.4 to 1.3.6. The most critical change is the introduction of a minimum Java version requirement.

Key Changes:

Java Version Requirement: Starting from version 1.3.0, commons-logging requires Java 8 or later. The previous version 1.2 required Java 6, and the starting version 1.0.4 is from an even earlier era.
Deprecated and Disabled Loggers: Several logger implementations for older frameworks have been deprecated and disabled in version 1.3.0, including Jdk13LumberjackLogger, Log4JLogger, AvalonLogger, and LogKitLogger. If your application was configured to use these specific implementations, it will no longer work.
API Deprecations: The LogConfigurationException.cause field has been deprecated in favor of the getCause() method.

Recommendation:
The primary risk is environmental. Verify that your application is running on Java 8 or a later version before applying this upgrade.

Source: Apache Commons Logging Release Notes

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

socket-security · 2026-04-28T03:45:32Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	commons-logging/commons-logging@1.0.4 ⏵ 1.3.6	^-24

View full report

karencapiiro · 2026-04-28T03:46:33Z

Checkmarx One – Scan Summary & Details – 913ba017-306a-46fe-9e2b-75f78c4cd682

New Issues (608)

Checkmarx found the following issues in this Pull Request

#	Issue	Source File / Package	Checkmarx Insight
1	Command_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/CommandInjection.java: 71	Attack Vector
2	Command_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/CommandInjection.java: 71	Attack Vector
3	Command_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/Challenge2Screen.java: 641	Attack Vector
4	Command_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/Challenge2Screen.java: 641	Attack Vector
5	Command_Injection	webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 581	Attack Vector
6	SQL_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/MaliciousFileExecution.java: 421	Attack Vector
7	SQL_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/Challenge2Screen.java: 797	Attack Vector
8	SQL_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 104	Attack Vector
9	SQL_Injection	webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674	Attack Vector
10	SQL_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/MaliciousFileExecution.java: 421	Attack Vector
11	SQL_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/SQLInjection/Login.java: 235	Attack Vector
12	SQL_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/BackDoors.java: 131	Attack Vector
13	SQL_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/SqlStringInjection.java: 203	Attack Vector
14	SQL_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/SQLInjection/ViewProfile.java: 192	Attack Vector
15	SQL_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/SqlModifyData.java: 166	Attack Vector
16	SQL_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 153	Attack Vector
17	SQL_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/WsSqlInjection.java: 161	Attack Vector
18	SQL_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/BackDoors.java: 164	Attack Vector
19	SQL_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/BackDoors.java: 131	Attack Vector
20	SQL_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/admin/ViewDatabase.java: 68	Attack Vector
21	SQL_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/SQLInjection/ViewProfile.java: 65	Attack Vector
22	SQL_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/SqlNumericInjection.java: 98	Attack Vector
23	SQL_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/DOS_Login.java: 85	Attack Vector
24	SQL_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/DOS_Login.java: 85	Attack Vector
25	SQL_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/SQLInjection/Login.java: 70	Attack Vector
26	SQL_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/BlindStringSqlInjection.java: 80	Attack Vector
27	SQL_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/BlindNumericSqlInjection.java: 80	Attack Vector
28	SQL_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/DOS_Login.java: 86	Attack Vector
29	SQL_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/SqlAddData.java: 148	Attack Vector
30	SQL_Injection	webgoat/src/main/java/org/owasp/webgoat/lessons/ThreadSafetyProblem.java: 80	Attack Vector
31	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/SqlNumericInjection.java: 263	Attack Vector
32	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/Challenge2Screen.java: 221	Attack Vector
33	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/Challenge2Screen.java: 221	Attack Vector
34	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java: 312	Attack Vector
35	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java: 312	Attack Vector
36	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java: 231	Attack Vector
37	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/StoredXss.java: 332	Attack Vector
38	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 198	Attack Vector
39	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 198	Attack Vector
40	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/PathBasedAccessControl.java: 80	Attack Vector
41	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/LessonAdapter.java: 178	Attack Vector
42	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/CSRF.java: 235	Attack Vector
43	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 198	Attack Vector
44	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 198	Attack Vector
45	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 198	Attack Vector
46	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 198	Attack Vector
47	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 198	Attack Vector
48	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 198	Attack Vector
49	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 198	Attack Vector
50	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 198	Attack Vector
51	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 198	Attack Vector
52	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 198	Attack Vector
53	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 198	Attack Vector
54	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 198	Attack Vector
55	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 198	Attack Vector
56	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 198	Attack Vector
57	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/SessionFixation.java: 641	Attack Vector
58	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/MultiLevelLogin2.java: 539	Attack Vector
59	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/MultiLevelLogin1.java: 628	Attack Vector
60	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/MultiLevelLogin1.java: 628	Attack Vector
61	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/MultiLevelLogin1.java: 628	Attack Vector
62	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/SessionFixation.java: 641	Attack Vector
63	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/SessionFixation.java: 641	Attack Vector
64	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 198	Attack Vector
65	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 198	Attack Vector
66	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/BackDoors.java: 180	Attack Vector
67	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/MultiLevelLogin2.java: 539	Attack Vector
68	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/MultiLevelLogin2.java: 539	Attack Vector
69	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/InsecureLogin.java: 447	Attack Vector
70	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/InsecureLogin.java: 447	Attack Vector
71	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/InsecureLogin.java: 447	Attack Vector
72	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/PathBasedAccessControl.java: 178	Attack Vector
73	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/BackDoors.java: 180	Attack Vector
74	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/BackDoors.java: 180	Attack Vector
75	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/BlindScript.java: 165	Attack Vector
76	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/BackDoors.java: 180	Attack Vector
77	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/BackDoors.java: 180	Attack Vector
78	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/BackDoors.java: 180	Attack Vector
79	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/BackDoors.java: 180	Attack Vector
80	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/BackDoors.java: 180	Attack Vector
81	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/BackDoors.java: 180	Attack Vector
82	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/BackDoors.java: 180	Attack Vector
83	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/MaliciousFileExecution.java: 150	Attack Vector
84	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/BackDoors.java: 148	Attack Vector
85	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/BackDoors.java: 148	Attack Vector
86	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/BackDoors.java: 148	Attack Vector
87	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/BackDoors.java: 148	Attack Vector
88	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/BackDoors.java: 148	Attack Vector
89	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/BackDoors.java: 148	Attack Vector
90	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/BackDoors.java: 148	Attack Vector
91	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/BackDoors.java: 148	Attack Vector
92	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/CSRF.java: 290	Attack Vector
93	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/BackDoors.java: 148	Attack Vector
94	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/BackDoors.java: 148	Attack Vector
95	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/CSRF.java: 290	Attack Vector
96	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/CSRF.java: 290	Attack Vector
97	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/CSRF.java: 290	Attack Vector
98	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/StoredXss.java: 218	Attack Vector
99	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/StoredXss.java: 218	Attack Vector
100	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/StoredXss.java: 218	Attack Vector
101	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/WSDLScanning.java: 154	Attack Vector
102	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/LessonAdapter.java: 88	Attack Vector
103	Stored_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/StoredXss.java: 218	Attack Vector
104	Connection_String_Injection	webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
105	Improper_Restriction_of_XXE_Ref	webgoat/src/main/java/org/owasp/webgoat/lessons/WsSAXInjection.java: 133	Attack Vector
106	Reflected_XSS	webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 1060	Attack Vector
107	Reflected_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/SessionFixation.java: 144	Attack Vector
108	Reflected_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/SessionFixation.java: 144	Attack Vector
109	Reflected_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/SessionFixation.java: 144	Attack Vector
110	Reflected_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/ClientSideValidation.java: 191	Attack Vector
111	Reflected_XSS	webgoat/src/main/java/org/owasp/webgoat/lessons/Challenge2Screen.java: 793	Attack Vector

More results are available on the CxOne platform

Communicate with Checkmarx by submitting a PR comment with @Checkmarx followed by one of the supported commands. Learn about the supported commands here.

Navigation Menu

Uh oh!

[Snyk] Upgrade commons-logging:commons-logging from 1.0.4 to 1.3.6 - #15

[Snyk] Upgrade commons-logging:commons-logging from 1.0.4 to 1.3.6#15
karencapiiro wants to merge 1 commit into
masterfrom
snyk-upgrade-20430283ba07abc0fc6d89fdb0430c59

karencapiiro commented Apr 28, 2026

Uh oh!

karencapiiro commented Apr 28, 2026

Uh oh!

socket-security Bot commented Apr 28, 2026

Uh oh!

karencapiiro commented Apr 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

karencapiiro commented Apr 28, 2026

Snyk has created this PR to upgrade commons-logging:commons-logging from 1.0.4 to 1.3.6.

Breaking Change Risk

Uh oh!

karencapiiro commented Apr 28, 2026

Uh oh!

socket-security Bot commented Apr 28, 2026

Uh oh!

karencapiiro commented Apr 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants