From ddeb474f3f7340329b313657c1f93bbc705b2fb4 Mon Sep 17 00:00:00 2001
From: Arnab Nandy <arnab_nandy7@yahoo.com>
Date: Fri, 23 Oct 2026 00:12:46 +0530
Subject: [PATCH] Fix: restore Shell 4 management and pin patched JLine and
 Junrar

Refs #97

Signed-off-by: Arnab Nandy <arnab_nandy7@yahoo.com>
---
 embabel-build-dependencies/pom.xml | 24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/embabel-build-dependencies/pom.xml b/embabel-build-dependencies/pom.xml
index de5bd31..9f6443d 100644
--- a/embabel-build-dependencies/pom.xml
+++ b/embabel-build-dependencies/pom.xml
@@ -47,8 +47,9 @@
         <!-- AsciiTable -->
         <asciitable.version>0.3.2</asciitable.version>
         <!-- Spring Shell -->
-        <spring-shell-starter.version>3.4.0</spring-shell-starter.version>
-        <!-- ReDoS fix: GHSA-r2xf-8xr9-62gw (Spring Shell 3.4.0 ships JLine 3.27.x) -->
+        <spring-shell.version>4.0.3</spring-shell.version>
+        <!-- GHSA-r2xf-8xr9-62gw is fixed in JLine 3.30.15.
+             Override Spring Shell 4.0.3's JLine 3.30.13, including separately resolved builtins. -->
         <jline.version>3.30.15</jline.version>
         <!-- OpenAPI -->
         <springdoc-openapi.version>2.8.5</springdoc-openapi.version>
@@ -59,6 +60,8 @@
         <bouncy-castle.version>1.85.2</bouncy-castle.version>
         <!-- Apache Tika -->
         <tika.version>3.3.0</tika.version>
+        <!-- GHSA-h9h9-2rmf-rvhp: override Tika's vulnerable Junrar dependency. -->
+        <junrar.version>7.6.1</junrar.version>
         <!-- jsoup security override for Tika's transitive dependency -->
         <jsoup.version>1.23.2</jsoup.version>
         <!-- Netty BOM -->
@@ -188,13 +191,23 @@
             <dependency>
                 <groupId>org.springframework.shell</groupId>
                 <artifactId>spring-shell-starter</artifactId>
-                <version>${spring-shell-starter.version}</version>
+                <version>${spring-shell.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.springframework.shell</groupId>
+                <artifactId>spring-shell-jline</artifactId>
+                <version>${spring-shell.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.jline</groupId>
                 <artifactId>jline</artifactId>
                 <version>${jline.version}</version>
             </dependency>
+            <dependency>
+                <groupId>org.jline</groupId>
+                <artifactId>jline-builtins</artifactId>
+                <version>${jline.version}</version>
+            </dependency>
 
             <!-- Kotlin Coroutines BOM -->
             <dependency>
@@ -346,6 +359,11 @@
                 <artifactId>tika-parsers-standard-package</artifactId>
                 <version>${tika.version}</version>
             </dependency>
+            <dependency>
+                <groupId>com.github.junrar</groupId>
+                <artifactId>junrar</artifactId>
+                <version>${junrar.version}</version>
+            </dependency>
 
             <!-- Override Tika's jsoup dependency for GHSA-65r4-943x-97jj.
                  Revisit upon upgrading Tika to 4.1.0. -->