fix(security): remove repackaged dot.commons-io dependency (CVE-2024-47554)

[dsilvam]

Proposed Changes

• Remove the com.dotcms.lib:dot.commons-io:2.0.1_2 dependency from dotCMS/pom.xml.
• Remove its dependencyManagement entry from bom/application/pom.xml.

This eliminates dot.commons-io-2.0.1_2.jar — a namespace-shaded copy of Apache Commons IO 2.0.1 (com.dotcms.repackage.org.apache.commons.io.*) that still contains the vulnerable XmlStreamReader, causing OWASP Dependency Check to flag CVE-2024-47554. The standard commons-io:commons-io:2.14.0 (already on the classpath, bumped in #35236) covers all real usage. Completes the outstanding commons-io action item from #35235.

No code migration was required: nothing in the repo imports the shaded namespace (verified across source, other com.dotcms.lib repackaged jars via bytecode scan, and OSGi/Felix export config — 0 references), and the shaded jar has 0 class overlap with commons-io:commons-io:2.14.0, so removing it cannot break the modern library.

Checklist

• Tests — ./mvnw install -pl :dotcms-core --am -DskipTests BUILD SUCCESS; verified dot.commons-io-*.jar gone from assembled webapp and commons-io-2.14.0.jar retained; local runtime smoke test (startup + navigation) clean
• Translations — n/a
• Security Implications Contemplated — removes a jar flagged for CVE-2024-47554 (CVSS 4.3, CWE-400). Residual risk: reflective use of the shaded namespace by a custom OSGi plugin — none found in-repo; smoke-tested commons-io-heavy paths.

Additional Info

• Closes Remove repackaged dot.commons-io dependency (CVE-2024-47554 follow-up to #35235) #36739
• Origin: fix(security): Upgrade vulnerable dependencies flagged by OWASP Dependency Check #35235 (OKR: Security & Privacy); related PRs fix(security): upgrade vulnerable dependencies and add OWASP suppressions #35236 (commons-io bump) and refactor(deps): remove dot.guava repackaged dependency #35315 (analogous dot.guava removal)
• Reported via support ticket 36256
• Backport: needs cherry-pick to the LTS lines that ship the flagged jar — confirm 24.07 / 24.12 / 25.07 coverage.

🤖 Generated with Claude Code

[claude]

Claude finished @dsilvam's task in 38s —— View job

---

Review: PR #36740 — remove repackaged dot.commons-io (CVE-2024-47554)

• Read PR diff
• Verify no source imports the shaded com.dotcms.repackage.org.apache.commons.io namespace
• Verify commons-io:commons-io is still on the classpath
• Check OSGi/Felix export config for the shaded namespace
• Post review

I independently verified each claim in the PR description against the current branch:

Claim	Verification	Result
Nothing imports the shaded namespace	grep com.dotcms.repackage.org.apache.commons.io across repo	✅ 0 references
Modern lib remains on classpath	commons-io:commons-io still declared in dotCMS/pom.xml:600 + managed in bom/application/pom.xml:700 (v2.14.0)	✅ retained
No OSGi/Felix export of the shaded namespace	grep felix configs + .properties for repackage.org.apache.commons.io	✅ none found
Removes only the flagged jar	Diff deletes only the dependencyManagement entry (bom/application/pom.xml) and the <dependency> (dotCMS/pom.xml)	✅ scoped

Both removals are consistent: the dotCMS/pom.xml dependency relied on the version supplied by the dependencyManagement entry, and both are removed together. The change matches the dotCMS convention that version coordinates live in bom/application/pom.xml.

New Issues

No issues found.

The diff is a clean dependency removal. My verification agrees with the description — no code migration is needed, and the modern commons-io:commons-io:2.14.0 covers real usage.

One note (non-blocking, already flagged by the author): the description mentions a required cherry-pick to the LTS lines (24.07 / 24.12 / 25.07) that ship the flagged jar. Worth confirming those backports land so the CVE finding clears there too.
• dsilvam/FD-36256

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request