From 97ae7b832b735292b2241630c93cba21a694d99a Mon Sep 17 00:00:00 2001
From: Slava Rudkovskiy <xraskolx@gmail.com>
Date: Tue, 20 Oct 2026 10:40:51 +0300
Subject: [PATCH 1/2] upgrade XMLDSig dependencies and address critical CVEs

---
 .github/dependabot.yml                        | 20 +++++++++
 .../workflows/netlicensing-client-release.yml |  6 +--
 .github/workflows/netlicesning-client-ci.yml  |  6 +--
 NetLicensingClient-demo/pom.xml               |  2 +-
 NetLicensingClient/pom.xml                    | 44 +++++++++++++++++++
 .../util/XMLDSigValidatorCustom.java          | 11 +++--
 .../util/XMLDSigValidatorCustomTest.java      | 26 +++++++++++
 pom.xml                                       | 43 +++++++++++++-----
 8 files changed, 131 insertions(+), 27 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..b10422c8
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,20 @@
+version: 2
+updates:
+  - package-ecosystem: maven
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      java-dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/netlicensing-client-release.yml b/.github/workflows/netlicensing-client-release.yml
index 0c84d477..305b89ce 100644
--- a/.github/workflows/netlicensing-client-release.yml
+++ b/.github/workflows/netlicensing-client-release.yml
@@ -19,12 +19,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        java-version: [11, 17]
+        java-version: [17]
         include:
-          - java-version: 11
-            jdk-suffix:
           - java-version: 17
-            jdk-suffix: -jdk17
+            jdk-suffix:
 
     steps:
     - name: Install required tooling
diff --git a/.github/workflows/netlicesning-client-ci.yml b/.github/workflows/netlicesning-client-ci.yml
index 169930e1..b683a089 100644
--- a/.github/workflows/netlicesning-client-ci.yml
+++ b/.github/workflows/netlicesning-client-ci.yml
@@ -26,12 +26,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        java-version: [11, 17]
+        java-version: [17]
         include:
-          - java-version: 11
-            jdk-suffix: ""
           - java-version: 17
-            jdk-suffix: -jdk17
+            jdk-suffix: ""
 
 
     steps:
diff --git a/NetLicensingClient-demo/pom.xml b/NetLicensingClient-demo/pom.xml
index 8fd68e23..79f4d159 100644
--- a/NetLicensingClient-demo/pom.xml
+++ b/NetLicensingClient-demo/pom.xml
@@ -52,7 +52,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-surefire-plugin</artifactId>
-                <version>3.0.0-M5</version>
+                <version>3.5.4</version>
                 <configuration>
                     <!-- Do not execute unit tests on build.
                          Unit tests in this project are used
diff --git a/NetLicensingClient/pom.xml b/NetLicensingClient/pom.xml
index 6c145843..4429f8db 100644
--- a/NetLicensingClient/pom.xml
+++ b/NetLicensingClient/pom.xml
@@ -157,6 +157,50 @@
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-pmd-plugin</artifactId>
             </plugin>
+            <plugin>
+                <groupId>org.jacoco</groupId>
+                <artifactId>jacoco-maven-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <goals>
+                            <goal>prepare-agent</goal>
+                        </goals>
+                    </execution>
+                    <execution>
+                        <id>xmldsig-coverage</id>
+                        <phase>verify</phase>
+                        <goals>
+                            <goal>report</goal>
+                            <goal>check</goal>
+                        </goals>
+                        <configuration>
+                            <includes>
+                                <include>com/labs64/netlicensing/util/XMLDSigValidatorCustom.class</include>
+                            </includes>
+                            <rules>
+                                <rule>
+                                    <element>CLASS</element>
+                                    <includes>
+                                        <include>com.labs64.netlicensing.util.XMLDSigValidatorCustom</include>
+                                    </includes>
+                                    <limits>
+                                        <limit>
+                                            <counter>LINE</counter>
+                                            <value>COVEREDRATIO</value>
+                                            <minimum>1.0</minimum>
+                                        </limit>
+                                        <limit>
+                                            <counter>BRANCH</counter>
+                                            <value>COVEREDRATIO</value>
+                                            <minimum>1.0</minimum>
+                                        </limit>
+                                    </limits>
+                                </rule>
+                            </rules>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
         </plugins>
     </build>
 </project>
diff --git a/NetLicensingClient/src/main/java/com/labs64/netlicensing/util/XMLDSigValidatorCustom.java b/NetLicensingClient/src/main/java/com/labs64/netlicensing/util/XMLDSigValidatorCustom.java
index a37771f1..24355a5a 100644
--- a/NetLicensingClient/src/main/java/com/labs64/netlicensing/util/XMLDSigValidatorCustom.java
+++ b/NetLicensingClient/src/main/java/com/labs64/netlicensing/util/XMLDSigValidatorCustom.java
@@ -2,7 +2,6 @@
 
 import java.security.Key;
 
-import javax.annotation.Nonnull;
 import javax.xml.crypto.KeySelector;
 import javax.xml.crypto.dsig.XMLSignature;
 import javax.xml.crypto.dsig.XMLSignatureException;
@@ -11,12 +10,12 @@
 import org.w3c.dom.Element;
 import org.w3c.dom.NodeList;
 
-import com.helger.commons.ValueEnforcer;
+import com.helger.base.enforce.ValueEnforcer;
 import com.helger.xmldsig.XMLDSigSetup;
 import com.helger.xmldsig.XMLDSigValidationResult;
 import com.helger.xmldsig.XMLDSigValidator;
 
-public class XMLDSigValidatorCustom {
+public final class XMLDSigValidatorCustom {
 
     private XMLDSigValidatorCustom() {
     }
@@ -26,7 +25,7 @@ private XMLDSigValidatorCustom() {
      * @param aDoc document to be verified
      * @return true if Document contains XML signature
      */
-    public static boolean containsSignature(@Nonnull final Document aDoc) {
+    public static boolean containsSignature(final Document aDoc) {
         return XMLDSigValidator.containsSignature(aDoc);
     }
 
@@ -36,7 +35,7 @@ public static boolean containsSignature(@Nonnull final Document aDoc) {
      * @return XMLDSig validation result
      * @throws XMLSignatureException
      */
-    public static XMLDSigValidationResult validateSignature(@Nonnull final Document aDoc)
+    public static XMLDSigValidationResult validateSignature(final Document aDoc)
             throws XMLSignatureException {
         return validateSignature(aDoc, null);
     }
@@ -47,7 +46,7 @@ public static XMLDSigValidationResult validateSignature(@Nonnull final Document
      * @return XMLDSig validation result
      * @throws XMLSignatureException
      */
-    public static XMLDSigValidationResult validateSignature(@Nonnull final Document aDoc, final Key aKey)
+    public static XMLDSigValidationResult validateSignature(final Document aDoc, final Key aKey)
             throws XMLSignatureException {
         ValueEnforcer.notNull(aDoc, "Document");
 
diff --git a/NetLicensingClient/src/test/java/com/labs64/netlicensing/util/XMLDSigValidatorCustomTest.java b/NetLicensingClient/src/test/java/com/labs64/netlicensing/util/XMLDSigValidatorCustomTest.java
index 3e62e714..c8420d58 100644
--- a/NetLicensingClient/src/test/java/com/labs64/netlicensing/util/XMLDSigValidatorCustomTest.java
+++ b/NetLicensingClient/src/test/java/com/labs64/netlicensing/util/XMLDSigValidatorCustomTest.java
@@ -13,18 +13,22 @@
 package com.labs64.netlicensing.util;
 
 import java.io.InputStream;
+import java.lang.reflect.Constructor;
 import java.nio.charset.StandardCharsets;
 import java.security.PublicKey;
 
+import javax.xml.crypto.dsig.XMLSignature;
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
 
 import org.apache.commons.io.IOUtils;
 import org.junit.jupiter.api.Test;
 import org.w3c.dom.Document;
+import org.w3c.dom.Element;
 
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 public final class XMLDSigValidatorCustomTest {
@@ -44,10 +48,32 @@ private static Document loadXmlDocument(final String fileName) throws Exception
     return aDoc;
   }
 
+  @Test
+  public void testUtilityClassConstructor() throws Exception {
+    final Constructor<XMLDSigValidatorCustom> constructor = XMLDSigValidatorCustom.class.getDeclaredConstructor();
+    constructor.setAccessible(true);
+    assertNotNull(constructor.newInstance());
+  }
+
+  @Test
+  public void testNullDocument() {
+    assertThrows(NullPointerException.class, () -> XMLDSigValidatorCustom.validateSignature(null));
+  }
+
   @Test
   public void testNotSignedXml() throws Exception {
     final Document aDoc = loadXmlDocument("xmldsig/xml-not-signed.xml");
     assertFalse(XMLDSigValidatorCustom.containsSignature(aDoc));
+    assertThrows(IllegalArgumentException.class, () -> XMLDSigValidatorCustom.validateSignature(aDoc));
+  }
+
+  @Test
+  public void testMultipleSignaturesAreRejected() throws Exception {
+    final Document aDoc = loadXmlDocument("xmldsig/xml-signed-inline-01.xml");
+    final Element signature = (Element) aDoc.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature").item(0);
+    aDoc.getDocumentElement().appendChild(signature.cloneNode(true));
+
+    assertThrows(IllegalArgumentException.class, () -> XMLDSigValidatorCustom.validateSignature(aDoc));
   }
 
   @Test
diff --git a/pom.xml b/pom.xml
index 02138d6b..22457042 100644
--- a/pom.xml
+++ b/pom.xml
@@ -70,24 +70,28 @@
         <project.title>${project.name}</project.title>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 
-        <java.version>11</java.version>
+        <java.version>17</java.version>
         <maven.version>3.6.0</maven.version>
 
         <repo.releases.url>OVERRIDE_REPO_URL</repo.releases.url>
         <repo.snapshots.url>OVERRIDE_REPO_URL</repo.snapshots.url>
 
         <!-- dependency.version>0.0.0</dependency.version -->
-        <commons-lang3.version>3.18.0</commons-lang3.version> <!-- https://commons.apache.org/ -->
-        <commons-collections4.version>4.4</commons-collections4.version>
-        <commons-io.version>2.15.1</commons-io.version>
-        <commons-cli.version>1.6.0</commons-cli.version>
-        <commons-text.version>1.11.0</commons-text.version>
-        <junit-jupiter.version>5.10.2</junit-jupiter.version>
-        <jersey.version>3.1.5</jersey.version> <!-- https://projects.eclipse.org/projects/ee4j.jersey -->
-        <jaxb-api.version>4.0.0</jaxb-api.version> <!-- https://jakarta.ee/specifications/xml-binding/4.0/ -->
-        <jaxb-impl.version>4.0.3</jaxb-impl.version> <!-- https://projects.eclipse.org/projects/ee4j.jaxb-impl -->
-        <ph-xmldsig.version>5.0.2</ph-xmldsig.version>
-        <slf4j.version>2.0.13</slf4j.version>
+        <commons-lang3.version>3.21.0</commons-lang3.version> <!-- https://commons.apache.org/ -->
+        <commons-collections4.version>4.6.0</commons-collections4.version>
+        <commons-io.version>2.22.0</commons-io.version>
+        <commons-cli.version>1.11.0</commons-cli.version>
+        <commons-text.version>1.15.0</commons-text.version>
+        <junit-jupiter.version>6.1.3</junit-jupiter.version>
+        <jersey.version>4.0.3</jersey.version> <!-- https://projects.eclipse.org/projects/ee4j.jersey -->
+        <jaxb-api.version>4.0.5</jaxb-api.version> <!-- https://jakarta.ee/specifications/xml-binding/4.0/ -->
+        <jaxb-impl.version>4.0.9</jaxb-impl.version> <!-- https://projects.eclipse.org/projects/ee4j.jaxb-impl -->
+        <ph-xmldsig.version>6.1.0</ph-xmldsig.version>
+        <!-- ph-xmldsig 6.1.0 manages Bouncy Castle 1.82. Override it because the
+             security fixes required by this client are only complete in 1.86. -->
+        <bouncycastle.version>1.86</bouncycastle.version>
+        <slf4j.version>2.0.20</slf4j.version>
+        <jacoco-maven-plugin.version>0.8.14</jacoco-maven-plugin.version>
 
         <!-- plugin.version>0.0.0</plugin.version -->
         <maven-enforcer-plugin.version>3.0.0</maven-enforcer-plugin.version>
@@ -351,6 +355,11 @@
                     <artifactId>maven-scm-plugin</artifactId>
                     <version>${maven-scm-plugin.version}</version>
                 </plugin>
+                <plugin>
+                    <groupId>org.jacoco</groupId>
+                    <artifactId>jacoco-maven-plugin</artifactId>
+                    <version>${jacoco-maven-plugin.version}</version>
+                </plugin>
             </plugins>
         </pluginManagement>
 
@@ -449,6 +458,16 @@
                 <artifactId>ph-xmldsig</artifactId>
                 <version>${ph-xmldsig.version}</version>
             </dependency>
+            <dependency>
+                <groupId>org.bouncycastle</groupId>
+                <artifactId>bcprov-jdk18on</artifactId>
+                <version>${bouncycastle.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.bouncycastle</groupId>
+                <artifactId>bcpkix-jdk18on</artifactId>
+                <version>${bouncycastle.version}</version>
+            </dependency>
             <!-- com.helger.ph-xmldsig is using slf4j, use NOP provider for testing / demo -->
             <dependency>
                 <groupId>org.slf4j</groupId>

From 6853b73a77b4980fb2600d8c89c87d7bfce24498 Mon Sep 17 00:00:00 2001
From: Slava Rudkovskiy <xraskolx@gmail.com>
Date: Tue, 20 Oct 2026 10:52:17 +0300
Subject: [PATCH 2/2] complete migration to Java 17

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 22457042..27202ae2 100644
--- a/pom.xml
+++ b/pom.xml
@@ -168,7 +168,7 @@
                     <!--https://stackoverflow.com/questions/15886209/maven-is-not-working-in-java-8-when-javadoc-tags-are-incomplete-->
                     <configuration>
                         <doclint>none</doclint>
-                        <source>11</source>
+                        <source>${java.version}</source>
                     </configuration>
                 </plugin>
                 <plugin>