[Copilot]

Releases version 6.9.0 and fixes a critical deserialization RCE in SnakeYAML (affects all versions ≤ 1.33).

Changes

• Version bump: 6.6.0 → 6.9.0 across all 17 pom.xml files
• Security fix: org.yaml:snakeyaml 1.32 → 2.0 in jeddict-lib/pom.xml

<!-- jeddict-lib/pom.xml -->
<dependency>
    <groupId>org.yaml</groupId>
    <artifactId>snakeyaml</artifactId>
    <version>2.0</version> <!-- was 1.32, vulnerable to Constructor deserialization RCE -->
</dependency>

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• www.netbeans.org
  • Triggering command: /opt/hostedtoolcache/CodeQL/2.24.3/x64/codeql/tools/linux64/java/bin/java /opt/hostedtoolcache/CodeQL/2.24.3/x64/codeql/tools/linux64/java/bin/java -jar /opt/hostedtoolcache/CodeQL/2.24.3/x64/codeql/xml/tools/xml-extractor.jar --fileList=/tmp/codeql-scratch-fdd66e05bc544768/dbs/java/working/files-to-index17210108835039738109.list --sourceArchiveDir=/tmp/codeql-scratch-fdd66e05bc544768/dbs/java/src --outputDir=/tmp/codeql-scratch-fdd66e05bc544768/dbs/java/trap/java (dns block)
  • Triggering command: /opt/hostedtoolcache/CodeQL/2.24.3/x64/codeql/tools/linux64/java/bin/java /opt/hostedtoolcache/CodeQL/2.24.3/x64/codeql/tools/linux64/java/bin/java -jar /opt/hostedtoolcache/CodeQL/2.24.3/x64/codeql/xml/tools/xml-extractor.jar --fileList=/tmp/codeql-scratch-fdd66e05bc544768/dbs/java/working/files-to-index10208509791684232161.list --sourceArchiveDir=/tmp/codeql-scratch-fdd66e05bc544768/dbs/java/src --outputDir=/tmp/codeql-scratch-fdd66e05bc544768/dbs/java/trap/java -e /home/dependabot/bin/test -e s/,/_/g 3667662e test ity_�� (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.