What the developer wrote
Authored by Craig Raw
upgrade thumbnailator to v0.4.21
What changed, and why it matters
This commit updates the image-resizing library Thumbnailator from version 0.4.18 to 0.4.21 and removes a manual module configuration for it. The newer version likely fixes bugs or security issues in the older library, but the commit message does not say what those issues are. Without a public advisory, we can only guess that this is a routine dependency update that may address security problems.
Verify the Thumbnailator 0.4.21 release notes for any CVEs fixed since 0.4.18, confirm the removed module-info block is no longer needed, and run dependency vulnerability scans. Treat this as a potentially security-relevant maintenance update rather than a confirmed critical fix.
Security signals we found
Dependency version bump of a library that processes untrusted image files
Removal of manual module-info workaround, consistent with upstream metadata fix
No CVE, advisory, or security rationale provided in commit message
Evidence from the diff
The change bumps net.coobird:thumbnailator from 0.4.18 to 0.4.21 in build.gradle and removes an extraJavaModuleInfo block that manually exported the thumbnailator package and required java.desktop. The removal suggests the newer release provides its own module metadata, making the manual workaround unnecessary. Thumbnailator is used for image thumbnail generation; older versions can be affected by image-parsing vulnerabilities. The commit itself does not identify a CVE or specific flaw.
Changed components
build.gradle dependency net.coobird:thumbnailatorextraJavaModuleInfo module definition for thumbnailatorInspect captured patch +1 / −5
diff --git a/build.gradle b/build.gradle
index c4314f4..e3c2b97 100644
--- a/build.gradle
+++ b/build.gradle
@@ -105,7 +105,7 @@ dependencies {
implementation('org.apache.commons:commons-compress:1.28.0')
implementation('com.github.librepdf:openpdf:1.3.43')
implementation('com.googlecode.lanterna:lanterna:3.1.3')
- implementation('net.coobird:thumbnailator:0.4.18')
+ implementation('net.coobird:thumbnailator:0.4.21')
implementation('com.github.hervegirod:fxsvgimage:1.1')
implementation('com.sparrowwallet:toucan:0.9.0')
implementation('com.jcraft:jzlib:1.1.3')
@@ -461,10 +461,6 @@ extraJavaModuleInfo {
exports('co.nstant.in.cbor.model')
exports('co.nstant.in.cbor.builder')
}
- module('net.coobird:thumbnailator', 'net.coobird.thumbnailator') {
- exports('net.coobird.thumbnailator')
- requires('java.desktop')
- }
module('org.jcommander:jcommander', 'org.jcommander') {
exports('com.beust.jcommander')
}
Why this scored 46/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.