fix(deps): update dependency org.mozilla:rhino to v1.7.14.1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.mozilla:rhino (source)	1.7.13 → 1.7.14.1

---

Rhino has high CPU usage and potential DoS when passing specific numbers to toFixed() function

CVE-2025-66453 / GHSA-3w8q-xq97-5j7x

More information

Details

When an application passed an attacker controlled float poing number into the toFixed() function, it might lead to high CPU consumption and a potential Denial of Service.

Small numbers go through this call stack: NativeNumber.numTo > DToA.JS_dtostr > DToA.JS_dtoa > DToA.pow5mult
where pow5mult attempts to raise 5 to a ridiculous power.

Example code: (4.47118444E-314).toFixed(2)

Severity

• CVSS Score: 2.7 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

• https://github.com/mozilla/rhino/security/advisories/GHSA-3w8q-xq97-5j7x
• https://nvd.nist.gov/vuln/detail/CVE-2025-66453
• https://github.com/mozilla/rhino/commit/2bcf4c43deace35f1f57d86377c6767b0608986e
• https://github.com/mozilla/rhino

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

mozilla/rhino (org.mozilla:rhino)

v1.7.14.1

December 2, 2025

These releases fix a bug in the code that formats floating-point numbers into strings
that could result in very bad performance in some cases.

We recommend that all users of Rhino upgrade to release 1.8.1 if possible,
and upgrade to Java 17 or 21.

Users who need an older release, or who cannot yet leave Java 8, can also
use 1.7.15.1 or 1.7.14.1.

v1.7.14

December 2, 2025

These releases fix a bug in the code that formats floating-point numbers into strings
that could result in very bad performance in some cases.

We recommend that all users of Rhino upgrade to release 1.8.1 if possible,
and upgrade to Java 17 or 21.

Users who need an older release, or who cannot yet leave Java 8, can also
use 1.7.15.1 or 1.7.14.1.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Test Results

18 tests   - 636   18 ✅  - 636   7s ⏱️ - 2m 29s
 3 suites  - 105    0 💤 ±  0 
 3 files    - 105    0 ❌ ±  0 

Results for commit 2f7f43c. ± Comparison against base commit e72e766.

This pull request removes 636 tests.

com.mirth.commons.encryption.test.DigesterTest ‑ testArgon2d
com.mirth.commons.encryption.test.DigesterTest ‑ testArgon2i
com.mirth.commons.encryption.test.DigesterTest ‑ testArgon2id
com.mirth.commons.encryption.test.DigesterTest ‑ testFallback1
com.mirth.commons.encryption.test.DigesterTest ‑ testFallback2
com.mirth.commons.encryption.test.DigesterTest ‑ testFallback3
com.mirth.commons.encryption.test.DigesterTest ‑ testFallback4
com.mirth.commons.encryption.test.DigesterTest ‑ testPBKDF2
com.mirth.commons.encryption.test.DigesterTest ‑ testSHA256
com.mirth.commons.encryption.test.EncryptionTest ‑ testDigest
…

[tonygermano]

Build failed. Several code changes/improvements are required before a rhino upgrade is possible. I plan on opening some PRs to address upgrading rhino. I would like to get it to the point where the library can be upgraded without code changes, though there are probably some api breaking changes coming soon.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (1.7.14.1). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.