fix: bump org.json:json to 20231013 (CVE-2023-5072) - #41

Automated dependency fix — CVE-2023-5072

Package: org.json:json 20090211 → 20231013
Severity: high
Lane: advised-bump

Assessment

• Exploitability: An attacker who can supply JSON input to the application can trigger a stack overflow / OOM via crafted nested structures, causing denial of service.
• Business impact: Successful exploitation causes application crashes or unavailability, disrupting any service that parses untrusted JSON with this library.
• Confidence: 0.95
• Rationale: This is a well-documented CVE in a direct dependency marked reachable, with a very old installed version (20090211) and a clear fixed version (20231013) available, making it a high-confidence auto-remediation candidate. Severity is high rather than critical since impact is DoS, not RCE, and EPSS is modest.

Advisory

• Breaking-change risk: medium
• Bump org.json:json from 20090211 to 20231013 to fix CVE-2023-5072 (parser DoS via nested JSON). Because the installed version is ~14 years old, minor API/behavior differences are possible, so verify JSON parsing code paths — but this is the vendor's fixed release and the minimal change that resolves the vulnerability.

Validation

• Patched branch installs, but the test suite fails.

Opened by the vulnerability management platform after human approval.