Backport develop commits to support/2.0 for the 2.0.3 release - #8039
Open
JinwooHwang wants to merge 11 commits into
Open
Backport develop commits to support/2.0 for the 2.0.3 release#8039JinwooHwang wants to merge 11 commits into
JinwooHwang wants to merge 11 commits into
Conversation
Partial backport of [GEODE-10592] Remediation of CVE-2026-40984 (apache#8018), commit 9780122 on develop. Only the micrometer dependency bump is taken. The rest of that commit does not apply to support/2.0: - GitHub Actions version pinning (checkout@v4.2.2, setup-java@v4.7.1) targets develop's workflow files, which have diverged on this branch. - The shiro 2.2.1 -> 2.1.0 change reverted apache#8017; support/2.0 is already at 2.1.0, so it is a no-op here. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Remediation of CVE-2026-54428 * CI build failure (cherry picked from commit e3cb1f0)
* feature/GEODE-10589 * CI build failure (cherry picked from commit 48fe054)
Upgrades shiro 2.1.0 -> 3.0.0 and slf4j-api 2.0.17 -> 2.0.18. (cherry picked from commit d284679) Conflicts were resolved to take only the two dependency changes this commit is about. The following develop-only drift that appeared in the conflict regions was deliberately NOT taken, as it is unrelated to this CVE and support/2.0 pins these intentionally: - bouncycastle 1.84 (develop is on 1.85; pinned here by GEODE-10583) - log4j 2.25.4 (develop is on 2.25.5) - jetty 12.0.33 (develop is on 12.0.37) - snakeyaml 2.3 (develop is on 2.5) Two upstream defects in the original commit were also not carried over; both were corrected on develop by [GEODE-10609] (apache#8035): - a corrupted fixture line, "jetty-io-1git 2.0.37.jar" - jul-to-slf4j listed as 2.0.18, which the build does not actually resolve; it remains 2.0.17 here Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…p.converter.ServerSerializableObjectHttpMessageConverter (apache#8024) * Removal of org.apache.geode.management.internal.web.http.converter.ServerSerializableObjectHttpMessageConverter * codeql warning * autobuild for go * These changes allow gfsh to perform complex MBean queries over HTTP without requiring the insecure SerializableObjectHttpMessageConverter in the request body, maintaining the project's security posture while restoring full JMX remoting functionality. * formatting fix * Delete .github/workflows/codeql.yml * restored codeql.yml * restored codeql.yml * Delete .mvn/wrapper/maven-wrapper.jar * Delete .mvn/wrapper/maven-wrapper.properties * restored codeql.yml (cherry picked from commit b37841a)
…ingObjectInputStream (apache#8025) * Secure JMX query expression deserialization via ValidatingObjectInputStream * fix formatting * license (cherry picked from commit 5fcca74)
Remediation of SNYK-JAVA-ORGAPACHELOGGINGLOG4J-17954276 (cherry picked from commit 4e02b54)
Bumps bouncycastle 1.84 -> 1.85. (cherry picked from commit 98d461e) Applied after apache#8033, so the fixture and DependencyConstraints conflict regions carried this commit's older context (shiro 2.1.0, slf4j 2.0.17). Only the bouncycastle bump was taken; shiro 3.0.0 and slf4j 2.0.18 from apache#8033 are preserved. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Bumps jetty 12.0.33 -> 12.0.37, which transitively brings asm 9.9.1 -> 9.10.1. (cherry picked from commit b507bd3) Applied after apache#8032/apache#8033, so the two classpath fixtures conflicted on this commit's older context (shiro 2.1.0, slf4j 2.0.17, bcprov reordering). Only the jetty and asm changes were taken; shiro 3.0.0, slf4j 2.0.18, bcprov 1.85 and snakeyaml 2.3 are preserved. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* GEODE-10610 gfsh - list member failure * :geode-assembly:integrationTest BundledJarsJUnitTest. verifyBundledJarsHaveNotChanged and GfshDependencyJarIntegrationTest. verifyManifestClassPath (cherry picked from commit 621c3d3)
The workflow was failing at startup on support/2.0, so no build, unitTest, integrationTest, acceptanceTest or distributedTest job ran at all. Takes develop's version of .github/workflows/gradle.yml verbatim except for the push/pull_request branch filters, which stay on support/2.0. This picks up the action SHA pinning introduced upstream by [GEODE-10593] (apache#8019) and [GEODE-10597] (apache#8023): actions/checkout v3 -> 3d3c42e5aac5ba805825da76410c181273ba90b1 actions/setup-java v3 -> 03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 actions/upload-artifact v4 -> 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a gradle/actions/setup-gradle v5 -> 0723195856401067f7a2779048b490ace7a47d7c Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backports 10 commits from
developtosupport/2.0for the 2.0.3 release.Security remediations (dependency upgrades)