From 5a297141d3afb1ccc95d78a95ed54ef34a94eff2 Mon Sep 17 00:00:00 2001 From: JinwooHwang Date: Mon, 24 Aug 2026 10:00:09 -0400 Subject: [PATCH 01/12] GEODE-10592: Upgrade micrometer from 1.14.0 to 1.15.12 Partial backport of [GEODE-10592] Remediation of CVE-2026-40984 (#8018), commit 978012290cb09e90c1d2adbb00801adc440965d3 on develop. Only the micrometer dependency bump is taken. The rest of that commit does not apply to support/2.0: - GitHub Actions version pinning (checkout@v4.2.2, setup-java@v4.7.1) targets develop's workflow files, which have diverged on this branch. - The shiro 2.2.1 -> 2.1.0 change reverted #8017; support/2.0 is already at 2.1.0, so it is a no-op here. Co-Authored-By: Claude Opus 5 (1M context) --- boms/geode-all-bom/src/test/resources/expected-pom.xml | 2 +- .../geode/gradle/plugins/DependencyConstraints.groovy | 2 +- .../src/integrationTest/resources/assembly_content.txt | 6 +++--- .../integrationTest/resources/gfsh_dependency_classpath.txt | 6 +++--- .../src/integrationTest/resources/dependency_classpath.txt | 6 +++--- 5 files changed, 11 insertions(+), 11 deletions(-) diff --git a/boms/geode-all-bom/src/test/resources/expected-pom.xml b/boms/geode-all-bom/src/test/resources/expected-pom.xml index 65f6a24015d..a161a145562 100644 --- a/boms/geode-all-bom/src/test/resources/expected-pom.xml +++ b/boms/geode-all-bom/src/test/resources/expected-pom.xml @@ -195,7 +195,7 @@ io.micrometer micrometer-core - 1.14.0 + 1.15.12 io.swagger.core.v3 diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy index d71e6717bad..891da783118 100644 --- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy +++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy @@ -48,7 +48,7 @@ class DependencyConstraints { deps.put("jgroups.version", "3.6.20.Final") deps.put("log4j.version", "2.25.4") deps.put("log4j-slf4j2-impl.version", "2.23.1") - deps.put("micrometer.version", "1.14.0") + deps.put("micrometer.version", "1.15.12") deps.put("shiro.version", "2.1.0") // GEODE-10583: Pin Bouncy Castle (transitive via shiro-crypto-hash) to a fixed version deps.put("bouncycastle.version", "1.84") diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index c769db89d0e..eaa2153faed 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -1022,9 +1022,9 @@ lib/lucene-analysis-phonetic-9.12.3.jar lib/lucene-core-9.12.3.jar lib/lucene-queries-9.12.3.jar lib/lucene-queryparser-9.12.3.jar -lib/micrometer-commons-1.14.0.jar -lib/micrometer-core-1.14.0.jar -lib/micrometer-observation-1.14.0.jar +lib/micrometer-commons-1.15.12.jar +lib/micrometer-core-1.15.12.jar +lib/micrometer-observation-1.15.12.jar lib/mx4j-3.0.2.jar lib/mx4j-remote-3.0.2.jar lib/mx4j-tools-3.0.1.jar diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index b39d44afd5e..520d00ad46a 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -75,7 +75,7 @@ commons-digester-2.1.jar commons-io-2.19.0.jar commons-logging-1.3.5.jar classgraph-4.8.147.jar -micrometer-core-1.14.0.jar +micrometer-core-1.15.12.jar HdrHistogram-2.2.2.jar fastutil-8.5.8.jar jakarta.resource-api-2.1.0.jar @@ -115,9 +115,9 @@ jul-to-slf4j-2.0.17.jar jetty-jndi-12.0.33.jar jetty-util-12.0.33.jar slf4j-api-2.0.17.jar -micrometer-observation-1.14.0.jar +micrometer-observation-1.15.12.jar spring-jcl-6.1.21.jar -micrometer-commons-1.14.0.jar +micrometer-commons-1.15.12.jar LatencyUtils-2.0.3.jar reactor-core-3.6.10.jar jline-console-3.26.3.jar diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index 6b665995a61..a0cf1c1d617 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -46,7 +46,7 @@ spring-shell-standard-commands-3.3.3.jar spring-shell-standard-3.3.3.jar spring-shell-core-3.3.3.jar commons-io-2.19.0.jar -micrometer-core-1.14.0.jar +micrometer-core-1.15.12.jar jakarta.resource-api-2.1.0.jar jetty-ee10-annotations-12.0.33.jar spring-boot-starter-validation-3.3.13.jar @@ -115,8 +115,8 @@ jetty-util-12.0.33.jar spring-boot-starter-logging-3.3.13.jar jul-to-slf4j-2.0.17.jar slf4j-api-2.0.17.jar -micrometer-observation-1.14.0.jar -micrometer-commons-1.14.0.jar +micrometer-observation-1.15.12.jar +micrometer-commons-1.15.12.jar LatencyUtils-2.0.3.jar snakeyaml-2.3.jar spring-jcl-6.1.21.jar From bfde6d63ee6f8ade051f200da956e4057dc713cc Mon Sep 17 00:00:00 2001 From: Jinwoo Hwang <92374539+JinwooHwang@users.noreply.github.com> Date: Tue, 28 Jul 2026 14:10:26 -0400 Subject: [PATCH 02/12] [GEODE-10590] Remediation of CVE-2026-54428 (#8016) * Remediation of CVE-2026-54428 * CI build failure (cherry picked from commit e3cb1f02a2fa35456053a43036a8961f99fd1292) --- .../apache/geode/gradle/plugins/DependencyConstraints.groovy | 4 ++-- .../src/integrationTest/resources/assembly_content.txt | 4 ++-- .../integrationTest/resources/gfsh_dependency_classpath.txt | 4 ++-- .../src/integrationTest/resources/dependency_classpath.txt | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy index 891da783118..05963dba56d 100644 --- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy +++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy @@ -175,8 +175,8 @@ class DependencyConstraints { api(group: 'org.apache.derby', name: 'derby', version: '10.14.2.0') // Apache HttpComponents 5.x - Modern HTTP client with HTTP/2 support api(group: 'org.apache.httpcomponents.client5', name: 'httpclient5', version: '5.4.4') - api(group: 'org.apache.httpcomponents.core5', name: 'httpcore5', version: '5.3.6') - api(group: 'org.apache.httpcomponents.core5', name: 'httpcore5-h2', version: '5.3.6') + api(group: 'org.apache.httpcomponents.core5', name: 'httpcore5', version: '5.4.3') + api(group: 'org.apache.httpcomponents.core5', name: 'httpcore5-h2', version: '5.4.3') // Legacy HttpComponents 4.x (keep temporarily during migration, remove after complete) api(group: 'org.apache.httpcomponents', name: 'httpclient', version: '4.5.13') api(group: 'org.apache.httpcomponents', name: 'httpcore', version: '4.4.15') diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index eaa2153faed..1ebf0e3ec6d 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -961,8 +961,8 @@ lib/geode-wan-0.0.0.jar lib/gfsh-dependencies.jar lib/hibernate-validator-8.0.2.Final.jar lib/httpclient5-5.4.4.jar -lib/httpcore5-5.3.6.jar -lib/httpcore5-h2-5.3.6.jar +lib/httpcore5-5.4.3.jar +lib/httpcore5-h2-5.4.3.jar lib/istack-commons-runtime-4.1.1.jar lib/jackson-annotations-2.21.jar lib/jackson-core-2.21.2.jar diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index 520d00ad46a..6b7f8c2de5b 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -60,8 +60,8 @@ lucene-queryparser-9.12.3.jar lucene-queries-9.12.3.jar lucene-core-9.12.3.jar httpclient5-5.4.4.jar -httpcore5-h2-5.3.6.jar -httpcore5-5.3.6.jar +httpcore5-h2-5.4.3.jar +httpcore5-5.4.3.jar HikariCP-4.0.3.jar antlr-2.7.7.jar istack-commons-runtime-4.1.1.jar diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index a0cf1c1d617..48ed6e9cb56 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -26,8 +26,8 @@ jackson-core-2.21.2.jar jackson-datatype-joda-2.21.2.jar jackson-databind-2.21.2.jar httpclient5-5.4.4.jar -httpcore5-h2-5.3.6.jar -httpcore5-5.3.6.jar +httpcore5-h2-5.4.3.jar +httpcore5-5.4.3.jar HikariCP-4.0.3.jar commons-lang3-3.18.0.jar jaxb-runtime-4.0.2.jar From a4521ba2385ae09e8f1e582050fdc7d168c4b9eb Mon Sep 17 00:00:00 2001 From: Jinwoo Hwang <92374539+JinwooHwang@users.noreply.github.com> Date: Tue, 28 Jul 2026 15:32:36 -0400 Subject: [PATCH 03/12] GEODE-10589 Remediation of GHSA-2m67-wjpj-xhg9 (#8015) * feature/GEODE-10589 * CI build failure (cherry picked from commit 48fe054b1ae148998f07187cc1ff354c8afa10f2) --- boms/geode-all-bom/src/test/resources/expected-pom.xml | 8 ++++---- .../geode/gradle/plugins/DependencyConstraints.groovy | 4 ++-- .../src/integrationTest/resources/assembly_content.txt | 10 +++++----- .../resources/gfsh_dependency_classpath.txt | 10 +++++----- .../integrationTest/resources/dependency_classpath.txt | 10 +++++----- 5 files changed, 21 insertions(+), 21 deletions(-) diff --git a/boms/geode-all-bom/src/test/resources/expected-pom.xml b/boms/geode-all-bom/src/test/resources/expected-pom.xml index a161a145562..8c9f5fa2492 100644 --- a/boms/geode-all-bom/src/test/resources/expected-pom.xml +++ b/boms/geode-all-bom/src/test/resources/expected-pom.xml @@ -475,22 +475,22 @@ com.fasterxml.jackson.core jackson-core - 2.21.2 + 2.21.5 com.fasterxml.jackson.core jackson-databind - 2.21.2 + 2.21.5 com.fasterxml.jackson.datatype jackson-datatype-joda - 2.21.2 + 2.21.5 com.fasterxml.jackson.datatype jackson-datatype-jsr310 - 2.21.2 + 2.21.5 com.jayway.jsonpath diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy index 05963dba56d..880bd185d16 100644 --- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy +++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy @@ -55,9 +55,9 @@ class DependencyConstraints { deps.put("slf4j-api.version", "2.0.17") deps.put("jakarta.transaction-api.version", "2.0.1") deps.put("jboss-modules.version", "1.11.0.Final") - deps.put("jackson.version", "2.21.2") + deps.put("jackson.version", "2.21.5") deps.put("jackson.annotations.version", "2.21") - deps.put("jackson.databind.version", "2.21.2") + deps.put("jackson.databind.version", "2.21.5") // Spring Framework 6.x Migration deps.put("springshell.version", "3.3.3") deps.put("springframework.version", "6.1.21") diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index 1ebf0e3ec6d..9a65366dba0 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -965,11 +965,11 @@ lib/httpcore5-5.4.3.jar lib/httpcore5-h2-5.4.3.jar lib/istack-commons-runtime-4.1.1.jar lib/jackson-annotations-2.21.jar -lib/jackson-core-2.21.2.jar -lib/jackson-databind-2.21.2.jar -lib/jackson-dataformat-yaml-2.21.2.jar -lib/jackson-datatype-joda-2.21.2.jar -lib/jackson-datatype-jsr310-2.21.2.jar +lib/jackson-core-2.21.5.jar +lib/jackson-databind-2.21.5.jar +lib/jackson-dataformat-yaml-2.21.5.jar +lib/jackson-datatype-joda-2.21.5.jar +lib/jackson-datatype-jsr310-2.21.5.jar lib/jakarta.activation-api-2.1.3.jar lib/jakarta.annotation-api-2.1.1.jar lib/jakarta.el-api-5.0.0.jar diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index 6b7f8c2de5b..80a6b43a2e5 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -21,12 +21,12 @@ spring-shell-starter-3.3.3.jar spring-web-6.1.21.jar commons-lang3-3.18.0.jar rmiio-2.1.2.jar -jackson-datatype-joda-2.21.2.jar +jackson-datatype-joda-2.21.5.jar jackson-annotations-2.21.jar -jackson-dataformat-yaml-2.21.2.jar -jackson-core-2.21.2.jar -jackson-datatype-jsr310-2.21.2.jar -jackson-databind-2.21.2.jar +jackson-dataformat-yaml-2.21.5.jar +jackson-core-2.21.5.jar +jackson-datatype-jsr310-2.21.5.jar +jackson-databind-2.21.5.jar swagger-annotations-2.2.22.jar jaxb-runtime-4.0.2.jar jaxb-core-4.0.2.jar diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index 48ed6e9cb56..de80b682ce4 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -19,12 +19,12 @@ geode-unsafe-0.0.0.jar geode-deployment-legacy-0.0.0.jar snappy-0.5.jar swagger-annotations-2.2.22.jar -jackson-datatype-jsr310-2.21.2.jar +jackson-datatype-jsr310-2.21.5.jar jackson-annotations-2.21.jar -jackson-dataformat-yaml-2.21.2.jar -jackson-core-2.21.2.jar -jackson-datatype-joda-2.21.2.jar -jackson-databind-2.21.2.jar +jackson-dataformat-yaml-2.21.5.jar +jackson-core-2.21.5.jar +jackson-datatype-joda-2.21.5.jar +jackson-databind-2.21.5.jar httpclient5-5.4.4.jar httpcore5-h2-5.4.3.jar httpcore5-5.4.3.jar From c1e9788e4b4cb9edbce540628c5a8fbf91ffe608 Mon Sep 17 00:00:00 2001 From: Jinwoo Hwang <92374539+JinwooHwang@users.noreply.github.com> Date: Fri, 7 Aug 2026 10:29:16 -0400 Subject: [PATCH 04/12] [GEODE-10607] Remediation of CVE-2026-49268 (#8033) Upgrades shiro 2.1.0 -> 3.0.0 and slf4j-api 2.0.17 -> 2.0.18. (cherry picked from commit d2846795019cdaa38a3f895610811f1e1874200e) Conflicts were resolved to take only the two dependency changes this commit is about. The following develop-only drift that appeared in the conflict regions was deliberately NOT taken, as it is unrelated to this CVE and support/2.0 pins these intentionally: - bouncycastle 1.84 (develop is on 1.85; pinned here by GEODE-10583) - log4j 2.25.4 (develop is on 2.25.5) - jetty 12.0.33 (develop is on 12.0.37) - snakeyaml 2.3 (develop is on 2.5) Two upstream defects in the original commit were also not carried over; both were corrected on develop by [GEODE-10609] (#8035): - a corrupted fixture line, "jetty-io-1git 2.0.37.jar" - jul-to-slf4j listed as 2.0.18, which the build does not actually resolve; it remains 2.0.17 here Co-Authored-By: Claude Opus 5 (1M context) --- .../src/test/resources/expected-pom.xml | 2 +- .../plugins/DependencyConstraints.groovy | 4 ++-- .../resources/assembly_content.txt | 24 +++++++++---------- .../resources/gfsh_dependency_classpath.txt | 24 +++++++++---------- .../resources/dependency_classpath.txt | 24 +++++++++---------- 5 files changed, 39 insertions(+), 39 deletions(-) diff --git a/boms/geode-all-bom/src/test/resources/expected-pom.xml b/boms/geode-all-bom/src/test/resources/expected-pom.xml index 8c9f5fa2492..e37bc8fb841 100644 --- a/boms/geode-all-bom/src/test/resources/expected-pom.xml +++ b/boms/geode-all-bom/src/test/resources/expected-pom.xml @@ -415,7 +415,7 @@ org.slf4j slf4j-api - 2.0.17 + 2.0.18 org.springframework.hateoas diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy index 880bd185d16..b1b211b2dfe 100644 --- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy +++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy @@ -49,10 +49,10 @@ class DependencyConstraints { deps.put("log4j.version", "2.25.4") deps.put("log4j-slf4j2-impl.version", "2.23.1") deps.put("micrometer.version", "1.15.12") - deps.put("shiro.version", "2.1.0") + deps.put("shiro.version", "3.0.0") // GEODE-10583: Pin Bouncy Castle (transitive via shiro-crypto-hash) to a fixed version deps.put("bouncycastle.version", "1.84") - deps.put("slf4j-api.version", "2.0.17") + deps.put("slf4j-api.version", "2.0.18") deps.put("jakarta.transaction-api.version", "2.0.1") deps.put("jboss-modules.version", "1.11.0.Final") deps.put("jackson.version", "2.21.5") diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index 9a65366dba0..61fc597c9d9 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -1032,18 +1032,18 @@ lib/ra.jar lib/reactive-streams-1.0.4.jar lib/reactor-core-3.6.10.jar lib/rmiio-2.1.2.jar -lib/shiro-cache-2.1.0.jar -lib/shiro-config-core-2.1.0.jar -lib/shiro-config-ogdl-2.1.0.jar -lib/shiro-core-2.1.0.jar -lib/shiro-crypto-cipher-2.1.0.jar -lib/shiro-crypto-core-2.1.0.jar -lib/shiro-crypto-hash-2.1.0.jar -lib/shiro-event-2.1.0.jar -lib/shiro-hashes-argon2-2.1.0.jar -lib/shiro-hashes-bcrypt-2.1.0.jar -lib/shiro-lang-2.1.0.jar -lib/slf4j-api-2.0.17.jar +lib/shiro-cache-3.0.0.jar +lib/shiro-config-core-3.0.0.jar +lib/shiro-config-ogdl-3.0.0.jar +lib/shiro-core-3.0.0.jar +lib/shiro-crypto-cipher-3.0.0.jar +lib/shiro-crypto-core-3.0.0.jar +lib/shiro-crypto-hash-3.0.0.jar +lib/shiro-event-3.0.0.jar +lib/shiro-hashes-argon2-3.0.0.jar +lib/shiro-hashes-bcrypt-3.0.0.jar +lib/shiro-lang-3.0.0.jar +lib/slf4j-api-2.0.18.jar lib/snakeyaml-2.3.jar lib/snappy-0.5.jar lib/spring-aop-6.1.21.jar diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index 80a6b43a2e5..3725735fef3 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -66,8 +66,8 @@ HikariCP-4.0.3.jar antlr-2.7.7.jar istack-commons-runtime-4.1.1.jar commons-validator-1.7.jar -shiro-core-2.1.0.jar -shiro-config-ogdl-2.1.0.jar +shiro-core-3.0.0.jar +shiro-config-ogdl-3.0.0.jar commons-beanutils-1.11.0.jar commons-codec-1.15.jar commons-collections-3.2.2.jar @@ -98,15 +98,15 @@ jetty-security-12.0.33.jar jetty-server-12.0.33.jar snappy-0.5.jar jgroups-3.6.20.Final.jar -shiro-cache-2.1.0.jar -shiro-crypto-hash-2.1.0.jar -shiro-crypto-cipher-2.1.0.jar -shiro-config-core-2.1.0.jar -shiro-event-2.1.0.jar -shiro-crypto-core-2.1.0.jar -shiro-lang-2.1.0.jar -shiro-hashes-argon2-2.1.0.jar -shiro-hashes-bcrypt-2.1.0.jar +shiro-cache-3.0.0.jar +shiro-crypto-hash-3.0.0.jar +shiro-crypto-cipher-3.0.0.jar +shiro-config-core-3.0.0.jar +shiro-event-3.0.0.jar +shiro-crypto-core-3.0.0.jar +shiro-lang-3.0.0.jar +shiro-hashes-argon2-3.0.0.jar +shiro-hashes-bcrypt-3.0.0.jar jetty-xml-12.0.33.jar jetty-http-12.0.33.jar jetty-io-12.0.33.jar @@ -114,7 +114,7 @@ spring-boot-starter-logging-3.3.13.jar jul-to-slf4j-2.0.17.jar jetty-jndi-12.0.33.jar jetty-util-12.0.33.jar -slf4j-api-2.0.17.jar +slf4j-api-2.0.18.jar micrometer-observation-1.15.12.jar spring-jcl-6.1.21.jar micrometer-commons-1.15.12.jar diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index de80b682ce4..4a11973139a 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -56,7 +56,7 @@ jakarta.enterprise.cdi-api-4.0.1.jar jakarta.interceptor-api-2.1.0.jar jakarta.annotation-api-2.1.1.jar jakarta.transaction-api-2.0.1.jar -shiro-core-2.1.0.jar +shiro-core-3.0.0.jar jgroups-3.6.20.Final.jar commons-validator-1.7.jar fastutil-8.5.8.jar @@ -82,7 +82,7 @@ lucene-analysis-common-9.12.3.jar lucene-queryparser-9.12.3.jar lucene-queries-9.12.3.jar lucene-core-9.12.3.jar -shiro-config-ogdl-2.1.0.jar +shiro-config-ogdl-3.0.0.jar commons-beanutils-1.11.0.jar commons-codec-1.15.jar commons-collections-3.2.2.jar @@ -98,15 +98,15 @@ jetty-session-12.0.33.jar jetty-plus-12.0.33.jar jetty-security-12.0.33.jar jetty-server-12.0.33.jar -shiro-cache-2.1.0.jar -shiro-hashes-argon2-2.1.0.jar -shiro-hashes-bcrypt-2.1.0.jar -shiro-crypto-hash-2.1.0.jar -shiro-crypto-cipher-2.1.0.jar -shiro-config-core-2.1.0.jar -shiro-event-2.1.0.jar -shiro-crypto-core-2.1.0.jar -shiro-lang-2.1.0.jar +shiro-cache-3.0.0.jar +shiro-hashes-argon2-3.0.0.jar +shiro-hashes-bcrypt-3.0.0.jar +shiro-crypto-hash-3.0.0.jar +shiro-crypto-cipher-3.0.0.jar +shiro-config-core-3.0.0.jar +shiro-event-3.0.0.jar +shiro-crypto-core-3.0.0.jar +shiro-lang-3.0.0.jar jetty-xml-12.0.33.jar jetty-http-12.0.33.jar jetty-io-12.0.33.jar @@ -114,7 +114,7 @@ jetty-jndi-12.0.33.jar jetty-util-12.0.33.jar spring-boot-starter-logging-3.3.13.jar jul-to-slf4j-2.0.17.jar -slf4j-api-2.0.17.jar +slf4j-api-2.0.18.jar micrometer-observation-1.15.12.jar micrometer-commons-1.15.12.jar LatencyUtils-2.0.3.jar From 3f13cc57bd7f12267a4042067c30164e247d3485 Mon Sep 17 00:00:00 2001 From: Jinwoo Hwang <92374539+JinwooHwang@users.noreply.github.com> Date: Fri, 31 Jul 2026 14:47:51 -0400 Subject: [PATCH 05/12] [GEODE-10598] Removal of org.apache.geode.management.internal.web.http.converter.ServerSerializableObjectHttpMessageConverter (#8024) * Removal of org.apache.geode.management.internal.web.http.converter.ServerSerializableObjectHttpMessageConverter * codeql warning * autobuild for go * These changes allow gfsh to perform complex MBean queries over HTTP without requiring the insecure SerializableObjectHttpMessageConverter in the request body, maintaining the project's security posture while restoring full JMX remoting functionality. * formatting fix * Delete .github/workflows/codeql.yml * restored codeql.yml * restored codeql.yml * Delete .mvn/wrapper/maven-wrapper.jar * Delete .mvn/wrapper/maven-wrapper.properties * restored codeql.yml (cherry picked from commit b37841adf071132a23dcd56eab2faee70d487a14) --- .../web/shell/HttpOperationInvoker.java | 10 ++++++++-- .../controllers/ShellCommandsController.java | 18 ++++++++++++------ .../main/webapp/WEB-INF/geode-mgmt-servlet.xml | 1 - 3 files changed, 20 insertions(+), 9 deletions(-) diff --git a/geode-gfsh/src/main/java/org/apache/geode/management/internal/web/shell/HttpOperationInvoker.java b/geode-gfsh/src/main/java/org/apache/geode/management/internal/web/shell/HttpOperationInvoker.java index bc70f5f4be6..c81202f1f82 100644 --- a/geode-gfsh/src/main/java/org/apache/geode/management/internal/web/shell/HttpOperationInvoker.java +++ b/geode-gfsh/src/main/java/org/apache/geode/management/internal/web/shell/HttpOperationInvoker.java @@ -17,6 +17,7 @@ import java.io.File; import java.io.IOException; import java.net.URI; +import java.util.Base64; import java.util.Properties; import java.util.Set; import java.util.concurrent.Executors; @@ -40,7 +41,6 @@ import org.apache.geode.management.internal.cli.CommandRequest; import org.apache.geode.management.internal.cli.shell.Gfsh; import org.apache.geode.management.internal.cli.shell.OperationInvoker; -import org.apache.geode.management.internal.web.domain.QueryParameterSource; import org.apache.geode.management.internal.web.http.support.HttpRequester; import org.apache.geode.management.internal.web.shell.support.HttpMBeanProxyFactory; @@ -383,8 +383,14 @@ public Object invoke(final String resourceName, final String operationName, fina public Set queryNames(final ObjectName objectName, final QueryExp queryExpression) { final URI link = HttpRequester.createURI(baseUrl, "/mbean/query"); - Object content = new QueryParameterSource(objectName, queryExpression); try { + final MultiValueMap content = new LinkedMultiValueMap(); + content.add("objectName", objectName.toString()); + if (queryExpression != null) { + content.add("queryExpression", + Base64.getEncoder().encodeToString(IOUtils.serializeObject(queryExpression))); + } + return (Set) IOUtils .deserializeObject(httpRequester.post(link, content, byte[].class)); } catch (Exception e) { diff --git a/geode-web/src/main/java/org/apache/geode/management/internal/web/controllers/ShellCommandsController.java b/geode-web/src/main/java/org/apache/geode/management/internal/web/controllers/ShellCommandsController.java index 3bc43a48e8d..8bb6cd8a2e0 100644 --- a/geode-web/src/main/java/org/apache/geode/management/internal/web/controllers/ShellCommandsController.java +++ b/geode-web/src/main/java/org/apache/geode/management/internal/web/controllers/ShellCommandsController.java @@ -20,6 +20,7 @@ import java.io.FileInputStream; import java.io.IOException; import java.nio.file.Path; +import java.util.Base64; import java.util.Optional; import java.util.Set; @@ -29,6 +30,7 @@ import javax.management.MBeanServer; import javax.management.MalformedObjectNameException; import javax.management.ObjectName; +import javax.management.QueryExp; import javax.management.ReflectionException; import org.apache.commons.io.FileUtils; @@ -39,7 +41,6 @@ import org.springframework.http.MediaType; import org.springframework.http.ResponseEntity; import org.springframework.stereotype.Controller; -import org.springframework.web.bind.annotation.RequestBody; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMethod; import org.springframework.web.bind.annotation.RequestParam; @@ -55,7 +56,6 @@ import org.apache.geode.management.internal.cli.result.model.ResultModel; import org.apache.geode.management.internal.cli.util.CommandStringBuilder; import org.apache.geode.management.internal.i18n.CliStrings; -import org.apache.geode.management.internal.web.domain.QueryParameterSource; import org.apache.geode.util.internal.GeodeConverter; /** @@ -162,11 +162,17 @@ public ResponseEntity invoke(@RequestParam("resourceName") final String resou } @RequestMapping(method = RequestMethod.POST, value = "/mbean/query") - public ResponseEntity queryNames(@RequestBody final QueryParameterSource query) - throws IOException { + public ResponseEntity queryNames(@RequestParam("objectName") final String objectName, + @RequestParam(value = "queryExpression", required = false) final String queryExpressionBase64) + throws Exception { // Exceptions are caught by the @ExceptionHandler AbstractCommandsController.handleAppException - final Set objectNames = - getMBeanServer().queryNames(query.getObjectName(), query.getQueryExpression()); + ObjectName name = ObjectName.getInstance(decode(objectName)); + QueryExp query = null; + if (queryExpressionBase64 != null) { + query = + (QueryExp) IOUtils.deserializeObject(Base64.getDecoder().decode(queryExpressionBase64)); + } + final Set objectNames = getMBeanServer().queryNames(name, query); return new ResponseEntity<>(IOUtils.serializeObject(objectNames), HttpStatus.OK); } diff --git a/geode-web/src/main/webapp/WEB-INF/geode-mgmt-servlet.xml b/geode-web/src/main/webapp/WEB-INF/geode-mgmt-servlet.xml index 0ea3261d606..e3c417a4595 100644 --- a/geode-web/src/main/webapp/WEB-INF/geode-mgmt-servlet.xml +++ b/geode-web/src/main/webapp/WEB-INF/geode-mgmt-servlet.xml @@ -48,7 +48,6 @@ limitations under the License. - From 7a1d0e778662b457e7a076e4912b79628be2a386 Mon Sep 17 00:00:00 2001 From: Jinwoo Hwang <92374539+JinwooHwang@users.noreply.github.com> Date: Mon, 3 Aug 2026 09:02:27 -0400 Subject: [PATCH 06/12] [GEODE-10599] Secure JMX query expression deserialization via ValidatingObjectInputStream (#8025) * Secure JMX query expression deserialization via ValidatingObjectInputStream * fix formatting * license (cherry picked from commit 5fcca74e1f4f713ccd22a18f25334c8bce6427fc) --- .../controllers/ShellCommandsController.java | 10 ++++- .../QueryExpDeserializationTest.java | 44 +++++++++++++++++++ 2 files changed, 52 insertions(+), 2 deletions(-) create mode 100644 geode-web/src/test/java/org/apache/geode/management/internal/web/controllers/QueryExpDeserializationTest.java diff --git a/geode-web/src/main/java/org/apache/geode/management/internal/web/controllers/ShellCommandsController.java b/geode-web/src/main/java/org/apache/geode/management/internal/web/controllers/ShellCommandsController.java index 8bb6cd8a2e0..5e194b19081 100644 --- a/geode-web/src/main/java/org/apache/geode/management/internal/web/controllers/ShellCommandsController.java +++ b/geode-web/src/main/java/org/apache/geode/management/internal/web/controllers/ShellCommandsController.java @@ -17,6 +17,7 @@ import static org.apache.commons.io.IOUtils.toInputStream; import static org.apache.geode.management.internal.web.util.UriUtils.decode; +import java.io.ByteArrayInputStream; import java.io.FileInputStream; import java.io.IOException; import java.nio.file.Path; @@ -34,6 +35,7 @@ import javax.management.ReflectionException; import org.apache.commons.io.FileUtils; +import org.apache.commons.io.serialization.ValidatingObjectInputStream; import org.apache.commons.lang3.ArrayUtils; import org.springframework.core.io.InputStreamResource; import org.springframework.http.HttpHeaders; @@ -169,8 +171,12 @@ public ResponseEntity queryNames(@RequestParam("objectName") final String obj ObjectName name = ObjectName.getInstance(decode(objectName)); QueryExp query = null; if (queryExpressionBase64 != null) { - query = - (QueryExp) IOUtils.deserializeObject(Base64.getDecoder().decode(queryExpressionBase64)); + byte[] decodedBytes = Base64.getDecoder().decode(queryExpressionBase64); + try (ValidatingObjectInputStream ois = + new ValidatingObjectInputStream(new ByteArrayInputStream(decodedBytes))) { + ois.accept("javax.management.*", "java.lang.*", "java.util.*"); + query = (QueryExp) ois.readObject(); + } } final Set objectNames = getMBeanServer().queryNames(name, query); return new ResponseEntity<>(IOUtils.serializeObject(objectNames), HttpStatus.OK); diff --git a/geode-web/src/test/java/org/apache/geode/management/internal/web/controllers/QueryExpDeserializationTest.java b/geode-web/src/test/java/org/apache/geode/management/internal/web/controllers/QueryExpDeserializationTest.java new file mode 100644 index 00000000000..763e45e6bff --- /dev/null +++ b/geode-web/src/test/java/org/apache/geode/management/internal/web/controllers/QueryExpDeserializationTest.java @@ -0,0 +1,44 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more contributor license + * agreements. See the NOTICE file distributed with this work for additional information regarding + * copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance with the License. You may obtain a + * copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software distributed under the License + * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express + * or implied. See the License for the specific language governing permissions and limitations under + * the License. + */ +package org.apache.geode.management.internal.web.controllers; + +import java.io.ByteArrayInputStream; +import java.io.ByteArrayOutputStream; +import java.io.ObjectOutputStream; + +import javax.management.Query; +import javax.management.QueryExp; + +import org.apache.commons.io.serialization.ValidatingObjectInputStream; +import org.junit.Test; + +public class QueryExpDeserializationTest { + @Test + public void testQueryExp() throws Exception { + QueryExp query = Query.eq(Query.attr("Name"), Query.value("mock")); + ByteArrayOutputStream baos = new ByteArrayOutputStream(); + ObjectOutputStream oos = new ObjectOutputStream(baos); + oos.writeObject(query); + oos.close(); + + byte[] decoded = baos.toByteArray(); + ValidatingObjectInputStream ois = + new ValidatingObjectInputStream(new ByteArrayInputStream(decoded)); + ois.accept("javax.management.*", "java.lang.*", "java.util.*"); + + QueryExp q = (QueryExp) ois.readObject(); + System.out.println(q); + } +} From 0ddb6f2b592e1bcf5c34d61e1a70588d1452f92c Mon Sep 17 00:00:00 2001 From: Jinwoo Hwang <92374539+JinwooHwang@users.noreply.github.com> Date: Thu, 6 Aug 2026 11:44:38 -0400 Subject: [PATCH 07/12] GEODE-10604 (#8030) Remediation of SNYK-JAVA-ORGAPACHELOGGINGLOG4J-17954276 (cherry picked from commit 4e02b54ac29fa050224c954538a0cb949dd462d6) --- boms/geode-all-bom/src/test/resources/expected-pom.xml | 10 +++++----- .../geode/gradle/plugins/DependencyConstraints.groovy | 2 +- .../gradle-test-projects/management/build.gradle | 2 +- .../src/integrationTest/resources/assembly_content.txt | 10 +++++----- .../resources/gfsh_dependency_classpath.txt | 10 +++++----- .../integrationTest/resources/dependency_classpath.txt | 10 +++++----- 6 files changed, 22 insertions(+), 22 deletions(-) diff --git a/boms/geode-all-bom/src/test/resources/expected-pom.xml b/boms/geode-all-bom/src/test/resources/expected-pom.xml index e37bc8fb841..ca41c043f52 100644 --- a/boms/geode-all-bom/src/test/resources/expected-pom.xml +++ b/boms/geode-all-bom/src/test/resources/expected-pom.xml @@ -530,27 +530,27 @@ org.apache.logging.log4j log4j-api - 2.25.4 + 2.25.5 org.apache.logging.log4j log4j-core - 2.25.4 + 2.25.5 org.apache.logging.log4j log4j-jcl - 2.25.4 + 2.25.5 org.apache.logging.log4j log4j-jul - 2.25.4 + 2.25.5 org.apache.logging.log4j log4j-slf4j-impl - 2.25.4 + 2.25.5 org.apache.lucene diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy index b1b211b2dfe..7be86d1fb34 100644 --- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy +++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy @@ -46,7 +46,7 @@ class DependencyConstraints { deps.put("jakarta.annotation.version", "2.1.1") deps.put("jakarta.ejb.version", "4.0.1") deps.put("jgroups.version", "3.6.20.Final") - deps.put("log4j.version", "2.25.4") + deps.put("log4j.version", "2.25.5") deps.put("log4j-slf4j2-impl.version", "2.23.1") deps.put("micrometer.version", "1.15.12") deps.put("shiro.version", "3.0.0") diff --git a/geode-assembly/src/acceptanceTest/resources/gradle-test-projects/management/build.gradle b/geode-assembly/src/acceptanceTest/resources/gradle-test-projects/management/build.gradle index a4e0645a450..7c0ca6a2a88 100644 --- a/geode-assembly/src/acceptanceTest/resources/gradle-test-projects/management/build.gradle +++ b/geode-assembly/src/acceptanceTest/resources/gradle-test-projects/management/build.gradle @@ -25,7 +25,7 @@ repositories { dependencies { implementation("${project.group}:geode-core:${project.version}") - runtimeOnly('org.apache.logging.log4j:log4j-slf4j-impl:2.25.4') + runtimeOnly('org.apache.logging.log4j:log4j-slf4j-impl:2.25.5') } application { diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index 61fc597c9d9..effdf78166a 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -1012,11 +1012,11 @@ lib/jna-platform-5.11.0.jar lib/joda-time-2.12.7.jar lib/jopt-simple-5.0.4.jar lib/jul-to-slf4j-2.0.17.jar -lib/log4j-api-2.25.4.jar -lib/log4j-core-2.25.4.jar -lib/log4j-jcl-2.25.4.jar -lib/log4j-jul-2.25.4.jar -lib/log4j-slf4j-impl-2.25.4.jar +lib/log4j-api-2.25.5.jar +lib/log4j-core-2.25.5.jar +lib/log4j-jcl-2.25.5.jar +lib/log4j-jul-2.25.5.jar +lib/log4j-slf4j-impl-2.25.5.jar lib/lucene-analysis-common-9.12.3.jar lib/lucene-analysis-phonetic-9.12.3.jar lib/lucene-core-9.12.3.jar diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index 3725735fef3..ef154f27dbe 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -32,11 +32,11 @@ jaxb-runtime-4.0.2.jar jaxb-core-4.0.2.jar jakarta.xml.bind-api-4.0.2.jar jopt-simple-5.0.4.jar -log4j-slf4j-impl-2.25.4.jar -log4j-core-2.25.4.jar -log4j-jcl-2.25.4.jar -log4j-jul-2.25.4.jar -log4j-api-2.25.4.jar +log4j-slf4j-impl-2.25.5.jar +log4j-core-2.25.5.jar +log4j-jcl-2.25.5.jar +log4j-jul-2.25.5.jar +log4j-api-2.25.5.jar spring-aop-6.1.21.jar spring-shell-autoconfigure-3.3.3.jar spring-shell-standard-commands-3.3.3.jar diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index 4a11973139a..17203bfd388 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -33,11 +33,11 @@ commons-lang3-3.18.0.jar jaxb-runtime-4.0.2.jar jaxb-core-4.0.2.jar jakarta.xml.bind-api-4.0.2.jar -log4j-slf4j-impl-2.25.4.jar -log4j-core-2.25.4.jar -log4j-jcl-2.25.4.jar -log4j-jul-2.25.4.jar -log4j-api-2.25.4.jar +log4j-slf4j-impl-2.25.5.jar +log4j-core-2.25.5.jar +log4j-jcl-2.25.5.jar +log4j-jul-2.25.5.jar +log4j-api-2.25.5.jar spring-shell-starter-3.3.3.jar rmiio-2.1.2.jar antlr-2.7.7.jar From df0802ac2a5d2dd87f9d1463ca1b34c6df2c977d Mon Sep 17 00:00:00 2001 From: Jinwoo Hwang <92374539+JinwooHwang@users.noreply.github.com> Date: Thu, 6 Aug 2026 11:45:03 -0400 Subject: [PATCH 08/12] GEODE-10606 Remediation of CVE-2026-8763 (#8032) Bumps bouncycastle 1.84 -> 1.85. (cherry picked from commit 98d461ebde7d0e4c81644821a96bd87cdc6faf2e) Applied after #8033, so the fixture and DependencyConstraints conflict regions carried this commit's older context (shiro 2.1.0, slf4j 2.0.17). Only the bouncycastle bump was taken; shiro 3.0.0 and slf4j 2.0.18 from #8033 are preserved. Co-Authored-By: Claude Opus 5 (1M context) --- .../apache/geode/gradle/plugins/DependencyConstraints.groovy | 2 +- .../src/integrationTest/resources/assembly_content.txt | 2 +- .../src/integrationTest/resources/gfsh_dependency_classpath.txt | 2 +- .../src/integrationTest/resources/dependency_classpath.txt | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy index 7be86d1fb34..563c7a7eb07 100644 --- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy +++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy @@ -51,7 +51,7 @@ class DependencyConstraints { deps.put("micrometer.version", "1.15.12") deps.put("shiro.version", "3.0.0") // GEODE-10583: Pin Bouncy Castle (transitive via shiro-crypto-hash) to a fixed version - deps.put("bouncycastle.version", "1.84") + deps.put("bouncycastle.version", "1.85") deps.put("slf4j-api.version", "2.0.18") deps.put("jakarta.transaction-api.version", "2.0.1") deps.put("jboss-modules.version", "1.11.0.Final") diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index effdf78166a..68d089a2a25 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -923,7 +923,7 @@ lib/antlr-runtime-3.5.2.jar lib/asm-9.9.1.jar lib/asm-commons-9.9.1.jar lib/asm-tree-9.9.1.jar -lib/bcprov-jdk18on-1.84.jar +lib/bcprov-jdk18on-1.85.jar lib/classgraph-4.8.147.jar lib/classmate-1.5.1.jar lib/commons-beanutils-1.11.0.jar diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index ef154f27dbe..b8de97c3ded 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -142,4 +142,4 @@ jboss-logging-3.4.3.Final.jar classmate-1.5.1.jar jakarta.el-api-5.0.0.jar jakarta.inject-api-2.0.1.jar -bcprov-jdk18on-1.84.jar +bcprov-jdk18on-1.85.jar diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index 17203bfd388..a49f0b53dd7 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -124,7 +124,7 @@ asm-commons-9.9.1.jar asm-tree-9.9.1.jar asm-9.9.1.jar txw2-4.0.2.jar -bcprov-jdk18on-1.84.jar +bcprov-jdk18on-1.85.jar reactor-core-3.6.10.jar jline-console-3.26.3.jar jline-builtins-3.26.3.jar From 2b0efe7561f5c69b21fc01249f80027dc28e26ce Mon Sep 17 00:00:00 2001 From: Jinwoo Hwang <92374539+JinwooHwang@users.noreply.github.com> Date: Fri, 7 Aug 2026 09:25:00 -0400 Subject: [PATCH 09/12] [GEODE-10605] Remediation of CVE-2026-10050 (#8031) Bumps jetty 12.0.33 -> 12.0.37, which transitively brings asm 9.9.1 -> 9.10.1. (cherry picked from commit b507bd3072f7fb10713cb26485787e64237fc538) Applied after #8032/#8033, so the two classpath fixtures conflicted on this commit's older context (shiro 2.1.0, slf4j 2.0.17, bcprov reordering). Only the jetty and asm changes were taken; shiro 3.0.0, slf4j 2.0.18, bcprov 1.85 and snakeyaml 2.3 are preserved. Co-Authored-By: Claude Opus 5 (1M context) --- README.md | 1 - .../plugins/DependencyConstraints.groovy | 2 +- .../tests/GenericAppServerInstall.java | 2 +- .../resources/assembly_content.txt | 34 +++++++++---------- .../resources/gfsh_dependency_classpath.txt | 34 +++++++++---------- .../resources/dependency_classpath.txt | 34 +++++++++---------- 6 files changed, 53 insertions(+), 54 deletions(-) diff --git a/README.md b/README.md index 4dd74940bb6..c74236bb495 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,6 @@ [![Apache Geode logo](https://geode.apache.org/img/Apache_Geode_logo.png)](http://geode.apache.org) [![Build Status](https://concourse.apachegeode-ci.info/api/v1/teams/main/pipelines/apache-develop-main/badge)](https://concourse.apachegeode-ci.info/teams/main/pipelines/apache-develop-main) [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://www.apache.org/licenses/LICENSE-2.0) [![Maven Central](https://maven-badges.herokuapp.com/maven-central/org.apache.geode/geode-core/badge.svg)](http://search.maven.org/#search%7Cga%7C1%7Cg%3A%22org.apache.geode%22) [![homebrew](https://img.shields.io/homebrew/v/apache-geode.svg)](https://formulae.brew.sh/formula/apache-geode) [![Docker Pulls](https://img.shields.io/docker/pulls/apachegeode/geode.svg)](https://hub.docker.com/r/apachegeode/geode/) [![Total alerts](https://img.shields.io/lgtm/alerts/g/apache/geode.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/apache/geode/alerts/) [![Language grade: Java](https://img.shields.io/lgtm/grade/java/g/apache/geode.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/apache/geode/context:java) [![Language grade: JavaScript](https://img.shields.io/lgtm/grade/javascript/g/apache/geode.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/apache/geode/context:javascript) [![Language grade: Python](https://img.shields.io/lgtm/grade/python/g/apache/geode.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/apache/geode/context:python) - ## Contents diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy index 563c7a7eb07..91042955c89 100644 --- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy +++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy @@ -85,7 +85,7 @@ class DependencyConstraints { // at o.a.g.sessions.tests.GenericAppServerInstall.java // Jetty 12.0.x for Jakarta EE 10 (Servlet 6.0) compatibility // Jetty 12 reorganized modules under ee10, ee9, ee8 packages - deps.put("jetty.version", "12.0.33") + deps.put("jetty.version", "12.0.37") // These versions are referenced in test.gradle, which is aggressively injected into all projects. deps.put("junit.version", "4.13.2") diff --git a/geode-assembly/src/distributedTest/java/org/apache/geode/session/tests/GenericAppServerInstall.java b/geode-assembly/src/distributedTest/java/org/apache/geode/session/tests/GenericAppServerInstall.java index b2fc46e8511..59edba38218 100644 --- a/geode-assembly/src/distributedTest/java/org/apache/geode/session/tests/GenericAppServerInstall.java +++ b/geode-assembly/src/distributedTest/java/org/apache/geode/session/tests/GenericAppServerInstall.java @@ -34,7 +34,7 @@ * specific code outside of the {@link GenericAppServerVersion}. */ public class GenericAppServerInstall extends ContainerInstall { - private static final String JETTY_VERSION = "12.0.33"; + private static final String JETTY_VERSION = "12.0.37"; /** * Get the version number, download URL, and container name of a generic app server using diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index 68d089a2a25..9c8a6fa28bd 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -920,9 +920,9 @@ lib/ST4-4.3.3.jar lib/angus-activation-2.0.0.jar lib/antlr-2.7.7.jar lib/antlr-runtime-3.5.2.jar -lib/asm-9.9.1.jar -lib/asm-commons-9.9.1.jar -lib/asm-tree-9.9.1.jar +lib/asm-9.10.1.jar +lib/asm-commons-9.10.1.jar +lib/asm-tree-9.10.1.jar lib/bcprov-jdk18on-1.85.jar lib/classgraph-4.8.147.jar lib/classmate-1.5.1.jar @@ -986,20 +986,20 @@ lib/jakarta.xml.bind-api-4.0.2.jar lib/jaxb-core-4.0.2.jar lib/jaxb-runtime-4.0.2.jar lib/jboss-logging-3.4.3.Final.jar -lib/jetty-ee-12.0.33.jar -lib/jetty-ee10-annotations-12.0.33.jar -lib/jetty-ee10-plus-12.0.33.jar -lib/jetty-ee10-servlet-12.0.33.jar -lib/jetty-ee10-webapp-12.0.33.jar -lib/jetty-http-12.0.33.jar -lib/jetty-io-12.0.33.jar -lib/jetty-jndi-12.0.33.jar -lib/jetty-plus-12.0.33.jar -lib/jetty-security-12.0.33.jar -lib/jetty-server-12.0.33.jar -lib/jetty-session-12.0.33.jar -lib/jetty-util-12.0.33.jar -lib/jetty-xml-12.0.33.jar +lib/jetty-ee-12.0.37.jar +lib/jetty-ee10-annotations-12.0.37.jar +lib/jetty-ee10-plus-12.0.37.jar +lib/jetty-ee10-servlet-12.0.37.jar +lib/jetty-ee10-webapp-12.0.37.jar +lib/jetty-http-12.0.37.jar +lib/jetty-io-12.0.37.jar +lib/jetty-jndi-12.0.37.jar +lib/jetty-plus-12.0.37.jar +lib/jetty-security-12.0.37.jar +lib/jetty-server-12.0.37.jar +lib/jetty-session-12.0.37.jar +lib/jetty-util-12.0.37.jar +lib/jetty-xml-12.0.37.jar lib/jgroups-3.6.20.Final.jar lib/jline-builtins-3.26.3.jar lib/jline-console-3.26.3.jar diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index b8de97c3ded..aa18f4e0307 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -79,23 +79,23 @@ micrometer-core-1.15.12.jar HdrHistogram-2.2.2.jar fastutil-8.5.8.jar jakarta.resource-api-2.1.0.jar -jetty-ee10-annotations-12.0.33.jar -jetty-ee10-plus-12.0.33.jar +jetty-ee10-annotations-12.0.37.jar +jetty-ee10-plus-12.0.37.jar jakarta.enterprise.cdi-api-4.0.1.jar jakarta.interceptor-api-2.1.0.jar jakarta.annotation-api-2.1.1.jar -jetty-ee10-webapp-12.0.33.jar -jetty-ee10-servlet-12.0.33.jar +jetty-ee10-webapp-12.0.37.jar +jetty-ee10-servlet-12.0.37.jar jakarta.servlet-api-6.0.0.jar jakarta.transaction-api-2.0.1.jar joda-time-2.12.7.jar jna-platform-5.11.0.jar jna-5.11.0.jar -jetty-ee-12.0.33.jar -jetty-session-12.0.33.jar -jetty-plus-12.0.33.jar -jetty-security-12.0.33.jar -jetty-server-12.0.33.jar +jetty-ee-12.0.37.jar +jetty-session-12.0.37.jar +jetty-plus-12.0.37.jar +jetty-security-12.0.37.jar +jetty-server-12.0.37.jar snappy-0.5.jar jgroups-3.6.20.Final.jar shiro-cache-3.0.0.jar @@ -107,13 +107,13 @@ shiro-crypto-core-3.0.0.jar shiro-lang-3.0.0.jar shiro-hashes-argon2-3.0.0.jar shiro-hashes-bcrypt-3.0.0.jar -jetty-xml-12.0.33.jar -jetty-http-12.0.33.jar -jetty-io-12.0.33.jar +jetty-xml-12.0.37.jar +jetty-http-12.0.37.jar +jetty-io-12.0.37.jar spring-boot-starter-logging-3.3.13.jar jul-to-slf4j-2.0.17.jar -jetty-jndi-12.0.33.jar -jetty-util-12.0.33.jar +jetty-jndi-12.0.37.jar +jetty-util-12.0.37.jar slf4j-api-2.0.18.jar micrometer-observation-1.15.12.jar spring-jcl-6.1.21.jar @@ -128,9 +128,9 @@ jline-terminal-3.26.3.jar ST4-4.3.3.jar txw2-4.0.2.jar snakeyaml-2.3.jar -asm-commons-9.9.1.jar -asm-tree-9.9.1.jar -asm-9.9.1.jar +asm-commons-9.10.1.jar +asm-tree-9.10.1.jar +asm-9.10.1.jar reactive-streams-1.0.4.jar jline-native-3.26.3.jar antlr-runtime-3.5.2.jar diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index a49f0b53dd7..fafbca5c744 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -48,10 +48,10 @@ spring-shell-core-3.3.3.jar commons-io-2.19.0.jar micrometer-core-1.15.12.jar jakarta.resource-api-2.1.0.jar -jetty-ee10-annotations-12.0.33.jar +jetty-ee10-annotations-12.0.37.jar spring-boot-starter-validation-3.3.13.jar spring-boot-starter-3.3.13.jar -jetty-ee10-plus-12.0.33.jar +jetty-ee10-plus-12.0.37.jar jakarta.enterprise.cdi-api-4.0.1.jar jakarta.interceptor-api-2.1.0.jar jakarta.annotation-api-2.1.1.jar @@ -89,15 +89,15 @@ commons-collections-3.2.2.jar commons-digester-2.1.jar commons-logging-1.3.5.jar HdrHistogram-2.2.2.jar -jetty-ee10-webapp-12.0.33.jar -jetty-ee10-servlet-12.0.33.jar +jetty-ee10-webapp-12.0.37.jar +jetty-ee10-servlet-12.0.37.jar jakarta.servlet-api-6.0.0.jar joda-time-2.12.7.jar -jetty-ee-12.0.33.jar -jetty-session-12.0.33.jar -jetty-plus-12.0.33.jar -jetty-security-12.0.33.jar -jetty-server-12.0.33.jar +jetty-ee-12.0.37.jar +jetty-session-12.0.37.jar +jetty-plus-12.0.37.jar +jetty-security-12.0.37.jar +jetty-server-12.0.37.jar shiro-cache-3.0.0.jar shiro-hashes-argon2-3.0.0.jar shiro-hashes-bcrypt-3.0.0.jar @@ -107,11 +107,11 @@ shiro-config-core-3.0.0.jar shiro-event-3.0.0.jar shiro-crypto-core-3.0.0.jar shiro-lang-3.0.0.jar -jetty-xml-12.0.33.jar -jetty-http-12.0.33.jar -jetty-io-12.0.33.jar -jetty-jndi-12.0.33.jar -jetty-util-12.0.33.jar +jetty-xml-12.0.37.jar +jetty-http-12.0.37.jar +jetty-io-12.0.37.jar +jetty-jndi-12.0.37.jar +jetty-util-12.0.37.jar spring-boot-starter-logging-3.3.13.jar jul-to-slf4j-2.0.17.jar slf4j-api-2.0.18.jar @@ -120,9 +120,9 @@ micrometer-commons-1.15.12.jar LatencyUtils-2.0.3.jar snakeyaml-2.3.jar spring-jcl-6.1.21.jar -asm-commons-9.9.1.jar -asm-tree-9.9.1.jar -asm-9.9.1.jar +asm-commons-9.10.1.jar +asm-tree-9.10.1.jar +asm-9.10.1.jar txw2-4.0.2.jar bcprov-jdk18on-1.85.jar reactor-core-3.6.10.jar From 7bd7f0b79b22762b8c9ef974e53f7aa86bfab6fe Mon Sep 17 00:00:00 2001 From: Jinwoo Hwang <92374539+JinwooHwang@users.noreply.github.com> Date: Wed, 19 Aug 2026 05:22:37 -0400 Subject: [PATCH 10/12] [GEODE-10610] gfsh - list members failure (#8036) * GEODE-10610 gfsh - list member failure * :geode-assembly:integrationTest BundledJarsJUnitTest. verifyBundledJarsHaveNotChanged and GfshDependencyJarIntegrationTest. verifyManifestClassPath (cherry picked from commit 621c3d359a4e02b339334d7708a16c3f5a41165d) --- .../plugins/DependencyConstraints.groovy | 2 ++ .../resources/assembly_content.txt | 2 ++ .../resources/expected_jars.txt | 2 ++ .../resources/gfsh_dependency_classpath.txt | 2 ++ geode-gfsh/build.gradle | 3 ++ .../src/test/resources/expected-pom.xml | 30 +++++++++++++++++++ .../resources/dependency_classpath.txt | 2 ++ 7 files changed, 43 insertions(+) diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy index 91042955c89..29e0d699c21 100644 --- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy +++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy @@ -108,6 +108,8 @@ class DependencyConstraints { project.dependencies { constraints { + api('org.jline:jline-terminal-jni:3.26.3') + api('org.jline:jline-terminal-ffm:3.26.3') // informal, inter-group dependencySet api(group: 'antlr', name: 'antlr', version: get('antlr.version')) api(group: 'cglib', name: 'cglib', version: get('cglib.version')) diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index 9c8a6fa28bd..9ba7a9ea17a 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -1007,6 +1007,8 @@ lib/jline-native-3.26.3.jar lib/jline-reader-3.26.3.jar lib/jline-style-3.26.3.jar lib/jline-terminal-3.26.3.jar +lib/jline-terminal-ffm-3.26.3.jar +lib/jline-terminal-jni-3.26.3.jar lib/jna-5.11.0.jar lib/jna-platform-5.11.0.jar lib/joda-time-2.12.7.jar diff --git a/geode-assembly/src/integrationTest/resources/expected_jars.txt b/geode-assembly/src/integrationTest/resources/expected_jars.txt index 7d0c0f27220..facbde0d7f6 100644 --- a/geode-assembly/src/integrationTest/resources/expected_jars.txt +++ b/geode-assembly/src/integrationTest/resources/expected_jars.txt @@ -71,6 +71,8 @@ jline-native jline-reader jline-style jline-terminal +jline-terminal-ffm +jline-terminal-jni jna jna-platform joda-time diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index aa18f4e0307..e8d49e23cf8 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -125,6 +125,8 @@ jline-builtins-3.26.3.jar jline-reader-3.26.3.jar jline-style-3.26.3.jar jline-terminal-3.26.3.jar +jline-terminal-jni-3.26.3.jar +jline-terminal-ffm-3.26.3.jar ST4-4.3.3.jar txw2-4.0.2.jar snakeyaml-2.3.jar diff --git a/geode-gfsh/build.gradle b/geode-gfsh/build.gradle index 3c814b10e02..f731cfff12e 100644 --- a/geode-gfsh/build.gradle +++ b/geode-gfsh/build.gradle @@ -40,6 +40,9 @@ dependencies { implementation('com.fasterxml.jackson.core:jackson-databind') implementation('io.swagger.core.v3:swagger-annotations') + runtimeOnly('org.jline:jline-terminal-jni') + runtimeOnly('org.jline:jline-terminal-ffm') + // JAXB dependencies needed for Java 11+ implementation('jakarta.xml.bind:jakarta.xml.bind-api') runtimeOnly('org.glassfish.jaxb:jaxb-runtime') diff --git a/geode-gfsh/src/test/resources/expected-pom.xml b/geode-gfsh/src/test/resources/expected-pom.xml index 45903f49046..579bdc65780 100644 --- a/geode-gfsh/src/test/resources/expected-pom.xml +++ b/geode-gfsh/src/test/resources/expected-pom.xml @@ -349,6 +349,36 @@ + + org.jline + jline-terminal-jni + runtime + + + log4j-to-slf4j + org.apache.logging.log4j + + + * + ch.qos.logback + + + + + org.jline + jline-terminal-ffm + runtime + + + log4j-to-slf4j + org.apache.logging.log4j + + + * + ch.qos.logback + + + org.glassfish.jaxb jaxb-runtime diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index fafbca5c744..2a832a1ea4a 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -131,6 +131,8 @@ jline-builtins-3.26.3.jar jline-reader-3.26.3.jar jline-style-3.26.3.jar jline-terminal-3.26.3.jar +jline-terminal-jni-3.26.3.jar +jline-terminal-ffm-3.26.3.jar ST4-4.3.3.jar jakarta.enterprise.lang-model-4.0.1.jar reactive-streams-1.0.4.jar From e86c745728f7a55393d4b281b40e6857011f311e Mon Sep 17 00:00:00 2001 From: JinwooHwang Date: Mon, 24 Aug 2026 11:40:32 -0400 Subject: [PATCH 11/12] Pin GitHub Actions to commit SHAs in gradle.yml workflow The workflow was failing at startup on support/2.0, so no build, unitTest, integrationTest, acceptanceTest or distributedTest job ran at all. Takes develop's version of .github/workflows/gradle.yml verbatim except for the push/pull_request branch filters, which stay on support/2.0. This picks up the action SHA pinning introduced upstream by [GEODE-10593] (#8019) and [GEODE-10597] (#8023): actions/checkout v3 -> 3d3c42e5aac5ba805825da76410c181273ba90b1 actions/setup-java v3 -> 03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 actions/upload-artifact v4 -> 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a gradle/actions/setup-gradle v5 -> 0723195856401067f7a2779048b490ace7a47d7c Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/gradle.yml | 74 ++++++++++++++++++------------------ 1 file changed, 37 insertions(+), 37 deletions(-) diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml index 00e80b387ec..be35375c019 100644 --- a/.github/workflows/gradle.yml +++ b/.github/workflows/gradle.yml @@ -32,14 +32,14 @@ jobs: env: DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }} steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up JDK 17 - uses: actions/setup-java@v3 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: '17' distribution: 'liberica' - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run 'build install javadoc spotlessCheck rat checkPom resolveDependencies pmdMain' with Gradle @@ -57,9 +57,9 @@ jobs: env: DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }} steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: distribution: ${{ matrix.distribution }} java-version: | @@ -96,15 +96,15 @@ jobs: env: DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }} steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up JDK (include all 3 JDKs in env) - uses: actions/setup-java@v3 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: distribution: ${{ matrix.distribution }} java-version: | 17 - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Set JAVA_TEST_PATH to 17 @@ -127,7 +127,7 @@ jobs: -PtestJVMVer=${JAVA_TEST_VERSION} \ -PtestJava17Home=${JAVA_HOME_17_X64} \ test --console=plain --no-daemon - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: failure() with: name: unit-test-reports-${{ matrix.os }}-${{ matrix.java }} @@ -145,15 +145,15 @@ jobs: env: DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }} steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: distribution: ${{ matrix.distribution }} java-version: | 17 - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run integration tests @@ -174,7 +174,7 @@ jobs: -PtestJVMVer=${JAVA_TEST_VERSION} \ -PtestJava17Home=${JAVA_HOME_17_X64} \ integrationTest --console=plain --no-daemon - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: failure() with: name: integration-test-reports-${{ matrix.os }}-${{ matrix.java }} @@ -192,14 +192,14 @@ jobs: env: DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }} steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run acceptance tests @@ -218,7 +218,7 @@ jobs: -PtestJVMVer=${JAVA_TEST_VERSION} \ -PtestJava17Home=${JAVA_HOME_17_X64} \ acceptanceTest --console=plain --no-daemon - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: failure() with: name: acceptance-test-reports-${{ matrix.os }}-${{ matrix.java }} @@ -236,14 +236,14 @@ jobs: env: DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }} steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run wan distributed tests @@ -264,7 +264,7 @@ jobs: -PtestJVMVer=${JAVA_TEST_VERSION} \ -PtestJava17Home=${JAVA_HOME_17_X64} \ geode-wan:distributedTest --console=plain --no-daemon - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: failure() with: name: wan-distributed-test-reports-${{ matrix.os }}-${{ matrix.java }} @@ -282,14 +282,14 @@ jobs: env: DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }} steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run cq distributed tests @@ -308,7 +308,7 @@ jobs: -PtestJVMVer=${JAVA_TEST_VERSION} \ -PtestJava17Home=${JAVA_HOME_17_X64} \ geode-cq:distributedTest --console=plain --no-daemon - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: failure() with: name: cq-distributed-test-reports-${{ matrix.os }}-${{ matrix.java }} @@ -326,14 +326,14 @@ jobs: env: DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }} steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run lucene distributed tests @@ -354,7 +354,7 @@ jobs: -PtestJVMVer=${JAVA_TEST_VERSION} \ -PtestJava17Home=${JAVA_HOME_17_X64} \ geode-lucene:distributedTest --console=plain --no-daemon - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: failure() with: name: lucene-distributed-test-reports-${{ matrix.os }}-${{ matrix.java }} @@ -372,14 +372,14 @@ jobs: env: DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }} steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run gfsh, web-mgmt, web distributed tests @@ -401,7 +401,7 @@ jobs: geode-gfsh:distributedTest \ geode-web:distributedTest \ geode-web-management:distributedTest --console=plain --no-daemon - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: failure() with: name: mgmt-distributed-test-reports-${{ matrix.os }}-${{ matrix.java }} @@ -420,14 +420,14 @@ jobs: env: DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }} steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run assembly, connectors, old-client, extensions distributed tests @@ -452,7 +452,7 @@ jobs: geode-old-client:distributedTest \ extensions:geode-modules:distributedTest \ extensions:geode-modules-tomcat10:distributedTest --console=plain --no-daemon - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: failure() with: name: assembly-distributed-test-reports-${{ matrix.os }}-${{ matrix.java }} From 1b74257478be421ad8ee52ef570e1fd3b7c382c4 Mon Sep 17 00:00:00 2001 From: JinwooHwang Date: Mon, 24 Aug 2026 20:25:44 -0400 Subject: [PATCH 12/12] Correct snakeyaml version in integration test fixtures The three dependency fixtures claimed snakeyaml 2.3, but the build resolves 2.5, failing verifyAssemblyContents and verifyManifestClassPath in geode-assembly and geode-server-all. snakeyaml is not pinned in DependencyConstraints; it arrives transitively via shiro, so upgrading shiro 2.1.0 -> 3.0.0 in [GEODE-10607] (#8033) moved it from 2.3 to 2.5. When that commit was backported the change was mistakenly treated as unrelated develop drift and the fixtures were left at 2.3. All three files are now taken from generated build output rather than edited by hand, so they also pick up the real resolution ordering for the jline, shiro and bcprov blocks. Verified: :geode-server-all:integrationTest and :geode-assembly:integrationTest AssemblyContentsIntegrationTest, GfshDependencyJarIntegrationTest, GeodeDependencyJarIntegrationTest, BundledJarsJUnitTest, GeodeServerAllJarIntegrationTest -- 5 tests, 0 failures checkPom -- 26 tasks, all passing Co-Authored-By: Claude Opus 5 (1M context) --- .../resources/assembly_content.txt | 2 +- .../resources/gfsh_dependency_classpath.txt | 32 +++++++++---------- .../resources/dependency_classpath.txt | 28 ++++++++-------- 3 files changed, 31 insertions(+), 31 deletions(-) diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index 9ba7a9ea17a..862f8c53a3a 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -1046,7 +1046,7 @@ lib/shiro-hashes-argon2-3.0.0.jar lib/shiro-hashes-bcrypt-3.0.0.jar lib/shiro-lang-3.0.0.jar lib/slf4j-api-2.0.18.jar -lib/snakeyaml-2.3.jar +lib/snakeyaml-2.5.jar lib/snappy-0.5.jar lib/spring-aop-6.1.21.jar lib/spring-beans-6.1.21.jar diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index e8d49e23cf8..68a5913622f 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -21,11 +21,10 @@ spring-shell-starter-3.3.3.jar spring-web-6.1.21.jar commons-lang3-3.18.0.jar rmiio-2.1.2.jar +jackson-datatype-jsr310-2.21.5.jar jackson-datatype-joda-2.21.5.jar -jackson-annotations-2.21.jar -jackson-dataformat-yaml-2.21.5.jar jackson-core-2.21.5.jar -jackson-datatype-jsr310-2.21.5.jar +jackson-dataformat-yaml-2.21.5.jar jackson-databind-2.21.5.jar swagger-annotations-2.2.22.jar jaxb-runtime-4.0.2.jar @@ -52,6 +51,8 @@ spring-context-6.1.21.jar spring-beans-6.1.21.jar spring-expression-6.1.21.jar spring-core-6.1.21.jar +jline-terminal-jni-3.26.3.jar +jline-terminal-ffm-3.26.3.jar angus-activation-2.0.0.jar jakarta.activation-api-2.1.3.jar lucene-analysis-phonetic-9.12.3.jar @@ -91,6 +92,10 @@ jakarta.transaction-api-2.0.1.jar joda-time-2.12.7.jar jna-platform-5.11.0.jar jna-5.11.0.jar +shiro-hashes-argon2-3.0.0.jar +shiro-hashes-bcrypt-3.0.0.jar +shiro-crypto-hash-3.0.0.jar +bcprov-jdk18on-1.85.jar jetty-ee-12.0.37.jar jetty-session-12.0.37.jar jetty-plus-12.0.37.jar @@ -99,14 +104,11 @@ jetty-server-12.0.37.jar snappy-0.5.jar jgroups-3.6.20.Final.jar shiro-cache-3.0.0.jar -shiro-crypto-hash-3.0.0.jar shiro-crypto-cipher-3.0.0.jar shiro-config-core-3.0.0.jar shiro-event-3.0.0.jar shiro-crypto-core-3.0.0.jar shiro-lang-3.0.0.jar -shiro-hashes-argon2-3.0.0.jar -shiro-hashes-bcrypt-3.0.0.jar jetty-xml-12.0.37.jar jetty-http-12.0.37.jar jetty-io-12.0.37.jar @@ -115,26 +117,25 @@ jul-to-slf4j-2.0.17.jar jetty-jndi-12.0.37.jar jetty-util-12.0.37.jar slf4j-api-2.0.18.jar -micrometer-observation-1.15.12.jar -spring-jcl-6.1.21.jar -micrometer-commons-1.15.12.jar -LatencyUtils-2.0.3.jar -reactor-core-3.6.10.jar +jackson-annotations-2.21.jar jline-console-3.26.3.jar jline-builtins-3.26.3.jar jline-reader-3.26.3.jar jline-style-3.26.3.jar jline-terminal-3.26.3.jar -jline-terminal-jni-3.26.3.jar -jline-terminal-ffm-3.26.3.jar +jline-native-3.26.3.jar +micrometer-observation-1.15.12.jar +spring-jcl-6.1.21.jar +micrometer-commons-1.15.12.jar +LatencyUtils-2.0.3.jar +snakeyaml-2.5.jar +reactor-core-3.6.10.jar ST4-4.3.3.jar txw2-4.0.2.jar -snakeyaml-2.3.jar asm-commons-9.10.1.jar asm-tree-9.10.1.jar asm-9.10.1.jar reactive-streams-1.0.4.jar -jline-native-3.26.3.jar antlr-runtime-3.5.2.jar tomcat-embed-el-10.1.42.jar hibernate-validator-8.0.2.Final.jar @@ -144,4 +145,3 @@ jboss-logging-3.4.3.Final.jar classmate-1.5.1.jar jakarta.el-api-5.0.0.jar jakarta.inject-api-2.0.1.jar -bcprov-jdk18on-1.85.jar diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index 2a832a1ea4a..8ba910109e4 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -20,7 +20,6 @@ geode-deployment-legacy-0.0.0.jar snappy-0.5.jar swagger-annotations-2.2.22.jar jackson-datatype-jsr310-2.21.5.jar -jackson-annotations-2.21.jar jackson-dataformat-yaml-2.21.5.jar jackson-core-2.21.5.jar jackson-datatype-joda-2.21.5.jar @@ -58,6 +57,7 @@ jakarta.annotation-api-2.1.1.jar jakarta.transaction-api-2.0.1.jar shiro-core-3.0.0.jar jgroups-3.6.20.Final.jar +jackson-annotations-2.21.jar commons-validator-1.7.jar fastutil-8.5.8.jar jna-platform-5.11.0.jar @@ -77,6 +77,8 @@ spring-context-6.1.21.jar spring-beans-6.1.21.jar spring-expression-6.1.21.jar spring-core-6.1.21.jar +jline-terminal-jni-3.26.3.jar +jline-terminal-ffm-3.26.3.jar lucene-analysis-phonetic-9.12.3.jar lucene-analysis-common-9.12.3.jar lucene-queryparser-9.12.3.jar @@ -93,15 +95,16 @@ jetty-ee10-webapp-12.0.37.jar jetty-ee10-servlet-12.0.37.jar jakarta.servlet-api-6.0.0.jar joda-time-2.12.7.jar +shiro-hashes-argon2-3.0.0.jar +shiro-hashes-bcrypt-3.0.0.jar +shiro-crypto-hash-3.0.0.jar +bcprov-jdk18on-1.85.jar jetty-ee-12.0.37.jar jetty-session-12.0.37.jar jetty-plus-12.0.37.jar jetty-security-12.0.37.jar jetty-server-12.0.37.jar shiro-cache-3.0.0.jar -shiro-hashes-argon2-3.0.0.jar -shiro-hashes-bcrypt-3.0.0.jar -shiro-crypto-hash-3.0.0.jar shiro-crypto-cipher-3.0.0.jar shiro-config-core-3.0.0.jar shiro-event-3.0.0.jar @@ -115,28 +118,25 @@ jetty-util-12.0.37.jar spring-boot-starter-logging-3.3.13.jar jul-to-slf4j-2.0.17.jar slf4j-api-2.0.18.jar +jline-console-3.26.3.jar +jline-builtins-3.26.3.jar +jline-reader-3.26.3.jar +jline-style-3.26.3.jar +jline-terminal-3.26.3.jar +jline-native-3.26.3.jar micrometer-observation-1.15.12.jar micrometer-commons-1.15.12.jar LatencyUtils-2.0.3.jar -snakeyaml-2.3.jar +snakeyaml-2.5.jar spring-jcl-6.1.21.jar asm-commons-9.10.1.jar asm-tree-9.10.1.jar asm-9.10.1.jar txw2-4.0.2.jar -bcprov-jdk18on-1.85.jar reactor-core-3.6.10.jar -jline-console-3.26.3.jar -jline-builtins-3.26.3.jar -jline-reader-3.26.3.jar -jline-style-3.26.3.jar -jline-terminal-3.26.3.jar -jline-terminal-jni-3.26.3.jar -jline-terminal-ffm-3.26.3.jar ST4-4.3.3.jar jakarta.enterprise.lang-model-4.0.1.jar reactive-streams-1.0.4.jar -jline-native-3.26.3.jar antlr-runtime-3.5.2.jar tomcat-embed-el-10.1.42.jar hibernate-validator-8.0.2.Final.jar