From 5a297141d3afb1ccc95d78a95ed54ef34a94eff2 Mon Sep 17 00:00:00 2001 From: JinwooHwang Date: Mon, 24 Aug 2026 10:00:09 -0400 Subject: [PATCH 01/10] GEODE-10592: Upgrade micrometer from 1.14.0 to 1.15.12 Partial backport of [GEODE-10592] Remediation of CVE-2026-40984 (#8018), commit 978012290cb09e90c1d2adbb00801adc440965d3 on develop. Only the micrometer dependency bump is taken. The rest of that commit does not apply to support/2.0: - GitHub Actions version pinning (checkout@v4.2.2, setup-java@v4.7.1) targets develop's workflow files, which have diverged on this branch. - The shiro 2.2.1 -> 2.1.0 change reverted #8017; support/2.0 is already at 2.1.0, so it is a no-op here. Co-Authored-By: Claude Opus 5 (1M context) --- boms/geode-all-bom/src/test/resources/expected-pom.xml | 2 +- .../geode/gradle/plugins/DependencyConstraints.groovy | 2 +- .../src/integrationTest/resources/assembly_content.txt | 6 +++--- .../integrationTest/resources/gfsh_dependency_classpath.txt | 6 +++--- .../src/integrationTest/resources/dependency_classpath.txt | 6 +++--- 5 files changed, 11 insertions(+), 11 deletions(-) diff --git a/boms/geode-all-bom/src/test/resources/expected-pom.xml b/boms/geode-all-bom/src/test/resources/expected-pom.xml index 65f6a24015d8..a161a1455627 100644 --- a/boms/geode-all-bom/src/test/resources/expected-pom.xml +++ b/boms/geode-all-bom/src/test/resources/expected-pom.xml @@ -195,7 +195,7 @@ io.micrometer micrometer-core - 1.14.0 + 1.15.12 io.swagger.core.v3 diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy index d71e6717badd..891da7831182 100644 --- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy +++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy @@ -48,7 +48,7 @@ class DependencyConstraints { deps.put("jgroups.version", "3.6.20.Final") deps.put("log4j.version", "2.25.4") deps.put("log4j-slf4j2-impl.version", "2.23.1") - deps.put("micrometer.version", "1.14.0") + deps.put("micrometer.version", "1.15.12") deps.put("shiro.version", "2.1.0") // GEODE-10583: Pin Bouncy Castle (transitive via shiro-crypto-hash) to a fixed version deps.put("bouncycastle.version", "1.84") diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index c769db89d0e5..eaa2153faed1 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -1022,9 +1022,9 @@ lib/lucene-analysis-phonetic-9.12.3.jar lib/lucene-core-9.12.3.jar lib/lucene-queries-9.12.3.jar lib/lucene-queryparser-9.12.3.jar -lib/micrometer-commons-1.14.0.jar -lib/micrometer-core-1.14.0.jar -lib/micrometer-observation-1.14.0.jar +lib/micrometer-commons-1.15.12.jar +lib/micrometer-core-1.15.12.jar +lib/micrometer-observation-1.15.12.jar lib/mx4j-3.0.2.jar lib/mx4j-remote-3.0.2.jar lib/mx4j-tools-3.0.1.jar diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index b39d44afd5e4..520d00ad46ad 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -75,7 +75,7 @@ commons-digester-2.1.jar commons-io-2.19.0.jar commons-logging-1.3.5.jar classgraph-4.8.147.jar -micrometer-core-1.14.0.jar +micrometer-core-1.15.12.jar HdrHistogram-2.2.2.jar fastutil-8.5.8.jar jakarta.resource-api-2.1.0.jar @@ -115,9 +115,9 @@ jul-to-slf4j-2.0.17.jar jetty-jndi-12.0.33.jar jetty-util-12.0.33.jar slf4j-api-2.0.17.jar -micrometer-observation-1.14.0.jar +micrometer-observation-1.15.12.jar spring-jcl-6.1.21.jar -micrometer-commons-1.14.0.jar +micrometer-commons-1.15.12.jar LatencyUtils-2.0.3.jar reactor-core-3.6.10.jar jline-console-3.26.3.jar diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index 6b665995a617..a0cf1c1d617c 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -46,7 +46,7 @@ spring-shell-standard-commands-3.3.3.jar spring-shell-standard-3.3.3.jar spring-shell-core-3.3.3.jar commons-io-2.19.0.jar -micrometer-core-1.14.0.jar +micrometer-core-1.15.12.jar jakarta.resource-api-2.1.0.jar jetty-ee10-annotations-12.0.33.jar spring-boot-starter-validation-3.3.13.jar @@ -115,8 +115,8 @@ jetty-util-12.0.33.jar spring-boot-starter-logging-3.3.13.jar jul-to-slf4j-2.0.17.jar slf4j-api-2.0.17.jar -micrometer-observation-1.14.0.jar -micrometer-commons-1.14.0.jar +micrometer-observation-1.15.12.jar +micrometer-commons-1.15.12.jar LatencyUtils-2.0.3.jar snakeyaml-2.3.jar spring-jcl-6.1.21.jar From bfde6d63ee6f8ade051f200da956e4057dc713cc Mon Sep 17 00:00:00 2001 From: Jinwoo Hwang <92374539+JinwooHwang@users.noreply.github.com> Date: Tue, 28 Jul 2026 14:10:26 -0400 Subject: [PATCH 02/10] [GEODE-10590] Remediation of CVE-2026-54428 (#8016) * Remediation of CVE-2026-54428 * CI build failure (cherry picked from commit e3cb1f02a2fa35456053a43036a8961f99fd1292) --- .../apache/geode/gradle/plugins/DependencyConstraints.groovy | 4 ++-- .../src/integrationTest/resources/assembly_content.txt | 4 ++-- .../integrationTest/resources/gfsh_dependency_classpath.txt | 4 ++-- .../src/integrationTest/resources/dependency_classpath.txt | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy index 891da7831182..05963dba56dc 100644 --- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy +++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy @@ -175,8 +175,8 @@ class DependencyConstraints { api(group: 'org.apache.derby', name: 'derby', version: '10.14.2.0') // Apache HttpComponents 5.x - Modern HTTP client with HTTP/2 support api(group: 'org.apache.httpcomponents.client5', name: 'httpclient5', version: '5.4.4') - api(group: 'org.apache.httpcomponents.core5', name: 'httpcore5', version: '5.3.6') - api(group: 'org.apache.httpcomponents.core5', name: 'httpcore5-h2', version: '5.3.6') + api(group: 'org.apache.httpcomponents.core5', name: 'httpcore5', version: '5.4.3') + api(group: 'org.apache.httpcomponents.core5', name: 'httpcore5-h2', version: '5.4.3') // Legacy HttpComponents 4.x (keep temporarily during migration, remove after complete) api(group: 'org.apache.httpcomponents', name: 'httpclient', version: '4.5.13') api(group: 'org.apache.httpcomponents', name: 'httpcore', version: '4.4.15') diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index eaa2153faed1..1ebf0e3ec6d2 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -961,8 +961,8 @@ lib/geode-wan-0.0.0.jar lib/gfsh-dependencies.jar lib/hibernate-validator-8.0.2.Final.jar lib/httpclient5-5.4.4.jar -lib/httpcore5-5.3.6.jar -lib/httpcore5-h2-5.3.6.jar +lib/httpcore5-5.4.3.jar +lib/httpcore5-h2-5.4.3.jar lib/istack-commons-runtime-4.1.1.jar lib/jackson-annotations-2.21.jar lib/jackson-core-2.21.2.jar diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index 520d00ad46ad..6b7f8c2de5ba 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -60,8 +60,8 @@ lucene-queryparser-9.12.3.jar lucene-queries-9.12.3.jar lucene-core-9.12.3.jar httpclient5-5.4.4.jar -httpcore5-h2-5.3.6.jar -httpcore5-5.3.6.jar +httpcore5-h2-5.4.3.jar +httpcore5-5.4.3.jar HikariCP-4.0.3.jar antlr-2.7.7.jar istack-commons-runtime-4.1.1.jar diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index a0cf1c1d617c..48ed6e9cb56a 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -26,8 +26,8 @@ jackson-core-2.21.2.jar jackson-datatype-joda-2.21.2.jar jackson-databind-2.21.2.jar httpclient5-5.4.4.jar -httpcore5-h2-5.3.6.jar -httpcore5-5.3.6.jar +httpcore5-h2-5.4.3.jar +httpcore5-5.4.3.jar HikariCP-4.0.3.jar commons-lang3-3.18.0.jar jaxb-runtime-4.0.2.jar From a4521ba2385ae09e8f1e582050fdc7d168c4b9eb Mon Sep 17 00:00:00 2001 From: Jinwoo Hwang <92374539+JinwooHwang@users.noreply.github.com> Date: Tue, 28 Jul 2026 15:32:36 -0400 Subject: [PATCH 03/10] GEODE-10589 Remediation of GHSA-2m67-wjpj-xhg9 (#8015) * feature/GEODE-10589 * CI build failure (cherry picked from commit 48fe054b1ae148998f07187cc1ff354c8afa10f2) --- boms/geode-all-bom/src/test/resources/expected-pom.xml | 8 ++++---- .../geode/gradle/plugins/DependencyConstraints.groovy | 4 ++-- .../src/integrationTest/resources/assembly_content.txt | 10 +++++----- .../resources/gfsh_dependency_classpath.txt | 10 +++++----- .../integrationTest/resources/dependency_classpath.txt | 10 +++++----- 5 files changed, 21 insertions(+), 21 deletions(-) diff --git a/boms/geode-all-bom/src/test/resources/expected-pom.xml b/boms/geode-all-bom/src/test/resources/expected-pom.xml index a161a1455627..8c9f5fa2492b 100644 --- a/boms/geode-all-bom/src/test/resources/expected-pom.xml +++ b/boms/geode-all-bom/src/test/resources/expected-pom.xml @@ -475,22 +475,22 @@ com.fasterxml.jackson.core jackson-core - 2.21.2 + 2.21.5 com.fasterxml.jackson.core jackson-databind - 2.21.2 + 2.21.5 com.fasterxml.jackson.datatype jackson-datatype-joda - 2.21.2 + 2.21.5 com.fasterxml.jackson.datatype jackson-datatype-jsr310 - 2.21.2 + 2.21.5 com.jayway.jsonpath diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy index 05963dba56dc..880bd185d16f 100644 --- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy +++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy @@ -55,9 +55,9 @@ class DependencyConstraints { deps.put("slf4j-api.version", "2.0.17") deps.put("jakarta.transaction-api.version", "2.0.1") deps.put("jboss-modules.version", "1.11.0.Final") - deps.put("jackson.version", "2.21.2") + deps.put("jackson.version", "2.21.5") deps.put("jackson.annotations.version", "2.21") - deps.put("jackson.databind.version", "2.21.2") + deps.put("jackson.databind.version", "2.21.5") // Spring Framework 6.x Migration deps.put("springshell.version", "3.3.3") deps.put("springframework.version", "6.1.21") diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index 1ebf0e3ec6d2..9a65366dba06 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -965,11 +965,11 @@ lib/httpcore5-5.4.3.jar lib/httpcore5-h2-5.4.3.jar lib/istack-commons-runtime-4.1.1.jar lib/jackson-annotations-2.21.jar -lib/jackson-core-2.21.2.jar -lib/jackson-databind-2.21.2.jar -lib/jackson-dataformat-yaml-2.21.2.jar -lib/jackson-datatype-joda-2.21.2.jar -lib/jackson-datatype-jsr310-2.21.2.jar +lib/jackson-core-2.21.5.jar +lib/jackson-databind-2.21.5.jar +lib/jackson-dataformat-yaml-2.21.5.jar +lib/jackson-datatype-joda-2.21.5.jar +lib/jackson-datatype-jsr310-2.21.5.jar lib/jakarta.activation-api-2.1.3.jar lib/jakarta.annotation-api-2.1.1.jar lib/jakarta.el-api-5.0.0.jar diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index 6b7f8c2de5ba..80a6b43a2e5b 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -21,12 +21,12 @@ spring-shell-starter-3.3.3.jar spring-web-6.1.21.jar commons-lang3-3.18.0.jar rmiio-2.1.2.jar -jackson-datatype-joda-2.21.2.jar +jackson-datatype-joda-2.21.5.jar jackson-annotations-2.21.jar -jackson-dataformat-yaml-2.21.2.jar -jackson-core-2.21.2.jar -jackson-datatype-jsr310-2.21.2.jar -jackson-databind-2.21.2.jar +jackson-dataformat-yaml-2.21.5.jar +jackson-core-2.21.5.jar +jackson-datatype-jsr310-2.21.5.jar +jackson-databind-2.21.5.jar swagger-annotations-2.2.22.jar jaxb-runtime-4.0.2.jar jaxb-core-4.0.2.jar diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index 48ed6e9cb56a..de80b682ce44 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -19,12 +19,12 @@ geode-unsafe-0.0.0.jar geode-deployment-legacy-0.0.0.jar snappy-0.5.jar swagger-annotations-2.2.22.jar -jackson-datatype-jsr310-2.21.2.jar +jackson-datatype-jsr310-2.21.5.jar jackson-annotations-2.21.jar -jackson-dataformat-yaml-2.21.2.jar -jackson-core-2.21.2.jar -jackson-datatype-joda-2.21.2.jar -jackson-databind-2.21.2.jar +jackson-dataformat-yaml-2.21.5.jar +jackson-core-2.21.5.jar +jackson-datatype-joda-2.21.5.jar +jackson-databind-2.21.5.jar httpclient5-5.4.4.jar httpcore5-h2-5.4.3.jar httpcore5-5.4.3.jar From c1e9788e4b4cb9edbce540628c5a8fbf91ffe608 Mon Sep 17 00:00:00 2001 From: Jinwoo Hwang <92374539+JinwooHwang@users.noreply.github.com> Date: Fri, 7 Aug 2026 10:29:16 -0400 Subject: [PATCH 04/10] [GEODE-10607] Remediation of CVE-2026-49268 (#8033) Upgrades shiro 2.1.0 -> 3.0.0 and slf4j-api 2.0.17 -> 2.0.18. (cherry picked from commit d2846795019cdaa38a3f895610811f1e1874200e) Conflicts were resolved to take only the two dependency changes this commit is about. The following develop-only drift that appeared in the conflict regions was deliberately NOT taken, as it is unrelated to this CVE and support/2.0 pins these intentionally: - bouncycastle 1.84 (develop is on 1.85; pinned here by GEODE-10583) - log4j 2.25.4 (develop is on 2.25.5) - jetty 12.0.33 (develop is on 12.0.37) - snakeyaml 2.3 (develop is on 2.5) Two upstream defects in the original commit were also not carried over; both were corrected on develop by [GEODE-10609] (#8035): - a corrupted fixture line, "jetty-io-1git 2.0.37.jar" - jul-to-slf4j listed as 2.0.18, which the build does not actually resolve; it remains 2.0.17 here Co-Authored-By: Claude Opus 5 (1M context) --- .../src/test/resources/expected-pom.xml | 2 +- .../plugins/DependencyConstraints.groovy | 4 ++-- .../resources/assembly_content.txt | 24 +++++++++---------- .../resources/gfsh_dependency_classpath.txt | 24 +++++++++---------- .../resources/dependency_classpath.txt | 24 +++++++++---------- 5 files changed, 39 insertions(+), 39 deletions(-) diff --git a/boms/geode-all-bom/src/test/resources/expected-pom.xml b/boms/geode-all-bom/src/test/resources/expected-pom.xml index 8c9f5fa2492b..e37bc8fb841b 100644 --- a/boms/geode-all-bom/src/test/resources/expected-pom.xml +++ b/boms/geode-all-bom/src/test/resources/expected-pom.xml @@ -415,7 +415,7 @@ org.slf4j slf4j-api - 2.0.17 + 2.0.18 org.springframework.hateoas diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy index 880bd185d16f..b1b211b2dfea 100644 --- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy +++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy @@ -49,10 +49,10 @@ class DependencyConstraints { deps.put("log4j.version", "2.25.4") deps.put("log4j-slf4j2-impl.version", "2.23.1") deps.put("micrometer.version", "1.15.12") - deps.put("shiro.version", "2.1.0") + deps.put("shiro.version", "3.0.0") // GEODE-10583: Pin Bouncy Castle (transitive via shiro-crypto-hash) to a fixed version deps.put("bouncycastle.version", "1.84") - deps.put("slf4j-api.version", "2.0.17") + deps.put("slf4j-api.version", "2.0.18") deps.put("jakarta.transaction-api.version", "2.0.1") deps.put("jboss-modules.version", "1.11.0.Final") deps.put("jackson.version", "2.21.5") diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index 9a65366dba06..61fc597c9d98 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -1032,18 +1032,18 @@ lib/ra.jar lib/reactive-streams-1.0.4.jar lib/reactor-core-3.6.10.jar lib/rmiio-2.1.2.jar -lib/shiro-cache-2.1.0.jar -lib/shiro-config-core-2.1.0.jar -lib/shiro-config-ogdl-2.1.0.jar -lib/shiro-core-2.1.0.jar -lib/shiro-crypto-cipher-2.1.0.jar -lib/shiro-crypto-core-2.1.0.jar -lib/shiro-crypto-hash-2.1.0.jar -lib/shiro-event-2.1.0.jar -lib/shiro-hashes-argon2-2.1.0.jar -lib/shiro-hashes-bcrypt-2.1.0.jar -lib/shiro-lang-2.1.0.jar -lib/slf4j-api-2.0.17.jar +lib/shiro-cache-3.0.0.jar +lib/shiro-config-core-3.0.0.jar +lib/shiro-config-ogdl-3.0.0.jar +lib/shiro-core-3.0.0.jar +lib/shiro-crypto-cipher-3.0.0.jar +lib/shiro-crypto-core-3.0.0.jar +lib/shiro-crypto-hash-3.0.0.jar +lib/shiro-event-3.0.0.jar +lib/shiro-hashes-argon2-3.0.0.jar +lib/shiro-hashes-bcrypt-3.0.0.jar +lib/shiro-lang-3.0.0.jar +lib/slf4j-api-2.0.18.jar lib/snakeyaml-2.3.jar lib/snappy-0.5.jar lib/spring-aop-6.1.21.jar diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index 80a6b43a2e5b..3725735fef3f 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -66,8 +66,8 @@ HikariCP-4.0.3.jar antlr-2.7.7.jar istack-commons-runtime-4.1.1.jar commons-validator-1.7.jar -shiro-core-2.1.0.jar -shiro-config-ogdl-2.1.0.jar +shiro-core-3.0.0.jar +shiro-config-ogdl-3.0.0.jar commons-beanutils-1.11.0.jar commons-codec-1.15.jar commons-collections-3.2.2.jar @@ -98,15 +98,15 @@ jetty-security-12.0.33.jar jetty-server-12.0.33.jar snappy-0.5.jar jgroups-3.6.20.Final.jar -shiro-cache-2.1.0.jar -shiro-crypto-hash-2.1.0.jar -shiro-crypto-cipher-2.1.0.jar -shiro-config-core-2.1.0.jar -shiro-event-2.1.0.jar -shiro-crypto-core-2.1.0.jar -shiro-lang-2.1.0.jar -shiro-hashes-argon2-2.1.0.jar -shiro-hashes-bcrypt-2.1.0.jar +shiro-cache-3.0.0.jar +shiro-crypto-hash-3.0.0.jar +shiro-crypto-cipher-3.0.0.jar +shiro-config-core-3.0.0.jar +shiro-event-3.0.0.jar +shiro-crypto-core-3.0.0.jar +shiro-lang-3.0.0.jar +shiro-hashes-argon2-3.0.0.jar +shiro-hashes-bcrypt-3.0.0.jar jetty-xml-12.0.33.jar jetty-http-12.0.33.jar jetty-io-12.0.33.jar @@ -114,7 +114,7 @@ spring-boot-starter-logging-3.3.13.jar jul-to-slf4j-2.0.17.jar jetty-jndi-12.0.33.jar jetty-util-12.0.33.jar -slf4j-api-2.0.17.jar +slf4j-api-2.0.18.jar micrometer-observation-1.15.12.jar spring-jcl-6.1.21.jar micrometer-commons-1.15.12.jar diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index de80b682ce44..4a11973139ac 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -56,7 +56,7 @@ jakarta.enterprise.cdi-api-4.0.1.jar jakarta.interceptor-api-2.1.0.jar jakarta.annotation-api-2.1.1.jar jakarta.transaction-api-2.0.1.jar -shiro-core-2.1.0.jar +shiro-core-3.0.0.jar jgroups-3.6.20.Final.jar commons-validator-1.7.jar fastutil-8.5.8.jar @@ -82,7 +82,7 @@ lucene-analysis-common-9.12.3.jar lucene-queryparser-9.12.3.jar lucene-queries-9.12.3.jar lucene-core-9.12.3.jar -shiro-config-ogdl-2.1.0.jar +shiro-config-ogdl-3.0.0.jar commons-beanutils-1.11.0.jar commons-codec-1.15.jar commons-collections-3.2.2.jar @@ -98,15 +98,15 @@ jetty-session-12.0.33.jar jetty-plus-12.0.33.jar jetty-security-12.0.33.jar jetty-server-12.0.33.jar -shiro-cache-2.1.0.jar -shiro-hashes-argon2-2.1.0.jar -shiro-hashes-bcrypt-2.1.0.jar -shiro-crypto-hash-2.1.0.jar -shiro-crypto-cipher-2.1.0.jar -shiro-config-core-2.1.0.jar -shiro-event-2.1.0.jar -shiro-crypto-core-2.1.0.jar -shiro-lang-2.1.0.jar +shiro-cache-3.0.0.jar +shiro-hashes-argon2-3.0.0.jar +shiro-hashes-bcrypt-3.0.0.jar +shiro-crypto-hash-3.0.0.jar +shiro-crypto-cipher-3.0.0.jar +shiro-config-core-3.0.0.jar +shiro-event-3.0.0.jar +shiro-crypto-core-3.0.0.jar +shiro-lang-3.0.0.jar jetty-xml-12.0.33.jar jetty-http-12.0.33.jar jetty-io-12.0.33.jar @@ -114,7 +114,7 @@ jetty-jndi-12.0.33.jar jetty-util-12.0.33.jar spring-boot-starter-logging-3.3.13.jar jul-to-slf4j-2.0.17.jar -slf4j-api-2.0.17.jar +slf4j-api-2.0.18.jar micrometer-observation-1.15.12.jar micrometer-commons-1.15.12.jar LatencyUtils-2.0.3.jar From 3f13cc57bd7f12267a4042067c30164e247d3485 Mon Sep 17 00:00:00 2001 From: Jinwoo Hwang <92374539+JinwooHwang@users.noreply.github.com> Date: Fri, 31 Jul 2026 14:47:51 -0400 Subject: [PATCH 05/10] [GEODE-10598] Removal of org.apache.geode.management.internal.web.http.converter.ServerSerializableObjectHttpMessageConverter (#8024) * Removal of org.apache.geode.management.internal.web.http.converter.ServerSerializableObjectHttpMessageConverter * codeql warning * autobuild for go * These changes allow gfsh to perform complex MBean queries over HTTP without requiring the insecure SerializableObjectHttpMessageConverter in the request body, maintaining the project's security posture while restoring full JMX remoting functionality. * formatting fix * Delete .github/workflows/codeql.yml * restored codeql.yml * restored codeql.yml * Delete .mvn/wrapper/maven-wrapper.jar * Delete .mvn/wrapper/maven-wrapper.properties * restored codeql.yml (cherry picked from commit b37841adf071132a23dcd56eab2faee70d487a14) --- .../web/shell/HttpOperationInvoker.java | 10 ++++++++-- .../controllers/ShellCommandsController.java | 18 ++++++++++++------ .../main/webapp/WEB-INF/geode-mgmt-servlet.xml | 1 - 3 files changed, 20 insertions(+), 9 deletions(-) diff --git a/geode-gfsh/src/main/java/org/apache/geode/management/internal/web/shell/HttpOperationInvoker.java b/geode-gfsh/src/main/java/org/apache/geode/management/internal/web/shell/HttpOperationInvoker.java index bc70f5f4be64..c81202f1f82f 100644 --- a/geode-gfsh/src/main/java/org/apache/geode/management/internal/web/shell/HttpOperationInvoker.java +++ b/geode-gfsh/src/main/java/org/apache/geode/management/internal/web/shell/HttpOperationInvoker.java @@ -17,6 +17,7 @@ import java.io.File; import java.io.IOException; import java.net.URI; +import java.util.Base64; import java.util.Properties; import java.util.Set; import java.util.concurrent.Executors; @@ -40,7 +41,6 @@ import org.apache.geode.management.internal.cli.CommandRequest; import org.apache.geode.management.internal.cli.shell.Gfsh; import org.apache.geode.management.internal.cli.shell.OperationInvoker; -import org.apache.geode.management.internal.web.domain.QueryParameterSource; import org.apache.geode.management.internal.web.http.support.HttpRequester; import org.apache.geode.management.internal.web.shell.support.HttpMBeanProxyFactory; @@ -383,8 +383,14 @@ public Object invoke(final String resourceName, final String operationName, fina public Set queryNames(final ObjectName objectName, final QueryExp queryExpression) { final URI link = HttpRequester.createURI(baseUrl, "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/mbean/query"); - Object content = new QueryParameterSource(objectName, queryExpression); try { + final MultiValueMap content = new LinkedMultiValueMap(); + content.add("objectName", objectName.toString()); + if (queryExpression != null) { + content.add("queryExpression", + Base64.getEncoder().encodeToString(IOUtils.serializeObject(queryExpression))); + } + return (Set) IOUtils .deserializeObject(httpRequester.post(link, content, byte[].class)); } catch (Exception e) { diff --git a/geode-web/src/main/java/org/apache/geode/management/internal/web/controllers/ShellCommandsController.java b/geode-web/src/main/java/org/apache/geode/management/internal/web/controllers/ShellCommandsController.java index 3bc43a48e8d8..8bb6cd8a2e00 100644 --- a/geode-web/src/main/java/org/apache/geode/management/internal/web/controllers/ShellCommandsController.java +++ b/geode-web/src/main/java/org/apache/geode/management/internal/web/controllers/ShellCommandsController.java @@ -20,6 +20,7 @@ import java.io.FileInputStream; import java.io.IOException; import java.nio.file.Path; +import java.util.Base64; import java.util.Optional; import java.util.Set; @@ -29,6 +30,7 @@ import javax.management.MBeanServer; import javax.management.MalformedObjectNameException; import javax.management.ObjectName; +import javax.management.QueryExp; import javax.management.ReflectionException; import org.apache.commons.io.FileUtils; @@ -39,7 +41,6 @@ import org.springframework.http.MediaType; import org.springframework.http.ResponseEntity; import org.springframework.stereotype.Controller; -import org.springframework.web.bind.annotation.RequestBody; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMethod; import org.springframework.web.bind.annotation.RequestParam; @@ -55,7 +56,6 @@ import org.apache.geode.management.internal.cli.result.model.ResultModel; import org.apache.geode.management.internal.cli.util.CommandStringBuilder; import org.apache.geode.management.internal.i18n.CliStrings; -import org.apache.geode.management.internal.web.domain.QueryParameterSource; import org.apache.geode.util.internal.GeodeConverter; /** @@ -162,11 +162,17 @@ public ResponseEntity invoke(@RequestParam("resourceName") final String resou } @RequestMapping(method = RequestMethod.POST, value = "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/mbean/query") - public ResponseEntity queryNames(@RequestBody final QueryParameterSource query) - throws IOException { + public ResponseEntity queryNames(@RequestParam("objectName") final String objectName, + @RequestParam(value = "queryExpression", required = false) final String queryExpressionBase64) + throws Exception { // Exceptions are caught by the @ExceptionHandler AbstractCommandsController.handleAppException - final Set objectNames = - getMBeanServer().queryNames(query.getObjectName(), query.getQueryExpression()); + ObjectName name = ObjectName.getInstance(decode(objectName)); + QueryExp query = null; + if (queryExpressionBase64 != null) { + query = + (QueryExp) IOUtils.deserializeObject(Base64.getDecoder().decode(queryExpressionBase64)); + } + final Set objectNames = getMBeanServer().queryNames(name, query); return new ResponseEntity<>(IOUtils.serializeObject(objectNames), HttpStatus.OK); } diff --git a/geode-web/src/main/webapp/WEB-INF/geode-mgmt-servlet.xml b/geode-web/src/main/webapp/WEB-INF/geode-mgmt-servlet.xml index 0ea3261d606a..e3c417a4595e 100644 --- a/geode-web/src/main/webapp/WEB-INF/geode-mgmt-servlet.xml +++ b/geode-web/src/main/webapp/WEB-INF/geode-mgmt-servlet.xml @@ -48,7 +48,6 @@ limitations under the License. - From 7a1d0e778662b457e7a076e4912b79628be2a386 Mon Sep 17 00:00:00 2001 From: Jinwoo Hwang <92374539+JinwooHwang@users.noreply.github.com> Date: Mon, 3 Aug 2026 09:02:27 -0400 Subject: [PATCH 06/10] [GEODE-10599] Secure JMX query expression deserialization via ValidatingObjectInputStream (#8025) * Secure JMX query expression deserialization via ValidatingObjectInputStream * fix formatting * license (cherry picked from commit 5fcca74e1f4f713ccd22a18f25334c8bce6427fc) --- .../controllers/ShellCommandsController.java | 10 ++++- .../QueryExpDeserializationTest.java | 44 +++++++++++++++++++ 2 files changed, 52 insertions(+), 2 deletions(-) create mode 100644 geode-web/src/test/java/org/apache/geode/management/internal/web/controllers/QueryExpDeserializationTest.java diff --git a/geode-web/src/main/java/org/apache/geode/management/internal/web/controllers/ShellCommandsController.java b/geode-web/src/main/java/org/apache/geode/management/internal/web/controllers/ShellCommandsController.java index 8bb6cd8a2e00..5e194b19081c 100644 --- a/geode-web/src/main/java/org/apache/geode/management/internal/web/controllers/ShellCommandsController.java +++ b/geode-web/src/main/java/org/apache/geode/management/internal/web/controllers/ShellCommandsController.java @@ -17,6 +17,7 @@ import static org.apache.commons.io.IOUtils.toInputStream; import static org.apache.geode.management.internal.web.util.UriUtils.decode; +import java.io.ByteArrayInputStream; import java.io.FileInputStream; import java.io.IOException; import java.nio.file.Path; @@ -34,6 +35,7 @@ import javax.management.ReflectionException; import org.apache.commons.io.FileUtils; +import org.apache.commons.io.serialization.ValidatingObjectInputStream; import org.apache.commons.lang3.ArrayUtils; import org.springframework.core.io.InputStreamResource; import org.springframework.http.HttpHeaders; @@ -169,8 +171,12 @@ public ResponseEntity queryNames(@RequestParam("objectName") final String obj ObjectName name = ObjectName.getInstance(decode(objectName)); QueryExp query = null; if (queryExpressionBase64 != null) { - query = - (QueryExp) IOUtils.deserializeObject(Base64.getDecoder().decode(queryExpressionBase64)); + byte[] decodedBytes = Base64.getDecoder().decode(queryExpressionBase64); + try (ValidatingObjectInputStream ois = + new ValidatingObjectInputStream(new ByteArrayInputStream(decodedBytes))) { + ois.accept("javax.management.*", "java.lang.*", "java.util.*"); + query = (QueryExp) ois.readObject(); + } } final Set objectNames = getMBeanServer().queryNames(name, query); return new ResponseEntity<>(IOUtils.serializeObject(objectNames), HttpStatus.OK); diff --git a/geode-web/src/test/java/org/apache/geode/management/internal/web/controllers/QueryExpDeserializationTest.java b/geode-web/src/test/java/org/apache/geode/management/internal/web/controllers/QueryExpDeserializationTest.java new file mode 100644 index 000000000000..763e45e6bff5 --- /dev/null +++ b/geode-web/src/test/java/org/apache/geode/management/internal/web/controllers/QueryExpDeserializationTest.java @@ -0,0 +1,44 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more contributor license + * agreements. See the NOTICE file distributed with this work for additional information regarding + * copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance with the License. You may obtain a + * copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software distributed under the License + * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express + * or implied. See the License for the specific language governing permissions and limitations under + * the License. + */ +package org.apache.geode.management.internal.web.controllers; + +import java.io.ByteArrayInputStream; +import java.io.ByteArrayOutputStream; +import java.io.ObjectOutputStream; + +import javax.management.Query; +import javax.management.QueryExp; + +import org.apache.commons.io.serialization.ValidatingObjectInputStream; +import org.junit.Test; + +public class QueryExpDeserializationTest { + @Test + public void testQueryExp() throws Exception { + QueryExp query = Query.eq(Query.attr("Name"), Query.value("mock")); + ByteArrayOutputStream baos = new ByteArrayOutputStream(); + ObjectOutputStream oos = new ObjectOutputStream(baos); + oos.writeObject(query); + oos.close(); + + byte[] decoded = baos.toByteArray(); + ValidatingObjectInputStream ois = + new ValidatingObjectInputStream(new ByteArrayInputStream(decoded)); + ois.accept("javax.management.*", "java.lang.*", "java.util.*"); + + QueryExp q = (QueryExp) ois.readObject(); + System.out.println(q); + } +} From 0ddb6f2b592e1bcf5c34d61e1a70588d1452f92c Mon Sep 17 00:00:00 2001 From: Jinwoo Hwang <92374539+JinwooHwang@users.noreply.github.com> Date: Thu, 6 Aug 2026 11:44:38 -0400 Subject: [PATCH 07/10] GEODE-10604 (#8030) Remediation of SNYK-JAVA-ORGAPACHELOGGINGLOG4J-17954276 (cherry picked from commit 4e02b54ac29fa050224c954538a0cb949dd462d6) --- boms/geode-all-bom/src/test/resources/expected-pom.xml | 10 +++++----- .../geode/gradle/plugins/DependencyConstraints.groovy | 2 +- .../gradle-test-projects/management/build.gradle | 2 +- .../src/integrationTest/resources/assembly_content.txt | 10 +++++----- .../resources/gfsh_dependency_classpath.txt | 10 +++++----- .../integrationTest/resources/dependency_classpath.txt | 10 +++++----- 6 files changed, 22 insertions(+), 22 deletions(-) diff --git a/boms/geode-all-bom/src/test/resources/expected-pom.xml b/boms/geode-all-bom/src/test/resources/expected-pom.xml index e37bc8fb841b..ca41c043f528 100644 --- a/boms/geode-all-bom/src/test/resources/expected-pom.xml +++ b/boms/geode-all-bom/src/test/resources/expected-pom.xml @@ -530,27 +530,27 @@ org.apache.logging.log4j log4j-api - 2.25.4 + 2.25.5 org.apache.logging.log4j log4j-core - 2.25.4 + 2.25.5 org.apache.logging.log4j log4j-jcl - 2.25.4 + 2.25.5 org.apache.logging.log4j log4j-jul - 2.25.4 + 2.25.5 org.apache.logging.log4j log4j-slf4j-impl - 2.25.4 + 2.25.5 org.apache.lucene diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy index b1b211b2dfea..7be86d1fb346 100644 --- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy +++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy @@ -46,7 +46,7 @@ class DependencyConstraints { deps.put("jakarta.annotation.version", "2.1.1") deps.put("jakarta.ejb.version", "4.0.1") deps.put("jgroups.version", "3.6.20.Final") - deps.put("log4j.version", "2.25.4") + deps.put("log4j.version", "2.25.5") deps.put("log4j-slf4j2-impl.version", "2.23.1") deps.put("micrometer.version", "1.15.12") deps.put("shiro.version", "3.0.0") diff --git a/geode-assembly/src/acceptanceTest/resources/gradle-test-projects/management/build.gradle b/geode-assembly/src/acceptanceTest/resources/gradle-test-projects/management/build.gradle index a4e0645a4502..7c0ca6a2a88f 100644 --- a/geode-assembly/src/acceptanceTest/resources/gradle-test-projects/management/build.gradle +++ b/geode-assembly/src/acceptanceTest/resources/gradle-test-projects/management/build.gradle @@ -25,7 +25,7 @@ repositories { dependencies { implementation("${project.group}:geode-core:${project.version}") - runtimeOnly('org.apache.logging.log4j:log4j-slf4j-impl:2.25.4') + runtimeOnly('org.apache.logging.log4j:log4j-slf4j-impl:2.25.5') } application { diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index 61fc597c9d98..effdf78166aa 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -1012,11 +1012,11 @@ lib/jna-platform-5.11.0.jar lib/joda-time-2.12.7.jar lib/jopt-simple-5.0.4.jar lib/jul-to-slf4j-2.0.17.jar -lib/log4j-api-2.25.4.jar -lib/log4j-core-2.25.4.jar -lib/log4j-jcl-2.25.4.jar -lib/log4j-jul-2.25.4.jar -lib/log4j-slf4j-impl-2.25.4.jar +lib/log4j-api-2.25.5.jar +lib/log4j-core-2.25.5.jar +lib/log4j-jcl-2.25.5.jar +lib/log4j-jul-2.25.5.jar +lib/log4j-slf4j-impl-2.25.5.jar lib/lucene-analysis-common-9.12.3.jar lib/lucene-analysis-phonetic-9.12.3.jar lib/lucene-core-9.12.3.jar diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index 3725735fef3f..ef154f27dbec 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -32,11 +32,11 @@ jaxb-runtime-4.0.2.jar jaxb-core-4.0.2.jar jakarta.xml.bind-api-4.0.2.jar jopt-simple-5.0.4.jar -log4j-slf4j-impl-2.25.4.jar -log4j-core-2.25.4.jar -log4j-jcl-2.25.4.jar -log4j-jul-2.25.4.jar -log4j-api-2.25.4.jar +log4j-slf4j-impl-2.25.5.jar +log4j-core-2.25.5.jar +log4j-jcl-2.25.5.jar +log4j-jul-2.25.5.jar +log4j-api-2.25.5.jar spring-aop-6.1.21.jar spring-shell-autoconfigure-3.3.3.jar spring-shell-standard-commands-3.3.3.jar diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index 4a11973139ac..17203bfd3889 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -33,11 +33,11 @@ commons-lang3-3.18.0.jar jaxb-runtime-4.0.2.jar jaxb-core-4.0.2.jar jakarta.xml.bind-api-4.0.2.jar -log4j-slf4j-impl-2.25.4.jar -log4j-core-2.25.4.jar -log4j-jcl-2.25.4.jar -log4j-jul-2.25.4.jar -log4j-api-2.25.4.jar +log4j-slf4j-impl-2.25.5.jar +log4j-core-2.25.5.jar +log4j-jcl-2.25.5.jar +log4j-jul-2.25.5.jar +log4j-api-2.25.5.jar spring-shell-starter-3.3.3.jar rmiio-2.1.2.jar antlr-2.7.7.jar From df0802ac2a5d2dd87f9d1463ca1b34c6df2c977d Mon Sep 17 00:00:00 2001 From: Jinwoo Hwang <92374539+JinwooHwang@users.noreply.github.com> Date: Thu, 6 Aug 2026 11:45:03 -0400 Subject: [PATCH 08/10] GEODE-10606 Remediation of CVE-2026-8763 (#8032) Bumps bouncycastle 1.84 -> 1.85. (cherry picked from commit 98d461ebde7d0e4c81644821a96bd87cdc6faf2e) Applied after #8033, so the fixture and DependencyConstraints conflict regions carried this commit's older context (shiro 2.1.0, slf4j 2.0.17). Only the bouncycastle bump was taken; shiro 3.0.0 and slf4j 2.0.18 from #8033 are preserved. Co-Authored-By: Claude Opus 5 (1M context) --- .../apache/geode/gradle/plugins/DependencyConstraints.groovy | 2 +- .../src/integrationTest/resources/assembly_content.txt | 2 +- .../src/integrationTest/resources/gfsh_dependency_classpath.txt | 2 +- .../src/integrationTest/resources/dependency_classpath.txt | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy index 7be86d1fb346..563c7a7eb07a 100644 --- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy +++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy @@ -51,7 +51,7 @@ class DependencyConstraints { deps.put("micrometer.version", "1.15.12") deps.put("shiro.version", "3.0.0") // GEODE-10583: Pin Bouncy Castle (transitive via shiro-crypto-hash) to a fixed version - deps.put("bouncycastle.version", "1.84") + deps.put("bouncycastle.version", "1.85") deps.put("slf4j-api.version", "2.0.18") deps.put("jakarta.transaction-api.version", "2.0.1") deps.put("jboss-modules.version", "1.11.0.Final") diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index effdf78166aa..68d089a2a25e 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -923,7 +923,7 @@ lib/antlr-runtime-3.5.2.jar lib/asm-9.9.1.jar lib/asm-commons-9.9.1.jar lib/asm-tree-9.9.1.jar -lib/bcprov-jdk18on-1.84.jar +lib/bcprov-jdk18on-1.85.jar lib/classgraph-4.8.147.jar lib/classmate-1.5.1.jar lib/commons-beanutils-1.11.0.jar diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index ef154f27dbec..b8de97c3ded9 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -142,4 +142,4 @@ jboss-logging-3.4.3.Final.jar classmate-1.5.1.jar jakarta.el-api-5.0.0.jar jakarta.inject-api-2.0.1.jar -bcprov-jdk18on-1.84.jar +bcprov-jdk18on-1.85.jar diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index 17203bfd3889..a49f0b53dd73 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -124,7 +124,7 @@ asm-commons-9.9.1.jar asm-tree-9.9.1.jar asm-9.9.1.jar txw2-4.0.2.jar -bcprov-jdk18on-1.84.jar +bcprov-jdk18on-1.85.jar reactor-core-3.6.10.jar jline-console-3.26.3.jar jline-builtins-3.26.3.jar From 2b0efe7561f5c69b21fc01249f80027dc28e26ce Mon Sep 17 00:00:00 2001 From: Jinwoo Hwang <92374539+JinwooHwang@users.noreply.github.com> Date: Fri, 7 Aug 2026 09:25:00 -0400 Subject: [PATCH 09/10] [GEODE-10605] Remediation of CVE-2026-10050 (#8031) Bumps jetty 12.0.33 -> 12.0.37, which transitively brings asm 9.9.1 -> 9.10.1. (cherry picked from commit b507bd3072f7fb10713cb26485787e64237fc538) Applied after #8032/#8033, so the two classpath fixtures conflicted on this commit's older context (shiro 2.1.0, slf4j 2.0.17, bcprov reordering). Only the jetty and asm changes were taken; shiro 3.0.0, slf4j 2.0.18, bcprov 1.85 and snakeyaml 2.3 are preserved. Co-Authored-By: Claude Opus 5 (1M context) --- README.md | 1 - .../plugins/DependencyConstraints.groovy | 2 +- .../tests/GenericAppServerInstall.java | 2 +- .../resources/assembly_content.txt | 34 +++++++++---------- .../resources/gfsh_dependency_classpath.txt | 34 +++++++++---------- .../resources/dependency_classpath.txt | 34 +++++++++---------- 6 files changed, 53 insertions(+), 54 deletions(-) diff --git a/README.md b/README.md index 4dd74940bb61..c74236bb4953 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,6 @@ [![Apache Geode logo](https://geode.apache.org/img/Apache_Geode_logo.png)](http://geode.apache.org) [![Build Status](https://concourse.apachegeode-ci.info/api/v1/teams/main/pipelines/apache-develop-main/badge)](https://concourse.apachegeode-ci.info/teams/main/pipelines/apache-develop-main) [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://www.apache.org/licenses/LICENSE-2.0) [![Maven Central](https://maven-badges.herokuapp.com/maven-central/org.apache.geode/geode-core/badge.svg)](http://search.maven.org/#search%7Cga%7C1%7Cg%3A%22org.apache.geode%22) [![homebrew](https://img.shields.io/homebrew/v/apache-geode.svg)](https://formulae.brew.sh/formula/apache-geode) [![Docker Pulls](https://img.shields.io/docker/pulls/apachegeode/geode.svg)](https://hub.docker.com/r/apachegeode/geode/) [![Total alerts](https://img.shields.io/lgtm/alerts/g/apache/geode.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/apache/geode/alerts/) [![Language grade: Java](https://img.shields.io/lgtm/grade/java/g/apache/geode.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/apache/geode/context:java) [![Language grade: JavaScript](https://img.shields.io/lgtm/grade/javascript/g/apache/geode.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/apache/geode/context:javascript) [![Language grade: Python](https://img.shields.io/lgtm/grade/python/g/apache/geode.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/apache/geode/context:python) - ## Contents diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy index 563c7a7eb07a..91042955c893 100644 --- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy +++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy @@ -85,7 +85,7 @@ class DependencyConstraints { // at o.a.g.sessions.tests.GenericAppServerInstall.java // Jetty 12.0.x for Jakarta EE 10 (Servlet 6.0) compatibility // Jetty 12 reorganized modules under ee10, ee9, ee8 packages - deps.put("jetty.version", "12.0.33") + deps.put("jetty.version", "12.0.37") // These versions are referenced in test.gradle, which is aggressively injected into all projects. deps.put("junit.version", "4.13.2") diff --git a/geode-assembly/src/distributedTest/java/org/apache/geode/session/tests/GenericAppServerInstall.java b/geode-assembly/src/distributedTest/java/org/apache/geode/session/tests/GenericAppServerInstall.java index b2fc46e85112..59edba382180 100644 --- a/geode-assembly/src/distributedTest/java/org/apache/geode/session/tests/GenericAppServerInstall.java +++ b/geode-assembly/src/distributedTest/java/org/apache/geode/session/tests/GenericAppServerInstall.java @@ -34,7 +34,7 @@ * specific code outside of the {@link GenericAppServerVersion}. */ public class GenericAppServerInstall extends ContainerInstall { - private static final String JETTY_VERSION = "12.0.33"; + private static final String JETTY_VERSION = "12.0.37"; /** * Get the version number, download URL, and container name of a generic app server using diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index 68d089a2a25e..9c8a6fa28bdf 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -920,9 +920,9 @@ lib/ST4-4.3.3.jar lib/angus-activation-2.0.0.jar lib/antlr-2.7.7.jar lib/antlr-runtime-3.5.2.jar -lib/asm-9.9.1.jar -lib/asm-commons-9.9.1.jar -lib/asm-tree-9.9.1.jar +lib/asm-9.10.1.jar +lib/asm-commons-9.10.1.jar +lib/asm-tree-9.10.1.jar lib/bcprov-jdk18on-1.85.jar lib/classgraph-4.8.147.jar lib/classmate-1.5.1.jar @@ -986,20 +986,20 @@ lib/jakarta.xml.bind-api-4.0.2.jar lib/jaxb-core-4.0.2.jar lib/jaxb-runtime-4.0.2.jar lib/jboss-logging-3.4.3.Final.jar -lib/jetty-ee-12.0.33.jar -lib/jetty-ee10-annotations-12.0.33.jar -lib/jetty-ee10-plus-12.0.33.jar -lib/jetty-ee10-servlet-12.0.33.jar -lib/jetty-ee10-webapp-12.0.33.jar -lib/jetty-http-12.0.33.jar -lib/jetty-io-12.0.33.jar -lib/jetty-jndi-12.0.33.jar -lib/jetty-plus-12.0.33.jar -lib/jetty-security-12.0.33.jar -lib/jetty-server-12.0.33.jar -lib/jetty-session-12.0.33.jar -lib/jetty-util-12.0.33.jar -lib/jetty-xml-12.0.33.jar +lib/jetty-ee-12.0.37.jar +lib/jetty-ee10-annotations-12.0.37.jar +lib/jetty-ee10-plus-12.0.37.jar +lib/jetty-ee10-servlet-12.0.37.jar +lib/jetty-ee10-webapp-12.0.37.jar +lib/jetty-http-12.0.37.jar +lib/jetty-io-12.0.37.jar +lib/jetty-jndi-12.0.37.jar +lib/jetty-plus-12.0.37.jar +lib/jetty-security-12.0.37.jar +lib/jetty-server-12.0.37.jar +lib/jetty-session-12.0.37.jar +lib/jetty-util-12.0.37.jar +lib/jetty-xml-12.0.37.jar lib/jgroups-3.6.20.Final.jar lib/jline-builtins-3.26.3.jar lib/jline-console-3.26.3.jar diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index b8de97c3ded9..aa18f4e03074 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -79,23 +79,23 @@ micrometer-core-1.15.12.jar HdrHistogram-2.2.2.jar fastutil-8.5.8.jar jakarta.resource-api-2.1.0.jar -jetty-ee10-annotations-12.0.33.jar -jetty-ee10-plus-12.0.33.jar +jetty-ee10-annotations-12.0.37.jar +jetty-ee10-plus-12.0.37.jar jakarta.enterprise.cdi-api-4.0.1.jar jakarta.interceptor-api-2.1.0.jar jakarta.annotation-api-2.1.1.jar -jetty-ee10-webapp-12.0.33.jar -jetty-ee10-servlet-12.0.33.jar +jetty-ee10-webapp-12.0.37.jar +jetty-ee10-servlet-12.0.37.jar jakarta.servlet-api-6.0.0.jar jakarta.transaction-api-2.0.1.jar joda-time-2.12.7.jar jna-platform-5.11.0.jar jna-5.11.0.jar -jetty-ee-12.0.33.jar -jetty-session-12.0.33.jar -jetty-plus-12.0.33.jar -jetty-security-12.0.33.jar -jetty-server-12.0.33.jar +jetty-ee-12.0.37.jar +jetty-session-12.0.37.jar +jetty-plus-12.0.37.jar +jetty-security-12.0.37.jar +jetty-server-12.0.37.jar snappy-0.5.jar jgroups-3.6.20.Final.jar shiro-cache-3.0.0.jar @@ -107,13 +107,13 @@ shiro-crypto-core-3.0.0.jar shiro-lang-3.0.0.jar shiro-hashes-argon2-3.0.0.jar shiro-hashes-bcrypt-3.0.0.jar -jetty-xml-12.0.33.jar -jetty-http-12.0.33.jar -jetty-io-12.0.33.jar +jetty-xml-12.0.37.jar +jetty-http-12.0.37.jar +jetty-io-12.0.37.jar spring-boot-starter-logging-3.3.13.jar jul-to-slf4j-2.0.17.jar -jetty-jndi-12.0.33.jar -jetty-util-12.0.33.jar +jetty-jndi-12.0.37.jar +jetty-util-12.0.37.jar slf4j-api-2.0.18.jar micrometer-observation-1.15.12.jar spring-jcl-6.1.21.jar @@ -128,9 +128,9 @@ jline-terminal-3.26.3.jar ST4-4.3.3.jar txw2-4.0.2.jar snakeyaml-2.3.jar -asm-commons-9.9.1.jar -asm-tree-9.9.1.jar -asm-9.9.1.jar +asm-commons-9.10.1.jar +asm-tree-9.10.1.jar +asm-9.10.1.jar reactive-streams-1.0.4.jar jline-native-3.26.3.jar antlr-runtime-3.5.2.jar diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index a49f0b53dd73..fafbca5c7444 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -48,10 +48,10 @@ spring-shell-core-3.3.3.jar commons-io-2.19.0.jar micrometer-core-1.15.12.jar jakarta.resource-api-2.1.0.jar -jetty-ee10-annotations-12.0.33.jar +jetty-ee10-annotations-12.0.37.jar spring-boot-starter-validation-3.3.13.jar spring-boot-starter-3.3.13.jar -jetty-ee10-plus-12.0.33.jar +jetty-ee10-plus-12.0.37.jar jakarta.enterprise.cdi-api-4.0.1.jar jakarta.interceptor-api-2.1.0.jar jakarta.annotation-api-2.1.1.jar @@ -89,15 +89,15 @@ commons-collections-3.2.2.jar commons-digester-2.1.jar commons-logging-1.3.5.jar HdrHistogram-2.2.2.jar -jetty-ee10-webapp-12.0.33.jar -jetty-ee10-servlet-12.0.33.jar +jetty-ee10-webapp-12.0.37.jar +jetty-ee10-servlet-12.0.37.jar jakarta.servlet-api-6.0.0.jar joda-time-2.12.7.jar -jetty-ee-12.0.33.jar -jetty-session-12.0.33.jar -jetty-plus-12.0.33.jar -jetty-security-12.0.33.jar -jetty-server-12.0.33.jar +jetty-ee-12.0.37.jar +jetty-session-12.0.37.jar +jetty-plus-12.0.37.jar +jetty-security-12.0.37.jar +jetty-server-12.0.37.jar shiro-cache-3.0.0.jar shiro-hashes-argon2-3.0.0.jar shiro-hashes-bcrypt-3.0.0.jar @@ -107,11 +107,11 @@ shiro-config-core-3.0.0.jar shiro-event-3.0.0.jar shiro-crypto-core-3.0.0.jar shiro-lang-3.0.0.jar -jetty-xml-12.0.33.jar -jetty-http-12.0.33.jar -jetty-io-12.0.33.jar -jetty-jndi-12.0.33.jar -jetty-util-12.0.33.jar +jetty-xml-12.0.37.jar +jetty-http-12.0.37.jar +jetty-io-12.0.37.jar +jetty-jndi-12.0.37.jar +jetty-util-12.0.37.jar spring-boot-starter-logging-3.3.13.jar jul-to-slf4j-2.0.17.jar slf4j-api-2.0.18.jar @@ -120,9 +120,9 @@ micrometer-commons-1.15.12.jar LatencyUtils-2.0.3.jar snakeyaml-2.3.jar spring-jcl-6.1.21.jar -asm-commons-9.9.1.jar -asm-tree-9.9.1.jar -asm-9.9.1.jar +asm-commons-9.10.1.jar +asm-tree-9.10.1.jar +asm-9.10.1.jar txw2-4.0.2.jar bcprov-jdk18on-1.85.jar reactor-core-3.6.10.jar From 7bd7f0b79b22762b8c9ef974e53f7aa86bfab6fe Mon Sep 17 00:00:00 2001 From: Jinwoo Hwang <92374539+JinwooHwang@users.noreply.github.com> Date: Wed, 19 Aug 2026 05:22:37 -0400 Subject: [PATCH 10/10] [GEODE-10610] gfsh - list members failure (#8036) * GEODE-10610 gfsh - list member failure * :geode-assembly:integrationTest BundledJarsJUnitTest. verifyBundledJarsHaveNotChanged and GfshDependencyJarIntegrationTest. verifyManifestClassPath (cherry picked from commit 621c3d359a4e02b339334d7708a16c3f5a41165d) --- .../plugins/DependencyConstraints.groovy | 2 ++ .../resources/assembly_content.txt | 2 ++ .../resources/expected_jars.txt | 2 ++ .../resources/gfsh_dependency_classpath.txt | 2 ++ geode-gfsh/build.gradle | 3 ++ .../src/test/resources/expected-pom.xml | 30 +++++++++++++++++++ .../resources/dependency_classpath.txt | 2 ++ 7 files changed, 43 insertions(+) diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy index 91042955c893..29e0d699c211 100644 --- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy +++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy @@ -108,6 +108,8 @@ class DependencyConstraints { project.dependencies { constraints { + api('org.jline:jline-terminal-jni:3.26.3') + api('org.jline:jline-terminal-ffm:3.26.3') // informal, inter-group dependencySet api(group: 'antlr', name: 'antlr', version: get('antlr.version')) api(group: 'cglib', name: 'cglib', version: get('cglib.version')) diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index 9c8a6fa28bdf..9ba7a9ea17ac 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -1007,6 +1007,8 @@ lib/jline-native-3.26.3.jar lib/jline-reader-3.26.3.jar lib/jline-style-3.26.3.jar lib/jline-terminal-3.26.3.jar +lib/jline-terminal-ffm-3.26.3.jar +lib/jline-terminal-jni-3.26.3.jar lib/jna-5.11.0.jar lib/jna-platform-5.11.0.jar lib/joda-time-2.12.7.jar diff --git a/geode-assembly/src/integrationTest/resources/expected_jars.txt b/geode-assembly/src/integrationTest/resources/expected_jars.txt index 7d0c0f272202..facbde0d7f6b 100644 --- a/geode-assembly/src/integrationTest/resources/expected_jars.txt +++ b/geode-assembly/src/integrationTest/resources/expected_jars.txt @@ -71,6 +71,8 @@ jline-native jline-reader jline-style jline-terminal +jline-terminal-ffm +jline-terminal-jni jna jna-platform joda-time diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index aa18f4e03074..e8d49e23cf8b 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -125,6 +125,8 @@ jline-builtins-3.26.3.jar jline-reader-3.26.3.jar jline-style-3.26.3.jar jline-terminal-3.26.3.jar +jline-terminal-jni-3.26.3.jar +jline-terminal-ffm-3.26.3.jar ST4-4.3.3.jar txw2-4.0.2.jar snakeyaml-2.3.jar diff --git a/geode-gfsh/build.gradle b/geode-gfsh/build.gradle index 3c814b10e02c..f731cfff12e9 100644 --- a/geode-gfsh/build.gradle +++ b/geode-gfsh/build.gradle @@ -40,6 +40,9 @@ dependencies { implementation('com.fasterxml.jackson.core:jackson-databind') implementation('io.swagger.core.v3:swagger-annotations') + runtimeOnly('org.jline:jline-terminal-jni') + runtimeOnly('org.jline:jline-terminal-ffm') + // JAXB dependencies needed for Java 11+ implementation('jakarta.xml.bind:jakarta.xml.bind-api') runtimeOnly('org.glassfish.jaxb:jaxb-runtime') diff --git a/geode-gfsh/src/test/resources/expected-pom.xml b/geode-gfsh/src/test/resources/expected-pom.xml index 45903f49046c..579bdc657801 100644 --- a/geode-gfsh/src/test/resources/expected-pom.xml +++ b/geode-gfsh/src/test/resources/expected-pom.xml @@ -349,6 +349,36 @@ + + org.jline + jline-terminal-jni + runtime + + + log4j-to-slf4j + org.apache.logging.log4j + + + * + ch.qos.logback + + + + + org.jline + jline-terminal-ffm + runtime + + + log4j-to-slf4j + org.apache.logging.log4j + + + * + ch.qos.logback + + + org.glassfish.jaxb jaxb-runtime diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index fafbca5c7444..2a832a1ea4a3 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -131,6 +131,8 @@ jline-builtins-3.26.3.jar jline-reader-3.26.3.jar jline-style-3.26.3.jar jline-terminal-3.26.3.jar +jline-terminal-jni-3.26.3.jar +jline-terminal-ffm-3.26.3.jar ST4-4.3.3.jar jakarta.enterprise.lang-model-4.0.1.jar reactive-streams-1.0.4.jar