Skip to content

feat(deps): update all non-major dependencies - #894

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/all-minor-patch
Open

feat(deps): update all non-major dependencies#894
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Jul 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Age Confidence
eclipse-temurin (source) final patch 21.0.11_10-jdk → 21.0.13_9-jdk age confidence
maven (source) minor 3.9.16 → 3.10.0 age confidence
maven (source) final minor 3.9.16-eclipse-temurin-21 → 3.10.0-eclipse-temurin-21 age confidence
com.mycila:license-maven-plugin-git build minor 5.0.0 → 5.1.2 age confidence
com.mycila:license-maven-plugin (source) build minor 5.0.0 → 5.1.2 age confidence
org.apache.ant:ant-launcher (source) build patch 1.10.17 → 1.10.18 age confidence
net.alchim31.maven:scala-maven-plugin build minor 4.9.10 → 4.10.0 age confidence
org.jacoco:jacoco-maven-plugin (source) build patch 0.8.15 → 0.8.16 age confidence
org.codehaus.mojo:build-helper-maven-plugin (source) build patch 3.6.1 → 3.6.2 age confidence
org.apache.maven.plugins:maven-surefire-plugin (source) build minor 3.5.6 → 3.6.1 age confidence
org.apache.maven.plugins:maven-jar-plugin (source) build patch 3.5.0 → 3.5.1 age confidence
org.apache.maven.plugins:maven-install-plugin (source) build minor 3.1.4 → 3.2.0 age confidence
org.apache.maven.plugins:maven-failsafe-plugin (source) build minor 3.5.6 → 3.6.1 age confidence
org.apache.maven.plugins:maven-enforcer-plugin (source) build minor 3.6.3 → 3.7.0 age confidence
io.fabric8:docker-maven-plugin build minor 0.48.1 → 0.49.0 age confidence
org.apache.maven.plugins:maven-deploy-plugin (source) build minor 3.1.4 → 3.2.0 age confidence
org.apache.maven.plugins:maven-compiler-plugin (source) build minor 3.15.0 → 3.16.0 age confidence
org.scalacheck:scalacheck_2.12 (source) test minor 1.19.0 → 1.20.0 age confidence
org.mockito:mockito-core test minor 5.23.0 → 5.24.0 age confidence
org.junit:junit-bom (source) import patch 6.1.1 → 6.1.3 age confidence
org.slf4j:jul-to-slf4j (source, changelog) compile patch 2.0.18 → 2.0.20 age confidence
org.slf4j:slf4j-api (source, changelog) compile patch 2.0.18 → 2.0.20 age confidence
ch.qos.logback:logback-core (source, changelog) compile minor 1.5.37 → 1.6.6 age confidence
ch.qos.logback:logback-classic (source, changelog) compile minor 1.5.37 → 1.6.6 age confidence
org.jetbrains.kotlin:kotlin-maven-plugin (source) build patch 2.4.0 → 2.4.21 age confidence
org.jetbrains.kotlin:kotlin-bom (source) import patch 2.4.0 → 2.4.21 age confidence
io.projectreactor:reactor-bom (source) import patch 2025.0.6 → 2025.0.8 age confidence
com.squareup.okhttp3:okhttp (source) compile patch 4.12.0 → 4.12.1 age confidence
io.netty:netty-bom (source) import patch 4.2.15.Final → 4.2.20.Final age confidence
io.micrometer:micrometer-registry-jmx compile patch 1.17.0 → 1.17.2 age confidence
io.micrometer:micrometer-registry-graphite compile patch 1.17.0 → 1.17.2 age confidence
io.micrometer:micrometer-registry-prometheus-simpleclient compile patch 1.17.0 → 1.17.2 age confidence
io.micrometer:micrometer-core compile patch 1.17.0 → 1.17.2 age confidence
com.fasterxml.jackson:jackson-bom import patch 2.22.0 → 2.22.4 age confidence
com.google.guava:guava compile minor 33.6.0-jre → 33.7.2-jre age confidence
io.dropwizard.metrics:metrics-jmx (source) compile patch 4.2.39 → 4.2.40 age confidence
io.dropwizard.metrics:metrics-healthchecks (source) compile patch 4.2.39 → 4.2.40 age confidence
io.dropwizard.metrics:metrics-graphite (source) compile patch 4.2.39 → 4.2.40 age confidence
io.dropwizard.metrics:metrics-json (source) compile patch 4.2.39 → 4.2.40 age confidence
io.dropwizard.metrics:metrics-jvm (source) compile patch 4.2.39 → 4.2.40 age confidence
io.dropwizard.metrics:metrics-core (source) compile patch 4.2.39 → 4.2.40 age confidence
net.bytebuddy:byte-buddy-parent (source) import patch 1.18.10-jdk5 → 1.18.17-jdk5 age confidence
org.bouncycastle:bcpkix-jdk18on (source) compile minor 1.84 → 1.86 age confidence

Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation

CVE-2026-102554 / GHSA-xxph-c9ww-hj94

More information

Details

CompactHashMap/CompactHashSet/MapMakerInternalMap native deserialization triggers uncontrolled memory allocation
Summary

CompactHashMap, CompactHashSet, and MapMakerInternalMap implement readObject(ObjectInputStream) by reading an attacker-controlled elementCount or initialCapacity from the stream. On the very first insertion during or after deserialization (for the CompactHash* collections, inside allocArrays()) or immediately during deserialization (for MapMakerInternalMap), the implementation eagerly allocates arrays sized to that full, unvalidated value (up to CompactHashing.MAX_SIZE = 2^30-1, ~1.07 billion, for example) before the rest of the stream's actual content has been consumed. A 72-byte malicious serialized stream containing a single tiny element can force a multi-gigabyte allocation and crash a JVM with OutOfMemoryError, dynamically confirmed against the current release.

Details

CompactHashMap.readObject() (guava/src/com/google/common/collect/CompactHashMap.java):

private void readObject(ObjectInputStream stream) throws IOException, ClassNotFoundException {
  stream.defaultReadObject();
  int elementCount = stream.readInt();
  if (elementCount < 0) {
    throw new InvalidObjectException("Invalid size: " + elementCount);
  }
  init(elementCount);
  for (int i = 0; i < elementCount; i++) {
    K key = (K) stream.readObject();
    V value = (V) stream.readObject();
    put(key, value);
  }
}

elementCount is only checked for being non-negative; there is no upper bound and no relationship enforced between the declared count and how much data actually follows in the stream. init(elementCount) (line 251) just stores the value (clamped to [1, CompactHashing.MAX_SIZE], i.e. up to 2^30-1):

void init(int expectedSize) {
  Preconditions.checkArgument(expectedSize >= 0, "Expected size must be >= 0");
  this.metadata = Ints.constrainToRange(expectedSize, 1, CompactHashing.MAX_SIZE);
}

The real allocation is deferred to allocArrays(), which fires lazily on the first put() call — i.e. after only one key/value pair has actually been read off the wire:

int allocArrays() {
  ...
  int expectedSize = metadata;
  int buckets = CompactHashing.tableSize(expectedSize);
  this.table = CompactHashing.createTable(buckets);
  setHashTableMask(buckets - 1);
  this.entries = new int[expectedSize];
  this.keys = new Object[expectedSize];
  this.values = new Object[expectedSize];
  return expectedSize;
}

With expectedSize near CompactHashing.MAX_SIZE (2^30-1), this single call allocates a hash table plus three expectedSize-length arrays — multiple gigabytes — triggered by a stream that has, at that point, only supplied one small real element. CompactHashSet.readObject()/allocArrays() have the identical shape. CompactLinkedHashMap/CompactLinkedHashSet extend these classes and inherit the same unguarded path.

The problem with MapMakerInternalMap is similar, with a size read from the serialized data and stored in a MapMaker instance for later user during deserialization, when the MapMaker is passed back to MapMakerInternalMap and segments are allocated by calling newSegment, whose implementations (example) create Segment instances (example) that allocate arrays of the requested capacity through the newTable helper.

This is the same amplification shape as the already-fixed CVE-2018-10237 (AtomicDoubleArray/CompoundOrdering: attacker declares a large size, library eagerly allocates before validating against actual stream content). That fix rewrote AtomicDoubleArray.readObject() to grow an ImmutableLongArray.Builder incrementally per element actually read, rather than pre-allocating from the declared size — Guava's own HashBiMap.readObject() documents the same defensive principle explicitly in a comment: init(16); // resist hostile attempts to allocate gratuitous heap. CompactHashMap/CompactHashSet do not follow either of these two patterns already present elsewhere in the same codebase.

Reachability: All classes are top-level, implements ... Serializable, and require no special classpath setup beyond Guava being present (near-ubiquitous on JVM backends). A native Java deserialization attacker names the class directly in a hand-crafted stream — no particular Guava factory method needs to have been used by the victim application, exactly as with the precedent CVE.

PoC

Full source and run instructions in the attached poc-guava-compacthash-dos.zip (Maven project, guava:33.7.1-jre — the current latest release — as the only dependency). The PoC:

  1. Uses reflection only to legitimately obtain a CompactHashSet instance (it is package-private; a real attacker does not need this step, since they craft the serialized bytes directly rather than calling Guava's own serialization code).
  2. Serializes one set with 1 element and one with 2 elements, diffs the two byte streams to locate the exact offset of the elementCount field (byte-precise, not guessed).
  3. Patches that one 4-byte field in the 1-element stream from 1 to 0x3FFFFFFF (CompactHashing.MAX_SIZE), leaving the rest of the 72-byte stream (one real "A" element) untouched.
  4. Feeds the resulting 72-byte malicious stream into a plain new ObjectInputStream(...).readObject() call against the real, unmodified guava-33.7.1-jre.jar.

Actual run output:


##### -Xmx8g (generous heap) ###
Located size field at offset 63, value=1 (expected 1)
Malicious stream size: 72 bytes
Declared elementCount: 1073741823 (~1.07 billion)
Real payload: 1 tiny string element ("A")
=== RESULT ===
Exception: java.lang.OutOfMemoryError: Java heap space
Time to allocate+fail: 4013 ms
Heap used before: 3 MB
Heap used after (at failure point): 4103 MB
JVM max heap (-Xmx): 8192 MB

##### -Xmx128m (ordinary service-sized heap) ###
Located size field at offset 63, value=1 (expected 1)
Malicious stream size: 72 bytes
Declared elementCount: 1073741823 (~1.07 billion)
Real payload: 1 tiny string element ("A")
=== RESULT ===
Exception: java.lang.OutOfMemoryError: Java heap space
Time to allocate+fail: 24 ms
Heap used before: 4 MB
Heap used after (at failure point): 2 MB
JVM max heap (-Xmx): 128 MB

A 72-byte input forces ~4.1 GB of real allocation before failing on an 8 GB heap, and crashes a 128 MB heap in 24 ms — over 50,000x amplification between input size and forced allocation.

To reproduce: mvn -q compile dependency:build-classpath -Dmdep.outputFile=cp.txt && java -Xmx128m -cp "target/classes:$(cat cp.txt)" poc.Poc

Impact

Uncontrolled resource consumption (CWE-770 / CWE-400) via native Java deserialization: any application that runs ObjectInputStream.readObject() on data reachable by an attacker, and has Guava on its classpath (true for a large fraction of the JVM ecosystem), can be crashed with a single ~72-byte payload, regardless of what type the application itself expected to deserialize.

Severity

CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H — identical vector to CVE-2018-10237, the precedent this is a sibling of. Recomputed with the full formula: exploitability = 8.22×0.85×0.44×0.85×0.85 = 2.221; ISS = 1-(1×1×0.44) = 0.56; impact = 6.42×0.56 = 3.595; base = roundup(5.816) = 5.9 (Medium).

Affected

com.google.guava:guava, all editions (-jre/-android) — confirmed on the current latest release, 33.7.1-jre. CompactHashMap/CompactHashSet/CompactLinkedHashMap/CompactLinkedHashSet have had this same readObject/allocArrays shape for a long time (probably since they were added in Guava 23.6), and similarly for MapMakerInternalMap (which was introduced in Guava 4.0); not tested against older individual releases.

Suggested fix

Apply the same defense already used elsewhere in this codebase: either clamp the initial init() capacity to a small constant regardless of the declared elementCount (as HashBiMap.readObject() already does — init(16); // resist hostile attempts to allocate gratuitous heap) and grow incrementally as elements are actually read, or grow the backing arrays incrementally per iteration of the deserialization loop (as the fixed AtomicDoubleArray.readObject() does via ImmutableLongArray.Builder) instead of eagerly sizing to the full attacker-declared count on first insert.

Severity

  • CVSS Score: 8.2 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

apache/maven (maven)

v3.10.0: 3.10.0

Compare Source

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

🔧 Build

📦 Dependency updates

mathieucarbou/license-maven-plugin (com.mycila:license-maven-plugin-git)

v5.1.2

Compare Source

What's Changed

Full Changelog: mathieucarbou/license-maven-plugin@v5.1.1...v5.1.2

v5.1.1

Compare Source

What's Changed

Full Changelog: mathieucarbou/license-maven-plugin@v5.1.0...v5.1.1

v5.1.0

Compare Source

What's Changed

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

@renovate renovate Bot added dependencies Pull requests that update a dependency file minor-version renovate labels Jul 6, 2026
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from c8504b4 to ccac748 Compare July 7, 2026 01:52
@renovate renovate Bot changed the title fix(deps): update import net.bytebuddy:byte-buddy-parent from v1.18.10-jdk5 to v1.18.11-jdk5 fix(deps): update all non-major dependencies Jul 7, 2026
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from a44d798 to 39ae61f Compare July 12, 2026 09:55
@renovate renovate Bot changed the title fix(deps): update all non-major dependencies feat(deps): update all non-major dependencies Jul 12, 2026
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 6c58223 to f75106d Compare July 14, 2026 09:30
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from bf9a7f4 to 0fd19d4 Compare July 28, 2026 11:43
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 3af39f5 to eecce96 Compare August 9, 2026 21:17
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from e237819 to b5dc087 Compare August 18, 2026 10:48
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from b5dc087 to c437cf6 Compare August 20, 2026 11:01
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from 4347b2b to 3b33e15 Compare September 4, 2026 01:23
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 1843006 to fccb530 Compare September 7, 2026 12:14
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 2ebd72c to 387badc Compare September 15, 2026 07:55
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from b5acaa3 to 5445229 Compare September 28, 2026 19:49
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from a07cf6c to d764547 Compare October 3, 2026 15:38
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from b0fffc9 to c83fc39 Compare October 18, 2026 00:50
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from 588d9b6 to 97bcec7 Compare October 26, 2026 16:55
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from f392475 to 3f3ad96 Compare November 2, 2026 17:11
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 3f3ad96 to b423d2e Compare November 3, 2026 00:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file minor-version renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants