From f82a829059005e380bc83606a33ad9fb6a3c9e70 Mon Sep 17 00:00:00 2001 From: JinwooHwang Date: Mon, 13 Jul 2026 09:11:46 -0400 Subject: [PATCH 1/2] Remediation of CVE-2026-54428 --- .../plugins/DependencyConstraints.groovy | 4 +-- .../resources/assembly_content.txt | 4 +-- .../resources/gfsh_dependency_classpath.txt | 4 +-- .../src/test/resources/expected-pom.xml | 30 +++++++++++++++++++ .../resources/dependency_classpath.txt | 4 +-- 5 files changed, 38 insertions(+), 8 deletions(-) diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy index d71e6717bad..b23f3f104c8 100644 --- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy +++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy @@ -175,8 +175,8 @@ class DependencyConstraints { api(group: 'org.apache.derby', name: 'derby', version: '10.14.2.0') // Apache HttpComponents 5.x - Modern HTTP client with HTTP/2 support api(group: 'org.apache.httpcomponents.client5', name: 'httpclient5', version: '5.4.4') - api(group: 'org.apache.httpcomponents.core5', name: 'httpcore5', version: '5.3.6') - api(group: 'org.apache.httpcomponents.core5', name: 'httpcore5-h2', version: '5.3.6') + api(group: 'org.apache.httpcomponents.core5', name: 'httpcore5', version: '5.4.3') + api(group: 'org.apache.httpcomponents.core5', name: 'httpcore5-h2', version: '5.4.3') // Legacy HttpComponents 4.x (keep temporarily during migration, remove after complete) api(group: 'org.apache.httpcomponents', name: 'httpclient', version: '4.5.13') api(group: 'org.apache.httpcomponents', name: 'httpcore', version: '4.4.15') diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index c769db89d0e..2cc0bf9bf7d 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -961,8 +961,8 @@ lib/geode-wan-0.0.0.jar lib/gfsh-dependencies.jar lib/hibernate-validator-8.0.2.Final.jar lib/httpclient5-5.4.4.jar -lib/httpcore5-5.3.6.jar -lib/httpcore5-h2-5.3.6.jar +lib/httpcore5-5.4.3.jar +lib/httpcore5-h2-5.4.3.jar lib/istack-commons-runtime-4.1.1.jar lib/jackson-annotations-2.21.jar lib/jackson-core-2.21.2.jar diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index b39d44afd5e..74007baf833 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -60,8 +60,8 @@ lucene-queryparser-9.12.3.jar lucene-queries-9.12.3.jar lucene-core-9.12.3.jar httpclient5-5.4.4.jar -httpcore5-h2-5.3.6.jar -httpcore5-5.3.6.jar +httpcore5-h2-5.4.3.jar +httpcore5-5.4.3.jar HikariCP-4.0.3.jar antlr-2.7.7.jar istack-commons-runtime-4.1.1.jar diff --git a/geode-core/src/test/resources/expected-pom.xml b/geode-core/src/test/resources/expected-pom.xml index f8a4cf1f007..23f621c0261 100644 --- a/geode-core/src/test/resources/expected-pom.xml +++ b/geode-core/src/test/resources/expected-pom.xml @@ -241,6 +241,36 @@ + + com.fasterxml.jackson.datatype + jackson-datatype-jdk8 + runtime + + + log4j-to-slf4j + org.apache.logging.log4j + + + * + ch.qos.logback + + + + + com.fasterxml.jackson.datatype + jackson-datatype-jsr310 + runtime + + + log4j-to-slf4j + org.apache.logging.log4j + + + * + ch.qos.logback + + + commons-validator commons-validator diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index 6b665995a61..1a1e422e02a 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -26,8 +26,8 @@ jackson-core-2.21.2.jar jackson-datatype-joda-2.21.2.jar jackson-databind-2.21.2.jar httpclient5-5.4.4.jar -httpcore5-h2-5.3.6.jar -httpcore5-5.3.6.jar +httpcore5-h2-5.4.3.jar +httpcore5-5.4.3.jar HikariCP-4.0.3.jar commons-lang3-3.18.0.jar jaxb-runtime-4.0.2.jar From fc476708c784432dd3a6906c01b429c67e59d051 Mon Sep 17 00:00:00 2001 From: JinwooHwang Date: Mon, 13 Jul 2026 14:49:43 -0400 Subject: [PATCH 2/2] CI build failure --- .github/workflows/gradle.yml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml index 8d5a5e36df7..5c7da171a26 100644 --- a/.github/workflows/gradle.yml +++ b/.github/workflows/gradle.yml @@ -39,7 +39,7 @@ jobs: java-version: '17' distribution: 'liberica' - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run 'build install javadoc spotlessCheck rat checkPom resolveDependencies pmdMain' with Gradle @@ -104,7 +104,7 @@ jobs: java-version: | 17 - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Set JAVA_TEST_PATH to 17 @@ -153,7 +153,7 @@ jobs: java-version: | 17 - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run integration tests @@ -199,7 +199,7 @@ jobs: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run acceptance tests @@ -243,7 +243,7 @@ jobs: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run wan distributed tests @@ -289,7 +289,7 @@ jobs: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run cq distributed tests @@ -333,7 +333,7 @@ jobs: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run lucene distributed tests @@ -379,7 +379,7 @@ jobs: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run gfsh, web-mgmt, web distributed tests @@ -427,7 +427,7 @@ jobs: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run assembly, connectors, old-client, extensions distributed tests