From 20e31587f9ed883cbbdf0f4d43d16873b25acead Mon Sep 17 00:00:00 2001 From: JinwooHwang Date: Mon, 13 Jul 2026 09:53:25 -0400 Subject: [PATCH 1/2] Remediation of CVE-2026-49268 --- .../plugins/DependencyConstraints.groovy | 2 +- .../resources/assembly_content.txt | 22 +++++++------- .../resources/gfsh_dependency_classpath.txt | 22 +++++++------- .../src/test/resources/expected-pom.xml | 30 +++++++++++++++++++ .../resources/dependency_classpath.txt | 22 +++++++------- 5 files changed, 64 insertions(+), 34 deletions(-) diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy index d71e6717bad..dbe7c1ac802 100644 --- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy +++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy @@ -49,7 +49,7 @@ class DependencyConstraints { deps.put("log4j.version", "2.25.4") deps.put("log4j-slf4j2-impl.version", "2.23.1") deps.put("micrometer.version", "1.14.0") - deps.put("shiro.version", "2.1.0") + deps.put("shiro.version", "2.2.1") // GEODE-10583: Pin Bouncy Castle (transitive via shiro-crypto-hash) to a fixed version deps.put("bouncycastle.version", "1.84") deps.put("slf4j-api.version", "2.0.17") diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index c769db89d0e..5e0b0a0b5a1 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -1032,17 +1032,17 @@ lib/ra.jar lib/reactive-streams-1.0.4.jar lib/reactor-core-3.6.10.jar lib/rmiio-2.1.2.jar -lib/shiro-cache-2.1.0.jar -lib/shiro-config-core-2.1.0.jar -lib/shiro-config-ogdl-2.1.0.jar -lib/shiro-core-2.1.0.jar -lib/shiro-crypto-cipher-2.1.0.jar -lib/shiro-crypto-core-2.1.0.jar -lib/shiro-crypto-hash-2.1.0.jar -lib/shiro-event-2.1.0.jar -lib/shiro-hashes-argon2-2.1.0.jar -lib/shiro-hashes-bcrypt-2.1.0.jar -lib/shiro-lang-2.1.0.jar +lib/shiro-cache-2.2.1.jar +lib/shiro-config-core-2.2.1.jar +lib/shiro-config-ogdl-2.2.1.jar +lib/shiro-core-2.2.1.jar +lib/shiro-crypto-cipher-2.2.1.jar +lib/shiro-crypto-core-2.2.1.jar +lib/shiro-crypto-hash-2.2.1.jar +lib/shiro-event-2.2.1.jar +lib/shiro-hashes-argon2-2.2.1.jar +lib/shiro-hashes-bcrypt-2.2.1.jar +lib/shiro-lang-2.2.1.jar lib/slf4j-api-2.0.17.jar lib/snakeyaml-2.3.jar lib/snappy-0.5.jar diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index b39d44afd5e..621f19e107c 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -66,8 +66,8 @@ HikariCP-4.0.3.jar antlr-2.7.7.jar istack-commons-runtime-4.1.1.jar commons-validator-1.7.jar -shiro-core-2.1.0.jar -shiro-config-ogdl-2.1.0.jar +shiro-core-2.2.1.jar +shiro-config-ogdl-2.2.1.jar commons-beanutils-1.11.0.jar commons-codec-1.15.jar commons-collections-3.2.2.jar @@ -98,15 +98,15 @@ jetty-security-12.0.33.jar jetty-server-12.0.33.jar snappy-0.5.jar jgroups-3.6.20.Final.jar -shiro-cache-2.1.0.jar -shiro-crypto-hash-2.1.0.jar -shiro-crypto-cipher-2.1.0.jar -shiro-config-core-2.1.0.jar -shiro-event-2.1.0.jar -shiro-crypto-core-2.1.0.jar -shiro-lang-2.1.0.jar -shiro-hashes-argon2-2.1.0.jar -shiro-hashes-bcrypt-2.1.0.jar +shiro-cache-2.2.1.jar +shiro-crypto-hash-2.2.1.jar +shiro-crypto-cipher-2.2.1.jar +shiro-config-core-2.2.1.jar +shiro-event-2.2.1.jar +shiro-crypto-core-2.2.1.jar +shiro-lang-2.2.1.jar +shiro-hashes-argon2-2.2.1.jar +shiro-hashes-bcrypt-2.2.1.jar jetty-xml-12.0.33.jar jetty-http-12.0.33.jar jetty-io-12.0.33.jar diff --git a/geode-core/src/test/resources/expected-pom.xml b/geode-core/src/test/resources/expected-pom.xml index f8a4cf1f007..23f621c0261 100644 --- a/geode-core/src/test/resources/expected-pom.xml +++ b/geode-core/src/test/resources/expected-pom.xml @@ -241,6 +241,36 @@ + + com.fasterxml.jackson.datatype + jackson-datatype-jdk8 + runtime + + + log4j-to-slf4j + org.apache.logging.log4j + + + * + ch.qos.logback + + + + + com.fasterxml.jackson.datatype + jackson-datatype-jsr310 + runtime + + + log4j-to-slf4j + org.apache.logging.log4j + + + * + ch.qos.logback + + + commons-validator commons-validator diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index 6b665995a61..ff39ffe8159 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -56,7 +56,7 @@ jakarta.enterprise.cdi-api-4.0.1.jar jakarta.interceptor-api-2.1.0.jar jakarta.annotation-api-2.1.1.jar jakarta.transaction-api-2.0.1.jar -shiro-core-2.1.0.jar +shiro-core-2.2.1.jar jgroups-3.6.20.Final.jar commons-validator-1.7.jar fastutil-8.5.8.jar @@ -82,7 +82,7 @@ lucene-analysis-common-9.12.3.jar lucene-queryparser-9.12.3.jar lucene-queries-9.12.3.jar lucene-core-9.12.3.jar -shiro-config-ogdl-2.1.0.jar +shiro-config-ogdl-2.2.1.jar commons-beanutils-1.11.0.jar commons-codec-1.15.jar commons-collections-3.2.2.jar @@ -98,15 +98,15 @@ jetty-session-12.0.33.jar jetty-plus-12.0.33.jar jetty-security-12.0.33.jar jetty-server-12.0.33.jar -shiro-cache-2.1.0.jar -shiro-hashes-argon2-2.1.0.jar -shiro-hashes-bcrypt-2.1.0.jar -shiro-crypto-hash-2.1.0.jar -shiro-crypto-cipher-2.1.0.jar -shiro-config-core-2.1.0.jar -shiro-event-2.1.0.jar -shiro-crypto-core-2.1.0.jar -shiro-lang-2.1.0.jar +shiro-cache-2.2.1.jar +shiro-hashes-argon2-2.2.1.jar +shiro-hashes-bcrypt-2.2.1.jar +shiro-crypto-hash-2.2.1.jar +shiro-crypto-cipher-2.2.1.jar +shiro-config-core-2.2.1.jar +shiro-event-2.2.1.jar +shiro-crypto-core-2.2.1.jar +shiro-lang-2.2.1.jar jetty-xml-12.0.33.jar jetty-http-12.0.33.jar jetty-io-12.0.33.jar From 90f054ff93802cfcdfe2440382adcd26874b943c Mon Sep 17 00:00:00 2001 From: JinwooHwang Date: Mon, 13 Jul 2026 14:50:07 -0400 Subject: [PATCH 2/2] CI build failure --- .github/workflows/gradle.yml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml index 8d5a5e36df7..5c7da171a26 100644 --- a/.github/workflows/gradle.yml +++ b/.github/workflows/gradle.yml @@ -39,7 +39,7 @@ jobs: java-version: '17' distribution: 'liberica' - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run 'build install javadoc spotlessCheck rat checkPom resolveDependencies pmdMain' with Gradle @@ -104,7 +104,7 @@ jobs: java-version: | 17 - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Set JAVA_TEST_PATH to 17 @@ -153,7 +153,7 @@ jobs: java-version: | 17 - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run integration tests @@ -199,7 +199,7 @@ jobs: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run acceptance tests @@ -243,7 +243,7 @@ jobs: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run wan distributed tests @@ -289,7 +289,7 @@ jobs: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run cq distributed tests @@ -333,7 +333,7 @@ jobs: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run lucene distributed tests @@ -379,7 +379,7 @@ jobs: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run gfsh, web-mgmt, web distributed tests @@ -427,7 +427,7 @@ jobs: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run assembly, connectors, old-client, extensions distributed tests