From 9ffb05f1ea91e50445cf2e52cad41efbd9e7b182 Mon Sep 17 00:00:00 2001 From: JinwooHwang Date: Mon, 13 Jul 2026 10:22:29 -0400 Subject: [PATCH 1/2] Remediation of CVE-2026-40984 --- .../src/test/resources/expected-pom.xml | 2 +- .../plugins/DependencyConstraints.groovy | 2 +- .../resources/assembly_content.txt | 6 ++-- .../resources/gfsh_dependency_classpath.txt | 6 ++-- .../src/test/resources/expected-pom.xml | 30 +++++++++++++++++++ .../resources/dependency_classpath.txt | 6 ++-- 6 files changed, 41 insertions(+), 11 deletions(-) diff --git a/boms/geode-all-bom/src/test/resources/expected-pom.xml b/boms/geode-all-bom/src/test/resources/expected-pom.xml index 65f6a24015d..a161a145562 100644 --- a/boms/geode-all-bom/src/test/resources/expected-pom.xml +++ b/boms/geode-all-bom/src/test/resources/expected-pom.xml @@ -195,7 +195,7 @@ io.micrometer micrometer-core - 1.14.0 + 1.15.12 io.swagger.core.v3 diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy index d71e6717bad..891da783118 100644 --- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy +++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy @@ -48,7 +48,7 @@ class DependencyConstraints { deps.put("jgroups.version", "3.6.20.Final") deps.put("log4j.version", "2.25.4") deps.put("log4j-slf4j2-impl.version", "2.23.1") - deps.put("micrometer.version", "1.14.0") + deps.put("micrometer.version", "1.15.12") deps.put("shiro.version", "2.1.0") // GEODE-10583: Pin Bouncy Castle (transitive via shiro-crypto-hash) to a fixed version deps.put("bouncycastle.version", "1.84") diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index c769db89d0e..eaa2153faed 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -1022,9 +1022,9 @@ lib/lucene-analysis-phonetic-9.12.3.jar lib/lucene-core-9.12.3.jar lib/lucene-queries-9.12.3.jar lib/lucene-queryparser-9.12.3.jar -lib/micrometer-commons-1.14.0.jar -lib/micrometer-core-1.14.0.jar -lib/micrometer-observation-1.14.0.jar +lib/micrometer-commons-1.15.12.jar +lib/micrometer-core-1.15.12.jar +lib/micrometer-observation-1.15.12.jar lib/mx4j-3.0.2.jar lib/mx4j-remote-3.0.2.jar lib/mx4j-tools-3.0.1.jar diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index b39d44afd5e..520d00ad46a 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -75,7 +75,7 @@ commons-digester-2.1.jar commons-io-2.19.0.jar commons-logging-1.3.5.jar classgraph-4.8.147.jar -micrometer-core-1.14.0.jar +micrometer-core-1.15.12.jar HdrHistogram-2.2.2.jar fastutil-8.5.8.jar jakarta.resource-api-2.1.0.jar @@ -115,9 +115,9 @@ jul-to-slf4j-2.0.17.jar jetty-jndi-12.0.33.jar jetty-util-12.0.33.jar slf4j-api-2.0.17.jar -micrometer-observation-1.14.0.jar +micrometer-observation-1.15.12.jar spring-jcl-6.1.21.jar -micrometer-commons-1.14.0.jar +micrometer-commons-1.15.12.jar LatencyUtils-2.0.3.jar reactor-core-3.6.10.jar jline-console-3.26.3.jar diff --git a/geode-core/src/test/resources/expected-pom.xml b/geode-core/src/test/resources/expected-pom.xml index f8a4cf1f007..23f621c0261 100644 --- a/geode-core/src/test/resources/expected-pom.xml +++ b/geode-core/src/test/resources/expected-pom.xml @@ -241,6 +241,36 @@ + + com.fasterxml.jackson.datatype + jackson-datatype-jdk8 + runtime + + + log4j-to-slf4j + org.apache.logging.log4j + + + * + ch.qos.logback + + + + + com.fasterxml.jackson.datatype + jackson-datatype-jsr310 + runtime + + + log4j-to-slf4j + org.apache.logging.log4j + + + * + ch.qos.logback + + + commons-validator commons-validator diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index 6b665995a61..a0cf1c1d617 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -46,7 +46,7 @@ spring-shell-standard-commands-3.3.3.jar spring-shell-standard-3.3.3.jar spring-shell-core-3.3.3.jar commons-io-2.19.0.jar -micrometer-core-1.14.0.jar +micrometer-core-1.15.12.jar jakarta.resource-api-2.1.0.jar jetty-ee10-annotations-12.0.33.jar spring-boot-starter-validation-3.3.13.jar @@ -115,8 +115,8 @@ jetty-util-12.0.33.jar spring-boot-starter-logging-3.3.13.jar jul-to-slf4j-2.0.17.jar slf4j-api-2.0.17.jar -micrometer-observation-1.14.0.jar -micrometer-commons-1.14.0.jar +micrometer-observation-1.15.12.jar +micrometer-commons-1.15.12.jar LatencyUtils-2.0.3.jar snakeyaml-2.3.jar spring-jcl-6.1.21.jar From 9ba9eddf34ee8232567e6b16fbb572cc6f7141a7 Mon Sep 17 00:00:00 2001 From: JinwooHwang Date: Mon, 13 Jul 2026 14:50:40 -0400 Subject: [PATCH 2/2] CI build failure --- .github/workflows/gradle.yml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml index 8d5a5e36df7..5c7da171a26 100644 --- a/.github/workflows/gradle.yml +++ b/.github/workflows/gradle.yml @@ -39,7 +39,7 @@ jobs: java-version: '17' distribution: 'liberica' - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run 'build install javadoc spotlessCheck rat checkPom resolveDependencies pmdMain' with Gradle @@ -104,7 +104,7 @@ jobs: java-version: | 17 - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Set JAVA_TEST_PATH to 17 @@ -153,7 +153,7 @@ jobs: java-version: | 17 - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run integration tests @@ -199,7 +199,7 @@ jobs: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run acceptance tests @@ -243,7 +243,7 @@ jobs: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run wan distributed tests @@ -289,7 +289,7 @@ jobs: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run cq distributed tests @@ -333,7 +333,7 @@ jobs: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run lucene distributed tests @@ -379,7 +379,7 @@ jobs: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run gfsh, web-mgmt, web distributed tests @@ -427,7 +427,7 @@ jobs: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - name: Setup Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c with: gradle-version: wrapper - name: Run assembly, connectors, old-client, extensions distributed tests