From 125981a0cca07ca0316fb5a19b67fa980bb1b465 Mon Sep 17 00:00:00 2001 From: Jen Hamon Date: Tue, 18 Aug 2026 10:31:56 -0400 Subject: [PATCH 1/2] fix(build): pin Shadow plugin's log4j to 2.25.5 (CVE-2026-49844) Shadow 8.1.1 pulls log4j-core 2.20.0 (-> log4j-api 2.20.0) onto the buildscript classpath, which is vulnerable to CVE-2026-49844 (improper encoding of non-finite floats in MapMessage JSON serialization, medium). Build-time only -- log4j is not part of the published artifact -- but pinning it clears the Dependabot alert, matching the existing commons-io / plexus-utils pins in the same block. --- build.gradle | 3 +++ 1 file changed, 3 insertions(+) diff --git a/build.gradle b/build.gradle index 5074defc..bf7b4177 100644 --- a/build.gradle +++ b/build.gradle @@ -5,10 +5,13 @@ buildscript { // Dependabot alerts: // - commons-io 2.11.0 -> CVE-2024-47554 (fixed in 2.14.0) // - plexus-utils 3.5.1 -> CVE-2025-67030 (fixed in 3.6.1) + // - log4j 2.20.0 -> CVE-2026-49844 (fixed in 2.25.5) configurations.classpath { resolutionStrategy { force 'commons-io:commons-io:2.18.0' force 'org.codehaus.plexus:plexus-utils:3.6.1' + force 'org.apache.logging.log4j:log4j-api:2.25.5' + force 'org.apache.logging.log4j:log4j-core:2.25.5' } } } From 4b723bc900421f55a1931553c73c1c479cccc350 Mon Sep 17 00:00:00 2001 From: Jen Hamon Date: Tue, 18 Aug 2026 10:32:08 -0400 Subject: [PATCH 2/2] fix(deps): bump netty to 4.1.136.Final and jackson to 2.21.5 Clears 13 Dependabot alerts against the published artifact. Netty 4.1.135 -> 4.1.136.Final (10 alerts, 5 high): netty-codec CVE-2026-59901 (high) netty-codec-http CVE-2026-55831, CVE-2026-55833, CVE-2026-56745 (high), CVE-2026-56746, CVE-2026-59898, CVE-2026-59899, CVE-2026-59921 netty-codec-http2 CVE-2026-56819 (high), CVE-2026-59900 Only netty-codec-http2 is declared directly; netty-codec and netty-codec-http resolve transitively beneath it, so the single nettyVersion bump covers all three modules. Staying on the 4.1.x line rather than taking Dependabot's suggested 4.2.17.Final: grpc-netty 1.60.2 is built against Netty 4.1, and 4.2 reworked the buffer allocator and IoHandler APIs it binds to. 4.1.136 clears every Netty alert without that compatibility risk. jackson-databind 2.21.4 -> 2.21.5 (3 medium alerts, incl. CVE-2026-54515 and CVE-2026-59889). jackson-core moved in lockstep to keep the bom aligned. Verified: clean build + compileIntegrationTestJava on Temurin 17, 90/90 tests pass; shaded jar still relocates Netty correctly. --- build.gradle | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/build.gradle b/build.gradle index bf7b4177..d37df984 100644 --- a/build.gradle +++ b/build.gradle @@ -58,7 +58,9 @@ def grpcVersion = '1.60.2' // Netty is pulled in transitively by grpc-netty (1.60.2 -> 4.1.100.Final, which is vulnerable // to CVE-2025-24970). grpc-netty does not pin a patched Netty even in recent releases, so we // pin Netty directly here. Bump alongside grpc when grpc itself ships a patched Netty. -def nettyVersion = '4.1.135.Final' +// Stay on the 4.1.x line: grpc-netty 1.60.2 targets Netty 4.1 and 4.2 changed the buffer +// allocator and IoHandler APIs it depends on. +def nettyVersion = '4.1.136.Final' dependencies { api "io.grpc:grpc-protobuf:${grpcVersion}" @@ -76,8 +78,8 @@ dependencies { implementation 'com.google.api.grpc:proto-google-common-protos:2.14.3' implementation 'com.squareup.okhttp3:okhttp:4.12.0' implementation 'com.squareup.okhttp3:logging-interceptor:4.12.0' - implementation 'com.fasterxml.jackson.core:jackson-databind:2.21.4' - implementation 'com.fasterxml.jackson.core:jackson-core:2.21.4' + implementation 'com.fasterxml.jackson.core:jackson-databind:2.21.5' + implementation 'com.fasterxml.jackson.core:jackson-core:2.21.5' implementation 'com.google.code.gson:gson:2.9.1' implementation 'io.gsonfire:gson-fire:1.8.5' implementation 'org.openapitools:jackson-databind-nullable:0.2.6' @@ -89,7 +91,7 @@ dependencies { testImplementation "org.hamcrest:hamcrest:2.2" testImplementation 'org.mockito:mockito-inline:4.8.0' testImplementation 'org.slf4j:slf4j-simple:2.0.5' - testImplementation 'com.fasterxml.jackson.core:jackson-databind:2.21.4' + testImplementation 'com.fasterxml.jackson.core:jackson-databind:2.21.5' testImplementation 'org.junit.jupiter:junit-jupiter-api:5.8.0' testImplementation 'org.junit.platform:junit-platform-launcher:1.8.0' testRuntimeOnly 'org.junit.jupiter:junit-jupiter-engine:5.8.0'