Skip to content

[bot] Merge 26.3 to 26.7 #1444

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
github-actions wants to merge 3 commits into
base: release26.7-SNAPSHOT
Choose a base branch
from
Open

[bot] Merge 26.3 to 26.7 #1444

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
df46309
Update Tomcat, HttpCore5, Jackson for OWASP CVE remediation (#1440)
labkey-willm Jul 9, 2026
281b17d
Port OWASP CVE remediations to 26.3: httpcore5-h2 5.4.3, pg driver 42…
labkey-willm Jul 10, 2026
1496e57
Merge 26.3 to 26.7
labkey-teamcity Jul 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -248,6 +248,8 @@ allprojects {
// force version for cloud, docker, fileTransfer, googledrive, tcrb, wnprc_ehr
force "org.apache.httpcomponents:httpcore:${httpcoreVersion}"
force "org.apache.httpcomponents.core5:httpcore5:${httpcore5Version}"
// align httpcore5-h2 with httpcore5; the transitive 5.3.6 is exposed to CVE-2026-54399/CVE-2026-54428 (fixed in 5.4.3)
force "org.apache.httpcomponents.core5:httpcore5-h2:${httpcore5Version}"
// force version for cloud, docker, fileTransfer, googledrive, tcrb, wnprc_ehr
force "org.apache.httpcomponents:httpclient:${httpclientVersion}"
force "org.apache.httpcomponents.client5:httpclient5:${httpclient5Version}"
Expand Down
21 changes: 20 additions & 1 deletion dependencyCheckSuppression.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -449,5 +449,24 @@
<packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/.*@.*$</packageUrl>
<cve>CVE-2026-53914</cve>
</suppress>

<!--
CVE-2026-54399 (httpcore5 HTTP/1.1 parser) and CVE-2026-54428 (httpcore5-h2 HTTP/2 HPACK decoder) are both scoped to Apache HttpComponents Core 5.x only. The classic httpcore 4.x line (org.apache.httpcomponents:httpcore) is EOL, has no HTTP/2 module, is not listed as affected, and has no fixed 4.4.x release. False positives for the 4.x artifact. -->
<suppress>
<notes><![CDATA[
file name: httpcore-4.4.16.jar (classic 4.x, not affected by the 5.x-scoped CVEs)
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.httpcomponents/httpcore@.*$</packageUrl>
<cve>CVE-2026-54399</cve>
<cve>CVE-2026-54428</cve>
</suppress>
<!--
CVE-2026-53914 is an unsafe-deserialization flaw in Kotlin build-cache metadata (build tooling); JetBrains (the CNA) scores it 6.7 MEDIUM (AV:L/AC:H/PR:H), not NVD's auto-assigned 9.8, and the advisory names no runtime package. The shipped Kotlin runtime jars (kotlin-stdlib, kotlin-reflect, etc.) do not execute the affected code, and no stable fixed release exists yet (only 2.4.20-Beta1). False positive for the runtime artifacts.
-->
<suppress>
<notes><![CDATA[
Kotlin runtime jars (kotlin-stdlib, kotlin-reflect, kotlin-stdlib-jdk7/jdk8) - build-tooling CVE, not applicable to runtime.
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/.*@.*$</packageUrl>
<cve>CVE-2026-53914</cve>
</suppress>
</suppressions>
8 changes: 4 additions & 4 deletions gradle.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,7 +98,7 @@ apacheDirectoryVersion=2.1.8
apacheMinaVersion=2.2.9

# Usually matches the version specified as a Spring Boot dependency (see springBootVersion below)
apacheTomcatVersion=11.0.22
apacheTomcatVersion=11.0.23

# (mothership) -> json-path -> json-smart -> accessor-smart
# (core) -> graalvm
Expand Down Expand Up @@ -195,9 +195,9 @@ httpcoreVersion=4.4.16
intellijKotlinVersion=2.3.10

# Update the three Jackson dependency versions below in tandem, unless one gets a patch release out-of-sync with the others
jacksonVersion=2.21.4
jacksonDatabindVersion=2.21.4
jacksonJaxrsBaseVersion=2.21.4
jacksonVersion=2.21.5
jacksonDatabindVersion=2.21.5
jacksonJaxrsBaseVersion=2.21.5

# Note the inconsistent version numbering for "annotations"... it no longer matches the above
jacksonAnnotationsVersion=2.21
Expand Down