Skip to content

[bot] Merge 26.7 to develop (Conflicts) #1446

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
github-actions merged 4 commits into from
Jul 15, 2026
+20 −0
Merged

[bot] Merge 26.7 to develop (Conflicts) #1446

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
df46309
Update Tomcat, HttpCore5, Jackson for OWASP CVE remediation (#1440)
labkey-willm Jul 9, 2026
281b17d
Port OWASP CVE remediations to 26.3: httpcore5-h2 5.4.3, pg driver 42…
labkey-willm Jul 10, 2026
1496e57
Merge 26.3 to 26.7
labkey-teamcity Jul 14, 2026
806b2c9
Merge 26.7 to develop
cnathe Jul 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions dependencyCheckSuppression.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -459,4 +459,24 @@
<packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/.*@.*$</packageUrl>
<cve>CVE-2026-53914</cve>
</suppress>
<!--
CVE-2026-54399 (httpcore5 HTTP/1.1 parser) and CVE-2026-54428 (httpcore5-h2 HTTP/2 HPACK decoder) are both scoped to Apache HttpComponents Core 5.x only. The classic httpcore 4.x line (org.apache.httpcomponents:httpcore) is EOL, has no HTTP/2 module, is not listed as affected, and has no fixed 4.4.x release. False positives for the 4.x artifact. -->
<suppress>
<notes><![CDATA[
file name: httpcore-4.4.16.jar (classic 4.x, not affected by the 5.x-scoped CVEs)
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.httpcomponents/httpcore@.*$</packageUrl>
<cve>CVE-2026-54399</cve>
<cve>CVE-2026-54428</cve>
</suppress>
<!--
CVE-2026-53914 is an unsafe-deserialization flaw in Kotlin build-cache metadata (build tooling); JetBrains (the CNA) scores it 6.7 MEDIUM (AV:L/AC:H/PR:H), not NVD's auto-assigned 9.8, and the advisory names no runtime package. The shipped Kotlin runtime jars (kotlin-stdlib, kotlin-reflect, etc.) do not execute the affected code, and no stable fixed release exists yet (only 2.4.20-Beta1). False positive for the runtime artifacts.
-->
<suppress>
<notes><![CDATA[
Kotlin runtime jars (kotlin-stdlib, kotlin-reflect, kotlin-stdlib-jdk7/jdk8) - build-tooling CVE, not applicable to runtime.
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/.*@.*$</packageUrl>
<cve>CVE-2026-53914</cve>
</suppress>
</suppressions>
Loading