Skip to content

Commit 0c0befc

Browse files
committed
build(crypto,rpc,http,event): bump bundled libs for security fixes
1. bump bcprov-jdk18on from 1.79 to 1.84 fix CVE-2026-5598 2. bump jetty from 9.4.57 to 9.4.58 fix CVE-2025-5115 3. bump pf4j from 3.10.0 to 3.14.1 fix CVE-2025-70952 4. bump grpc-java from 1.75 to 1.81 fix CVE-2026-33871
1 parent 22e0aa3 commit 0c0befc

5 files changed

Lines changed: 260 additions & 235 deletions

File tree

build.gradle

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ ext.archInfo = [
3535
// https://github.com/grpc/grpc-java/issues/7690
3636
// https://github.com/grpc/grpc-java/pull/12319, Add support for macOS aarch64 with universal binary
3737
// https://github.com/grpc/grpc-java/pull/11371 , 1.64.x is not supported CentOS 7.
38-
ProtocGenVersion: isArm64 && isMac ? '1.76.0' : '1.60.0'
38+
ProtocGenVersion: isArm64 || isMac ? '1.81.0' : '1.60.0'
3939
],
4040
VMOptions: isArm64 ? "${rootDir}/gradle/jdk17/java-tron.vmoptions" : "${rootDir}/gradle/java-tron.vmoptions"
4141
]
@@ -90,7 +90,7 @@ subprojects {
9090
implementation group: 'org.apache.commons', name: 'commons-math', version: '2.2'
9191
implementation "org.apache.commons:commons-collections4:4.1"
9292
implementation group: 'joda-time', name: 'joda-time', version: '2.3'
93-
implementation group: 'org.bouncycastle', name: 'bcprov-jdk18on', version: '1.79'
93+
implementation group: 'org.bouncycastle', name: 'bcprov-jdk18on', version: '1.84'
9494

9595
compileOnly 'org.projectlombok:lombok:1.18.34'
9696
annotationProcessor 'org.projectlombok:lombok:1.18.34'

framework/build.gradle

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,8 @@ dependencies {
4242
implementation group: 'io.dropwizard.metrics', name: 'metrics-core', version: '3.1.2'
4343
implementation group: 'com.github.davidb', name: 'metrics-influxdb', version: '0.8.2'
4444
// http
45-
implementation 'org.eclipse.jetty:jetty-server:9.4.57.v20241219'
46-
implementation 'org.eclipse.jetty:jetty-servlet:9.4.57.v20241219'
45+
implementation 'org.eclipse.jetty:jetty-server:9.4.58.v20250814'
46+
implementation 'org.eclipse.jetty:jetty-servlet:9.4.58.v20250814'
4747
implementation 'com.alibaba:fastjson:1.2.83'
4848
// end http
4949

@@ -53,7 +53,7 @@ dependencies {
5353
// https://mvnrepository.com/artifact/javax.portlet/portlet-api
5454
compileOnly group: 'javax.portlet', name: 'portlet-api', version: '3.0.1'
5555

56-
implementation (group: 'org.pf4j', name: 'pf4j', version: '3.10.0') {
56+
implementation (group: 'org.pf4j', name: 'pf4j', version: '3.14.1') {
5757
exclude group: "org.slf4j", module: "slf4j-api"
5858
}
5959

0 commit comments

Comments
 (0)