From 0c0befcc5eee7502d55071627080caaee65697cc Mon Sep 17 00:00:00 2001 From: halibobo1205 Date: Thu, 2 Apr 2026 12:58:41 +0800 Subject: [PATCH] build(crypto,rpc,http,event): bump bundled libs for security fixes 1. bump bcprov-jdk18on from 1.79 to 1.84 fix CVE-2026-5598 2. bump jetty from 9.4.57 to 9.4.58 fix CVE-2025-5115 3. bump pf4j from 3.10.0 to 3.14.1 fix CVE-2025-70952 4. bump grpc-java from 1.75 to 1.81 fix CVE-2026-33871 --- build.gradle | 4 +- framework/build.gradle | 6 +- gradle/verification-metadata.xml | 480 ++++++++++++++++--------------- plugins/build.gradle | 2 +- protocol/build.gradle | 3 +- 5 files changed, 260 insertions(+), 235 deletions(-) diff --git a/build.gradle b/build.gradle index 12a0622db99..4ceebadb158 100644 --- a/build.gradle +++ b/build.gradle @@ -35,7 +35,7 @@ ext.archInfo = [ // https://github.com/grpc/grpc-java/issues/7690 // https://github.com/grpc/grpc-java/pull/12319, Add support for macOS aarch64 with universal binary // https://github.com/grpc/grpc-java/pull/11371 , 1.64.x is not supported CentOS 7. - ProtocGenVersion: isArm64 && isMac ? '1.76.0' : '1.60.0' + ProtocGenVersion: isArm64 || isMac ? '1.81.0' : '1.60.0' ], VMOptions: isArm64 ? "${rootDir}/gradle/jdk17/java-tron.vmoptions" : "${rootDir}/gradle/java-tron.vmoptions" ] @@ -90,7 +90,7 @@ subprojects { implementation group: 'org.apache.commons', name: 'commons-math', version: '2.2' implementation "org.apache.commons:commons-collections4:4.1" implementation group: 'joda-time', name: 'joda-time', version: '2.3' - implementation group: 'org.bouncycastle', name: 'bcprov-jdk18on', version: '1.79' + implementation group: 'org.bouncycastle', name: 'bcprov-jdk18on', version: '1.84' compileOnly 'org.projectlombok:lombok:1.18.34' annotationProcessor 'org.projectlombok:lombok:1.18.34' diff --git a/framework/build.gradle b/framework/build.gradle index d884b6a7c49..1aa266da3cd 100644 --- a/framework/build.gradle +++ b/framework/build.gradle @@ -42,8 +42,8 @@ dependencies { implementation group: 'io.dropwizard.metrics', name: 'metrics-core', version: '3.1.2' implementation group: 'com.github.davidb', name: 'metrics-influxdb', version: '0.8.2' // http - implementation 'org.eclipse.jetty:jetty-server:9.4.57.v20241219' - implementation 'org.eclipse.jetty:jetty-servlet:9.4.57.v20241219' + implementation 'org.eclipse.jetty:jetty-server:9.4.58.v20250814' + implementation 'org.eclipse.jetty:jetty-servlet:9.4.58.v20250814' implementation 'com.alibaba:fastjson:1.2.83' // end http @@ -53,7 +53,7 @@ dependencies { // https://mvnrepository.com/artifact/javax.portlet/portlet-api compileOnly group: 'javax.portlet', name: 'portlet-api', version: '3.0.1' - implementation (group: 'org.pf4j', name: 'pf4j', version: '3.10.0') { + implementation (group: 'org.pf4j', name: 'pf4j', version: '3.14.1') { exclude group: "org.slf4j", module: "slf4j-api" } diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index 86880157f35..8ef39e7669b 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -289,12 +289,12 @@ - - - + + + - - + + @@ -315,12 +315,12 @@ - - - + + + - - + + @@ -347,12 +347,12 @@ - - - + + + - - + + @@ -363,9 +363,9 @@ - - - + + + @@ -386,12 +386,12 @@ - - - + + + - - + + @@ -404,9 +404,9 @@ - - - + + + @@ -417,12 +417,12 @@ - - - + + + - - + + @@ -467,15 +467,15 @@ - - - + + + - - + + - - + + @@ -508,14 +508,14 @@ - - - + + + - - - + + + @@ -539,12 +539,12 @@ - - - + + + - - + + @@ -888,194 +888,191 @@ - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - - - - - - - - - - + + + + + + - - + + + + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + @@ -1654,12 +1651,12 @@ - - - + + + - - + + @@ -1699,12 +1696,12 @@ - - - + + + - - + + @@ -1712,9 +1709,9 @@ - - - + + + @@ -1722,9 +1719,9 @@ - - - + + + @@ -1751,65 +1748,65 @@ - - - + + + - - + + - - - + + + - - + + - - - + + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + @@ -2012,6 +2009,17 @@ + + + + + + + + + + + @@ -2044,6 +2052,22 @@ + + + + + + + + + + + + + + + + @@ -2168,17 +2192,17 @@ - - - + + + - - + + - - - + + + diff --git a/plugins/build.gradle b/plugins/build.gradle index 2e358a884a3..fc9ef5e00d6 100644 --- a/plugins/build.gradle +++ b/plugins/build.gradle @@ -43,7 +43,7 @@ dependencies { implementation group: 'info.picocli', name: 'picocli', version: '4.6.3' implementation group: 'com.typesafe', name: 'config', version: '1.3.2' implementation group: 'me.tongfei', name: 'progressbar', version: '0.9.3' - implementation group: 'org.bouncycastle', name: 'bcprov-jdk18on', version: '1.79' + implementation group: 'org.bouncycastle', name: 'bcprov-jdk18on', version: '1.84' if (rootProject.archInfo.isArm64) { testRuntimeOnly group: 'org.fusesource.hawtjni', name: 'hawtjni-runtime', version: '1.18' // for test implementation project(":platform") diff --git a/protocol/build.gradle b/protocol/build.gradle index 04d970b59db..0ce01a9bfb8 100644 --- a/protocol/build.gradle +++ b/protocol/build.gradle @@ -2,7 +2,8 @@ apply plugin: 'com.google.protobuf' apply from: 'protoLint.gradle' def protobufVersion = '3.25.8' -def grpcVersion = '1.75.0' +// keep same version as protoc-gen-grpc-java for arm64 or macOS, see rootProject.archInfo.requires.ProtocGenVersion +def grpcVersion = '1.81.0' dependencies { api group: 'com.google.protobuf', name: 'protobuf-java', version: protobufVersion