MINOR: version updates for build and project dependencies (multiple CVEs are addressed) - #22939
Merged
mimaison merged 1 commit intoJul 29, 2026
Conversation
github-actions
Bot
added
triage
dejan2609
force-pushed
the
build-and-test-dependencies-version-updates
branch
2 times, most recently
from
July 26, 2026 10:14
168cf89 to
8d7eb38
Compare
dejan2609
changed the title
Contributor
Author
|
🧪 PR is tested (using this reference: https://kafka.apache.org/quickstart)
|
Contributor
Author
|
FYI @chia7712 |
Contributor
Author
|
Update: single job (build results upload to Develocity instance) failed; this is probably unrelated with PR changes, but I'll still invoke another execution for all Github Actions jobs. |
dejan2609
force-pushed
the
build-and-test-dependencies-version-updates
branch
from
July 27, 2026 13:18
8d7eb38 to
37bec52
Compare
Contributor
Author
|
Test results are fine (just a few unrelated test are failing for both Java 17 and 25):
FYI @mimaison |
Contributor
Author
|
Update:
Related links:
|
dejan2609
force-pushed
the
build-and-test-dependencies-version-updates
branch
from
July 28, 2026 09:25
37bec52 to
48cab93
Compare
Contributor
Author
|
Build is fine, but now I have to solve some minor conflicts 😅 |
…VEs are addressed)
details:
- bcpkix: 1.84 -->> 1.85
- jgit: 7.6.0 -->> 7.7.1
- junit: 5.14.3 -->> 5.14.4
- junitPlatform: 1.14.3 -->> 1.14.4
- mavenArtifact: 3.9.15 -->> 3.9.16
- swagger: 2.2.48 -->> 2.2.52
- Gradle plugins:
- gradle-versions-plugin: version update (0.54.0 -->> 0.56.0) and name change (from `com.github.ben-manes.versions plugin` to `io.github.ben-manes.versions`)
- note: plugin now supports parallel build (and hence `--no-parallel` switch is not required anymore)
- dependencycheck: 12.2.1 -->> 12.2.2
- spotbugs: 6.5.1 -->> 6.5.9
- scoverage: 8.1 -->> 9.1
- shadow: 9.4.1 -->> 9.6.1
CVEs addressed via bcpkix and jgit version updates:
- bcpkix: several vulnerabilities are addressed: https://github.com/bcgit/bc-java/blob/r1rv85/docs/releasenotes.html#L330
- JGit: these two vulnerabilities are addressed:
- CVE-2026-44432
- https://www.cve.org/CVERecord?id=CVE-2026-44432
- GHSA-mf9v-mfxr-j63j
- CVE-2026-56624
- https://www.cve.org/CVERecord?id=CVE-2026-56624
- https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6
Some notable release notes links:
- bcpkix: https://github.com/bcgit/bc-java/blob/r1rv85/docs/releasenotes.html#L22
- JGit:
- https://projects.eclipse.org/projects/technology.jgit/releases/7.7.0
- https://projects.eclipse.org/projects/technology.jgit/releases/7.7.1
- gradle-versions-plugin:
- https://github.com/ben-manes/gradle-versions-plugin/releases/tag/v0.55.0
- https://github.com/ben-manes/gradle-versions-plugin/releases/tag/v0.56.0
- scoverage gradle plugin:
- https://github.com/scoverage/gradle-scoverage/releases/tag/9.0
- https://github.com/scoverage/gradle-scoverage/releases/tag/9.1
- shadow gradle plugin: https://gradleup.com/shadow/changes/#961-2026-07-22
dejan2609
force-pushed
the
build-and-test-dependencies-version-updates
branch
from
July 28, 2026 13:14
48cab93 to
e09170b
Compare
Contributor
Author
|
@mimaison all tests results are fine ✅ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
details: - bcpkix: 1.84 -->> 1.85 - jgit: 7.6.0 -->> 7.7.1 -
junit: 5.14.3 -->> 5.14.4 - junitPlatform: 1.14.3 -->> 1.14.4 -
mavenArtifact: 3.9.15 -->> 3.9.16 - swagger: 2.2.48 -->> 2.2.52 -
Gradle plugins: - gradle-versions-plugin: version update (0.54.0 -->>
0.56.0) and name change (from
com.github.ben-manes.versions plugintoio.github.ben-manes.versions) - note: plugin now supportsparallel build (and hence
--no-parallelswitch is not requiredanymore) - dependencycheck: 12.2.1 -->> 12.2.2 - spotbugs: 6.5.1
-->> 6.5.9 - scoverage: 8.1 -->> 9.1 - shadow: 9.4.1 -->> 9.6.1
CVEs addressed via bcpkix and jgit version updates: - bcpkix: several
vulnerabilities are addressed:
https://github.com/bcgit/bc-java/blob/r1rv85/docs/releasenotes.html#L330
GHSA-mf9v-mfxr-j63j
Some notable release notes links: - bcpkix:
https://github.com/bcgit/bc-java/blob/r1rv85/docs/releasenotes.html#L22
https://projects.eclipse.org/projects/technology.jgit/releases/7.7.0
https://github.com/ben-manes/gradle-versions-plugin/releases/tag/v0.55.0
https://github.com/ben-manes/gradle-versions-plugin/releases/tag/v0.56.0
https://github.com/scoverage/gradle-scoverage/releases/tag/9.0 -
https://github.com/scoverage/gradle-scoverage/releases/tag/9.1 -
shadow gradle plugin:
https://gradleup.com/shadow/changes/#961-2026-07-22
Reviewers: Mickael Maison mickael.maison@gmail.com