Skip to content

Commit b6ba908

Browse files
supersingh05supersingh05
authored
fix(sec): bump wire-runtime 5.2.0 → 6.3.0 for CVE-2026-45799 (#19094)
1 parent 56d0ca6 commit b6ba908

18 files changed

Lines changed: 402 additions & 394 deletions

File tree

‎build.gradle‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,9 @@ buildscript {
111111
// CVE-2026-56820/56821/56822 (netty-handler-ssl-ocsp); CVE-2026-59901 (netty-codec-compression):
112112
// all fixed in 4.2.16+
113113
ext.nettyVersion = '4.2.16.Final' // align all io.netty modules (excl. netty-tcnative line)
114+
// CVE-2026-45799: wire-runtime skipGroup() negative-length crash (fixed in 6.3.0+);
115+
// transitive via schema-registry-serde → wire-compiler → wire-runtime-jvm
116+
ext.wireVersion = '6.3.0'
114117
// CVE-2026-40542 / GHSA: SCRAM-SHA-256 authentication verification (httpclient5 5.6 → 5.6.1+)
115118
ext.httpClient5Version = '5.6.1'
116119
// Align org.bouncycastle *-jdk18on (bcpkix, bcprov, bcutil); CVE-2026-0636 (bcprov fixed in 1.84+)
@@ -410,7 +413,7 @@ project.ext.externalDependency = [
410413
'typesafeConfig':'com.typesafe:config:1.4.1',
411414
'wiremock':'com.github.tomakehurst:wiremock:2.10.0',
412415
'zookeeper': 'org.apache.zookeeper:zookeeper:3.8.6',
413-
'wire': 'com.squareup.wire:wire-compiler:3.7.1',
416+
'wire': "com.squareup.wire:wire-compiler:${wireVersion}",
414417
'charle': 'com.charleskorn.kaml:kaml:0.53.0',
415418
'jline':'jline:jline:1.4.1',
416419
'jetbrains':' org.jetbrains.kotlin:kotlin-stdlib:1.6.0',
@@ -627,6 +630,10 @@ configure(subprojects.findAll {! it.name.startsWith('spark-lineage')}) {
627630
details.useVersion(rootProject.ext.nettyVersion)
628631
details.because("Netty aligned to ${rootProject.ext.nettyVersion} for CVE fixes")
629632
}
633+
if (details.requested.group == 'com.squareup.wire') {
634+
details.useVersion(rootProject.ext.wireVersion)
635+
details.because("CVE-2026-45799; wire-runtime skipGroup() negative-length crash (fixed ${rootProject.ext.wireVersion}+)")
636+
}
630637
if (details.requested.group == 'io.grpc') {
631638
details.useVersion(rootProject.ext.grpcVersion)
632639
details.because("gRPC stack aligned to ${rootProject.ext.grpcVersion} (grpc-netty-shaded excluded — no gRPC transport)")

‎datahub-upgrade/gradle.lockfile‎

Lines changed: 24 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -149,23 +149,23 @@ com.microsoft.azure:msal4j:1.23.1=compileClasspath,productionRuntimeClasspath,ru
149149
com.mixpanel:mixpanel-java:1.4.4=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
150150
com.mysql:mysql-connector-j:9.4.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
151151
com.netflix.concurrency-limits:concurrency-limits-core:0.5.3=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
152-
com.palantir.javapoet:javapoet:0.6.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
152+
com.palantir.javapoet:javapoet:0.12.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
153153
com.squareup.okhttp3:okhttp-jvm:5.3.2=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
154154
com.squareup.okhttp3:okhttp:5.3.2=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
155-
com.squareup.okio:okio-fakefilesystem-jvm:3.9.1=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
156-
com.squareup.okio:okio-fakefilesystem:3.9.1=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
157-
com.squareup.okio:okio-jvm:3.16.4=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
158-
com.squareup.okio:okio:3.16.4=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
159-
com.squareup.wire:wire-compiler:5.2.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
160-
com.squareup.wire:wire-java-generator:5.2.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
161-
com.squareup.wire:wire-kotlin-generator:5.2.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
162-
com.squareup.wire:wire-runtime-jvm:5.2.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
163-
com.squareup.wire:wire-runtime:5.2.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
164-
com.squareup.wire:wire-schema-jvm:5.2.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
165-
com.squareup.wire:wire-schema:5.2.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
166-
com.squareup.wire:wire-swift-generator:5.2.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
167-
com.squareup:kotlinpoet-jvm:2.0.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
168-
com.squareup:kotlinpoet:2.0.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
155+
com.squareup.okio:okio-fakefilesystem-jvm:3.17.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
156+
com.squareup.okio:okio-fakefilesystem:3.17.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
157+
com.squareup.okio:okio-jvm:3.17.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
158+
com.squareup.okio:okio:3.17.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
159+
com.squareup.wire:wire-compiler:6.3.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
160+
com.squareup.wire:wire-java-generator:6.3.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
161+
com.squareup.wire:wire-kotlin-generator:6.3.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
162+
com.squareup.wire:wire-runtime-jvm:6.3.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
163+
com.squareup.wire:wire-runtime:6.3.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
164+
com.squareup.wire:wire-schema-jvm:6.3.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
165+
com.squareup.wire:wire-schema:6.3.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
166+
com.squareup.wire:wire-swift-generator:6.3.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
167+
com.squareup:kotlinpoet-jvm:2.2.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
168+
com.squareup:kotlinpoet:2.2.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
169169
com.sun.activation:jakarta.activation:2.0.1=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
170170
com.sun.activation:javax.activation:1.2.0=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
171171
com.sun.codemodel:codemodel:2.2=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
@@ -368,7 +368,7 @@ io.opentelemetry:opentelemetry-sdk-logs:1.62.0=compileClasspath,productionRuntim
368368
io.opentelemetry:opentelemetry-sdk-metrics:1.62.0=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
369369
io.opentelemetry:opentelemetry-sdk-trace:1.62.0=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
370370
io.opentelemetry:opentelemetry-sdk:1.62.0=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
371-
io.outfoxx:swiftpoet:1.6.5=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
371+
io.outfoxx:swiftpoet:1.6.11=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
372372
io.perfmark:perfmark-api:0.27.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
373373
io.projectreactor.netty:reactor-netty-core:1.3.5=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
374374
io.projectreactor.netty:reactor-netty-http:1.3.5=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -531,26 +531,26 @@ org.javassist:javassist:3.26.0-GA=productionRuntimeClasspath,runtimeClasspath,te
531531
org.javatuples:javatuples:1.2=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
532532
org.jctools:jctools-core:4.0.6=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
533533
org.jetbrains.kotlin:kotlin-bom:1.8.10=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
534-
org.jetbrains.kotlin:kotlin-reflect:2.0.10=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
534+
org.jetbrains.kotlin:kotlin-reflect:2.1.21=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
535535
org.jetbrains.kotlin:kotlin-script-runtime:1.9.25=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
536536
org.jetbrains.kotlin:kotlin-scripting-common:1.9.25=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
537537
org.jetbrains.kotlin:kotlin-scripting-compiler-embeddable:1.9.25=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
538538
org.jetbrains.kotlin:kotlin-scripting-compiler-impl-embeddable:1.9.25=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
539539
org.jetbrains.kotlin:kotlin-scripting-jvm:1.9.25=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
540540
org.jetbrains.kotlin:kotlin-stdlib-common:1.8.10=compileClasspath,testCompileClasspath
541-
org.jetbrains.kotlin:kotlin-stdlib-common:2.2.21=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
541+
org.jetbrains.kotlin:kotlin-stdlib-common:2.3.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
542542
org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.9.25=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
543543
org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.25=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
544544
org.jetbrains.kotlin:kotlin-stdlib:1.8.10=compileClasspath,testCompileClasspath
545-
org.jetbrains.kotlin:kotlin-stdlib:2.2.21=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
546-
org.jetbrains.kotlinx:kotlinx-datetime-jvm:0.6.1=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
547-
org.jetbrains.kotlinx:kotlinx-datetime:0.6.1=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
545+
org.jetbrains.kotlin:kotlin-stdlib:2.3.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
546+
org.jetbrains.kotlinx:kotlinx-datetime-jvm:0.7.1-0.6.x-compat=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
547+
org.jetbrains.kotlinx:kotlinx-datetime:0.7.1-0.6.x-compat=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
548+
org.jetbrains.kotlinx:kotlinx-serialization-bom:1.10.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
548549
org.jetbrains.kotlinx:kotlinx-serialization-bom:1.5.0=compileClasspath,testCompileClasspath
549-
org.jetbrains.kotlinx:kotlinx-serialization-bom:1.7.3=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
550+
org.jetbrains.kotlinx:kotlinx-serialization-core-jvm:1.10.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
550551
org.jetbrains.kotlinx:kotlinx-serialization-core-jvm:1.5.0=compileClasspath,testCompileClasspath
551-
org.jetbrains.kotlinx:kotlinx-serialization-core-jvm:1.7.3=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
552+
org.jetbrains.kotlinx:kotlinx-serialization-core:1.10.0=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
552553
org.jetbrains.kotlinx:kotlinx-serialization-core:1.5.0=compileClasspath,testCompileClasspath
553-
org.jetbrains.kotlinx:kotlinx-serialization-core:1.7.3=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
554554
org.jetbrains:annotations:13.0=compileClasspath,productionRuntimeClasspath,runtimeClasspath
555555
org.jetbrains:annotations:17.0.0=testCompileClasspath,testRuntimeClasspath
556556
org.jgrapht:jgrapht-core:1.5.3=productionRuntimeClasspath,runtimeClasspath,testRuntimeClasspath

‎metadata-jobs/common/gradle.lockfile‎

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -125,21 +125,21 @@ com.linkedin.pegasus:restli-server:29.74.2=runtimeClasspath,testRuntimeClasspath
125125
com.linkedin.pegasus:restli-spring-bridge:29.74.2=runtimeClasspath,testRuntimeClasspath
126126
com.mixpanel:mixpanel-java:1.4.4=runtimeClasspath,testRuntimeClasspath
127127
com.netflix.concurrency-limits:concurrency-limits-core:0.5.3=runtimeClasspath,testRuntimeClasspath
128-
com.palantir.javapoet:javapoet:0.6.0=runtimeClasspath,testRuntimeClasspath
129-
com.squareup.okio:okio-fakefilesystem-jvm:3.9.1=runtimeClasspath,testRuntimeClasspath
130-
com.squareup.okio:okio-fakefilesystem:3.9.1=runtimeClasspath,testRuntimeClasspath
131-
com.squareup.okio:okio-jvm:3.9.1=runtimeClasspath,testRuntimeClasspath
132-
com.squareup.okio:okio:3.9.1=runtimeClasspath,testRuntimeClasspath
133-
com.squareup.wire:wire-compiler:5.2.0=runtimeClasspath,testRuntimeClasspath
134-
com.squareup.wire:wire-java-generator:5.2.0=runtimeClasspath,testRuntimeClasspath
135-
com.squareup.wire:wire-kotlin-generator:5.2.0=runtimeClasspath,testRuntimeClasspath
136-
com.squareup.wire:wire-runtime-jvm:5.2.0=runtimeClasspath,testRuntimeClasspath
137-
com.squareup.wire:wire-runtime:5.2.0=runtimeClasspath,testRuntimeClasspath
138-
com.squareup.wire:wire-schema-jvm:5.2.0=runtimeClasspath,testRuntimeClasspath
139-
com.squareup.wire:wire-schema:5.2.0=runtimeClasspath,testRuntimeClasspath
140-
com.squareup.wire:wire-swift-generator:5.2.0=runtimeClasspath,testRuntimeClasspath
141-
com.squareup:kotlinpoet-jvm:2.0.0=runtimeClasspath,testRuntimeClasspath
142-
com.squareup:kotlinpoet:2.0.0=runtimeClasspath,testRuntimeClasspath
128+
com.palantir.javapoet:javapoet:0.12.0=runtimeClasspath,testRuntimeClasspath
129+
com.squareup.okio:okio-fakefilesystem-jvm:3.17.0=runtimeClasspath,testRuntimeClasspath
130+
com.squareup.okio:okio-fakefilesystem:3.17.0=runtimeClasspath,testRuntimeClasspath
131+
com.squareup.okio:okio-jvm:3.17.0=runtimeClasspath,testRuntimeClasspath
132+
com.squareup.okio:okio:3.17.0=runtimeClasspath,testRuntimeClasspath
133+
com.squareup.wire:wire-compiler:6.3.0=runtimeClasspath,testRuntimeClasspath
134+
com.squareup.wire:wire-java-generator:6.3.0=runtimeClasspath,testRuntimeClasspath
135+
com.squareup.wire:wire-kotlin-generator:6.3.0=runtimeClasspath,testRuntimeClasspath
136+
com.squareup.wire:wire-runtime-jvm:6.3.0=runtimeClasspath,testRuntimeClasspath
137+
com.squareup.wire:wire-runtime:6.3.0=runtimeClasspath,testRuntimeClasspath
138+
com.squareup.wire:wire-schema-jvm:6.3.0=runtimeClasspath,testRuntimeClasspath
139+
com.squareup.wire:wire-schema:6.3.0=runtimeClasspath,testRuntimeClasspath
140+
com.squareup.wire:wire-swift-generator:6.3.0=runtimeClasspath,testRuntimeClasspath
141+
com.squareup:kotlinpoet-jvm:2.2.0=runtimeClasspath,testRuntimeClasspath
142+
com.squareup:kotlinpoet:2.2.0=runtimeClasspath,testRuntimeClasspath
143143
com.sun.activation:jakarta.activation:2.0.1=runtimeClasspath,testRuntimeClasspath
144144
com.sun.activation:javax.activation:1.2.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
145145
com.sun.codemodel:codemodel:2.2=runtimeClasspath,testRuntimeClasspath
@@ -324,7 +324,7 @@ io.opentelemetry:opentelemetry-sdk-logs:1.62.0=compileClasspath,runtimeClasspath
324324
io.opentelemetry:opentelemetry-sdk-metrics:1.62.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
325325
io.opentelemetry:opentelemetry-sdk-trace:1.62.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
326326
io.opentelemetry:opentelemetry-sdk:1.62.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
327-
io.outfoxx:swiftpoet:1.6.5=runtimeClasspath,testRuntimeClasspath
327+
io.outfoxx:swiftpoet:1.6.11=runtimeClasspath,testRuntimeClasspath
328328
io.perfmark:perfmark-api:0.27.0=runtimeClasspath,testRuntimeClasspath
329329
io.projectreactor:reactor-core:3.7.5=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
330330
io.prometheus:prometheus-metrics-config:1.4.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -466,20 +466,20 @@ org.javassist:javassist:3.26.0-GA=runtimeClasspath,testRuntimeClasspath
466466
org.javatuples:javatuples:1.2=runtimeClasspath,testRuntimeClasspath
467467
org.jboss.logging:jboss-logging:3.6.1.Final=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
468468
org.jctools:jctools-core:4.0.6=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
469-
org.jetbrains.kotlin:kotlin-reflect:2.0.10=runtimeClasspath,testRuntimeClasspath
469+
org.jetbrains.kotlin:kotlin-reflect:2.1.21=runtimeClasspath,testRuntimeClasspath
470470
org.jetbrains.kotlin:kotlin-script-runtime:1.9.25=runtimeClasspath,testRuntimeClasspath
471471
org.jetbrains.kotlin:kotlin-scripting-common:1.9.25=runtimeClasspath,testRuntimeClasspath
472472
org.jetbrains.kotlin:kotlin-scripting-compiler-embeddable:1.9.25=runtimeClasspath,testRuntimeClasspath
473473
org.jetbrains.kotlin:kotlin-scripting-compiler-impl-embeddable:1.9.25=runtimeClasspath,testRuntimeClasspath
474474
org.jetbrains.kotlin:kotlin-scripting-jvm:1.9.25=runtimeClasspath,testRuntimeClasspath
475475
org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.9.25=runtimeClasspath,testRuntimeClasspath
476476
org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.25=runtimeClasspath,testRuntimeClasspath
477-
org.jetbrains.kotlin:kotlin-stdlib:2.0.21=runtimeClasspath,testRuntimeClasspath
478-
org.jetbrains.kotlinx:kotlinx-datetime-jvm:0.6.1=runtimeClasspath,testRuntimeClasspath
479-
org.jetbrains.kotlinx:kotlinx-datetime:0.6.1=runtimeClasspath,testRuntimeClasspath
480-
org.jetbrains.kotlinx:kotlinx-serialization-bom:1.7.3=runtimeClasspath,testRuntimeClasspath
481-
org.jetbrains.kotlinx:kotlinx-serialization-core-jvm:1.7.3=runtimeClasspath,testRuntimeClasspath
482-
org.jetbrains.kotlinx:kotlinx-serialization-core:1.7.3=runtimeClasspath,testRuntimeClasspath
477+
org.jetbrains.kotlin:kotlin-stdlib:2.3.0=runtimeClasspath,testRuntimeClasspath
478+
org.jetbrains.kotlinx:kotlinx-datetime-jvm:0.7.1-0.6.x-compat=runtimeClasspath,testRuntimeClasspath
479+
org.jetbrains.kotlinx:kotlinx-datetime:0.7.1-0.6.x-compat=runtimeClasspath,testRuntimeClasspath
480+
org.jetbrains.kotlinx:kotlinx-serialization-bom:1.10.0=runtimeClasspath,testRuntimeClasspath
481+
org.jetbrains.kotlinx:kotlinx-serialization-core-jvm:1.10.0=runtimeClasspath,testRuntimeClasspath
482+
org.jetbrains.kotlinx:kotlinx-serialization-core:1.10.0=runtimeClasspath,testRuntimeClasspath
483483
org.jetbrains:annotations:13.0=runtimeClasspath,testRuntimeClasspath
484484
org.jgrapht:jgrapht-core:1.5.3=runtimeClasspath,testRuntimeClasspath
485485
org.jheaps:jheaps:0.14=runtimeClasspath,testRuntimeClasspath

0 commit comments

Comments
 (0)