fix(deps): upgrade shadow plugin to resolve log4j-core XmlLayout vuln (COMP-1573)#120
Merged
cristianrcv merged 4 commits intoJul 6, 2026
Conversation
… (COMP-1573) The com.github.johnrengelman.shadow 8.1.1 build plugin transitively bundled org.apache.logging.log4j:log4j-core 2.20.0 in the build tooling classpath, which is affected by CVE-2026-34480 / GHSA-3pxv-7cmr-fjr4 (XmlLayout fails to sanitize characters forbidden by the XML 1.0 spec; fixed in log4j-core 2.25.4). Migrate to the successor plugin com.gradleup.shadow 9.5.0, which ships log4j-core 2.26.1 (>= 2.25.4). Shadow 9.x requires Gradle 9, so the Gradle wrapper is bumped 8.13 -> 9.6.1 and the GraalVM native-build-tools plugin 0.10.6 -> 1.1.3 (first line to support Gradle 9). Verified: shadowJar builds and all tests pass under Gradle 9.6.1. See: https://github.com/seqeralabs/wave-cli/security/dependabot/16 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The repo/org policy requires all GitHub Actions to be pinned to a full-length commit SHA. Pin graalvm/setup-graalvm@v1 -> @cabbb10818fabc989d6dbd508e4846596d20dd2d (v1.6.0) in build.yml (both native-image steps) and the dependency-graph workflow, matching the SHA-pinning convention already used for the other actions. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The shadow-plugin migration for the log4j fix pulled in Gradle 9 and native-build-tools 1.1.3, whose GraalVM reachability-metadata repository requires a newer reachability-metadata schema than GraalVM for JDK 21 provides. CI `nativeCompile` failed on that schema mismatch. Bump the build toolchain to JDK 25 across the repo so the GraalVM reachability metadata schema is supported: - setup-graalvm / setup-java java-version 21 -> 25 in build.yml and security-submit-dependecy-graph.yml - Gradle toolchain and native launcher languageVersion 21 -> 25 - Groovy test deps 4.0.24 -> 4.0.32 (4.0.24 cannot compile against JDK 25 class files: "Unsupported class file major version 69") sourceCompatibility/targetCompatibility stay at 17, so the shipped fat jar still runs on JRE 17+. Also fix a pre-existing broken test-report artifact name that referenced the undefined matrix.java_version (collided across all OS jobs); use matrix.os to match the nativeCompile artifact naming. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…OMP-1573) The nativeCompile failure was not a JDK-too-old problem: native-build-tools 1.1.3 downloads the latest GraalVM reachability-metadata repository, which uses the new unified reachability-metadata schema that GraalVM for JDK 21 (and 25.0.1) does not accept. Bumping the JDK could not fix it. native-build-tools 0.11.x supports Gradle 9 (needed for the shadow 9.x migration) but still uses the legacy metadata-repository schema that GraalVM 21 accepts. Downgrading 1.1.3 -> 0.11.5 removes the schema mismatch with the metadata repository left enabled. This lets us revert the collateral bumps that were only introduced to chase the 1.1.3 schema: - native-build-tools 1.1.3 -> 0.11.5 - Gradle toolchain + native launcher languageVersion 25 -> 21 - setup-graalvm / setup-java java-version 25 -> 21 - Groovy test deps 4.0.32 -> 4.0.24 Net toolchain (GraalVM/JDK 21, Groovy 4.0.24) now matches master; the only new tool versions are shadow 9.5.0, Gradle 9.6.1, and native-build-tools 0.11.5. Retains the setup-graalvm SHA pinning and the test-report artifact name fix. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
cristianrcv
requested review from
alberto-miranda,
jonmarti,
munishchouhan,
pditommaso,
ramonamela and
stefanoboriero
ramonamela
approved these changes
Jul 6, 2026
jonmarti
approved these changes
Jul 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
org.apache.logging.log4j:log4j-coreis pulled in transitively by thecom.github.johnrengelman.shadow8.1.1 Gradle build plugin (build-tooling classpath only — it is not on the application runtime classpath). Shadow 8.1.1 bundles log4j-core2.20.0, affected by CVE-2026-34480 / GHSA-3pxv-7cmr-fjr4 (Apache Log4j Core'sXmlLayoutfails to sanitize XML-1.0-forbidden characters; fixed in log4j-core2.25.4).Per policy we do not force-pin transitive dependencies — we upgrade the declaring build plugin. Only the shadow
9.xline bundles log4j-core ≥2.25.4(the8.3.xline tops out at2.25.3), and shadow9.xrequires Gradle 9:com.github.johnrengelman.shadow8.1.1→com.gradleup.shadow9.5.0(successor lineage; ships log4j-core2.26.1≥2.25.4)8.13→9.6.1(required by shadow 9.x)org.graalvm.buildtools.native0.10.6→0.11.5(the 0.11.x line adds Gradle 9 support while keeping the legacy GraalVM reachability-metadata schema)The build toolchain is unchanged from master: GraalVM/JDK 21, Groovy 4.0.24,
source/targetCompatibility17. The shipped fat jar still runs on JRE 17+.Note on native-build-tools version choice
An earlier iteration used native-build-tools
1.1.3, which brokenativeCompile: the1.xline downloads the latest GraalVM reachability-metadata repository, whose new unifiedreachability-metadata.jsonschema is not accepted by GraalVM for JDK 21 or 25.0.1 (verified in CI — bumping the JDK did not help).0.11.5supports Gradle 9 but keeps the legacy metadata schema, so the metadata repository stays enabled and the schema mismatch disappears without any JDK/Groovy changes.Also included
graalvm/setup-graalvm@v1refs to a full commit SHA (cabbb10818fabc989d6dbd508e4846596d20dd2d, v1.6.0), now required by org policy.matrix.java_version(collided across all OS jobs) → nowmatrix.os, matching thenativeCompileartifact naming.Verification
./gradlew clean test shadowJarpasses under Gradle 9.6.1 on the JDK 21 toolchainwave.jarruns (--version)nativeCompile) requires GraalVM and is verified by CI on this PRJIRA
COMP-1573: Fix Apache Log4j Core's XmlLayout fails to sanitize characters
Security Advisory
https://github.com/seqeralabs/wave-cli/security/dependabot/16
🤖 Generated with Claude Code