From 85e733afe52b1869ab4bce6fb69ff789e3e2ac84 Mon Sep 17 00:00:00 2001 From: JinwooHwang Date: Thu, 6 Aug 2026 08:09:51 -0400 Subject: [PATCH 1/4] GEODE-10605 Remediation of CVE-2026-10050 --- .../plugins/DependencyConstraints.groovy | 2 +- .../tests/GenericAppServerInstall.java | 2 +- .../resources/assembly_content.txt | 28 +++++++++---------- .../resources/gfsh_dependency_classpath.txt | 28 +++++++++---------- .../resources/dependency_classpath.txt | 28 +++++++++---------- 5 files changed, 44 insertions(+), 44 deletions(-) diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy index 02aa0e30ee3..41558f630d4 100644 --- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy +++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy @@ -85,7 +85,7 @@ class DependencyConstraints { // at o.a.g.sessions.tests.GenericAppServerInstall.java // Jetty 12.0.x for Jakarta EE 10 (Servlet 6.0) compatibility // Jetty 12 reorganized modules under ee10, ee9, ee8 packages - deps.put("jetty.version", "12.0.33") + deps.put("jetty.version", "12.0.37") // These versions are referenced in test.gradle, which is aggressively injected into all projects. deps.put("junit.version", "4.13.2") diff --git a/geode-assembly/src/distributedTest/java/org/apache/geode/session/tests/GenericAppServerInstall.java b/geode-assembly/src/distributedTest/java/org/apache/geode/session/tests/GenericAppServerInstall.java index b2fc46e8511..59edba38218 100644 --- a/geode-assembly/src/distributedTest/java/org/apache/geode/session/tests/GenericAppServerInstall.java +++ b/geode-assembly/src/distributedTest/java/org/apache/geode/session/tests/GenericAppServerInstall.java @@ -34,7 +34,7 @@ * specific code outside of the {@link GenericAppServerVersion}. */ public class GenericAppServerInstall extends ContainerInstall { - private static final String JETTY_VERSION = "12.0.33"; + private static final String JETTY_VERSION = "12.0.37"; /** * Get the version number, download URL, and container name of a generic app server using diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index eacc877be72..0762262756a 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -987,20 +987,20 @@ lib/jakarta.xml.bind-api-4.0.2.jar lib/jaxb-core-4.0.2.jar lib/jaxb-runtime-4.0.2.jar lib/jboss-logging-3.4.3.Final.jar -lib/jetty-ee-12.0.33.jar -lib/jetty-ee10-annotations-12.0.33.jar -lib/jetty-ee10-plus-12.0.33.jar -lib/jetty-ee10-servlet-12.0.33.jar -lib/jetty-ee10-webapp-12.0.33.jar -lib/jetty-http-12.0.33.jar -lib/jetty-io-12.0.33.jar -lib/jetty-jndi-12.0.33.jar -lib/jetty-plus-12.0.33.jar -lib/jetty-security-12.0.33.jar -lib/jetty-server-12.0.33.jar -lib/jetty-session-12.0.33.jar -lib/jetty-util-12.0.33.jar -lib/jetty-xml-12.0.33.jar +lib/jetty-ee-12.0.37.jar +lib/jetty-ee10-annotations-12.0.37.jar +lib/jetty-ee10-plus-12.0.37.jar +lib/jetty-ee10-servlet-12.0.37.jar +lib/jetty-ee10-webapp-12.0.37.jar +lib/jetty-http-12.0.37.jar +lib/jetty-io-12.0.37.jar +lib/jetty-jndi-12.0.37.jar +lib/jetty-plus-12.0.37.jar +lib/jetty-security-12.0.37.jar +lib/jetty-server-12.0.37.jar +lib/jetty-session-12.0.37.jar +lib/jetty-util-12.0.37.jar +lib/jetty-xml-12.0.37.jar lib/jgroups-3.6.20.Final.jar lib/jline-builtins-3.26.3.jar lib/jline-console-3.26.3.jar diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index 72435fcb718..ec977efa8c9 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -79,13 +79,13 @@ micrometer-core-1.15.12.jar HdrHistogram-2.2.2.jar fastutil-8.5.8.jar jakarta.resource-api-2.1.0.jar -jetty-ee10-annotations-12.0.33.jar -jetty-ee10-plus-12.0.33.jar +jetty-ee10-annotations-12.0.37.jar +jetty-ee10-plus-12.0.37.jar jakarta.enterprise.cdi-api-4.0.1.jar jakarta.interceptor-api-2.1.0.jar jakarta.annotation-api-2.1.1.jar -jetty-ee10-webapp-12.0.33.jar -jetty-ee10-servlet-12.0.33.jar +jetty-ee10-webapp-12.0.37.jar +jetty-ee10-servlet-12.0.37.jar jakarta.servlet-api-6.0.0.jar jakarta.transaction-api-2.0.1.jar joda-time-2.12.7.jar @@ -95,11 +95,11 @@ shiro-hashes-argon2-2.1.0.jar shiro-hashes-bcrypt-2.1.0.jar shiro-crypto-hash-2.1.0.jar bcprov-jdk18on-1.84.jar -jetty-ee-12.0.33.jar -jetty-session-12.0.33.jar -jetty-plus-12.0.33.jar -jetty-security-12.0.33.jar -jetty-server-12.0.33.jar +jetty-ee-12.0.37.jar +jetty-session-12.0.37.jar +jetty-plus-12.0.37.jar +jetty-security-12.0.37.jar +jetty-server-12.0.37.jar snappy-0.5.jar jgroups-3.6.20.Final.jar shiro-cache-2.1.0.jar @@ -108,13 +108,13 @@ shiro-config-core-2.1.0.jar shiro-event-2.1.0.jar shiro-crypto-core-2.1.0.jar shiro-lang-2.1.0.jar -jetty-xml-12.0.33.jar -jetty-http-12.0.33.jar -jetty-io-12.0.33.jar +jetty-xml-12.0.37.jar +jetty-http-12.0.37.jar +jetty-io-12.0.37.jar spring-boot-starter-logging-3.3.13.jar jul-to-slf4j-2.0.17.jar -jetty-jndi-12.0.33.jar -jetty-util-12.0.33.jar +jetty-jndi-12.0.37.jar +jetty-util-12.0.37.jar slf4j-api-2.0.17.jar jackson-annotations-2.21.jar micrometer-observation-1.15.12.jar diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index 58a97aa2c7b..b9a7c436189 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -48,10 +48,10 @@ spring-shell-core-3.3.3.jar commons-io-2.19.0.jar micrometer-core-1.15.12.jar jakarta.resource-api-2.1.0.jar -jetty-ee10-annotations-12.0.33.jar +jetty-ee10-annotations-12.0.37.jar spring-boot-starter-validation-3.3.13.jar spring-boot-starter-3.3.13.jar -jetty-ee10-plus-12.0.33.jar +jetty-ee10-plus-12.0.37.jar jakarta.enterprise.cdi-api-4.0.1.jar jakarta.interceptor-api-2.1.0.jar jakarta.annotation-api-2.1.1.jar @@ -90,30 +90,30 @@ commons-collections-3.2.2.jar commons-digester-2.1.jar commons-logging-1.3.5.jar HdrHistogram-2.2.2.jar -jetty-ee10-webapp-12.0.33.jar -jetty-ee10-servlet-12.0.33.jar +jetty-ee10-webapp-12.0.37.jar +jetty-ee10-servlet-12.0.37.jar jakarta.servlet-api-6.0.0.jar joda-time-2.12.7.jar shiro-hashes-argon2-2.1.0.jar shiro-hashes-bcrypt-2.1.0.jar shiro-crypto-hash-2.1.0.jar bcprov-jdk18on-1.84.jar -jetty-ee-12.0.33.jar -jetty-session-12.0.33.jar -jetty-plus-12.0.33.jar -jetty-security-12.0.33.jar -jetty-server-12.0.33.jar +jetty-ee-12.0.37.jar +jetty-session-12.0.37.jar +jetty-plus-12.0.37.jar +jetty-security-12.0.37.jar +jetty-server-12.0.37.jar shiro-cache-2.1.0.jar shiro-crypto-cipher-2.1.0.jar shiro-config-core-2.1.0.jar shiro-event-2.1.0.jar shiro-crypto-core-2.1.0.jar shiro-lang-2.1.0.jar -jetty-xml-12.0.33.jar -jetty-http-12.0.33.jar -jetty-io-12.0.33.jar -jetty-jndi-12.0.33.jar -jetty-util-12.0.33.jar +jetty-xml-12.0.37.jar +jetty-http-12.0.37.jar +jetty-io-12.0.37.jar +jetty-jndi-12.0.37.jar +jetty-util-12.0.37.jar spring-boot-starter-logging-3.3.13.jar jul-to-slf4j-2.0.17.jar slf4j-api-2.0.17.jar From 8fe2cd03bb1901c015a229910316865d3b2f6cf5 Mon Sep 17 00:00:00 2001 From: JinwooHwang Date: Thu, 6 Aug 2026 14:46:32 -0400 Subject: [PATCH 2/4] resolved merge conflict --- .../src/integrationTest/resources/gfsh_dependency_classpath.txt | 2 +- .../src/integrationTest/resources/dependency_classpath.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index ec977efa8c9..b7bb0bf3dc4 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -94,7 +94,7 @@ jna-5.11.0.jar shiro-hashes-argon2-2.1.0.jar shiro-hashes-bcrypt-2.1.0.jar shiro-crypto-hash-2.1.0.jar -bcprov-jdk18on-1.84.jar +bcprov-jdk18on-1.85.jar jetty-ee-12.0.37.jar jetty-session-12.0.37.jar jetty-plus-12.0.37.jar diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index b9a7c436189..e03cdb40432 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -97,7 +97,7 @@ joda-time-2.12.7.jar shiro-hashes-argon2-2.1.0.jar shiro-hashes-bcrypt-2.1.0.jar shiro-crypto-hash-2.1.0.jar -bcprov-jdk18on-1.84.jar +bcprov-jdk18on-1.85.jar jetty-ee-12.0.37.jar jetty-session-12.0.37.jar jetty-plus-12.0.37.jar From 76c093d726ef705c4684c3b85d5101ca37330229 Mon Sep 17 00:00:00 2001 From: JinwooHwang Date: Thu, 6 Aug 2026 17:29:41 -0400 Subject: [PATCH 3/4] resolved merge conflict --- .../src/integrationTest/resources/assembly_content.txt | 6 +++--- .../integrationTest/resources/gfsh_dependency_classpath.txt | 6 +++--- .../src/integrationTest/resources/dependency_classpath.txt | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index 1d9a2944d55..3e055a4b327 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -920,9 +920,9 @@ lib/ST4-4.3.3.jar lib/angus-activation-2.0.0.jar lib/antlr-2.7.7.jar lib/antlr-runtime-3.5.2.jar -lib/asm-9.9.1.jar -lib/asm-commons-9.9.1.jar -lib/asm-tree-9.9.1.jar +lib/asm-9.10.1.jar +lib/asm-commons-9.10.1.jar +lib/asm-tree-9.10.1.jar lib/bcprov-jdk18on-1.85.jar lib/classgraph-4.8.147.jar lib/classmate-1.5.1.jar diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index 6abe8c37f40..2b4a97f4eef 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -130,9 +130,9 @@ jline-style-3.26.3.jar jline-terminal-3.26.3.jar ST4-4.3.3.jar txw2-4.0.2.jar -asm-commons-9.9.1.jar -asm-tree-9.9.1.jar -asm-9.9.1.jar +asm-commons-9.10.1.jar +asm-tree-9.10.1.jar +asm-9.10.1.jar reactive-streams-1.0.4.jar jline-native-3.26.3.jar antlr-runtime-3.5.2.jar diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index 2f39f3213e7..837fc21e6a3 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -122,9 +122,9 @@ micrometer-commons-1.15.12.jar LatencyUtils-2.0.3.jar snakeyaml-2.5.jar spring-jcl-6.1.21.jar -asm-commons-9.9.1.jar -asm-tree-9.9.1.jar -asm-9.9.1.jar +asm-commons-9.10.1.jar +asm-tree-9.10.1.jar +asm-9.10.1.jar txw2-4.0.2.jar reactor-core-3.6.10.jar jline-console-3.26.3.jar From 5890febbf37cd44d1a3eba30b5a86e7c906cbf76 Mon Sep 17 00:00:00 2001 From: JinwooHwang Date: Fri, 7 Aug 2026 06:37:43 -0400 Subject: [PATCH 4/4] Triggering github action --- README.md | 1 - 1 file changed, 1 deletion(-) diff --git a/README.md b/README.md index 4dd74940bb6..c74236bb495 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,6 @@ [![Apache Geode logo](https://geode.apache.org/img/Apache_Geode_logo.png)](http://geode.apache.org) [![Build Status](https://concourse.apachegeode-ci.info/api/v1/teams/main/pipelines/apache-develop-main/badge)](https://concourse.apachegeode-ci.info/teams/main/pipelines/apache-develop-main) [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://www.apache.org/licenses/LICENSE-2.0) [![Maven Central](https://maven-badges.herokuapp.com/maven-central/org.apache.geode/geode-core/badge.svg)](http://search.maven.org/#search%7Cga%7C1%7Cg%3A%22org.apache.geode%22) [![homebrew](https://img.shields.io/homebrew/v/apache-geode.svg)](https://formulae.brew.sh/formula/apache-geode) [![Docker Pulls](https://img.shields.io/docker/pulls/apachegeode/geode.svg)](https://hub.docker.com/r/apachegeode/geode/) [![Total alerts](https://img.shields.io/lgtm/alerts/g/apache/geode.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/apache/geode/alerts/) [![Language grade: Java](https://img.shields.io/lgtm/grade/java/g/apache/geode.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/apache/geode/context:java) [![Language grade: JavaScript](https://img.shields.io/lgtm/grade/javascript/g/apache/geode.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/apache/geode/context:javascript) [![Language grade: Python](https://img.shields.io/lgtm/grade/python/g/apache/geode.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/apache/geode/context:python) - ## Contents