From 61e45375fca4ffbb07a8ad8435b482c6b48c346f Mon Sep 17 00:00:00 2001 From: JinwooHwang Date: Thu, 6 Aug 2026 08:26:04 -0400 Subject: [PATCH] GEODE-10606 Remediation of CVE-2026-8763 --- .../apache/geode/gradle/plugins/DependencyConstraints.groovy | 2 +- .../src/integrationTest/resources/assembly_content.txt | 2 +- .../src/integrationTest/resources/gfsh_dependency_classpath.txt | 2 +- .../src/integrationTest/resources/dependency_classpath.txt | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy index 02aa0e30ee3..e7eeb3944ff 100644 --- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy +++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy @@ -51,7 +51,7 @@ class DependencyConstraints { deps.put("micrometer.version", "1.15.12") deps.put("shiro.version", "2.1.0") // GEODE-10583: Pin Bouncy Castle (transitive via shiro-crypto-hash) to a fixed version - deps.put("bouncycastle.version", "1.84") + deps.put("bouncycastle.version", "1.85") deps.put("slf4j-api.version", "2.0.17") deps.put("jakarta.transaction-api.version", "2.0.1") deps.put("jboss-modules.version", "1.11.0.Final") diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index eacc877be72..83f02c09a73 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -923,7 +923,7 @@ lib/antlr-runtime-3.5.2.jar lib/asm-9.9.1.jar lib/asm-commons-9.9.1.jar lib/asm-tree-9.9.1.jar -lib/bcprov-jdk18on-1.84.jar +lib/bcprov-jdk18on-1.85.jar lib/classgraph-4.8.147.jar lib/classmate-1.5.1.jar lib/commons-beanutils-1.11.0.jar diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index 72435fcb718..22ecfe5b045 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -94,7 +94,7 @@ jna-5.11.0.jar shiro-hashes-argon2-2.1.0.jar shiro-hashes-bcrypt-2.1.0.jar shiro-crypto-hash-2.1.0.jar -bcprov-jdk18on-1.84.jar +bcprov-jdk18on-1.85.jar jetty-ee-12.0.33.jar jetty-session-12.0.33.jar jetty-plus-12.0.33.jar diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index 58a97aa2c7b..f4e0aeb5464 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -97,7 +97,7 @@ joda-time-2.12.7.jar shiro-hashes-argon2-2.1.0.jar shiro-hashes-bcrypt-2.1.0.jar shiro-crypto-hash-2.1.0.jar -bcprov-jdk18on-1.84.jar +bcprov-jdk18on-1.85.jar jetty-ee-12.0.33.jar jetty-session-12.0.33.jar jetty-plus-12.0.33.jar