From 4ab10ead3e37d18fe13667af9ab4345f16eb7535 Mon Sep 17 00:00:00 2001 From: JinwooHwang Date: Thu, 6 Aug 2026 09:04:45 -0400 Subject: [PATCH 1/5] GEODE-10607 Remediation of CVE-2026-49268 --- .../plugins/DependencyConstraints.groovy | 2 +- .../resources/assembly_content.txt | 22 +++++++++---------- .../resources/gfsh_dependency_classpath.txt | 22 +++++++++---------- .../resources/dependency_classpath.txt | 22 +++++++++---------- 4 files changed, 34 insertions(+), 34 deletions(-) diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy index 02aa0e30ee3..34c17d841fd 100644 --- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy +++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy @@ -49,7 +49,7 @@ class DependencyConstraints { deps.put("log4j.version", "2.25.4") deps.put("log4j-slf4j2-impl.version", "2.23.1") deps.put("micrometer.version", "1.15.12") - deps.put("shiro.version", "2.1.0") + deps.put("shiro.version", "3.0.0") // GEODE-10583: Pin Bouncy Castle (transitive via shiro-crypto-hash) to a fixed version deps.put("bouncycastle.version", "1.84") deps.put("slf4j-api.version", "2.0.17") diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index eacc877be72..b4a3af5058d 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -1033,17 +1033,17 @@ lib/ra.jar lib/reactive-streams-1.0.4.jar lib/reactor-core-3.6.10.jar lib/rmiio-2.1.2.jar -lib/shiro-cache-2.1.0.jar -lib/shiro-config-core-2.1.0.jar -lib/shiro-config-ogdl-2.1.0.jar -lib/shiro-core-2.1.0.jar -lib/shiro-crypto-cipher-2.1.0.jar -lib/shiro-crypto-core-2.1.0.jar -lib/shiro-crypto-hash-2.1.0.jar -lib/shiro-event-2.1.0.jar -lib/shiro-hashes-argon2-2.1.0.jar -lib/shiro-hashes-bcrypt-2.1.0.jar -lib/shiro-lang-2.1.0.jar +lib/shiro-cache-3.0.0.jar +lib/shiro-config-core-3.0.0.jar +lib/shiro-config-ogdl-3.0.0.jar +lib/shiro-core-3.0.0.jar +lib/shiro-crypto-cipher-3.0.0.jar +lib/shiro-crypto-core-3.0.0.jar +lib/shiro-crypto-hash-3.0.0.jar +lib/shiro-event-3.0.0.jar +lib/shiro-hashes-argon2-3.0.0.jar +lib/shiro-hashes-bcrypt-3.0.0.jar +lib/shiro-lang-3.0.0.jar lib/slf4j-api-2.0.17.jar lib/snakeyaml-2.5.jar lib/snappy-0.5.jar diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index 72435fcb718..be49fdadd17 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -66,8 +66,8 @@ HikariCP-4.0.3.jar antlr-2.7.7.jar istack-commons-runtime-4.1.1.jar commons-validator-1.7.jar -shiro-core-2.1.0.jar -shiro-config-ogdl-2.1.0.jar +shiro-core-3.0.0.jar +shiro-config-ogdl-3.0.0.jar commons-beanutils-1.11.0.jar commons-codec-1.15.jar commons-collections-3.2.2.jar @@ -91,9 +91,9 @@ jakarta.transaction-api-2.0.1.jar joda-time-2.12.7.jar jna-platform-5.11.0.jar jna-5.11.0.jar -shiro-hashes-argon2-2.1.0.jar -shiro-hashes-bcrypt-2.1.0.jar -shiro-crypto-hash-2.1.0.jar +shiro-hashes-argon2-3.0.0.jar +shiro-hashes-bcrypt-3.0.0.jar +shiro-crypto-hash-3.0.0.jar bcprov-jdk18on-1.84.jar jetty-ee-12.0.33.jar jetty-session-12.0.33.jar @@ -102,12 +102,12 @@ jetty-security-12.0.33.jar jetty-server-12.0.33.jar snappy-0.5.jar jgroups-3.6.20.Final.jar -shiro-cache-2.1.0.jar -shiro-crypto-cipher-2.1.0.jar -shiro-config-core-2.1.0.jar -shiro-event-2.1.0.jar -shiro-crypto-core-2.1.0.jar -shiro-lang-2.1.0.jar +shiro-cache-3.0.0.jar +shiro-crypto-cipher-3.0.0.jar +shiro-config-core-3.0.0.jar +shiro-event-3.0.0.jar +shiro-crypto-core-3.0.0.jar +shiro-lang-3.0.0.jar jetty-xml-12.0.33.jar jetty-http-12.0.33.jar jetty-io-12.0.33.jar diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index 58a97aa2c7b..e1972862a3a 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -56,7 +56,7 @@ jakarta.enterprise.cdi-api-4.0.1.jar jakarta.interceptor-api-2.1.0.jar jakarta.annotation-api-2.1.1.jar jakarta.transaction-api-2.0.1.jar -shiro-core-2.1.0.jar +shiro-core-3.0.0.jar jgroups-3.6.20.Final.jar jackson-annotations-2.21.jar commons-validator-1.7.jar @@ -83,7 +83,7 @@ lucene-analysis-common-9.12.3.jar lucene-queryparser-9.12.3.jar lucene-queries-9.12.3.jar lucene-core-9.12.3.jar -shiro-config-ogdl-2.1.0.jar +shiro-config-ogdl-3.0.0.jar commons-beanutils-1.11.0.jar commons-codec-1.15.jar commons-collections-3.2.2.jar @@ -94,21 +94,21 @@ jetty-ee10-webapp-12.0.33.jar jetty-ee10-servlet-12.0.33.jar jakarta.servlet-api-6.0.0.jar joda-time-2.12.7.jar -shiro-hashes-argon2-2.1.0.jar -shiro-hashes-bcrypt-2.1.0.jar -shiro-crypto-hash-2.1.0.jar +shiro-hashes-argon2-3.0.0.jar +shiro-hashes-bcrypt-3.0.0.jar +shiro-crypto-hash-3.0.0.jar bcprov-jdk18on-1.84.jar jetty-ee-12.0.33.jar jetty-session-12.0.33.jar jetty-plus-12.0.33.jar jetty-security-12.0.33.jar jetty-server-12.0.33.jar -shiro-cache-2.1.0.jar -shiro-crypto-cipher-2.1.0.jar -shiro-config-core-2.1.0.jar -shiro-event-2.1.0.jar -shiro-crypto-core-2.1.0.jar -shiro-lang-2.1.0.jar +shiro-cache-3.0.0.jar +shiro-crypto-cipher-3.0.0.jar +shiro-config-core-3.0.0.jar +shiro-event-3.0.0.jar +shiro-crypto-core-3.0.0.jar +shiro-lang-3.0.0.jar jetty-xml-12.0.33.jar jetty-http-12.0.33.jar jetty-io-12.0.33.jar From 16584bdbd70c4aa0bba54f0805fed1d4a0375aa2 Mon Sep 17 00:00:00 2001 From: JinwooHwang Date: Thu, 6 Aug 2026 14:49:46 -0400 Subject: [PATCH 2/5] resolved merge conflict --- .../src/integrationTest/resources/gfsh_dependency_classpath.txt | 2 +- .../src/integrationTest/resources/dependency_classpath.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index be49fdadd17..26552a6b839 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -94,7 +94,7 @@ jna-5.11.0.jar shiro-hashes-argon2-3.0.0.jar shiro-hashes-bcrypt-3.0.0.jar shiro-crypto-hash-3.0.0.jar -bcprov-jdk18on-1.84.jar +bcprov-jdk18on-1.85.jar jetty-ee-12.0.33.jar jetty-session-12.0.33.jar jetty-plus-12.0.33.jar diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index e1972862a3a..fbcd4c548c2 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -97,7 +97,7 @@ joda-time-2.12.7.jar shiro-hashes-argon2-3.0.0.jar shiro-hashes-bcrypt-3.0.0.jar shiro-crypto-hash-3.0.0.jar -bcprov-jdk18on-1.84.jar +bcprov-jdk18on-1.85.jar jetty-ee-12.0.33.jar jetty-session-12.0.33.jar jetty-plus-12.0.33.jar From 25a3397eb301cbf5d4b104803f731b08bf19158c Mon Sep 17 00:00:00 2001 From: JinwooHwang Date: Thu, 6 Aug 2026 17:43:21 -0400 Subject: [PATCH 3/5] resolved merge conflict --- boms/geode-all-bom/src/test/resources/expected-pom.xml | 2 +- .../geode/gradle/plugins/DependencyConstraints.groovy | 2 +- .../src/integrationTest/resources/assembly_content.txt | 4 ++-- .../integrationTest/resources/gfsh_dependency_classpath.txt | 4 ++-- .../src/integrationTest/resources/dependency_classpath.txt | 6 +++--- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/boms/geode-all-bom/src/test/resources/expected-pom.xml b/boms/geode-all-bom/src/test/resources/expected-pom.xml index 12f59c11743..ca41c043f52 100644 --- a/boms/geode-all-bom/src/test/resources/expected-pom.xml +++ b/boms/geode-all-bom/src/test/resources/expected-pom.xml @@ -415,7 +415,7 @@ org.slf4j slf4j-api - 2.0.17 + 2.0.18 org.springframework.hateoas diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy index b21aa09865a..68df7ac253b 100644 --- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy +++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy @@ -52,7 +52,7 @@ class DependencyConstraints { deps.put("shiro.version", "3.0.0") // GEODE-10583: Pin Bouncy Castle (transitive via shiro-crypto-hash) to a fixed version deps.put("bouncycastle.version", "1.85") - deps.put("slf4j-api.version", "2.0.17") + deps.put("slf4j-api.version", "2.0.18") deps.put("jakarta.transaction-api.version", "2.0.1") deps.put("jboss-modules.version", "1.11.0.Final") deps.put("jackson.version", "2.21.5") diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index 2f55d149dfe..e06b7d60b23 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -1012,7 +1012,7 @@ lib/jna-5.11.0.jar lib/jna-platform-5.11.0.jar lib/joda-time-2.12.7.jar lib/jopt-simple-5.0.4.jar -lib/jul-to-slf4j-2.0.17.jar +lib/jul-to-slf4j-2.0.18.jar lib/log4j-api-2.25.5.jar lib/log4j-core-2.25.5.jar lib/log4j-jcl-2.25.5.jar @@ -1044,7 +1044,7 @@ lib/shiro-event-3.0.0.jar lib/shiro-hashes-argon2-3.0.0.jar lib/shiro-hashes-bcrypt-3.0.0.jar lib/shiro-lang-3.0.0.jar -lib/slf4j-api-2.0.17.jar +lib/slf4j-api-2.0.18.jar lib/snakeyaml-2.5.jar lib/snappy-0.5.jar lib/spring-aop-6.1.21.jar diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index 559f98125d5..867b7f39a01 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -112,10 +112,10 @@ jetty-xml-12.0.33.jar jetty-http-12.0.33.jar jetty-io-12.0.33.jar spring-boot-starter-logging-3.3.13.jar -jul-to-slf4j-2.0.17.jar +jul-to-slf4j-2.0.18.jar jetty-jndi-12.0.33.jar jetty-util-12.0.33.jar -slf4j-api-2.0.17.jar +slf4j-api-2.0.18.jar jackson-annotations-2.21.jar micrometer-observation-1.15.12.jar spring-jcl-6.1.21.jar diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index 61d1e21f4ad..042b4d50113 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -111,12 +111,12 @@ shiro-crypto-core-3.0.0.jar shiro-lang-3.0.0.jar jetty-xml-12.0.33.jar jetty-http-12.0.33.jar -jetty-io-12.0.33.jar +jetty-io-1git 2.0.33.jar jetty-jndi-12.0.33.jar jetty-util-12.0.33.jar spring-boot-starter-logging-3.3.13.jar -jul-to-slf4j-2.0.17.jar -slf4j-api-2.0.17.jar +jul-to-slf4j-2.0.18.jar +slf4j-api-2.0.18.jar micrometer-observation-1.15.12.jar micrometer-commons-1.15.12.jar LatencyUtils-2.0.3.jar From e751f55a1f845b94e2607cbcc8171db8b69062bd Mon Sep 17 00:00:00 2001 From: JinwooHwang Date: Fri, 7 Aug 2026 06:36:58 -0400 Subject: [PATCH 4/5] Triggering github action --- README.md | 1 - 1 file changed, 1 deletion(-) diff --git a/README.md b/README.md index 4dd74940bb6..c74236bb495 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,6 @@ [![Apache Geode logo](https://geode.apache.org/img/Apache_Geode_logo.png)](http://geode.apache.org) [![Build Status](https://concourse.apachegeode-ci.info/api/v1/teams/main/pipelines/apache-develop-main/badge)](https://concourse.apachegeode-ci.info/teams/main/pipelines/apache-develop-main) [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://www.apache.org/licenses/LICENSE-2.0) [![Maven Central](https://maven-badges.herokuapp.com/maven-central/org.apache.geode/geode-core/badge.svg)](http://search.maven.org/#search%7Cga%7C1%7Cg%3A%22org.apache.geode%22) [![homebrew](https://img.shields.io/homebrew/v/apache-geode.svg)](https://formulae.brew.sh/formula/apache-geode) [![Docker Pulls](https://img.shields.io/docker/pulls/apachegeode/geode.svg)](https://hub.docker.com/r/apachegeode/geode/) [![Total alerts](https://img.shields.io/lgtm/alerts/g/apache/geode.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/apache/geode/alerts/) [![Language grade: Java](https://img.shields.io/lgtm/grade/java/g/apache/geode.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/apache/geode/context:java) [![Language grade: JavaScript](https://img.shields.io/lgtm/grade/javascript/g/apache/geode.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/apache/geode/context:javascript) [![Language grade: Python](https://img.shields.io/lgtm/grade/python/g/apache/geode.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/apache/geode/context:python) - ## Contents From 896bfd29f4f838c2b526699f673cb6f3be25388e Mon Sep 17 00:00:00 2001 From: JinwooHwang Date: Fri, 7 Aug 2026 09:31:09 -0400 Subject: [PATCH 5/5] resolved merge conflict --- .../resources/gfsh_dependency_classpath.txt | 10 +++++----- .../resources/dependency_classpath.txt | 20 +++++++++---------- 2 files changed, 15 insertions(+), 15 deletions(-) diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index 867b7f39a01..24225444982 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -108,13 +108,13 @@ shiro-config-core-3.0.0.jar shiro-event-3.0.0.jar shiro-crypto-core-3.0.0.jar shiro-lang-3.0.0.jar -jetty-xml-12.0.33.jar -jetty-http-12.0.33.jar -jetty-io-12.0.33.jar +jetty-xml-12.0.37.jar +jetty-http-12.0.37.jar +jetty-io-12.0.37.jar spring-boot-starter-logging-3.3.13.jar jul-to-slf4j-2.0.18.jar -jetty-jndi-12.0.33.jar -jetty-util-12.0.33.jar +jetty-jndi-12.0.37.jar +jetty-util-12.0.37.jar slf4j-api-2.0.18.jar jackson-annotations-2.21.jar micrometer-observation-1.15.12.jar diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index 042b4d50113..ea2f37a9883 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -98,22 +98,22 @@ shiro-hashes-argon2-3.0.0.jar shiro-hashes-bcrypt-3.0.0.jar shiro-crypto-hash-3.0.0.jar bcprov-jdk18on-1.85.jar -jetty-ee-12.0.33.jar -jetty-session-12.0.33.jar -jetty-plus-12.0.33.jar -jetty-security-12.0.33.jar -jetty-server-12.0.33.jar +jetty-ee-12.0.37.jar +jetty-session-12.0.37.jar +jetty-plus-12.0.37.jar +jetty-security-12.0.37.jar +jetty-server-12.0.37.jar shiro-cache-3.0.0.jar shiro-crypto-cipher-3.0.0.jar shiro-config-core-3.0.0.jar shiro-event-3.0.0.jar shiro-crypto-core-3.0.0.jar shiro-lang-3.0.0.jar -jetty-xml-12.0.33.jar -jetty-http-12.0.33.jar -jetty-io-1git 2.0.33.jar -jetty-jndi-12.0.33.jar -jetty-util-12.0.33.jar +jetty-xml-12.0.37.jar +jetty-http-12.0.37.jar +jetty-io-1git 2.0.37.jar +jetty-jndi-12.0.37.jar +jetty-util-12.0.37.jar spring-boot-starter-logging-3.3.13.jar jul-to-slf4j-2.0.18.jar slf4j-api-2.0.18.jar