[GEODE-10607] Remediation of CVE-2026-49268

boms/geode-all-bom/src/test/resources/expected-pom.xml

@@ -415,7 +415,7 @@
       <dependency>
         <groupId>org.slf4j</groupId>
         <artifactId>slf4j-api</artifactId>
-        <version>2.0.17</version>
+        <version>2.0.18</version>
       </dependency>
       <dependency>
         <groupId>org.springframework.hateoas</groupId>

build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy

@@ -49,10 +49,10 @@ class DependencyConstraints {
     deps.put("log4j.version", "2.25.5")
     deps.put("log4j-slf4j2-impl.version", "2.23.1")
     deps.put("micrometer.version", "1.15.12")
-    deps.put("shiro.version", "2.1.0")
+    deps.put("shiro.version", "3.0.0")
     // GEODE-10583: Pin Bouncy Castle (transitive via shiro-crypto-hash) to a fixed version
     deps.put("bouncycastle.version", "1.85")
-    deps.put("slf4j-api.version", "2.0.17")
+    deps.put("slf4j-api.version", "2.0.18")
     deps.put("jakarta.transaction-api.version", "2.0.1")
     deps.put("jboss-modules.version", "1.11.0.Final")
     deps.put("jackson.version", "2.21.5")

geode-assembly/src/integrationTest/resources/assembly_content.txt

@@ -1012,7 +1012,7 @@ lib/jna-5.11.0.jar
 lib/jna-platform-5.11.0.jar
 lib/joda-time-2.12.7.jar
 lib/jopt-simple-5.0.4.jar
-lib/jul-to-slf4j-2.0.17.jar
+lib/jul-to-slf4j-2.0.18.jar
 lib/log4j-api-2.25.5.jar
 lib/log4j-core-2.25.5.jar
 lib/log4j-jcl-2.25.5.jar
@@ -1033,18 +1033,18 @@ lib/ra.jar
 lib/reactive-streams-1.0.4.jar
 lib/reactor-core-3.6.10.jar
 lib/rmiio-2.1.2.jar
-lib/shiro-cache-2.1.0.jar
-lib/shiro-config-core-2.1.0.jar
-lib/shiro-config-ogdl-2.1.0.jar
-lib/shiro-core-2.1.0.jar
-lib/shiro-crypto-cipher-2.1.0.jar
-lib/shiro-crypto-core-2.1.0.jar
-lib/shiro-crypto-hash-2.1.0.jar
-lib/shiro-event-2.1.0.jar
-lib/shiro-hashes-argon2-2.1.0.jar
-lib/shiro-hashes-bcrypt-2.1.0.jar
-lib/shiro-lang-2.1.0.jar
-lib/slf4j-api-2.0.17.jar
+lib/shiro-cache-3.0.0.jar
+lib/shiro-config-core-3.0.0.jar
+lib/shiro-config-ogdl-3.0.0.jar
+lib/shiro-core-3.0.0.jar
+lib/shiro-crypto-cipher-3.0.0.jar
+lib/shiro-crypto-core-3.0.0.jar
+lib/shiro-crypto-hash-3.0.0.jar
+lib/shiro-event-3.0.0.jar
+lib/shiro-hashes-argon2-3.0.0.jar
+lib/shiro-hashes-bcrypt-3.0.0.jar
+lib/shiro-lang-3.0.0.jar
+lib/slf4j-api-2.0.18.jar
 lib/snakeyaml-2.5.jar
 lib/snappy-0.5.jar
 lib/spring-aop-6.1.21.jar

geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt

@@ -66,8 +66,8 @@ HikariCP-4.0.3.jar
 antlr-2.7.7.jar
 istack-commons-runtime-4.1.1.jar
 commons-validator-1.7.jar
-shiro-core-2.1.0.jar
-shiro-config-ogdl-2.1.0.jar
+shiro-core-3.0.0.jar
+shiro-config-ogdl-3.0.0.jar
 commons-beanutils-1.11.0.jar
 commons-codec-1.15.jar
 commons-collections-3.2.2.jar
@@ -91,9 +91,9 @@ jakarta.transaction-api-2.0.1.jar
 joda-time-2.12.7.jar
 jna-platform-5.11.0.jar
 jna-5.11.0.jar
-shiro-hashes-argon2-2.1.0.jar
-shiro-hashes-bcrypt-2.1.0.jar
-shiro-crypto-hash-2.1.0.jar
+shiro-hashes-argon2-3.0.0.jar
+shiro-hashes-bcrypt-3.0.0.jar
+shiro-crypto-hash-3.0.0.jar
 bcprov-jdk18on-1.85.jar
 jetty-ee-12.0.37.jar
 jetty-session-12.0.37.jar
@@ -102,20 +102,20 @@ jetty-security-12.0.37.jar
 jetty-server-12.0.37.jar
 snappy-0.5.jar
 jgroups-3.6.20.Final.jar
-shiro-cache-2.1.0.jar
-shiro-crypto-cipher-2.1.0.jar
-shiro-config-core-2.1.0.jar
-shiro-event-2.1.0.jar
-shiro-crypto-core-2.1.0.jar
-shiro-lang-2.1.0.jar
+shiro-cache-3.0.0.jar
+shiro-crypto-cipher-3.0.0.jar
+shiro-config-core-3.0.0.jar
+shiro-event-3.0.0.jar
+shiro-crypto-core-3.0.0.jar
+shiro-lang-3.0.0.jar
 jetty-xml-12.0.37.jar
 jetty-http-12.0.37.jar
 jetty-io-12.0.37.jar
 spring-boot-starter-logging-3.3.13.jar
-jul-to-slf4j-2.0.17.jar
+jul-to-slf4j-2.0.18.jar
 jetty-jndi-12.0.37.jar
 jetty-util-12.0.37.jar
-slf4j-api-2.0.17.jar
+slf4j-api-2.0.18.jar
 jackson-annotations-2.21.jar
 micrometer-observation-1.15.12.jar
 spring-jcl-6.1.21.jar

geode-server-all/src/integrationTest/resources/dependency_classpath.txt

@@ -56,7 +56,7 @@ jakarta.enterprise.cdi-api-4.0.1.jar
 jakarta.interceptor-api-2.1.0.jar
 jakarta.annotation-api-2.1.1.jar
 jakarta.transaction-api-2.0.1.jar
-shiro-core-2.1.0.jar
+shiro-core-3.0.0.jar
 jgroups-3.6.20.Final.jar
 jackson-annotations-2.21.jar
 commons-validator-1.7.jar
@@ -83,7 +83,7 @@ lucene-analysis-common-9.12.3.jar
 lucene-queryparser-9.12.3.jar
 lucene-queries-9.12.3.jar
 lucene-core-9.12.3.jar
-shiro-config-ogdl-2.1.0.jar
+shiro-config-ogdl-3.0.0.jar
 commons-beanutils-1.11.0.jar
 commons-codec-1.15.jar
 commons-collections-3.2.2.jar
@@ -94,29 +94,29 @@ jetty-ee10-webapp-12.0.37.jar
 jetty-ee10-servlet-12.0.37.jar
 jakarta.servlet-api-6.0.0.jar
 joda-time-2.12.7.jar
-shiro-hashes-argon2-2.1.0.jar
-shiro-hashes-bcrypt-2.1.0.jar
-shiro-crypto-hash-2.1.0.jar
+shiro-hashes-argon2-3.0.0.jar
+shiro-hashes-bcrypt-3.0.0.jar
+shiro-crypto-hash-3.0.0.jar
 bcprov-jdk18on-1.85.jar
 jetty-ee-12.0.37.jar
 jetty-session-12.0.37.jar
 jetty-plus-12.0.37.jar
 jetty-security-12.0.37.jar
 jetty-server-12.0.37.jar
-shiro-cache-2.1.0.jar
-shiro-crypto-cipher-2.1.0.jar
-shiro-config-core-2.1.0.jar
-shiro-event-2.1.0.jar
-shiro-crypto-core-2.1.0.jar
-shiro-lang-2.1.0.jar
+shiro-cache-3.0.0.jar
+shiro-crypto-cipher-3.0.0.jar
+shiro-config-core-3.0.0.jar
+shiro-event-3.0.0.jar
+shiro-crypto-core-3.0.0.jar
+shiro-lang-3.0.0.jar
 jetty-xml-12.0.37.jar
 jetty-http-12.0.37.jar
-jetty-io-12.0.37.jar
+jetty-io-1git 2.0.37.jar
 jetty-jndi-12.0.37.jar
 jetty-util-12.0.37.jar
 spring-boot-starter-logging-3.3.13.jar
-jul-to-slf4j-2.0.17.jar
-slf4j-api-2.0.17.jar
+jul-to-slf4j-2.0.18.jar
+slf4j-api-2.0.18.jar
 micrometer-observation-1.15.12.jar
 micrometer-commons-1.15.12.jar
 LatencyUtils-2.0.3.jar