JinwooHwang opened a new pull request, #8039: URL: https://github.com/apache/geode/pull/8039
Backports 10 commits from `develop` to `support/2.0` for the 2.0.3 release. Opened primarily to get CI coverage — in particular `integrationTest` and `checkPom`, which have not been run against these changes locally. ## Security remediations (dependency upgrades) | Advisory | Component | Change | JIRA | Upstream PR | |---|---|---|---|---| | CVE-2026-54428 | httpcore5, httpcore5-h2 | 5.3.6 → 5.4.3 | GEODE-10590 | #8016 | | GHSA-2m67-wjpj-xhg9 | Jackson | 2.21.2 → 2.21.5 | GEODE-10589 | #8015 | | CVE-2026-40984 | Micrometer | 1.14.0 → 1.15.12 | GEODE-10592 | #8018 | | CVE-2026-8763 | Bouncy Castle | 1.84 → 1.85 | GEODE-10606 | #8032 | | CVE-2026-10050 | Jetty | 12.0.33 → 12.0.37 | GEODE-10605 | #8031 | | CVE-2026-49268 | Apache Shiro | 2.1.0 → 3.0.0 | GEODE-10607 | #8033 | | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-17954276 | Log4j | 2.25.4 → 2.25.5 | GEODE-10604 | #8030 | Transitive: slf4j-api 2.0.17 → 2.0.18, asm 9.9.1 → 9.10.1. ## Security hardening - **GEODE-10598** (#8024) — Removed `ServerSerializableObjectHttpMessageConverter` from the management REST servlet, eliminating an unrestricted Java deserialization path. `gfsh` now sends `queryNames` as request parameters rather than a serialized request body. - **GEODE-10599** (#8025) — The remaining query-expression deserialization now uses `ValidatingObjectInputStream`, restricted to `javax.management.*`, `java.lang.*`, `java.util.*`. ## Fixes - **GEODE-10610** (#8036) — Fixes `gfsh list members` failure by adding `jline-terminal-jni` and `jline-terminal-ffm` 3.26.3. ## Deviations from upstream Five commits did not apply verbatim and were resolved by hand. Details are in the individual commit messages. - **Micrometer (GEODE-10592)** is a *partial* backport of #8018. Only the micrometer bump was taken. That commit's GitHub Actions version pinning targets develop's workflow files, and its shiro 2.2.1 → 2.1.0 change was a revert of #8017 and is a no-op here. - **#8017 was deliberately skipped.** Its shiro 2.2.1 change was reverted by #8018 on develop and superseded by #8033, which is taken here instead. - **#8033, #8032, #8031** were applied out of develop's original order, so their conflict regions carried older context. Only each commit's own dependency change was taken; unrelated develop drift (jetty, log4j, snakeyaml, bcprov versions from neighbouring commits) was not. - **#8033** additionally carried two defects that were corrected upstream by #8035 and are not reproduced here: a corrupted fixture line (`jetty-io-1git 2.0.37.jar`) and `jul-to-slf4j` listed as 2.0.18, which does not match what the build resolves. ## Compatibility notes for the release - Apache Shiro **3.0.0 is a major version upgrade**. Custom `SecurityManager` or `Realm` implementations written against Shiro 2.x may require changes. - GEODE-10598 **changes the management REST wire format**. A 2.0.2 `gfsh` talking to a 2.0.3 cluster (or the reverse) will fail on `queryNames`. `gfsh` and the cluster should be upgraded together. ## Verification status Passed locally: ``` ./gradlew clean spA build install javadoc spotlessCheck resolveDependencies pmdMain japicmp test -x rat -x checkPom ``` **Not yet run:** `integrationTest` and `checkPom`. Both matter here, because the conflict resolutions edited the integration-test fixtures (`assembly_content.txt`, `gfsh_dependency_classpath.txt`, `dependency_classpath.txt`, `expected_jars.txt`) and the expected POMs by hand rather than regenerating them. Those files encode this branch's resolved dependency graph, which differs from develop's, so upstream's CI results do not carry over. Getting CI to check them is the main purpose of this PR. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
