This is an automated email from the ASF dual-hosted git repository.
kezhenxu94 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/skywalking.git
The following commit(s) were added to refs/heads/master by this push:
new 46129f18e8 Bump netty/jackson/commons-codec to clear CVE alerts on
shipped OAP jars (#13944)
46129f18e8 is described below
commit 46129f18e815829ea14afce9a013bae7d8dfdc66
Author: kezhenxu94 <[email protected]>
AuthorDate: Mon Jul 13 14:32:31 2026 +0800
Bump netty/jackson/commons-codec to clear CVE alerts on shipped OAP jars
(#13944)
- netty 4.2.12.Final -> 4.2.15.Final (root pom netty.version)
- jackson 2.18.6 -> 2.18.8 (oap-server-bom)
- jackson-databind 2.16.0 -> 2.18.8 (realign to the rest of the jackson
family, which had moved ahead while databind was left behind)
- commons-codec 1.11 -> 1.13 (oap-server-bom)
All versions are JDK 11 compatible (SkyWalking targets
maven.compiler.release=11).
Update dist-material/release-docs/LICENSE and .licenserc.yaml to match the
bumped dependency versions (the CI dependency-license check regenerates
LICENSE and fails on any drift).
Signed-off-by: kezhenxu94 <[email protected]>
---
.licenserc.yaml | 2 +-
dist-material/release-docs/LICENSE | 63 +++++++++++++++++++-------------------
docs/en/changes/changes.md | 1 +
oap-server-bom/pom.xml | 6 ++--
pom.xml | 2 +-
5 files changed, 37 insertions(+), 37 deletions(-)
diff --git a/.licenserc.yaml b/.licenserc.yaml
index d446073adc..556b796515 100644
--- a/.licenserc.yaml
+++ b/.licenserc.yaml
@@ -109,7 +109,7 @@ dependency:
version: 2.20.1
license: Apache-2.0
- name: com.fasterxml.jackson.datatype:jackson-datatype-jdk8
- version: 2.18.6,2.20.1
+ version: 2.18.8,2.20.1
license: Apache-2.0
- name: com.fasterxml.jackson.dataformat:jackson-dataformat-yaml
version: 2.15.2
diff --git a/dist-material/release-docs/LICENSE
b/dist-material/release-docs/LICENSE
index a59f02c2f1..7ca29900d8 100644
--- a/dist-material/release-docs/LICENSE
+++ b/dist-material/release-docs/LICENSE
@@ -199,12 +199,12 @@ The text of each license is the standard Apache 2.0
license.
https://mvnrepository.com/artifact/com.alibaba.nacos/nacos-encryption-plugin/2.3.2
Apache-2.0
https://mvnrepository.com/artifact/com.ctrip.framework.apollo/apollo-client/1.8.0
Apache-2.0
https://mvnrepository.com/artifact/com.ctrip.framework.apollo/apollo-core/1.8.0
Apache-2.0
-
https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-annotations/2.18.6
Apache-2.0
-
https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-core/2.18.6
Apache-2.0
-
https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind/2.16.0
Apache-2.0
+
https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-annotations/2.18.8
Apache-2.0
+
https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-core/2.18.8
Apache-2.0
+
https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind/2.18.8
Apache-2.0
https://mvnrepository.com/artifact/com.fasterxml.jackson.dataformat/jackson-dataformat-yaml/2.15.2
Apache-2.0
-
https://mvnrepository.com/artifact/com.fasterxml.jackson.datatype/jackson-datatype-guava/2.18.6
Apache-2.0
-
https://mvnrepository.com/artifact/com.fasterxml.jackson.datatype/jackson-datatype-jdk8/2.18.6
Apache-2.0
+
https://mvnrepository.com/artifact/com.fasterxml.jackson.datatype/jackson-datatype-guava/2.18.8
Apache-2.0
+
https://mvnrepository.com/artifact/com.fasterxml.jackson.datatype/jackson-datatype-jdk8/2.18.8
Apache-2.0
https://mvnrepository.com/artifact/com.fasterxml.jackson.datatype/jackson-datatype-jsr310/2.20.1
Apache-2.0
https://mvnrepository.com/artifact/com.fasterxml.jackson.module/jackson-module-kotlin/2.13.4
Apache-2.0
https://mvnrepository.com/artifact/com.fasterxml/classmate/1.5.1 Apache-2.0
@@ -232,7 +232,7 @@ The text of each license is the standard Apache 2.0 license.
https://mvnrepository.com/artifact/com.squareup.retrofit2/retrofit/2.9.0
Apache-2.0
https://mvnrepository.com/artifact/com.zaxxer/HikariCP/3.1.0 Apache-2.0
https://mvnrepository.com/artifact/commons-beanutils/commons-beanutils/1.11.0
Apache-2.0
- https://mvnrepository.com/artifact/commons-codec/commons-codec/1.11
Apache-2.0
+ https://mvnrepository.com/artifact/commons-codec/commons-codec/1.13
Apache-2.0
https://mvnrepository.com/artifact/commons-io/commons-io/2.17.0 Apache-2.0
https://mvnrepository.com/artifact/commons-net/commons-net/3.9.0 Apache-2.0
https://mvnrepository.com/artifact/commons-validator/commons-validator/1.10.1
Apache-2.0
@@ -283,33 +283,32 @@ The text of each license is the standard Apache 2.0
license.
https://mvnrepository.com/artifact/io.micrometer/micrometer-commons/1.14.4
Apache-2.0
https://mvnrepository.com/artifact/io.micrometer/micrometer-core/1.14.4
Apache-2.0
https://mvnrepository.com/artifact/io.micrometer/micrometer-observation/1.14.4
Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-buffer/4.2.12.Final
Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-codec/4.2.12.Final
Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-codec-base/4.2.12.Final
Apache-2.0
-
https://mvnrepository.com/artifact/io.netty/netty-codec-compression/4.2.12.Final
Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-codec-dns/4.2.12.Final
Apache-2.0
-
https://mvnrepository.com/artifact/io.netty/netty-codec-haproxy/4.2.12.Final
Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-codec-http/4.2.12.Final
Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-codec-http2/4.2.12.Final
Apache-2.0
-
https://mvnrepository.com/artifact/io.netty/netty-codec-marshalling/4.2.12.Final
Apache-2.0
-
https://mvnrepository.com/artifact/io.netty/netty-codec-protobuf/4.2.12.Final
Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-codec-socks/4.2.12.Final
Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-common/4.2.12.Final
Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-handler/4.2.12.Final
Apache-2.0
-
https://mvnrepository.com/artifact/io.netty/netty-handler-proxy/4.2.12.Final
Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-resolver/4.2.12.Final
Apache-2.0
-
https://mvnrepository.com/artifact/io.netty/netty-resolver-dns/4.2.12.Final
Apache-2.0
-
https://mvnrepository.com/artifact/io.netty/netty-resolver-dns-classes-macos/4.2.12.Final
Apache-2.0
-
https://mvnrepository.com/artifact/io.netty/netty-resolver-dns-native-macos/4.2.12.Final
Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-buffer/4.2.15.Final
Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-codec/4.2.15.Final
Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-codec-base/4.2.15.Final
Apache-2.0
+
https://mvnrepository.com/artifact/io.netty/netty-codec-compression/4.2.15.Final
Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-codec-dns/4.2.15.Final
Apache-2.0
+
https://mvnrepository.com/artifact/io.netty/netty-codec-haproxy/4.2.15.Final
Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-codec-http/4.2.15.Final
Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-codec-http2/4.2.15.Final
Apache-2.0
+
https://mvnrepository.com/artifact/io.netty/netty-codec-marshalling/4.2.15.Final
Apache-2.0
+
https://mvnrepository.com/artifact/io.netty/netty-codec-protobuf/4.2.15.Final
Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-codec-socks/4.2.15.Final
Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-common/4.2.15.Final
Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-handler/4.2.15.Final
Apache-2.0
+
https://mvnrepository.com/artifact/io.netty/netty-handler-proxy/4.2.15.Final
Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-resolver/4.2.15.Final
Apache-2.0
+
https://mvnrepository.com/artifact/io.netty/netty-resolver-dns/4.2.15.Final
Apache-2.0
+
https://mvnrepository.com/artifact/io.netty/netty-resolver-dns-classes-macos/4.2.15.Final
Apache-2.0
+
https://mvnrepository.com/artifact/io.netty/netty-resolver-dns-native-macos/4.2.15.Final
Apache-2.0
https://mvnrepository.com/artifact/io.netty/netty-tcnative-boringssl-static/2.0.77.Final
Apache-2.0
-
https://mvnrepository.com/artifact/io.netty/netty-tcnative-boringssl-static/2.0.75.Final
Apache-2.0
-
https://mvnrepository.com/artifact/io.netty/netty-tcnative-classes/2.0.75.Final
Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-transport/4.2.12.Final
Apache-2.0
-
https://mvnrepository.com/artifact/io.netty/netty-transport-classes-epoll/4.2.12.Final
Apache-2.0
-
https://mvnrepository.com/artifact/io.netty/netty-transport-classes-kqueue/4.2.12.Final
Apache-2.0
-
https://mvnrepository.com/artifact/io.netty/netty-transport-native-epoll/4.2.12.Final
Apache-2.0
-
https://mvnrepository.com/artifact/io.netty/netty-transport-native-kqueue/4.2.12.Final
Apache-2.0
-
https://mvnrepository.com/artifact/io.netty/netty-transport-native-unix-common/4.2.12.Final
Apache-2.0
+
https://mvnrepository.com/artifact/io.netty/netty-tcnative-classes/2.0.77.Final
Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-transport/4.2.15.Final
Apache-2.0
+
https://mvnrepository.com/artifact/io.netty/netty-transport-classes-epoll/4.2.15.Final
Apache-2.0
+
https://mvnrepository.com/artifact/io.netty/netty-transport-classes-kqueue/4.2.15.Final
Apache-2.0
+
https://mvnrepository.com/artifact/io.netty/netty-transport-native-epoll/4.2.15.Final
Apache-2.0
+
https://mvnrepository.com/artifact/io.netty/netty-transport-native-kqueue/4.2.15.Final
Apache-2.0
+
https://mvnrepository.com/artifact/io.netty/netty-transport-native-unix-common/4.2.15.Final
Apache-2.0
https://mvnrepository.com/artifact/io.perfmark/perfmark-api/0.27.0
Apache-2.0
https://mvnrepository.com/artifact/io.prometheus/simpleclient/0.6.0
Apache-2.0
https://mvnrepository.com/artifact/io.prometheus/simpleclient_common/0.6.0
Apache-2.0
diff --git a/docs/en/changes/changes.md b/docs/en/changes/changes.md
index 15839723ec..dcd40ce586 100644
--- a/docs/en/changes/changes.md
+++ b/docs/en/changes/changes.md
@@ -321,6 +321,7 @@
* Add `@Stream(allowBootReshape = true)` opt-in for additive boot-time reshape
of BanyanDB streams / measures. Code-defined stream classes (e.g.
`AlarmRecord`) can now annotate their schema as eligible for in-place additive
update at OAP boot — a new `@Column` is appended to the live tag-family /
fields via `client.update` instead of being silently rejected with
`SKIPPED_SHAPE_MISMATCH` (which previously forced operators to drop the measure
/ stream and lose historical rows). Additive in [...]
* Mask keywords `trustStorePass`, `keyStorePass` by default.
* Bump up dependencies to clear CVE alerts on shipped OAP jars: log4j `2.25.3`
→ `2.25.4`, jackson `2.18.5` → `2.18.6`, kafka-clients `3.4.0` → `3.9.2`,
postgresql `42.4.4` → `42.7.11`, commons-compress `1.21` → `1.26.2`.
+* Bump up more dependencies to clear CVE alerts on shipped OAP jars: netty
`4.2.12.Final` → `4.2.15.Final`, jackson `2.18.6` → `2.18.8`, commons-codec
`1.11` → `1.13`. Also realign `jackson-databind` `2.16.0` → `2.18.8` so the
whole jackson family is managed at a single version (it had been left behind
the other jackson artifacts).
* Bump Apache Curator `4.3.0` → `5.9.0` and Apache ZooKeeper `3.5.7` → `3.9.5`
together to clear CVE-2023-44981 (the bundled ZooKeeper jar carried it; OAP is
a ZooKeeper client only, so the server-side bug was never reachable, but the
jar tripped Dependabot). The cluster-zookeeper and configuration-zookeeper
plugins use only stable Curator APIs, so no source changes were required.
Operator-facing change: the supported ZooKeeper server version is now 3.6+
(Curator 5.x uses ZooKeeper persi [...]
* Migrate the Consul cluster and configuration client from the abandoned
`com.orbitz.consul:consul-client` `1.5.3` to the maintained fork
`org.kiwiproject:consul-client` `0.9.0` to clear the okhttp CVE the old client
carried (CVE-2021-0341; the old client pinned okhttp `3.14.9`, fixed in okhttp
`4.9.2+`), so the BOM now pins okhttp to `4.12.0`. The fork's `0.9.x` line is
the last one built for JDK 11 (which SkyWalking still targets); `1.0.0+` is
compiled to JDK 17 bytecode, so the migrat [...]
* Bump test-scope assertj-core `3.20.2` → `3.27.7` to clear CVE-2026-24400
(XXE in `isXmlEqualTo`, not used by any test).
diff --git a/oap-server-bom/pom.xml b/oap-server-bom/pom.xml
index e04d58ccfd..413b34700f 100644
--- a/oap-server-bom/pom.xml
+++ b/oap-server-bom/pom.xml
@@ -42,15 +42,15 @@
<snakeyaml.version>2.0</snakeyaml.version>
<protobuf-java.version>4.33.1</protobuf-java.version>
<protobuf-java-util.version>4.33.1</protobuf-java-util.version>
- <commons-codec.version>1.11</commons-codec.version>
+ <commons-codec.version>1.13</commons-codec.version>
<commons-lang3.version>3.18.0</commons-lang3.version>
<commons-io.version>2.17.0</commons-io.version>
<commons-text.version>1.4</commons-text.version>
<kubernetes.version>6.7.1</kubernetes.version>
<hikaricp.version>3.1.0</hikaricp.version>
<zipkin.version>2.24.1</zipkin.version>
- <jackson.version>2.18.6</jackson.version>
- <jackson-databind.version>2.16.0</jackson-databind.version>
+ <jackson.version>2.18.8</jackson.version>
+ <jackson-databind.version>2.18.8</jackson-databind.version>
<simpleclient.version>0.6.0</simpleclient.version>
<apollo.version>1.8.0</apollo.version>
<nacos.version>2.3.2</nacos.version>
diff --git a/pom.xml b/pom.xml
index 75696d88a4..03032b901b 100755
--- a/pom.xml
+++ b/pom.xml
@@ -155,7 +155,7 @@
<!-- core lib dependency -->
<grpc.version>1.80.0</grpc.version>
<protobuf-java.version>4.33.1</protobuf-java.version>
- <netty.version>4.2.12.Final</netty.version>
+ <netty.version>4.2.15.Final</netty.version>
<netty-tcnative-boringssl-static.version>2.0.77.Final</netty-tcnative-boringssl-static.version>
<gson.version>2.9.0</gson.version>
<os-maven-plugin.version>1.6.2</os-maven-plugin.version>
