You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jira@kafka.apache.org by "dejan2609 (via GitHub)" <gi...@apache.org> on 2026/07/26 10:06:26 UTC

[PR] MINOR: version updates for build and project dependencies [kafka]

dejan2609 opened a new pull request, #22939:
URL: https://github.com/apache/kafka/pull/22939

   details:
    - bcpkix: 1.84 -->> 1.85
    - jgit: 7.6.0 -->> 7.7.1
    - junit: 5.14.3 -->> 5.14.4
    - junitPlatform: 1.14.3 -->> 1.14.4
    - mavenArtifact: 3.9.15 -->> 3.9.16
    - swagger: 2.2.48 -->> 2.2.52
    - Gradle plugins:
     - dependencycheck: 12.2.1 -->> 12.2.2
     - spotbugs: 6.5.1 -->> 6.5.9
     - scoverage: 8.1 -->> 9.1
     - shadow: 9.4.1 -->> 9.6.1
   
   CVEs addressed via bcpkix and jgit version updates:
    - bcpkix: several vulnerabilities are addressed: https://github.com/bcgit/bc-java/blob/r1rv85/docs/releasenotes.html#L330
    - JGit: these two vulnerabilities are addressed:
      - CVE-2026-44432
        - https://www.cve.org/CVERecord?id=CVE-2026-44432
        - https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j
      - CVE-2026-56624 
        - https://www.cve.org/CVERecord?id=CVE-2026-56624 
        - https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6
   
   Some notable release notes links:
    - bcpkix: https://github.com/bcgit/bc-java/blob/r1rv85/docs/releasenotes.html#L22
    - JGit:
      - https://projects.eclipse.org/projects/technology.jgit/releases/7.7.0
      - https://projects.eclipse.org/projects/technology.jgit/releases/7.7.1
    - scoverage gradle plugin:
      - https://github.com/scoverage/gradle-scoverage/releases/tag/9.0
      - https://github.com/scoverage/gradle-scoverage/releases/tag/9.0
    - shadow gradle plugin: https://gradleup.com/shadow/changes/#961-2026-07-22
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] MINOR: version updates for build and project dependencies (multiple CVEs are addressed) [kafka]

Posted by "dejan2609 (via GitHub)" <gi...@apache.org>.
dejan2609 commented on PR #22939:
URL: https://github.com/apache/kafka/pull/22939#issuecomment-5102325210

   Update: `gradle-versions-plugin` version update (0.54.0 -->> 0.56.0) will be added also; some notes:
   - plugin name changed from `com.github.ben-manes.versions plugin` to `io.github.ben-manes.versions`
   - plugin now supports parallel build (and hence `--no-parallel` switch is not required anymore)
   
   Related links:
   - https://github.com/ben-manes/gradle-versions-plugin/pull/998
   - https://github.com/ben-manes/gradle-versions-plugin/blob/v0.56.0/gradle-versions-plugin/src/test/groovy/com/github/benmanes/gradle/versions/LegacyPluginIdSpec.groovy#L48
   - https://github.com/ben-manes/gradle-versions-plugin/releases/tag/v0.55.0
   - https://github.com/ben-manes/gradle-versions-plugin/releases/tag/v0.56.0


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] MINOR: version updates for build and project dependencies (multiple CVEs are addressed) [kafka]

Posted by "dejan2609 (via GitHub)" <gi...@apache.org>.
dejan2609 commented on PR #22939:
URL: https://github.com/apache/kafka/pull/22939#issuecomment-5094323607

   Test results are fine (just a few unrelated test are failing for both Java 17 and 25):
   > (FAILED ❌ KRaftClusterTest > testDescribeQuorumRequestToControllers()
    
   FYI @mimaison 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] MINOR: version updates for build and project dependencies (multiple CVEs are addressed) [kafka]

Posted by "dejan2609 (via GitHub)" <gi...@apache.org>.
dejan2609 commented on PR #22939:
URL: https://github.com/apache/kafka/pull/22939#issuecomment-5091732504

   Update: single job (build results upload to Develocity instance) failed; this is probably unrelated with PR changes, but I'll still invoke another execution for all Github Actions jobs.
   <img width="1858" height="1000" alt="image" src="https://github.com/user-attachments/assets/17a66d7a-faea-48a7-a6e4-bb51bbecafba" />


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] MINOR: version updates for build and project dependencies (multiple CVEs are addressed) [kafka]

Posted by "dejan2609 (via GitHub)" <gi...@apache.org>.
dejan2609 commented on PR #22939:
URL: https://github.com/apache/kafka/pull/22939#issuecomment-5083145962

   :test_tube: PR is tested (using this reference: https://kafka.apache.org/quickstart)
   - Kafka distribution was created (`./gradlew clean releaseTarGz`) and then unpacked
   - smoke tests are performed and things are looking fine (messages are written into the topic and read by a consumer) :white_check_mark: 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] MINOR: version updates for build and project dependencies (multiple CVEs are addressed) [kafka]

Posted by "mimaison (via GitHub)" <gi...@apache.org>.
mimaison merged PR #22939:
URL: https://github.com/apache/kafka/pull/22939


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] MINOR: version updates for build and project dependencies (multiple CVEs are addressed) [kafka]

Posted by "dejan2609 (via GitHub)" <gi...@apache.org>.
dejan2609 commented on PR #22939:
URL: https://github.com/apache/kafka/pull/22939#issuecomment-5107378349

   @mimaison all tests results are fine :white_check_mark: 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] MINOR: version updates for build and project dependencies (multiple CVEs are addressed) [kafka]

Posted by "dejan2609 (via GitHub)" <gi...@apache.org>.
dejan2609 commented on PR #22939:
URL: https://github.com/apache/kafka/pull/22939#issuecomment-5104531902

   Build is fine, but now I have to solve some minor conflicts :sweat_smile:
   <img width="1182" height="704" alt="image" src="https://github.com/user-attachments/assets/63f1d7b9-8a4f-4f75-af57-659bcc928cf6" />
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] MINOR: version updates for build and project dependencies (multiple CVEs are addressed) [kafka]

Posted by "dejan2609 (via GitHub)" <gi...@apache.org>.
dejan2609 commented on PR #22939:
URL: https://github.com/apache/kafka/pull/22939#issuecomment-5085380069

   FYI @chia7712 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org