(openwhisk) branch master updated: Set resolution for lz4 and jackson to address vulnerabilities (#5570)

[bd...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

bdoyle pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/openwhisk.git


The following commit(s) were added to refs/heads/master by this push:
     new d15fd4f52 Set resolution for lz4 and jackson to address vulnerabilities (#5570)
d15fd4f52 is described below

commit d15fd4f527dc5e1733485da268edec2504053504
Author: Quinten Parker <77...@users.noreply.github.com>
AuthorDate: Mon Mar 23 17:31:36 2026 -0700

    Set resolution for lz4 and jackson to address vulnerabilities (#5570)
    
    * Set resolution for lz4 and jackson to address vulnerabilities
    
    * update
    
    * update
    
    * update
    
    * fix test
---
 common/scala/build.gradle                          |  5 +++--
 settings.gradle                                    |  2 +-
 .../v2/test/InvokerHealthManagerTests.scala        | 23 +++++-----------------
 3 files changed, 9 insertions(+), 21 deletions(-)

diff --git a/common/scala/build.gradle b/common/scala/build.gradle
index 2f1099593..9f33d6375 100644
--- a/common/scala/build.gradle
+++ b/common/scala/build.gradle
@@ -198,6 +198,7 @@ dependencies {
         api("ch.qos.logback:logback-core:1.2.13")
         api("io.netty:netty-codec:${gradle.netty.version}")
         api("io.netty:netty-common:${gradle.netty.version}")
+        api("com.fasterxml.jackson.core:jackson-databind:${gradle.jackson.version}")
     }
 }
 
@@ -206,10 +207,10 @@ configurations {
         exclude group: 'commons-logging'
         exclude group: 'log4j'
     }
-    all {
+    configureEach {
         resolutionStrategy.dependencySubstitution {
             // CVE-2025-12183, CVE-2025-66566: org.lz4:lz4-java relocated to at.yawk.lz4 transitive dependency of kafka-clients
-            substitute module('org.lz4:lz4-java') using module('at.yawk.lz4:lz4-java:1.10.3')
+            substitute module("org.lz4:lz4-java") using module("at.yawk.lz4:lz4-java:1.10.3")
         }
     }
 }
diff --git a/settings.gradle b/settings.gradle
index 607dc03e0..ed55d1fd0 100644
--- a/settings.gradle
+++ b/settings.gradle
@@ -108,5 +108,5 @@ gradle.ext.grpc = [version : '1.75.0']
 
 gradle.ext.curator = [version : '5.7.0']
 gradle.ext.kube_client = [version: '4.10.3']
-
+gradle.ext.jackson = [version: '2.21.1']
 gradle.ext.netty = [version : '4.1.128.Final']
diff --git a/tests/src/test/scala/org/apache/openwhisk/core/containerpool/v2/test/InvokerHealthManagerTests.scala b/tests/src/test/scala/org/apache/openwhisk/core/containerpool/v2/test/InvokerHealthManagerTests.scala
index 69f600611..6eca154cd 100644
--- a/tests/src/test/scala/org/apache/openwhisk/core/containerpool/v2/test/InvokerHealthManagerTests.scala
+++ b/tests/src/test/scala/org/apache/openwhisk/core/containerpool/v2/test/InvokerHealthManagerTests.scala
@@ -19,7 +19,7 @@ package org.apache.openwhisk.core.containerpool.v2.test
 
 import org.apache.pekko.actor.FSM.{CurrentState, SubscribeTransitionCallBack, Transition}
 import org.apache.pekko.actor.{ActorRef, ActorRefFactory, ActorSystem}
-import org.apache.pekko.testkit.{ImplicitSender, TestActor, TestFSMRef, TestKit, TestProbe}
+import org.apache.pekko.testkit.{ImplicitSender, TestFSMRef, TestKit, TestProbe}
 import common.StreamLogging
 import org.apache.openwhisk.common.InvokerState.{Healthy, Offline, Unhealthy}
 import org.apache.openwhisk.common.{Enable, GracefulShutdown, RingBuffer}
@@ -331,26 +331,13 @@ class InvokerHealthManagerTests
           instanceId.tags,
           instanceId.dedicatedNamespaces).serialize))
 
-    val mockHealthActionProxy = TestProbe()
-
-    mockHealthActionProxy.setAutoPilot((sender, msg) =>
-      msg match {
-        case _: Initialize =>
-          (1 to InvokerHealthManager.bufferSize - InvokerHealthManager.bufferErrorTolerance) foreach { _ =>
-            sender ! HealthMessage(true)
-          }
-          TestActor.KeepRunning
-
-        case GracefulShutdown =>
-          TestActor.KeepRunning
-    })
-
-    fsm.underlyingActor.healthActionProxy = Some(mockHealthActionProxy.ref)
-
     fsm ! Enable
+    (1 to InvokerHealthManager.bufferSize - InvokerHealthManager.bufferErrorTolerance) foreach { _ =>
+      fsm ! HealthMessage(true)
+    }
 
     probe.expectMsg(Transition(fsm, Offline, Unhealthy))
-    probe.expectMsg(10.seconds, Transition(fsm, Unhealthy, Healthy))
+    probe.expectMsg(Transition(fsm, Unhealthy, Healthy))
 
     dataManagementService.expectMsg(
       UpdateDataOnChange(